diff --git a/.buildkite/pipeline.backport-dispatch.yml b/.buildkite/pipeline.backport-dispatch.yml
new file mode 100644
index 00000000000..6a82c3bd3b3
--- /dev/null
+++ b/.buildkite/pipeline.backport-dispatch.yml
@@ -0,0 +1,43 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
+
+env:
+  SETUP_GVM_VERSION: "v0.6.0"
+  LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
+  YQ_VERSION: 'v4.35.2'
+  GH_CLI_VERSION: "2.29.0"
+  NOTIFY_TO: "ecosystem-team@elastic.co"
+
+steps:
+  - label: ":ballot_box_with_check: Backports inventory validation"
+    key: "check-backports-inventory"
+    command: ".buildkite/scripts/check_backports_inventory.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    if_changed:
+      - ".backports.yml"
+      - ".buildkite/scripts/run_dev_scripts_tests.sh"
+      - "dev/scripts/**.sh"
+      - "dev/backports/**"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') == "false" && build.branch == "main"
+
+  - label: ":git: Create backport branches for new entries"
+    key: "trigger-backport-create"
+    command: ".buildkite/scripts/trigger_backport.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "check-backports-inventory"
+        allow_failure: false
+    if_changed:
+      - ".backports.yml"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') == "false" &&
+      build.branch == "main" &&
+      build.env('BUILDKITE_PIPELINE_SLUG') == "integrations-backport-dispatch"
+
+notify:
+  - email: "$NOTIFY_TO"
+    if: "build.state == 'failed' && build.env('BUILDKITE_PULL_REQUEST') == 'false'"
diff --git a/.buildkite/pipeline.backport.yml b/.buildkite/pipeline.backport.yml
index 2538e32d651..f3562a2d969 100644
--- a/.buildkite/pipeline.backport.yml
+++ b/.buildkite/pipeline.backport.yml
@@ -3,21 +3,33 @@
 name: "integrations-backport"
 
 env:
+  SETUP_GVM_VERSION: "v0.6.0"
   YQ_VERSION: 'v4.35.2'
+  GH_CLI_VERSION: "2.29.0"
   # Agent images used in pipeline steps
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
+  NOTIFY_TO: "ecosystem-team@elastic.co"
 
 steps:
 
   - label: "Check that it runs from UI"
     key: "check-ui"
     command:
-      - "buildkite-agent annotate \"The $BUILDKITE_PIPELINE_SLUG is used only for running from UI!\" --style 'warning'"
+      - "buildkite-agent annotate \"The $${BUILDKITE_PIPELINE_SLUG} pipeline can only be triggered from the UI by members of the 'ecosystem' team, or via a trigger step from the 'integrations' or 'integrations-backport-dispatch' pipeline. For the recommended workflow see the [documentation](https://www.elastic.co/guide/en/integrations-developer/current/developer-workflow-support-old-package.html).\" --style 'warning'"
       - "exit 1"
-    if: "build.source != 'ui'"
+    if: |
+      !(
+        (build.source == 'ui' && build.creator.teams includes "ecosystem") ||
+        (build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations') ||
+        (build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations-backport-dispatch')
+      )
+
+  # Ensure that the check-ui step runs before any other step
+  - wait: ~
 
   - input: "Input values for the variables"
     key: "input-variables"
+    if: "build.source != 'trigger_job'"
     fields:
     - select: "DRY_RUN"
       key: "DRY_RUN"
@@ -35,10 +47,6 @@ steps:
       key: "PACKAGE_NAME"
       required: true
       default: ""
-    - text: "Enter name of the folder for the package (in most cases coincides with PACKAGE_NAME)"
-      key: "PACKAGE_FOLDER_NAME"
-      required: true
-      default: ""
     - text: "Enter package version (examples: 1.5.7, 1.0.0-beta1)"
       key: "PACKAGE_VERSION"
       required: true
@@ -50,7 +58,15 @@ steps:
           value: "true"
         - label: "False"
           value: "false"
-      default: "false"
+      default: "true"
+    - text: "Backport branch name (optional, defaults to backport-<package>-<major>.<minor>)"
+      key: "BACKPORT_BRANCH_NAME"
+      required: false
+      default: ""
+    - text: "PR number to notify on completion (optional)"
+      key: "PR_NUMBER"
+      required: false
+      default: ""
 
   - label: "Creating the backport branch"
     key: "create-backport-branch"
@@ -65,3 +81,30 @@ steps:
     depends_on:
       - step: "input-variables"
         allow_failure: false
+
+  - label: ":github: Notify PR"
+    key: "notify-pr"
+    command: |
+      if ! outcome=$$(buildkite-agent step get "outcome" --step "create-backport-branch"); then
+        echo "Failed to retrieve step outcome, skipping PR notification"
+        exit 0
+      fi
+      if [[ "$${outcome}" == "passed" ]]; then
+        NOTIFY_STATUS=success .buildkite/scripts/notify_backport_pr.sh
+      else
+        NOTIFY_STATUS=failure .buildkite/scripts/notify_backport_pr.sh
+      fi
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "create-backport-branch"
+        allow_failure: true
+
+notify:
+  # Only notify for automated backport creation failures (triggered by integrations-backport-dispatch).
+  # Dry-run failures from PR builds (triggered by integrations) are already surfaced as a failing
+  # CI status on the PR itself and do not warrant a team email.
+  - email: "$NOTIFY_TO"
+    if: "build.state == 'failed' && build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations-backport-dispatch'"
diff --git a/.buildkite/pipeline.publish.yml b/.buildkite/pipeline.publish.yml
index ba0d922b38f..64f5d60c7dc 100644
--- a/.buildkite/pipeline.publish.yml
+++ b/.buildkite/pipeline.publish.yml
@@ -38,6 +38,9 @@ steps:
       ARTIFACTS_FOLDER: "artifacts-to-sign"
       # by default it will publish packages
       DRY_RUN: "${DRY_RUN:-false}"
+      # Comma-separated list of package zip filenames to skip (e.g. "foo-1.0.0.zip,bar-2.0.0.zip")
+      # kubeletstats_input_otel-0.1.0 was deleted but it is kept in the repository for now, in case it is needed to release a new version if needed
+      SKIP_PACKAGES: "kubeletstats_input_otel-0.1.0.zip"
     depends_on:
       - step: "check"
         allow_failure: false
diff --git a/.buildkite/pipeline.schedule-daily.yml b/.buildkite/pipeline.schedule-daily.yml
index de122a940b2..aff5682d0ff 100644
--- a/.buildkite/pipeline.schedule-daily.yml
+++ b/.buildkite/pipeline.schedule-daily.yml
@@ -34,7 +34,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.11-SNAPSHOT
+        STACK_VERSION: 8.19.20-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "true"
     depends_on:
       - step: "check"
@@ -48,7 +48,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.11-SNAPSHOT
+        STACK_VERSION: 8.19.20-SNAPSHOT
         STACK_LOGSDB_ENABLED: "true"
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:
@@ -86,13 +86,13 @@ steps:
     if: |
       build.env('TEST_PACKAGES_BASIC_SUBSCRIPTION') == "true"
 
-  - label: "Check integrations local stacks - Stack Version v9.4"
+  - label: "Check integrations local stacks - Stack Version v9.6"
     trigger: "integrations"
     build:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 9.4.0-SNAPSHOT
+        STACK_VERSION: 9.6.0-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:
       - step: "check"
diff --git a/.buildkite/pipeline.schedule-weekly.yml b/.buildkite/pipeline.schedule-weekly.yml
index ca21a491579..a2a0666b312 100644
--- a/.buildkite/pipeline.schedule-weekly.yml
+++ b/.buildkite/pipeline.schedule-weekly.yml
@@ -21,20 +21,20 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.11-SNAPSHOT
+        STACK_VERSION: 8.19.20-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
         ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
     depends_on:
       - step: "check"
         allow_failure: false
 
-  - label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.4"
+  - label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.6"
     trigger: "integrations"
     build:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 9.4.0-SNAPSHOT
+        STACK_VERSION: 9.6.0-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
         ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
     depends_on:
diff --git a/.buildkite/pipeline.serverless.yml b/.buildkite/pipeline.serverless.yml
index 195bacac447..9a405774a12 100644
--- a/.buildkite/pipeline.serverless.yml
+++ b/.buildkite/pipeline.serverless.yml
@@ -5,10 +5,10 @@ env:
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
   DOCKER_COMPOSE_VERSION: "v2.24.1"
   DOCKER_VERSION: "false" # not required to set since system tests are not running yet
-  KIND_VERSION: 'v0.27.0'
-  K8S_VERSION: 'v1.33.0'
+  KIND_VERSION: 'v0.32.0'
+  K8S_VERSION: 'v1.36.1'
   YQ_VERSION: 'v4.35.2'
-  IMAGE_UBUNTU_X86_64: "family/core-ubuntu-2204"
+  IMAGE_UBUNTU_X86_64: "family/platform-obs-integrations-ubuntu-2204"
   GH_CLI_VERSION: "2.29.0"
   # This pipeline is intended to test packages with Elastic Serverless
   SERVERLESS: true
@@ -71,14 +71,13 @@ steps:
       # See https://github.com/elastic/oblt-infra/blob/main/conf/resources/repos/integrations/01-aws-buildkite-oidc.tf
       # This plugin creates the environment variables required by the service deployer (AWS_SECRET_ACCESS_KEY and AWS_SECRET_KEY_ID)
       - elastic/oblt-aws-auth#v0.1.0:
-          duration: 10800 # seconds
+          duration: 21600 # seconds
       # See https://github.com/elastic/oblt-infra/blob/main/conf/resources/repos/integrations/01-gcp-buildkite-oidc.tf
       # This plugin authenticates to CI Google Cloud using the OIDC token.
       - elastic/oblt-google-auth#v1.3.0:
-          lifetime: 10800 # seconds
+          lifetime: 21600 # seconds
           project-id: "elastic-observability-ci"
           project-number: "911195782929"
-          lifetime: 10800 # seconds
       - avaly/gcp-secret-manager#v1.2.0:
           env:
             EC_API_KEY: elastic-cloud-observability-team-qa-api-key
diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 57e83fad413..ab11f026725 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -8,10 +8,11 @@ env:
   YQ_VERSION: 'v4.35.2'
   JQ_VERSION: '1.7'
   GH_CLI_VERSION: "2.29.0"
+  CHANGELOG_SKIP_LABEL: "changelog-link-check:skip"
 
   # Agent images used in pipeline steps
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
-  IMAGE_UBUNTU_X86_64: "family/core-ubuntu-2204"
+  IMAGE_UBUNTU_X86_64: "family/platform-obs-integrations-ubuntu-2204"
 
   # Elastic package settings
   # Manage docker output/logs
@@ -60,6 +61,47 @@ steps:
     artifact_paths:
       - tests-report.xml
 
+  - label: ":bash: :snake: Buildkite scripts unit tests"
+    key: "check-buildkite-scripts"
+    command: ".buildkite/scripts/run_buildkite_scripts_tests.sh"
+    agents:
+      # GCP VM used to match the same Python 3 version available in the steps that test packages
+      provider: gcp
+      image: "${IMAGE_UBUNTU_X86_64}"
+
+  - label: ":bash: Dev scripts unit tests"
+    key: "check-dev-scripts"
+    command: ".buildkite/scripts/run_dev_scripts_tests.sh"
+
+  - label: ":ballot_box_with_check: Backports inventory validation"
+    key: "check-backports-inventory"
+    command: ".buildkite/scripts/check_backports_inventory.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    if_changed:
+      - ".backports.yml"
+      - ".buildkite/scripts/run_dev_scripts_tests.sh"
+      - "dev/scripts/**.sh"
+      - "dev/backports/**"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') == "main"
+
+  - label: ":git: Trigger backport dry-runs"
+    key: "trigger-backport-dryrun"
+    command: ".buildkite/scripts/trigger_backport.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    depends_on:
+      - step: "check-backports-inventory"
+        allow_failure: false
+    if_changed:
+      - ".backports.yml"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PIPELINE_SLUG') == "integrations" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') == "main"
+
   - label: ":junit: Sources Junit annotate"
     agents:
       # requires at least "bash", "curl" and "git"
@@ -76,6 +118,62 @@ steps:
           run-in-docker: false
           context: junit-sources
 
+  - label: ":scroll: Check changelog versions not in main"
+    key: "check-changelog-versions-in-main"
+    command: ".buildkite/scripts/check_changelog_versions_in_main.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+      cpu: "2"
+      memory: "1G"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') =~ /^backport-/
+    if_changed:
+      - "**/changelog.yml"
+
+  - label: ":scroll: Check changelog PR links"
+    key: "check-changelog-pr-links"
+    command: ".buildkite/scripts/check_changelog_entries.sh"
+    soft_fail:
+      - exit_status: 2
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+      cpu: "2"
+      memory: "1G"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "check-buildkite-scripts"
+        allow_failure: false
+    # CHANGELOG_SKIP_LABEL is substituted into the regex at pipeline upload time.
+    # This works because the variable is defined in the global env section above;
+    # step-level env vars are not available at upload time and cannot be used here.
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      !(build.env("GITHUB_PR_LABELS") =~ /${CHANGELOG_SKIP_LABEL}/)
+    if_changed:
+      - "**/changelog.yml"
+
+  - label: ":busts_in_silhouette: Check backport package owners"
+    key: "check-backport-owners"
+    command: ".buildkite/scripts/check_backport_owners.sh"
+    soft_fail: true
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+      cpu: "2"
+      memory: "1G"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "check-buildkite-scripts"
+        allow_failure: false
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') =~ /^backport-/
+    if_changed:
+      - "packages/**"
+      - ".github/CODEOWNERS"
+
   - label: "Trigger integrations"
     key: "test-integrations"
     command: ".buildkite/scripts/trigger_integrations_in_parallel.sh"
@@ -84,6 +182,8 @@ steps:
     depends_on:
       - step: "check"
         allow_failure: false
+      - step: "check-buildkite-scripts"
+        allow_failure: false
 
   - wait: ~
     continue_on_failure: true
diff --git a/.buildkite/pull-requests.json b/.buildkite/pull-requests.json
index cfa177cc02a..e69e992bfbb 100644
--- a/.buildkite/pull-requests.json
+++ b/.buildkite/pull-requests.json
@@ -14,16 +14,29 @@
       "skip_ci_labels": [],
       "skip_target_branches": [],
       "skip_ci_on_only_changed": [
-        "^.github/workflows/",
+        "^.agents/skills/",
+        "^.buildkite/pipeline.backport.yml$",
+        "^.buildkite/pipeline.backport-dispatch.yml$",
+        "^.buildkite/pipeline.publish.yml$",
+        "^.buildkite/pipeline.serverless.yml$",
+        "^.buildkite/pipeline.schedule-daily.yml$",
+        "^.buildkite/pipeline.schedule-weekly.yml$",
+        "^.buildkite/pull-requests.json$",
+        "^.buildkite/scripts/backport_branch.sh$",
+        "^.buildkite/scripts/build_packages.sh$",
+        "^.buildkite/scripts/notify_backport_pr.sh$",
         "^.github/dependabot.yml$",
+        "^.github/workflows/",
+        "^.github/stale.yml$",
         "^.github/ISSUE_TEMPLATE/",
-        "^docs/",
+        "^.github/PULL_REQUEST_TEMPLATE.md$",
+        "^.gitignore",
+        "^.mergify.yml$",
         "^catalog-info.yaml$",
+        "^docs/",
         "^CODE_OF_CONDUCT.md$",
-        "^.buildkite/pipeline.schedule-daily.yml$",
-        "^.buildkite/pipeline.schedule-weekly.yml$",
-        "^.buildkite/pipeline.backport.yml$",
-        "^.buildkite/pull-requests.json$"
+        "^CONTRIBUTING.md$",
+        "^README.md$"
       ],
       "always_require_ci_on_changed": []
     },
@@ -75,6 +88,22 @@
       "skip_ci_on_only_changed": [],
       "always_require_ci_on_changed": []
     },
+    {
+      "enabled": false,
+      "pipelineSlug": "integrations-backport-dispatch",
+      "allow_org_users": true,
+      "allowed_repo_permissions": ["admin", "write"],
+      "allowed_list": [],
+      "set_commit_status": false,
+      "build_on_commit": false,
+      "build_on_comment": false,
+      "trigger_comment_regex": "",
+      "always_trigger_comment_regex": "",
+      "skip_ci_labels": [],
+      "skip_target_branches": [],
+      "skip_ci_on_only_changed": [],
+      "always_require_ci_on_changed": []
+    },
     {
       "enabled": false,
       "pipelineSlug": "integrations-publish",
diff --git a/.buildkite/scripts/backport_branch.sh b/.buildkite/scripts/backport_branch.sh
index 0e1dc51007a..38073c3cef7 100755
--- a/.buildkite/scripts/backport_branch.sh
+++ b/.buildkite/scripts/backport_branch.sh
@@ -1,27 +1,50 @@
 #!/bin/bash
 
 source .buildkite/scripts/common.sh
+source "$(dirname "${BASH_SOURCE[0]}")/backport_branch_lib.sh"
 
 set -euo pipefail
 
 cleanup_gh() {
-    pushd $WORKSPACE > /dev/null
+    pushd "$WORKSPACE" > /dev/null
     git config remote.origin.url "https://github.com/elastic/integrations.git"
     popd > /dev/null
 }
 
-trap cleanup_gh EXIT
+cleanup() {
+  local exit_code=$?
+  cleanup_gh
+  exit "${exit_code}"
+}
 
+trap cleanup EXIT
+
+# annotate_and_echo posts a Buildkite annotation and echoes the same message
+# to the build log so it is visible in both the annotation panel and the raw output.
+# Usage: annotate_and_echo <style> <message>
+#   style: error | warning | success | info
+annotate_and_echo() {
+    local style="${1}"
+    local message="${2}"
+    echo "${message}"
+    buildkite-agent annotate "${message}" --style "${style}"
+}
 
-DRY_RUN="$(buildkite-agent meta-data get DRY_RUN --default ${DRY_RUN:-"true"})"
-BASE_COMMIT="$(buildkite-agent meta-data get BASE_COMMIT --default ${BASE_COMMIT:-""})"
-PACKAGE_NAME="$(buildkite-agent meta-data get PACKAGE_NAME --default ${PACKAGE_NAME:-""})"
-PACKAGE_FOLDER_NAME="$(buildkite-agent meta-data get PACKAGE_FOLDER_NAME --default ${PACKAGE_FOLDER_NAME:-""})"
-PACKAGE_VERSION="$(buildkite-agent meta-data get PACKAGE_VERSION --default ${PACKAGE_VERSION:-""})"
-REMOVE_OTHER_PACKAGES="$(buildkite-agent meta-data get REMOVE_OTHER_PACKAGES --default ${REMOVE_OTHER_PACKAGES:-"false"})"
+DRY_RUN="$(buildkite-agent meta-data get DRY_RUN --default "${DRY_RUN:-"true"}")"
+BASE_COMMIT="$(buildkite-agent meta-data get BASE_COMMIT --default "${BASE_COMMIT:-""}")"
+PACKAGE_NAME="$(buildkite-agent meta-data get PACKAGE_NAME --default "${PACKAGE_NAME:-""}")"
+PACKAGE_VERSION="$(buildkite-agent meta-data get PACKAGE_VERSION --default "${PACKAGE_VERSION:-""}")"
+REMOVE_OTHER_PACKAGES="$(buildkite-agent meta-data get REMOVE_OTHER_PACKAGES --default "${REMOVE_OTHER_PACKAGES:-"true"}")"
+BACKPORT_BRANCH_NAME="$(buildkite-agent meta-data get BACKPORT_BRANCH_NAME --default "${BACKPORT_BRANCH_NAME:-""}")"
+PR_NUMBER="$(buildkite-agent meta-data get PR_NUMBER --default "${PR_NUMBER:-""}")"
 
-if [[ -z "$PACKAGE_NAME" ]] || [[ -z "$PACKAGE_FOLDER_NAME" ]] || [[ -z "$PACKAGE_VERSION" ]]; then
-  buildkite-agent annotate "The variables **PACKAGE_NAME**, **PACKAGE_FOLDER_NAME** or **PACKAGE_VERSION** aren't defined, please try again" --style "warning"
+if [[ -z "$PACKAGE_NAME" ]] || [[ -z "$PACKAGE_VERSION" ]]; then
+  annotate_and_echo "warning" "The variables **PACKAGE_NAME** or **PACKAGE_VERSION** aren't defined, please try again"
+  exit 1
+fi
+
+if [[ -n "${PR_NUMBER}" ]] && ! [[ "${PR_NUMBER}" =~ ^[0-9]+$ ]]; then
+  annotate_and_echo "error" "Invalid PR_NUMBER **${PR_NUMBER}**: must be a positive integer"
   exit 1
 fi
 
@@ -30,9 +53,10 @@ PARAMETERS=(
     "**DRY_RUN**=$DRY_RUN"
     "**BASE_COMMIT**=$BASE_COMMIT"
     "**PACKAGE_NAME**=$PACKAGE_NAME"
-    "**PACKAGE_FOLDER_NAME**=$PACKAGE_FOLDER_NAME"
     "**PACKAGE_VERSION**=$PACKAGE_VERSION"
     "**REMOVE_OTHER_PACKAGES**=$REMOVE_OTHER_PACKAGES"
+    "**BACKPORT_BRANCH_NAME**=$BACKPORT_BRANCH_NAME"
+    "**PR_NUMBER**=$PR_NUMBER"
 )
 
 # Show each parameter in a different line
@@ -43,14 +67,24 @@ echo "Parameters: ${PARAMETERS[*]}" | sed 's/ /\n- /g' | buildkite-agent annotat
 FULL_ZIP_PACKAGE_NAME="${PACKAGE_NAME}-${PACKAGE_VERSION}.zip"
 TRIMMED_PACKAGE_VERSION="$(echo "$PACKAGE_VERSION" | cut -d '.' -f -2)"
 SOURCE_BRANCH="main"
-BACKPORT_BRANCH_NAME="backport-${PACKAGE_NAME}-${TRIMMED_PACKAGE_VERSION}"
+## In order to test other branches probably it is required to copy the dev files or magefile from the PR branch, and for that it would require these changes
+# git checkout -b test_main
+# SOURCE_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+# echo "--- SOURCE_BRANCH: ${SOURCE_BRANCH}"
+
+# If the backport branch name is not set, use the expected one.
+EXPECTED_BACKPORT_BRANCH_NAME="backport-${PACKAGE_NAME}-${TRIMMED_PACKAGE_VERSION}"
+if [[ "${BACKPORT_BRANCH_NAME}" == "" ]]; then
+  BACKPORT_BRANCH_NAME="${EXPECTED_BACKPORT_BRANCH_NAME}"
+fi
+
 PACKAGES_FOLDER_PATH="packages"
 MSG=""
 
 isPackagePublished() {
   local packageZip=$1
   local responseCode
-  responseCode=$(curl -s -o /dev/null -w "%{http_code}" "https://package-storage.elastic.co/artifacts/packages/${packageZip}")
+  responseCode=$(retry 5 curl -s -o /dev/null -w "%{http_code}" "https://package-storage.elastic.co/artifacts/packages/${packageZip}")
   if [[ $responseCode == "200" ]]; then
     return 0
   else
@@ -91,27 +125,11 @@ createLocalBackportBranch() {
   if git checkout -b "$branch_name" "$source_commit"; then
     echo "The branch $branch_name has been created."
   else
-    buildkite-agent annotate "The backport branch **$BACKPORT_BRANCH_NAME** could not be created." --style "warning"
+    annotate_and_echo "warning" "The backport branch **$BACKPORT_BRANCH_NAME** could not be created."
     exit 1
   fi
 }
 
-removeOtherPackages() {
-  local sourceFolder=$1
-  local currentPackage=""
-  for dir in "$sourceFolder"/*; do
-    if [[ -d "$dir" ]] && [[ "$(basename "$dir")" != "$PACKAGE_FOLDER_NAME" ]]; then
-      echo "Removing directory: $dir"
-      rm -rf "$dir"
-
-      currentPackage=$(basename "${dir}")
-      echo "Removing ${currentPackage} from .github/CODEOWNERS"
-      sed -i "/^\/packages\/${currentPackage}\//d" .github/CODEOWNERS
-      sed -i "/^\/packages\/${currentPackage} /d" .github/CODEOWNERS
-    fi
-  done
-}
-
 update_git_config() {
     pushd "$WORKSPACE" > /dev/null
     git config --global user.name "${GITHUB_USERNAME}"
@@ -126,44 +144,29 @@ updateBackportBranchContents() {
   local files_cached_num=""
 
   git checkout "$BACKPORT_BRANCH_NAME"
-  echo "Copying $BUILDKITE_FOLDER_PATH from $SOURCE_BRANCH..."
+  echo "--- Copying $BUILDKITE_FOLDER_PATH from $SOURCE_BRANCH..."
   git checkout $SOURCE_BRANCH -- $BUILDKITE_FOLDER_PATH
   git add $BUILDKITE_FOLDER_PATH
 
   if git ls-tree -d --name-only main:.ci >/dev/null 2>&1; then
-    echo "Copying $JENKINS_FOLDER_PATH from $SOURCE_BRANCH..."
+    echo "--- Copying $JENKINS_FOLDER_PATH from $SOURCE_BRANCH..."
     git checkout $SOURCE_BRANCH -- $JENKINS_FOLDER_PATH
     git add $JENKINS_FOLDER_PATH
   else
     if [ -d "${JENKINS_FOLDER_PATH}" ]; then
-      echo "Removing $JENKINS_FOLDER_PATH from $BACKPORT_BRANCH_NAME..."
+      echo "--- Removing $JENKINS_FOLDER_PATH from $BACKPORT_BRANCH_NAME..."
       rm -rf "$JENKINS_FOLDER_PATH"
       git add "$JENKINS_FOLDER_PATH"
     fi
   fi
 
   # Update scripts used by mage
-  local MAGEFILE_SCRIPTS_FOLDER="dev/citools"
-  local TESTSREPORTER_SCRIPTS_FOLDER="dev/testsreporter"
-  local COVERAGE_SCRIPTS_FOLDER="dev/coverage"
-  local CODEOWNERS_SCRIPTS_FOLDER="dev/codeowners"
-
-  if git ls-tree -d --name-only main:${MAGEFILE_SCRIPTS_FOLDER} > /dev/null 2>&1 ; then
-    echo "Copying $MAGEFILE_SCRIPTS_FOLDER from $SOURCE_BRANCH..."
-    git checkout "$SOURCE_BRANCH" -- "${MAGEFILE_SCRIPTS_FOLDER}"
-    git add ${MAGEFILE_SCRIPTS_FOLDER}
-
-    echo "Copying $TESTSREPORTER_SCRIPTS_FOLDER from $SOURCE_BRANCH..."
-    git checkout "$SOURCE_BRANCH" -- "${TESTSREPORTER_SCRIPTS_FOLDER}"
-    git add ${TESTSREPORTER_SCRIPTS_FOLDER}
+  local DEV_FOLDER="dev"
 
-    echo "Copying $COVERAGE_SCRIPTS_FOLDER from $SOURCE_BRANCH..."
-    git checkout "$SOURCE_BRANCH" -- "${COVERAGE_SCRIPTS_FOLDER}"
-    git add ${COVERAGE_SCRIPTS_FOLDER}
-
-    echo "Copying $CODEOWNERS_SCRIPTS_FOLDER from $SOURCE_BRANCH..."
-    git checkout "$SOURCE_BRANCH" -- "${CODEOWNERS_SCRIPTS_FOLDER}"
-    git add ${CODEOWNERS_SCRIPTS_FOLDER}
+  if git ls-tree -d --name-only main:${DEV_FOLDER} > /dev/null 2>&1 ; then
+    echo "--- Copying $DEV_FOLDER from $SOURCE_BRANCH..."
+    git checkout "$SOURCE_BRANCH" -- "${DEV_FOLDER}"
+    git add "${DEV_FOLDER}"
 
     echo "Copying magefile.go from $SOURCE_BRANCH..."
     git checkout "$SOURCE_BRANCH" -- "magefile.go"
@@ -172,56 +175,74 @@ updateBackportBranchContents() {
     # As this script runs in the context of the main branch (mainly go mod tidy), we need to copy
     # the .go-version file from the main branch to the backport branch. This avoids failures
     # installing dependencies in the backport Pull Request.
-    echo "Copying .go-version from $SOURCE_BRANCH..."
+    echo "--- Copying .go-version from $SOURCE_BRANCH..."
     git checkout "$SOURCE_BRANCH" -- ".go-version"
     git add .go-version
 
     # Restore workflows from the main branch since modifying them requires extra permissions.
     # > error: GH013: Repository rule violations found for ...
     # > refusing to allow a GitHub App to create or update workflow `.github/workflows/bump-elastic-stack-version.yml` without `workflows` permission
-    echo "Copying .github/workflows from $SOURCE_BRANCH..."
+    echo "--- Copying .github/workflows from $SOURCE_BRANCH..."
     git checkout "$SOURCE_BRANCH" -- ".github/workflows"
     git add .github/workflows
 
     # Copy tools.go so we have the dev scripts dependencies required
-    echo "Copying tools.go from $SOURCE_BRANCH..."
+    echo "--- Copying tools.go from $SOURCE_BRANCH..."
     git checkout "$SOURCE_BRANCH" -- "tools.go"
     git add tools.go
 
     # Run go mod tidy to update just the dependencies related to magefile and dev scripts
+    echo "--- Running go mod tidy to update dependencies related to magefile and dev scripts..."
     go mod tidy
 
     git add go.mod go.sum
   fi
 
   if [ "${REMOVE_OTHER_PACKAGES}" == "true" ]; then
-    echo "Removing all packages from $PACKAGES_FOLDER_PATH folder"
-    removeOtherPackages "${PACKAGES_FOLDER_PATH}"
+    echo "--- Removing all packages from $PACKAGES_FOLDER_PATH folder"
+
+    # Build the list of packages to keep: the target package plus any packages
+    # it requires (composable packages declare dependencies under requires.input
+    # and requires.content in their manifest.yml).
+    local -a packages_to_keep=("${PACKAGE_PATH}")
+    while IFS= read -r req_name; do
+      local req_path
+      req_path=$(get_package_path "${req_name}" || true)
+      if [[ -n "${req_path}" ]]; then
+        echo "Keeping required package: ${req_path} (required by ${PACKAGE_NAME})"
+        packages_to_keep+=("${req_path}")
+      else
+        echo "Warning: required package '${req_name}' not found in packages folder"
+      fi
+    done < <(get_required_package_names "${PACKAGE_PATH}")
+
+    remove_other_packages "${packages_to_keep[@]}"
     ls -la "${PACKAGES_FOLDER_PATH}"
 
     git add "${PACKAGES_FOLDER_PATH}/"
     git add .github/CODEOWNERS
   fi
 
+  echo "--- Current git status before commit:"
   git status
 
-  echo "Setting up git environment..."
+  echo "--- Setting up git environment..."
   update_git_config
 
   files_cached_num=$(git diff --name-only --cached | wc -l)
   if [ "${files_cached_num}" -gt 0 ]; then
-    echo "Committing changes..."
+    echo "--- Committing changes..."
     git commit -m "Add $BUILDKITE_FOLDER_PATH and $JENKINS_FOLDER_PATH to backport branch: $BACKPORT_BRANCH_NAME from the $SOURCE_BRANCH branch"
   else
-    echo "Nothing to commit, skip."
+    echo "+++ Nothing to commit, skip."
   fi
 
   if [ "$DRY_RUN" == "true" ];then
-    echo "DRY_RUN mode, nothing will be pushed."
+    echo "--- DRY_RUN mode, nothing will be pushed."
     # Show just the relevant files diff (go.mod, go.sum, .buildkite, dev, .go-version, .github/CODEOWNERS and package to be backported)
-    git --no-pager diff $SOURCE_BRANCH...$BACKPORT_BRANCH_NAME .buildkite/ dev/ go.sum go.mod .go-version tools.go .github/CODEOWNERS "packages/${PACKAGE_FOLDER_NAME}"
+    git --no-pager diff "$SOURCE_BRANCH...$BACKPORT_BRANCH_NAME" .buildkite/ dev/ go.sum go.mod .go-version tools.go .github/CODEOWNERS "${PACKAGE_PATH}"
   else
-    echo "Pushing..."
+    echo "--- Pushing..."
     git push origin "$BACKPORT_BRANCH_NAME"
   fi
 
@@ -229,57 +250,76 @@ updateBackportBranchContents() {
 }
 
 if ! [[ "${PACKAGE_VERSION}" =~ ^[0-9]+(\.[0-9]+){2}(\-.*)?$ ]]; then
-  buildkite-agent annotate "The entered package version ${PACKAGE_VERSION} doesn't match the pattern" --style "error"
+  annotate_and_echo "error" "The entered package version ${PACKAGE_VERSION} doesn't match the pattern"
   exit 1
 fi
 
 add_bin_path
 
 with_yq
+with_mage
 
-echo "Check if the package is published"
+echo "--- Validating custom backport branch name"
+if ! mage ValidateBackportBranchName "${PACKAGE_NAME}" "${BACKPORT_BRANCH_NAME}"; then
+  annotate_and_echo "error" "Invalid backport branch name **${BACKPORT_BRANCH_NAME}**: must match \`backport-${PACKAGE_NAME}-<suffix>\`"
+  exit 1
+fi
+
+echo "--- Resolve package path from PACKAGE_NAME"
+PACKAGE_PATH="$(get_package_path "${PACKAGE_NAME}" || true)"
+if [[ -z "${PACKAGE_PATH}" ]]; then
+  annotate_and_echo "error" "Package **${PACKAGE_NAME}** not found"
+  exit 1
+fi
+echo "Package path: ${PACKAGE_PATH}"
+
+echo "--- Check if the package is published"
 if ! isPackagePublished "$FULL_ZIP_PACKAGE_NAME"; then
-  buildkite-agent annotate "The package version: **${PACKAGE_NAME}-${PACKAGE_VERSION}** hasn't been published yet." --style "error"
+  annotate_and_echo "error" "The package version: **${PACKAGE_NAME}-${PACKAGE_VERSION}** hasn't been published yet."
   exit 1
 fi
 
-echo "Check if the base commit exists."
+echo "--- Check if the base commit exists."
 if [ ! -z "$BASE_COMMIT" ]; then
   if ! commitExists "$BASE_COMMIT" "$SOURCE_BRANCH"; then
-    buildkite-agent annotate "The entered commit hasn't found in the **${SOURCE_BRANCH}** branch" --style "error"
+    annotate_and_echo "error" "The entered commit was not found in the **${SOURCE_BRANCH}** branch"
     exit 1
   fi
 fi
 
-echo "Check if the backport-branch exists"
+
+echo "--- Check if the backport-branch exists"
 if branchExist "$BACKPORT_BRANCH_NAME"; then
   MSG="The backport branch: **$BACKPORT_BRANCH_NAME** is already created. Not updating contents of the branch."
-  buildkite-agent annotate "$MSG" --style "warning"
+  annotate_and_echo "warning" "$MSG"
+  # Set meta-data so the notify step can distinguish this success case
+  # (branch pre-existed) from a branch that was freshly created.
+  buildkite-agent meta-data set BRANCH_ALREADY_EXISTED true
   exit 0
 fi
 
 # backport branch does not exist, running checks and create branch
-version="$(git show "${BASE_COMMIT}":"packages/${PACKAGE_FOLDER_NAME}/manifest.yml" | yq -r .version)"
-echo "Check if version from ${BASE_COMMIT} (${version}) matches with version from input step ${PACKAGE_VERSION}"
+version="$(git show "${BASE_COMMIT}":"${PACKAGE_PATH}/manifest.yml" | yq -r .version)"
+echo "--- Check if version from ${BASE_COMMIT} (${version}) matches with version from input step ${PACKAGE_VERSION}"
 if [[ "${version}" != "${PACKAGE_VERSION}" ]]; then
-  buildkite-agent annotate "Unexpected version found in packages/${PACKAGE_FOLDER_NAME}/manifest.yml" --style "error"
+  annotate_and_echo "error" "Unexpected version found in ${PACKAGE_PATH}/manifest.yml"
   exit 1
 fi
 
-echo "Check that this changeset is the one creating the version $PACKAGE_NAME"
-if ! git show -p "${BASE_COMMIT}" "packages/${PACKAGE_FOLDER_NAME}/manifest.yml" | grep -E "^\+version: \"{0,1}${PACKAGE_VERSION}" ; then
-  buildkite-agent annotate "This changeset does not creates the version ${PACKAGE_VERSION}" --style "error"
+echo "---Check that this changeset is the one creating the version $PACKAGE_NAME"
+if ! git show -p "${BASE_COMMIT}" "${PACKAGE_PATH}/manifest.yml" | grep -E "^\+version: \"{0,1}${PACKAGE_VERSION}" ; then
+  annotate_and_echo "error" "This changeset does not create the version ${PACKAGE_VERSION}"
   exit 1
 fi
 
-echo "Creating the branch: $BACKPORT_BRANCH_NAME from the commit: $BASE_COMMIT"
+echo "--- Creating the branch: $BACKPORT_BRANCH_NAME from the commit: $BASE_COMMIT"
 createLocalBackportBranch "$BACKPORT_BRANCH_NAME" "$BASE_COMMIT"
 MSG="The backport branch: **$BACKPORT_BRANCH_NAME** has been created."
 
-echo "Adding CI files into the branch ${BACKPORT_BRANCH_NAME}"
+echo "+++ Adding CI files into the branch ${BACKPORT_BRANCH_NAME}"
 updateBackportBranchContents
 
 if [ "${DRY_RUN}" == "true" ]; then
   MSG="[DRY_RUN] ${MSG}."
 fi
-buildkite-agent annotate "$MSG" --style "success"
+annotate_and_echo "success" "$MSG"
diff --git a/.buildkite/scripts/backport_branch_lib.sh b/.buildkite/scripts/backport_branch_lib.sh
new file mode 100755
index 00000000000..1faac41877b
--- /dev/null
+++ b/.buildkite/scripts/backport_branch_lib.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Pure helper functions for backport_branch.sh.
+# Source this file; do not execute it directly.
+
+# get_package_path returns the path of the package with the given name as
+# defined in the manifest.yml `name` field. Returns 1 if not found.
+get_package_path() {
+  local package_name="${1}"
+  local package_path=""
+
+  while IFS= read -r package_path; do
+    local name
+    name=$(yq -r '.name' "${package_path}/manifest.yml")
+    if [[ "${name}" == "${package_name}" ]]; then
+      echo "${package_path}"
+      return 0
+    fi
+  done < <(list_all_directories)
+
+  return 1
+}
+
+# get_required_package_names returns (one per line) the names of all packages
+# listed under requires.input and requires.content in the manifest.yml of the
+# given package path. Outputs nothing if the section is absent.
+get_required_package_names() {
+  local package_path="${1}"
+  local manifest="${package_path}/manifest.yml"
+
+  if [[ ! -f "${manifest}" ]]; then
+    return 0
+  fi
+
+  yq -r '.requires.input[].package' "${manifest}" 2>/dev/null || true
+  yq -r '.requires.content[].package' "${manifest}" 2>/dev/null || true
+}
+
+remove_other_packages() {
+  local -a packages_to_keep=("$@")
+  local package_path
+  local package_paths=""
+  package_paths=$(list_all_directories)
+  for package_path in ${package_paths}; do
+    local should_keep=false
+    for keep_path in "${packages_to_keep[@]}"; do
+      if [[ "${package_path}" == "${keep_path}" ]]; then
+        should_keep=true
+        break
+      fi
+    done
+    if [[ -d "$package_path" ]] && [[ "${should_keep}" == "false" ]]; then
+      echo "Removing directory: ${package_path}"
+      rm -rf "$package_path"
+
+      echo "Removing ${package_path} from .github/CODEOWNERS"
+      sed -i "\|^/${package_path}/|d" .github/CODEOWNERS
+      sed -i "\|^/${package_path} |d" .github/CODEOWNERS
+    fi
+  done
+}
diff --git a/.buildkite/scripts/build_packages.sh b/.buildkite/scripts/build_packages.sh
index dfc6ada97bc..895471c221a 100644
--- a/.buildkite/scripts/build_packages.sh
+++ b/.buildkite/scripts/build_packages.sh
@@ -5,10 +5,16 @@ source .buildkite/scripts/common.sh
 set -euo pipefail
 
 SKIP_PUBLISHING=${SKIP_PUBLISHING:-"false"}
+# Comma-separated list of package zip filenames to skip (e.g. "foo-1.0.0.zip,bar-2.0.0.zip")
+SKIP_PACKAGES=${SKIP_PACKAGES:-""}
 ARTIFACTS_FOLDER=${ARTIFACTS_FOLDER:-"packageArtifacts"}
 BUILD_PACKAGES_FOLDER="build/packages"
 DRY_RUN=${DRY_RUN:-"true"}
 
+is_skipped_package() {
+    [[ ",${SKIP_PACKAGES}," == *",${1},"* ]]
+}
+
 skipPublishing() {
     if [[ "${BUILDKITE_PULL_REQUEST}" != "false" ]]; then
         return 0
@@ -21,6 +27,7 @@ skipPublishing() {
         return 1
     fi
 
+    # feature/* and other non-publishing branches fall through here
     return 0
 }
 
@@ -48,21 +55,27 @@ report_build_failure() {
 }
 
 build_packages() {
-    pushd packages > /dev/null || exit 1
+    local packages=""
+    local version=""
+    local name=""
+    local package_zip=""
+    local package_path=""
 
-    for it in $(find . -maxdepth 1 -mindepth 1 -type d); do
-        local package
-        local version
-        local name
-        package=$(basename "${it}")
-        echo "Package ${package}: check"
+    packages=$(list_all_directories)
+    for package_path in ${packages}; do
+        pushd "${package_path}" > /dev/null || exit 1
+        echo "Package \"${package_path}\": check"
 
-        pushd "${package}" > /dev/null || exit 1
+        version=$(yq .version manifest.yml)
+        name=$(yq .name manifest.yml)
 
-        version=$(cat manifest.yml | yq .version)
-        name=$(cat manifest.yml | yq .name)
+        package_zip="${name}-${version}.zip"
 
-        local package_zip="${name}-${version}.zip"
+        if is_skipped_package "${package_zip}" ; then
+            echo "Skipping. ${package_zip} is in the skip list"
+            popd > /dev/null
+            continue
+        fi
 
         if is_already_published "${package_zip}" ; then
             echo "Skipping. ${package_zip} already published"
@@ -70,15 +83,14 @@ build_packages() {
             continue
         fi
 
-        echo "Build package as zip: ${package}"
-        if check_and_build_package "${package}" ; then
+        echo "Build package as zip: ${package_path}"
+        if check_and_build_package "${package_path}" ; then
             unpublished="true"
         else
-            report_build_failure "${package}"
+            report_build_failure "${package_path}"
         fi
         popd > /dev/null || exit 1
     done
-    popd > /dev/null || exit 1
 }
 
 if [ "${SKIP_PUBLISHING}" == "true" ] ; then
@@ -94,7 +106,7 @@ fi
 add_bin_path
 
 with_yq
-with_go
+with_mage
 use_elastic_package
 
 echo "--- Build packages"
diff --git a/.buildkite/scripts/check_backport_owners.sh b/.buildkite/scripts/check_backport_owners.sh
new file mode 100755
index 00000000000..4adc6a87792
--- /dev/null
+++ b/.buildkite/scripts/check_backport_owners.sh
@@ -0,0 +1,133 @@
+#!/bin/bash
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/common.sh"
+
+# BACKPORT_OWNERS_SOURCE_BRANCH is the ownership source of truth — main is
+# always authoritative. Not meant to be overridden via the environment (that
+# would let this drift from apply.go's own hardcoded "main"); it's a plain
+# variable purely so the value lives in one place, easy to tweak here for
+# local debugging/testing.
+BACKPORT_OWNERS_SOURCE_BRANCH="main"
+
+# Renders the PR comment body for mismatches_json, the JSON array emitted by
+# `mage checkBackportOwners -asJSON` (an object per changed package that
+# needs attention — a package fully in sync with main is simply absent).
+# Each object is either {"package","teams"} (a real mismatch: teams is a
+# pre-resolved, deduped, "@"-prefixed list) or {"package","error"} (the check
+# itself couldn't run for that package — no team could be resolved, so none
+# is mentioned).
+# Usage: build_owner_check_comment <mismatches_json>
+build_owner_check_comment() {
+    local mismatches_json="$1"
+
+    local count
+    count=$(jq 'length' <<< "${mismatches_json}")
+
+    if [[ "${count}" -eq 0 ]]; then
+        echo ":white_check_mark: Package owners are in sync with \`main\`."
+        return
+    fi
+
+    echo "**Package owners are out of sync with \`main\`:**"
+    echo ""
+    jq -r '.[] |
+        if .error then
+            "- `" + .package + "` — could not check ownership on `main`: " + .error
+        else
+            "- `" + .package + "` — should now be owned by " + (.teams | join(", "))
+        end' <<< "${mismatches_json}"
+}
+
+# Renders the PR comment body for when the check itself failed to run
+# entirely (e.g. `mage checkBackportOwners` exited non-zero — most likely its
+# own `git fetch` of main, a genuinely new network dependency this script
+# introduces rather than relying on a ref the pre-command hook already
+# fetched) rather than completing and reporting per-package results. This is
+# a distinct state from "no mismatches found" — build_owner_check_comment
+# must never be called with data from a failed run, since an empty/absent
+# result would then misrender as the in-sync confirmation.
+# Usage: build_owner_check_failure_comment <build_url>
+build_owner_check_failure_comment() {
+    local build_url="${1:-""}"
+
+    echo ":warning: The backport owner check failed to run — it could not determine whether package owners are in sync with \`main\`."
+    if [[ -n "${build_url}" ]]; then
+        echo ""
+        echo "See the [build log](${build_url}) for details."
+    fi
+}
+
+main() {
+    set -euo pipefail
+
+    if [[ "${BUILDKITE_PULL_REQUEST:-"false"}" == "false" ]]; then
+        echo "Not a pull request build, skipping backport owner check."
+        exit 0
+    fi
+
+    if [[ ! "${BUILDKITE_PULL_REQUEST_BASE_BRANCH:-""}" =~ ^backport- ]]; then
+        echo "Base branch '${BUILDKITE_PULL_REQUEST_BASE_BRANCH:-""}' is not a backport-* branch, skipping."
+        exit 0
+    fi
+
+    if running_on_buildkite; then
+        echo "--- Installing tools"
+        add_bin_path
+        with_jq         # containers do not have jq installed
+        with_github_cli # to post comments in Pull Requests
+        with_mage       # to run the checkBackportOwners target
+    fi
+
+    local remote="origin"
+    local merge_base=""
+    local check_exit=0
+    merge_base="$(git merge-base "${BUILDKITE_COMMIT}" "${remote}/${BUILDKITE_PULL_REQUEST_BASE_BRANCH}")" || check_exit=$?
+
+    echo "--- Checking package owners for PR #${BUILDKITE_PULL_REQUEST}"
+    echo "Base branch: ${BUILDKITE_PULL_REQUEST_BASE_BRANCH}, merge-base: ${merge_base}, head: ${BUILDKITE_COMMIT}"
+
+    local mismatches_json=""
+    if [[ "${check_exit}" -eq 0 ]]; then
+        mismatches_json="$(mage checkBackportOwners "${remote}" "${BACKPORT_OWNERS_SOURCE_BRANCH}" "${merge_base}" "${BUILDKITE_COMMIT}")" || check_exit=$?
+    fi
+
+    local comment
+    if [[ "${check_exit}" -ne 0 ]]; then
+        comment="$(build_owner_check_failure_comment "${BUILDKITE_BUILD_URL:-""}")"
+    else
+        comment="$(build_owner_check_comment "${mismatches_json}")"
+    fi
+    echo "${comment}"
+
+    if running_on_buildkite; then
+        echo "${comment}" > backport-owner-check.txt
+        if ! delete_and_create_gh_pr_comment \
+            "${BUILDKITE_ORGANIZATION_SLUG}" \
+            "integrations" \
+            "${BUILDKITE_PULL_REQUEST}" \
+            "backport-owner-check" \
+            "backport-owner-check.txt"; then
+            echo "Failed to post GitHub PR comment"
+        fi
+    fi
+
+    if [[ "${check_exit}" -ne 0 ]]; then
+        echo ""
+        echo "--- backport owner check failed to run (exit ${check_exit})"
+        exit "${check_exit}"
+    fi
+
+    local mismatch_count
+    mismatch_count="$(jq 'length' <<< "${mismatches_json}")"
+
+    if [[ "${mismatch_count}" -gt 0 ]]; then
+        echo ""
+        echo "--- ${mismatch_count} package(s) have owner mismatches with \`main\`"
+        exit 1
+    fi
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    main "$@"
+fi
diff --git a/.buildkite/scripts/check_backports_inventory.sh b/.buildkite/scripts/check_backports_inventory.sh
new file mode 100755
index 00000000000..35a886dc062
--- /dev/null
+++ b/.buildkite/scripts/check_backports_inventory.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+source .buildkite/scripts/common.sh
+
+set -euo pipefail
+
+add_bin_path
+with_mage
+with_yq
+
+echo "--- Validate .backports.yml inventory schema"
+mage -d "${WORKSPACE}" -v validateBackportsInventory
+
+echo "--- Check if any files modified"
+check_git_diff
diff --git a/.buildkite/scripts/check_changelog_entries.sh b/.buildkite/scripts/check_changelog_entries.sh
new file mode 100755
index 00000000000..c04a831f49a
--- /dev/null
+++ b/.buildkite/scripts/check_changelog_entries.sh
@@ -0,0 +1,217 @@
+#!/bin/bash
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/common.sh"
+
+CHANGELOG_SKIP_LABEL="${CHANGELOG_SKIP_LABEL:-"changelog-link-check:skip"}"
+
+# Global counter for sentinel (REPLACE_ME) links — set inside check_changelog_file,
+# read in main to distinguish hard (exit 1) vs soft (exit 2) failures.
+_sentinel_errors=0
+
+# Extracts the GitHub org/repo path from a remote URL.
+# Handles SSH (git@github.com:org/repo.git) and HTTPS formats.
+github_repo_path() {
+    local repo_url="$1"
+    echo "${repo_url}" | sed -E 's|.*github\.com[:/]||; s|\.git$||'
+}
+
+# Returns the link: values added in the diff of a changelog file.
+# Usage: get_added_links <base_ref> <changelog_file>
+get_added_links() {
+    local base_ref="$1"
+    local changelog_file="$2"
+    git diff "${base_ref}" -- "${changelog_file}" \
+        | grep -E '^\+[[:space:]]+link:' \
+        | sed -E 's/^\+[[:space:]]+link:[[:space:]]*//' \
+        || true
+}
+
+# Validates the link: entries added to a changelog file in this PR.
+# Prints a result line per link (OK / SKIP / ERROR).
+# Returns the number of invalid links found.
+# Usage: check_changelog_file <base_ref> <changelog_file> <expected_pr_link>
+check_changelog_file() {
+    local base_ref="$1"
+    local changelog_file="$2"
+    local expected_pr_link="$3"
+    local errors=0
+
+    if [[ ! -f "${changelog_file}" ]]; then
+        echo "[${changelog_file}] File deleted, skipping."
+        return 0
+    fi
+
+    echo "--- [${changelog_file}]"
+
+    local added_links
+    added_links=$(get_added_links "${base_ref}" "${changelog_file}")
+
+    if [[ -z "${added_links}" ]]; then
+        echo "No new 'link:' entries found, skipping."
+        return 0
+    fi
+
+    while IFS= read -r link; do
+        [[ -z "${link}" ]] && continue
+        if [[ "${link}" =~ /issues/[0-9]+$ ]]; then
+            echo "SKIP: '${link}' (issue link, not required to match PR)"
+        elif [[ "${link}" == *"REPLACE_ME"* ]]; then
+            echo "SENTINEL: '${link}' (placeholder not replaced — auto-fix may have failed)"
+            _sentinel_errors=$((_sentinel_errors + 1))
+            errors=$((errors + 1))
+        elif [[ "${link}" != "${expected_pr_link}" ]]; then
+            echo "ERROR: unexpected link: '${link}'"
+            echo "       expected:         '${expected_pr_link}'"
+            errors=$((errors + 1))
+        else
+            echo "OK: '${link}'"
+        fi
+    done <<< "${added_links}"
+
+    return "${errors}"
+}
+
+# Returns 0 (true) if the changelog link check should be skipped based on PR labels.
+# Usage: should_skip_changelog_check <labels>
+should_skip_changelog_check() {
+    local labels="${1:-""}"
+    [[ "${labels}" == *"${CHANGELOG_SKIP_LABEL}"* ]]
+}
+
+# Returns the @mention string for the given user, substituting elastic/ecosystem
+# when the user is the github-actions[bot] automated user.
+# Usage: get_pr_mention <user>
+get_pr_mention() {
+    local user="${1:-""}"
+    if [[ -z "${user}" ]]; then
+        echo ""
+        return 0
+    fi
+    if [[ "${user}" == "github-actions[bot]" ]]; then
+        user="elastic/ecosystem"
+    fi
+    echo $'\n'"@${user}"
+}
+
+# Posts a single Buildkite annotation and GitHub PR comment listing all files
+# with changelog link mismatches.
+# Usage: notify_changelog_mismatch <message> <pr_number>
+notify_changelog_mismatch() {
+    local message="$1"
+    local pr_number="$2"
+
+    echo "--- :bell: Sending mismatch notifications"
+
+    buildkite-agent annotate \
+        "${message}" \
+        --context "ctx-changelog-link-mismatch" \
+        --style "error"
+
+    local mention
+    mention="$(get_pr_mention "${GITHUB_PR_USER:-""}")"
+    echo "${message}${mention}" > changelog-link-mismatch.txt
+    if ! delete_and_create_gh_pr_comment \
+        "${BUILDKITE_ORGANIZATION_SLUG}" \
+        "integrations" \
+        "${pr_number}" \
+        "changelog-link-mismatch" \
+        "changelog-link-mismatch.txt" ; then
+        echo "Failed to post GitHub PR comment"
+    fi
+}
+
+main() {
+    set -euo pipefail
+
+    if [[ "${BUILDKITE_PULL_REQUEST:-"false"}" == "false" ]]; then
+        echo "Not a pull request build, skipping changelog link check."
+        exit 0
+    fi
+
+    if should_skip_changelog_check "${GITHUB_PR_LABELS:-""}"; then
+        echo "Skipping changelog link check: '${CHANGELOG_SKIP_LABEL}' label found."
+        exit 0
+    fi
+
+    if running_on_buildkite; then
+        # Install required tools to post comments in Pull Requests
+        echo "--- Installing tools"
+        add_bin_path
+        with_jq         # containers do not have jq installed
+        with_github_cli # to post comments in Pull Requests
+    fi
+
+    local repo_path
+    repo_path=$(github_repo_path "${BUILDKITE_REPO}")
+    local expected_pr_link="https://github.com/${repo_path}/pull/${BUILDKITE_PULL_REQUEST}"
+    local base_ref="origin/${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
+
+    echo "--- Checking changelog entries for PR #${BUILDKITE_PULL_REQUEST}"
+    echo "Expected PR link: ${expected_pr_link}"
+
+    local changed_changelogs
+    changed_changelogs=$(git diff --name-only "${base_ref}" | grep 'changelog\.yml$' || true)
+
+    if [[ -z "${changed_changelogs}" ]]; then
+        echo "No changelog.yml files were modified in this PR."
+        exit 0
+    fi
+
+    echo "Modified changelog files:"
+    echo "${changed_changelogs}"
+    echo ""
+
+    local total_errors=0
+    local failed_files=()
+
+    while IFS= read -r changelog_file; do
+        local file_errors=0
+        check_changelog_file "${base_ref}" "${changelog_file}" "${expected_pr_link}" || file_errors=$?
+
+        if [[ "${file_errors}" -gt 0 ]]; then
+            total_errors=$((total_errors + file_errors))
+            failed_files+=("${changelog_file}")
+        fi
+    done <<< "${changed_changelogs}"
+
+    if [[ "${total_errors}" -gt 0 ]]; then
+        echo ""
+        echo "--- ${total_errors} changelog link(s) do not match this PR"
+        local message="**Changelog link mismatch** — expected \`${expected_pr_link}\` in the following file(s):"$'\n'
+        for f in "${failed_files[@]}"; do
+            message+="- \`${f}\`"$'\n'
+        done
+        message+=$'\n'"> [!TIP]"$'\n'"> If expected, add the \`${CHANGELOG_SKIP_LABEL}\` label to skip this check. Or, if an issue link was intended, use \`.../issues/<n>\` instead."
+        echo "${message}"
+        if running_on_buildkite; then
+            message+=$'\n\n'"[View Buildkite build](${BUILDKITE_BUILD_URL})"
+            notify_changelog_mismatch "${message}" "${BUILDKITE_PULL_REQUEST}"
+        fi
+        if [[ "${_sentinel_errors}" -gt 0 ]]; then
+            echo "FATAL: ${_sentinel_errors} changelog link(s) still contain the REPLACE_ME sentinel — the auto-fix step likely failed to push the link-fix commit."
+            exit 1
+        fi
+        exit 2
+    fi
+
+    echo ""
+    echo "All new changelog entries have the correct PR link."
+    if running_on_buildkite; then
+        echo "--- :bell: Sending resolved notification"
+        local resolved_message=":white_check_mark: All changelog entries have the correct PR link."
+        echo "${resolved_message}" > changelog-link-resolved.txt
+        if ! delete_and_create_gh_pr_comment \
+            "${BUILDKITE_ORGANIZATION_SLUG}" \
+            "integrations" \
+            "${BUILDKITE_PULL_REQUEST}" \
+            "changelog-link-mismatch" \
+            "changelog-link-resolved.txt" ; then
+            echo "Failed to update GitHub PR comment"
+        fi
+    fi
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    main "$@"
+fi
diff --git a/.buildkite/scripts/check_changelog_versions_in_main.sh b/.buildkite/scripts/check_changelog_versions_in_main.sh
new file mode 100755
index 00000000000..70ab4e0f8c3
--- /dev/null
+++ b/.buildkite/scripts/check_changelog_versions_in_main.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+source .buildkite/scripts/common.sh
+
+set -euo pipefail
+
+add_bin_path
+with_mage
+
+echo "--- Check changelog versions are not already in main"
+mage -d "${WORKSPACE}" -v checkChangelogVersionsInMain "${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
diff --git a/.buildkite/scripts/common.sh b/.buildkite/scripts/common.sh
index 2dd185ff62b..dc2b5a6c48c 100755
--- a/.buildkite/scripts/common.sh
+++ b/.buildkite/scripts/common.sh
@@ -10,6 +10,8 @@ platform_type_lowercase="${platform_type,,}"
 
 SCRIPTS_BUILDKITE_PATH="${WORKSPACE}/.buildkite/scripts"
 
+readonly LONG_RUNNING_BRANCH_PATTERN="^(backport-|feature/)"
+
 export ELASTIC_PACKAGE_BIN=${WORKSPACE}/build/elastic-package
 
 API_BUILDKITE_PIPELINES_URL="https://api.buildkite.com/v2/organizations/elastic/pipelines/"
@@ -172,8 +174,8 @@ with_docker_compose_plugin() {
     local DOCKER_CONFIG="$HOME/.docker/cli-plugins"
     mkdir -p "$DOCKER_CONFIG"
 
-    retry 5 curl -SL -o ${DOCKER_CONFIG}/docker-compose "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-${platform_type_lowercase}-${hw_type}"
-    chmod +x ${DOCKER_CONFIG}/docker-compose
+    retry 5 curl -SL -o "${DOCKER_CONFIG}/docker-compose" "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-${platform_type_lowercase}-${hw_type}"
+    chmod +x "${DOCKER_CONFIG}/docker-compose"
     docker compose version
 }
 
@@ -380,16 +382,14 @@ package_name_manifest() {
 }
 
 is_package_excluded_in_config() {
-    local package=$1
-    local config_file_path=$2
+    local package_name="$1"
+    local config_file_path="$2"
     local excluded_packages=""
 
     excluded_packages=$(packages_excluded "${config_file_path}")
     if [[ "${excluded_packages}" == "null" ]]; then
         return 1
     fi
-    local package_name=""
-    package_name=$(package_name_manifest)
 
     # Avoid using "-q" in grep in this pipe, it could cause some weird behavior in some scenarios due to SIGPIPE errors when "set -o pipefail"
     # https://tldp.org/LDP/lpg/node20.html
@@ -626,39 +626,52 @@ get_previous_successful_commit() {
 }
 
 get_from_changeset() {
-    local from=""
     if [ "${BUILDKITE_PULL_REQUEST}" != "false" ]; then
         echo "origin/${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
         return
     fi
 
-    local previous_commit
-    previous_commit=$(get_previous_commit "${BUILDKITE_PIPELINE_SLUG}" "${BUILDKITE_BRANCH}")
-
-    if [[ "${previous_commit}" != "null" ]] ; then
-        from="${previous_commit}"
-    else
-        from="${BUILDKITE_COMMIT}^"
+    if [[ "${BUILDKITE_BRANCH}" != "main" && ! "${BUILDKITE_BRANCH}" =~ ${LONG_RUNNING_BRANCH_PATTERN} ]]; then
+        local previous_commit
+        previous_commit=$(get_previous_commit "${BUILDKITE_PIPELINE_SLUG}" "${BUILDKITE_BRANCH}")
+        if [[ "${previous_commit}" != "null" ]]; then
+            echo "${previous_commit}"
+        else
+            echo "${BUILDKITE_COMMIT}^"
+        fi
+        return
     fi
 
-    if [[ "${BUILDKITE_BRANCH}" == "main" || ${BUILDKITE_BRANCH} =~ ^backport- ]]; then
-        local previous_successful_commit
-        previous_successful_commit=$(get_previous_successful_commit "${BUILDKITE_PIPELINE_SLUG}" "${BUILDKITE_BRANCH}")
+    local previous_successful_commit
+    previous_successful_commit=$(get_previous_successful_commit "${BUILDKITE_PIPELINE_SLUG}" "${BUILDKITE_BRANCH}")
 
-        from="${previous_successful_commit}"
-        if [[ "${previous_successful_commit}" == "null" ]]; then
-            from="origin/${BUILDKITE_BRANCH}^"
-        fi
+    if [[ "${previous_successful_commit}" != "null" ]]; then
+        echo "${previous_successful_commit}"
+        return
+    fi
+
+    if [[ "${BUILDKITE_BRANCH}" == "main" ]]; then
+        echo "origin/${BUILDKITE_BRANCH}^"
+        return
     fi
 
-    echo "${from}"
+    # First push of a long-running branch: use merge-base with main to scope the diff to
+    # commits exclusive to this branch. Test them only if they contain package changes
+    # (e.g. a CI infra-only first commit should not trigger package testing).
+    local merge_base
+    merge_base=$(git merge-base "${BUILDKITE_COMMIT}" "origin/main")
+    if git diff --name-only "${merge_base}" "${BUILDKITE_COMMIT}" | grep -E '^packages/' > /dev/null; then
+        echo "${merge_base}"
+    else
+        echo "${BUILDKITE_COMMIT}"
+    fi
 }
 
 get_to_changeset() {
     # Changeset that triggered the build
     local to="${BUILDKITE_COMMIT}"
 
-    if [[ "${BUILDKITE_BRANCH}" == "main" || ${BUILDKITE_BRANCH} =~ ^backport- ]]; then
+    if [[ "${BUILDKITE_BRANCH}" == "main" || ${BUILDKITE_BRANCH} =~ ${LONG_RUNNING_BRANCH_PATTERN} ]]; then
         to="origin/${BUILDKITE_BRANCH}"
     fi
     echo "${to}"
@@ -688,18 +701,35 @@ is_logsdb_compatible() {
     return 0
 }
 
+# pr_has_package_related_files reads file paths from stdin (one per line) and returns 0 if
+# at least one path is not matched by any non-package pattern, meaning package tests should run.
+# Returns 1 if every path is covered by a non-package pattern (no package tests needed).
+# Patterns are loaded from non_package_patterns.txt (one ERE per line; # comments and blank lines ignored).
+# Avoid using grep -q: SIGPIPE under set -o pipefail can cause missed detections.
+# See: https://buildkite.com/elastic/integrations/builds/25606
+pr_has_package_related_files() {
+    grep -Evf <(grep -Ev '^[[:space:]]*(#|$)' "${SCRIPTS_BUILDKITE_PATH}/non_package_patterns.txt") > /dev/null
+}
+
+# is_pr_affected accepts a package path and returns true if the package is affected by the PR
+# it expects that the working directory is the package path to be checked
+# Example:
+# is_pr_affected "packages/elastic_package_registry" "origin/main" "origin/main"
 is_pr_affected() {
-    local package="${1}"
+    local package_path="${1}"
     local from="${2}"
     local to="${3}"
 
+    local package_name=""
+    package_name=$(package_name_manifest)
+
     local stack_supported=""
     if ! stack_supported=$(is_supported_stack) ; then
         echo "${FATAL_ERROR}"
         return 1
     fi
     if [[ "${stack_supported}" == "false" ]]; then
-        echo "[${package}] PR is not affected: unsupported stack (${STACK_VERSION})"
+        echo "[${package_name}] PR is not affected: unsupported stack (${STACK_VERSION})"
         return 1
     fi
 
@@ -711,28 +741,28 @@ is_pr_affected() {
             return 1
         fi
         if [[ "${logsdb_compatible}" == "false" ]]; then
-            echo "[${package}] PR is not affected: not supported LogsDB (${STACK_VERSION})"
+            echo "[${package_name}] PR is not affected: not supported LogsDB (${STACK_VERSION})"
             return 1
         fi
     fi
 
     if is_serverless; then
-        if is_package_excluded_in_config "${package}" "${WORKSPACE}/kibana.serverless.config.yml";  then
-            echo "[${package}] PR is not affected: package ${package} excluded in Kibana config for ${SERVERLESS_PROJECT}"
+        if is_package_excluded_in_config "${package_name}" "${WORKSPACE}/kibana.serverless.config.yml";  then
+            echo "[${package_name}] PR is not affected: package ${package_name} excluded in Kibana config for ${SERVERLESS_PROJECT}"
             return 1
         fi
         if ! is_supported_capability ; then
-            echo "[${package}] PR is not affected: capabilities not matched with the project (${SERVERLESS_PROJECT})"
+            echo "[${package_name}] PR is not affected: capabilities not matched with the project (${SERVERLESS_PROJECT})"
             return 1
         fi
-        if [[ "${package}" == "fleet_server" ]]; then
+        if [[ "${package_name}" == "fleet_server" ]]; then
             echoerr "fleet_server not supported. Skipped"
-            echo "[${package}] not supported"
+            echo "[${package_name}] not supported"
             return 1
         fi
         if ! is_spec_3_0_0 ; then
             echoerr "Not v3 spec version. Skipped"
-            echo "[${package}] spec <3.0.0"
+            echo "[${package_name}] spec <3.0.0"
             return 1
         fi
     fi
@@ -742,47 +772,74 @@ is_pr_affected() {
         return 1
     fi
     if [[ "${compatible}" == "false" ]]; then
-        echo "[${package}] PR is not affected: subscription not compatible with ${ELASTIC_SUBSCRIPTION}"
+        echo "[${package_name}] PR is not affected: subscription not compatible with ${ELASTIC_SUBSCRIPTION}"
         return 1
     fi
 
     if [[ "${FORCE_CHECK_ALL}" == "true" ]];then
-        echo "[${package}] PR is affected: \"force_check_all\" parameter enabled"
+        echo "[${package_name}] PR is affected: \"force_check_all\" parameter enabled"
         return 0
     fi
 
     commit_merge=$(git merge-base "${from}" "${to}")
-    echoerr "[${package}] git-diff: check non-package files (${commit_merge}..${to})"
-    # Avoid using "-q" in grep in this pipe, it could cause that some files updated are not detected due to SIGPIPE errors when "set -o pipefail"
-    # Example:
-    # https://buildkite.com/elastic/integrations/builds/25606
-    # https://github.com/elastic/integrations/pull/13810
-    if git diff --name-only "${commit_merge}" "${to}" | grep -E -v '^(packages/|\.github/(CODEOWNERS|ISSUE_TEMPLATE|PULL_REQUEST_TEMPLATE|workflows/)|CODE_OF_CONDUCT\.md|README\.md|docs/|catalog-info\.yaml|\.buildkite/(pull-requests\.json|pipeline\.schedule-daily\.yml|pipeline\.schedule-weekly\.yml|pipeline\.backport\.yml|scripts/packages/.+\.sh|scripts/backport_branch\.sh))' > /dev/null; then
-        echo "[${package}] PR is affected: found non-package files"
+    echoerr "[${package_name}] git-diff: check non-package files (${commit_merge}..${to})"
+    # .github/CODEOWNERS must not be added to "skip_ci_on_only_changed" in ".buildkite/pull-requests.json".
+    # When this file is updated, the Buildkite build must be triggered to run the "mage check" step.
+    # Same for ".buildkite/scripts/packages/.+.sh": this pattern must not be added to "skip_ci_on_only_changed" to allow triggering the tests of the given package.
+    if git diff --name-only "${commit_merge}" "${to}" | pr_has_package_related_files; then
+        echo "[${package_name}] PR is affected: found non-package files"
         return 0
     fi
-    echoerr "[${package}] git-diff: check custom package checker script file (${commit_merge}..${to})"
+    echoerr "[${package_name}] git-diff: check custom package checker script file (${commit_merge}..${to})"
     # Avoid using "-q" in grep in this pipe, it could cause that some files updated are not detected due to SIGPIPE errors when "set -o pipefail"
     # Example:
     # https://buildkite.com/elastic/integrations/builds/25606
     # https://github.com/elastic/integrations/pull/13810
-    if git diff --name-only "${commit_merge}" "${to}" | grep -E "^\.buildkite/scripts/packages/${package}.sh" > /dev/null; then
-        echo "[${package}] PR is affected: found package checker script changes"
+    if git diff --name-only "${commit_merge}" "${to}" | grep -E "^\.buildkite/scripts/${package_path}.sh" > /dev/null; then
+        echo "[${package_name}] PR is affected: found package checker script changes"
         return 0
     fi
-    echoerr "[${package}] git-diff: check package files (${commit_merge}..${to})"
+    echoerr "[${package_name}] git-diff: check package files (${commit_merge}..${to})"
     # Avoid using "-q" in grep in this pipe, it could cause that some files updated are not detected due to SIGPIPE errors when "set -o pipefail"
     # Example:
     # https://buildkite.com/elastic/integrations/builds/25606
     # https://github.com/elastic/integrations/pull/13810
-    if git diff --name-only "${commit_merge}" "${to}" | grep -E "^packages/${package}/" > /dev/null ; then
-        echo "[${package}] PR is affected: found package files"
+    if git diff --name-only "${commit_merge}" "${to}" | grep -E "^${package_path}/" > /dev/null ; then
+        echo "[${package_name}] PR is affected: found package files"
         return 0
     fi
-    echo "[${package}] PR is not affected"
+    echo "[${package_name}] PR is not affected"
     return 1
 }
 
+# should_test_package checks if a package is affected by the current PR.
+# Prints the reason to stderr. Returns 0 if the package should be tested,
+# 1 if it should be skipped. Exits on fatal error.
+should_test_package() {
+    local package_path="${1}"
+    local from="${2}"
+    local to="${3}"
+
+    local reason=""
+    local skip="false"
+
+    pushd "${package_path}" > /dev/null
+    if ! reason=$(is_pr_affected "${package_path}" "${from}" "${to}"); then
+        skip="true"
+        if [[ "${reason}" == "${FATAL_ERROR}" ]]; then
+            echo "Unexpected failure checking ${package_path}" >&2
+            exit 1
+        fi
+    fi
+    popd > /dev/null
+
+    echoerr "${reason}"
+    if [[ "${skip}" == "true" ]]; then
+        return 1
+    fi
+    return 0
+}
+
 is_pr() {
     if [[ "${BUILDKITE_PULL_REQUEST}" == "false" && "${BUILDKITE_TAG}" == "" ]]; then
         return 1
@@ -799,20 +856,20 @@ kubernetes_service_deployer_used() {
 }
 
 teardown_serverless_test_package() {
-    local package=$1
+    local package_name="$1"
     local build_directory="${WORKSPACE}/build"
-    local dump_directory="${build_directory}/elastic-stack-dump/${package}"
+    local dump_directory="${build_directory}/elastic-stack-dump/${package_name}"
 
     echo "--- Collect Elastic stack logs"
     ${ELASTIC_PACKAGE_BIN} stack dump -v --output "${dump_directory}"
 
-    upload_safe_logs_from_package "${package}" "${build_directory}"
+    upload_safe_logs_from_package "${package_name}" "${build_directory}"
 }
 
 teardown_test_package() {
-    local package=$1
+    local package_name="$1"
     local build_directory="${WORKSPACE}/build"
-    local dump_directory="${build_directory}/elastic-stack-dump/${package}"
+    local dump_directory="${build_directory}/elastic-stack-dump/${package_name}"
 
     if ! is_stack_created; then
         echo "No stack running. Skip dump logs and run stack down process."
@@ -822,19 +879,20 @@ teardown_test_package() {
     echo "--- Collect Elastic stack logs"
     ${ELASTIC_PACKAGE_BIN} stack dump -v --output "${dump_directory}"
 
-    upload_safe_logs_from_package "${package}" "${build_directory}"
+    upload_safe_logs_from_package "${package_name}" "${build_directory}"
 
     echo "--- Take down the Elastic stack"
     ${ELASTIC_PACKAGE_BIN} stack down -v
 }
 
+# list all directories that are packages from the root of the repository
 list_all_directories() {
-    find . -maxdepth 1 -mindepth 1 -type d | xargs -I {} basename {} | sort
+    mage -d "${WORKSPACE}" listPackages
 }
 
 check_package() {
-    local package=$1
-    echo "Check package: ${package}"
+    local package_name="$1"
+    echo "Check package: ${package_name}"
     if ! ${ELASTIC_PACKAGE_BIN} check -v ; then
         return 1
     fi
@@ -843,8 +901,8 @@ check_package() {
 }
 
 build_zip_package() {
-    local package=$1
-    echo "Build zip package: ${package}"
+    local package_name="$1"
+    echo "Build zip package: ${package_name}"
     if ! ${ELASTIC_PACKAGE_BIN} build --zip ; then
         return 1
     fi
@@ -853,12 +911,12 @@ build_zip_package() {
 }
 
 skip_installation_step() {
-    local package=$1
+    local package_name="$1"
     if ! is_serverless ; then
         return 1
     fi
 
-    if [[ "$package" == "security_detection_engine" ]]; then
+    if [[ "$package_name" == "security_detection_engine" ]]; then
         return 0
     fi
 
@@ -866,8 +924,8 @@ skip_installation_step() {
 }
 
 install_package() {
-    local package=$1
-    echo "Install package: ${package}"
+    local package_name="$1"
+    echo "Install package: ${package_name}"
     if ! ${ELASTIC_PACKAGE_BIN} install "${ELASTIC_PACKAGE_VERBOSITY}" ; then
         return 1
     fi
@@ -876,10 +934,10 @@ install_package() {
 }
 
 test_package_in_local_stack() {
-    local package=$1
+    local package_name="$1"
     TEST_OPTIONS="--report-format xUnit --report-output file"
 
-    echo "Test package: ${package}"
+    echo "Test package: ${package_name}"
     # Run all test suites
     ${ELASTIC_PACKAGE_BIN} test "${ELASTIC_PACKAGE_VERBOSITY}" ${TEST_OPTIONS} ${COVERAGE_OPTIONS}
     local ret=$?
@@ -891,10 +949,10 @@ test_package_in_local_stack() {
 # too much time, since all packages are run in the same step one by one.
 # Packages are tested one by one to avoid creating more than 100 projects for one build.
 test_package_in_serverless() {
-    local package=$1
+    local package_name="$1"
     TEST_OPTIONS="${ELASTIC_PACKAGE_VERBOSITY} --report-format xUnit --report-output file"
 
-    echo "Test package: ${package}"
+    echo "Test package: ${package_name}"
     if ! ${ELASTIC_PACKAGE_BIN} test asset ${TEST_OPTIONS} ${COVERAGE_OPTIONS}; then
         return 1
     fi
@@ -914,9 +972,9 @@ test_package_in_serverless() {
 }
 
 run_tests_package() {
-    local package=$1
-    echo "--- [${package}] format and lint"
-    if ! check_package "${package}" ; then
+    local package_name="$1"
+    echo "--- [${package_name}] format and lint"
+    if ! check_package "${package_name}" ; then
         return 1
     fi
 
@@ -927,26 +985,26 @@ run_tests_package() {
         fi
     fi
 
-    if ! skip_installation_step "${package}" ; then
-        echo "--- [${package}] test installation"
-        if ! install_package "${package}" ; then
-            if [[ "${package}" == "elastic_connectors" ]]; then
+    if ! skip_installation_step "${package_name}" ; then
+        echo "--- [${package_name}] test installation"
+        if ! install_package "${package_name}" ; then
+            if [[ "${package_name}" == "elastic_connectors" ]]; then
                 # TODO: Remove this skip once elastic_connectors can be installed again
                 # For reference: https://github.com/elastic/kibana/pull/211419
-                echo "[${package}]: Known issue when package is installed - skipped all tests"
+                echo "[${package_name}]: Known issue when package is installed - skipped all tests"
                 return 0
             fi
             return 1
         fi
     fi
 
-    echo "--- [${package}] run test suites"
+    echo "--- [${package_name}] run test suites"
     if is_serverless; then
-        if ! test_package_in_serverless "${package}" ; then
+        if ! test_package_in_serverless "${package_name}" ; then
             return 1
         fi
     else
-        if ! test_package_in_local_stack "${package}" ; then
+        if ! test_package_in_local_stack "${package_name}" ; then
             return 1
         fi
     fi
@@ -996,10 +1054,10 @@ upload_safe_logs_from_package() {
         return
     fi
 
-    local package=$1
+    local package_name="$1"
     local retry_count="${BUILDKITE_RETRY_COUNT:-"0"}"
     if [[ "${retry_count}" -ne 0 ]]; then
-        package="${package}_retry_${retry_count}"
+        package_name="${package_name}_retry_${retry_count}"
     fi
     local build_directory=$2
 
@@ -1009,29 +1067,32 @@ upload_safe_logs_from_package() {
 
     upload_safe_logs \
         "${JOB_GCS_BUCKET_INTERNAL}" \
-        "${build_directory}/elastic-stack-dump/${package}/logs/elastic-agent-internal/*.*" \
-        "${parent_folder}/${package}/elastic-agent-logs/"
+        "${build_directory}/elastic-stack-dump/${package_name}/logs/elastic-agent-internal/*.*" \
+        "${parent_folder}/${package_name}/elastic-agent-logs/"
 
     # required for <8.6.0
     upload_safe_logs \
         "${JOB_GCS_BUCKET_INTERNAL}" \
-        "${build_directory}/elastic-stack-dump/${package}/logs/elastic-agent-internal/default/*" \
-        "${parent_folder}/${package}/elastic-agent-logs/default/"
+        "${build_directory}/elastic-stack-dump/${package_name}/logs/elastic-agent-internal/default/*" \
+        "${parent_folder}/${package_name}/elastic-agent-logs/default/"
 
     upload_safe_logs \
         "${JOB_GCS_BUCKET_INTERNAL}" \
         "${build_directory}/container-logs/*.log" \
-        "${parent_folder}/${package}/container-logs/"
+        "${parent_folder}/${package_name}/container-logs/"
 }
 
 # Helper to run all tests and checks for a package
 process_package() {
-    local package="${1}"
+    local package_path="${1}"
     local failed_packages_file="${2:-""}"
     local exit_code=0
+    local package_name=""
 
-    echo "--- Package ${package}: check"
-    pushd "${package}" > /dev/null
+    pushd "${package_path}" > /dev/null
+
+    package_name="$(package_name_manifest)"
+    echo "--- Package ${package_name}: check"
 
     clean_safe_logs
 
@@ -1049,13 +1110,13 @@ process_package() {
         fi
     fi
 
-    if ! run_tests_package "${package}" ; then
+    if ! run_tests_package "${package_name}" ; then
         exit_code=1
         # Ensure that the group where the failure happened is opened.
         echo "^^^ +++"
-        echo "[${package}] run_tests_package failed"
+        echo "[${package_name}] run_tests_package failed"
         if [[ "${failed_packages_file}" != "" ]]; then
-            echo "- ${package}" >> "${failed_packages_file}"
+            echo "- ${package_name}" >> "${failed_packages_file}"
         fi
     fi
 
@@ -1070,13 +1131,13 @@ process_package() {
     fi
 
     if is_serverless ; then
-        teardown_serverless_test_package "${package}"
+        teardown_serverless_test_package "${package_name}"
     else
-        if ! teardown_test_package "${package}" ; then
+        if ! teardown_test_package "${package_name}" ; then
             exit_code=1
             # Ensure that the group where the failure happened is opened.
             echo "^^^ +++"
-            echo "[${package}] teardown_test_package failed"
+            echo "[${package_name}] teardown_test_package failed"
         fi
     fi
 
@@ -1101,7 +1162,8 @@ add_or_edit_gh_pr_comment() {
     if [[ "${comment_id}" == "" ]]; then
         echo "Creating new comment"
         gh pr comment \
-          "${BUILDKITE_PULL_REQUEST}" \
+          "${pr_number}" \
+          --repo "${owner}/${repo}" \
           --body "${contents}"
         return
     fi
@@ -1115,6 +1177,66 @@ add_or_edit_gh_pr_comment() {
       -f body="${contents}" | jq -r '.html_url'
 }
 
+delete_and_create_gh_pr_comment() {
+    local owner="$1"
+    local repo="$2"
+    local pr_number="$3"
+    local id="$4"
+    local comment_file="$5"
+    local metadata="<!--COMMENT_GENERATED_WITH_ID_${id}-->"
+
+    local comment_id
+    comment_id=$(get_comment_with_pattern "${owner}" "${repo}" "${pr_number}" "${metadata}")
+    if [[ -n "${comment_id}" ]]; then
+        echo "Deleting existing comment: ${comment_id}"
+        gh api \
+            --method DELETE \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "/repos/${owner}/${repo}/issues/comments/${comment_id}"
+    fi
+
+    local contents
+    contents="$(cat "${comment_file}")"
+    printf -v contents '%s\n%s' "${contents}" "${metadata}"
+
+    echo "Creating new comment"
+    gh pr comment \
+        "${pr_number}" \
+        --repo "${owner}/${repo}" \
+        --body "${contents}"
+}
+
+# Posts a new comment on every pipeline run/retry while staying idempotent
+# within a single attempt. Pass a unique id per attempt (e.g. build-number +
+# retry-count) — if a comment with that id already exists the call is a no-op,
+# so transient gh failures can be retried safely without double-posting.
+create_new_gh_pr_comment() {
+    local owner="$1"
+    local repo="$2"
+    local pr_number="$3"
+    local id="$4"
+    local comment_file="$5"
+    local metadata="<!--COMMENT_GENERATED_WITH_ID_${id}-->"
+
+    local comment_id
+    comment_id=$(get_comment_with_pattern "${owner}" "${repo}" "${pr_number}" "${metadata}")
+    if [[ -n "${comment_id}" ]]; then
+        echo "Comment already posted for id=${id}, skipping"
+        return
+    fi
+
+    local contents
+    contents="$(cat "${comment_file}")"
+    printf -v contents '%s\n%s' "${contents}" "${metadata}"
+
+    echo "Creating new comment"
+    gh pr comment \
+        "${pr_number}" \
+        --repo "${owner}/${repo}" \
+        --body "${contents}"
+}
+
 # FIXME: In a Pull Request that there are more than 100 comments,
 # if the comment is older than those 100 comments, it won't be found due to pagination
 get_comment_with_pattern() {
diff --git a/.buildkite/scripts/non_package_patterns.txt b/.buildkite/scripts/non_package_patterns.txt
new file mode 100644
index 00000000000..f1cf268aed3
--- /dev/null
+++ b/.buildkite/scripts/non_package_patterns.txt
@@ -0,0 +1,55 @@
+# Patterns for files that, when changed alone, do NOT trigger package tests.
+# One ERE pattern per line. Blank lines and lines starting with # are ignored.
+# This file itself is listed below so editing it does not trigger all tests.
+^packages/
+^\.agents/skills/
+^\.backports\.yml
+^\.buildkite/pipeline\.backport\.yml
+^\.buildkite/pipeline\.backport-dispatch\.yml
+^\.buildkite/pipeline\.publish\.yml
+^\.buildkite/pipeline\.schedule-daily\.yml
+^\.buildkite/pipeline\.schedule-weekly\.yml
+^\.buildkite/pipeline\.serverless\.yml
+^\.buildkite/pull-requests\.json
+^\.buildkite/scripts/backport_branch\.sh
+^\.buildkite/scripts/backport_branch_lib\.sh
+^\.buildkite/scripts/check_backports_inventory\.sh
+^\.buildkite/scripts/non_package_patterns\.txt
+^\.buildkite/scripts/notify_backport_pr\.sh
+^\.buildkite/scripts/trigger_backport\.sh
+^\.buildkite/scripts/trigger_backport_lib\.sh
+^\.buildkite/scripts/build_packages\.sh
+^\.buildkite/scripts/check_backport_owners\.sh
+^\.buildkite/scripts/check_changelog_entries\.sh
+^\.buildkite/scripts/check_changelog_versions_in_main\.sh
+^\.buildkite/scripts/packages/.+\.sh
+^\.buildkite/scripts/requirements-ci-python-scripts\.txt
+^\.buildkite/scripts/run_buildkite_scripts_tests\.sh
+^\.buildkite/scripts/run_dev_scripts_tests\.sh
+^\.buildkite/scripts/test_backport_branch\.sh
+^\.buildkite/scripts/test_check_backport_owners\.sh
+^\.buildkite/scripts/test_check_changelog_entries\.sh
+^\.buildkite/scripts/test_helpers\.sh
+^\.buildkite/scripts/test_non_package_patterns\.sh
+^\.buildkite/scripts/test_trigger_backport\.sh
+^\.claude/
+^\.github/dependabot\.yml
+^\.github/stale\.yml
+^\.github/scripts/
+^\.github/workflows/
+^\.github/CODEOWNERS
+^\.github/ISSUE_TEMPLATE/
+^\.github/PULL_REQUEST_TEMPLATE\.md
+^\.gitignore
+^\.mergify\.yml
+^catalog-info\.yaml
+^dev/backports/
+^dev/codeowners/
+^dev/gitutil/
+^dev/requiresupdate/
+^dev/scripts/
+^docs/
+^CODE_OF_CONDUCT\.md
+^CONTRIBUTING\.md
+^CLAUDE\.md
+^README\.md
diff --git a/.buildkite/scripts/notify_backport_pr.sh b/.buildkite/scripts/notify_backport_pr.sh
new file mode 100755
index 00000000000..e06cb9e6edf
--- /dev/null
+++ b/.buildkite/scripts/notify_backport_pr.sh
@@ -0,0 +1,64 @@
+#!/bin/bash
+# Posts a comment on the PR that triggered the backport branch creation,
+# reporting success or failure of the branch creation step.
+# Expects env vars: PR_NUMBER, NOTIFY_STATUS (success|failure),
+#                   BACKPORT_BRANCH_NAME, PACKAGE_NAME, PACKAGE_VERSION,
+#                   BUILDKITE_BUILD_URL, DRY_RUN
+
+source .buildkite/scripts/common.sh
+
+set -euo pipefail
+
+BACKPORT_BRANCH_NAME="$(buildkite-agent meta-data get BACKPORT_BRANCH_NAME --default "${BACKPORT_BRANCH_NAME:-""}")"
+PACKAGE_NAME="$(buildkite-agent meta-data get PACKAGE_NAME --default "${PACKAGE_NAME:-""}")"
+PACKAGE_VERSION="$(buildkite-agent meta-data get PACKAGE_VERSION --default "${PACKAGE_VERSION:-""}")"
+PR_NUMBER="$(buildkite-agent meta-data get PR_NUMBER --default "${PR_NUMBER:-""}")"
+DRY_RUN="$(buildkite-agent meta-data get DRY_RUN --default "${DRY_RUN:-"true"}")"
+
+# Validate required env vars not available via meta-data.
+echo "--- Validating required env vars"
+: "${NOTIFY_STATUS:?NOTIFY_STATUS must be set to 'success' or 'failure'}"
+
+if [[ "${DRY_RUN}" == "true" ]]; then
+    echo "DRY_RUN is set, skipping PR notification"
+    exit 0
+fi
+
+if [[ -z "${PR_NUMBER}" ]]; then
+    echo "PR_NUMBER not set, skipping PR notification"
+    exit 0
+fi
+
+echo "--- Adding GitHub CLI to PATH"
+add_bin_path
+with_github_cli
+
+echo "--- Creating body file"
+BODY_FILE="$(mktemp)"
+trap 'rm -f "${BODY_FILE}"' EXIT
+
+BRANCH_ALREADY_EXISTED="$(buildkite-agent meta-data get BRANCH_ALREADY_EXISTED --default "")"
+
+if [[ "${NOTIFY_STATUS}" == "success" ]] && [[ "${BRANCH_ALREADY_EXISTED}" == "true" ]]; then
+    cat > "${BODY_FILE}" <<EOF
+:information_source: Backport branch \`${BACKPORT_BRANCH_NAME}\` for package \`${PACKAGE_NAME}\` \`${PACKAGE_VERSION}\` already existed — no action taken.
+
+[Buildkite build](${BUILDKITE_BUILD_URL})
+EOF
+elif [[ "${NOTIFY_STATUS}" == "success" ]]; then
+    cat > "${BODY_FILE}" <<EOF
+:white_check_mark: Backport branch \`${BACKPORT_BRANCH_NAME}\` created successfully for package \`${PACKAGE_NAME}\` \`${PACKAGE_VERSION}\`.
+
+[Buildkite build](${BUILDKITE_BUILD_URL})
+EOF
+else
+    cat > "${BODY_FILE}" <<EOF
+:x: Failed to create backport branch \`${BACKPORT_BRANCH_NAME}\` for package \`${PACKAGE_NAME}\` \`${PACKAGE_VERSION}\`.
+
+Check the [Buildkite build](${BUILDKITE_BUILD_URL}) for details.
+EOF
+fi
+
+echo "--- Creating new GitHub PR comment"
+RUN_ID="backport-${BACKPORT_BRANCH_NAME}-${BUILDKITE_BUILD_NUMBER:-0}-${BUILDKITE_RETRY_COUNT:-0}"
+retry 3 create_new_gh_pr_comment "elastic" "integrations" "${PR_NUMBER}" "${RUN_ID}" "${BODY_FILE}"
diff --git a/.buildkite/scripts/process_benchmarks.sh b/.buildkite/scripts/process_benchmarks.sh
index 22367d7125c..3fde8898722 100755
--- a/.buildkite/scripts/process_benchmarks.sh
+++ b/.buildkite/scripts/process_benchmarks.sh
@@ -8,7 +8,7 @@ set -euo pipefail
 BENCHMARK_THRESHOLD=${BENCHMARK_THRESHOLD:-'15'}
 
 if ! is_pr ; then
-    echo "[benchmarks] Not a pull request build. Skip procesing benchmarks."
+    echo "[benchmarks] Not a pull request build. Skip processing benchmarks."
     exit 0
 fi
 
diff --git a/.buildkite/scripts/requirements-ci-python-scripts.txt b/.buildkite/scripts/requirements-ci-python-scripts.txt
new file mode 100644
index 00000000000..73f37361246
--- /dev/null
+++ b/.buildkite/scripts/requirements-ci-python-scripts.txt
@@ -0,0 +1,3 @@
+# Deps for Python CI scripts (unit tests + runtime)
+requests==2.33.0
+PyYAML==6.0.2
diff --git a/.buildkite/scripts/run_buildkite_scripts_tests.sh b/.buildkite/scripts/run_buildkite_scripts_tests.sh
new file mode 100755
index 00000000000..4a5e2c27b80
--- /dev/null
+++ b/.buildkite/scripts/run_buildkite_scripts_tests.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Runs tests for scripts in .buildkite/scripts/.
+# TODO: migrate to the bats framework (https://github.com/bats-core/bats-core)
+#       for better test isolation, TAP output, and native setup/teardown support.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+VENV_DIR="${REPO_ROOT}/.buildkite/.venv-ci-python-scripts"
+REQ_FILE="${REPO_ROOT}/.buildkite/scripts/requirements-ci-python-scripts.txt"
+FIND_OLDEST_SCRIPT="${REPO_ROOT}/.buildkite/scripts/find_oldest_supported_version.py"
+
+run_tests_if_exists() {
+    local script="$1"
+    if [[ ! -f "${script}" ]]; then
+        echo "Skipping ${script} (file not found)"
+        return 0
+    fi
+    "${script}"
+}
+
+echo "=== Running find_oldest_supported_version.py tests ==="
+if [[ ! -f "${VENV_DIR}/bin/activate" ]]; then
+    rm -rf "${VENV_DIR}"
+    if ! python3 -m venv "${VENV_DIR}"; then
+        echo "--- Installing python3-venv"
+        if command -v apt-get >/dev/null 2>&1; then
+            echo "python3 -m venv unavailable; installing python3-venv"
+            sudo apt-get update -q
+            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y python3-venv
+        fi
+        rm -rf "${VENV_DIR}"
+        python3 -m venv "${VENV_DIR}"
+    fi
+fi
+echo "--- Installing dependencies"
+# shellcheck source=/dev/null
+source "${VENV_DIR}/bin/activate"
+python3 -m pip install -q -r "${REQ_FILE}"
+echo "+++ Running tests"
+python3 "${FIND_OLDEST_SCRIPT}" --test
+echo "--- Deactivating venv"
+deactivate
+
+echo ""
+echo "=== Running check_changelog_entries.sh tests ==="
+run_tests_if_exists "${REPO_ROOT}/.buildkite/scripts/test_check_changelog_entries.sh"
+
+echo ""
+echo "=== Running check_backport_owners.sh tests ==="
+run_tests_if_exists "${REPO_ROOT}/.buildkite/scripts/test_check_backport_owners.sh"
+
+echo ""
+echo "=== Running trigger_backport_lib.sh tests ==="
+# yq is required by generate_trigger_pipeline(); install it if not already available.
+if ! command -v yq &>/dev/null; then
+    source "${REPO_ROOT}/.buildkite/scripts/common.sh"
+    add_bin_path
+    with_yq
+fi
+run_tests_if_exists "${REPO_ROOT}/.buildkite/scripts/test_trigger_backport.sh"
+
+echo ""
+echo "=== Running backport_branch_lib.sh tests ==="
+# test_backport_branch.sh also requires yq.
+run_tests_if_exists "${REPO_ROOT}/.buildkite/scripts/test_backport_branch.sh"
+
+echo ""
+echo "=== Running non_package_patterns tests ==="
+run_tests_if_exists "${REPO_ROOT}/.buildkite/scripts/test_non_package_patterns.sh"
diff --git a/.buildkite/scripts/run_dev_scripts_tests.sh b/.buildkite/scripts/run_dev_scripts_tests.sh
new file mode 100755
index 00000000000..86121001104
--- /dev/null
+++ b/.buildkite/scripts/run_dev_scripts_tests.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Runs tests for scripts in dev/scripts/.
+# TODO: migrate to the bats framework (https://github.com/bats-core/bats-core)
+#       for better test isolation, TAP output, and native setup/teardown support.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+
+echo "=== Running get_release_commit.sh tests ==="
+bash "${REPO_ROOT}/dev/scripts/test_get_release_commit.sh"
diff --git a/.buildkite/scripts/test_backport_branch.sh b/.buildkite/scripts/test_backport_branch.sh
new file mode 100755
index 00000000000..572e82f162e
--- /dev/null
+++ b/.buildkite/scripts/test_backport_branch.sh
@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+# Unit tests for backport_branch_lib.sh.
+# Run directly or via .buildkite/scripts/run_buildkite_scripts_tests.sh.
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+
+TMPDIR_PKGS=""
+TMPDIR_REPO=""
+TMPDIR_REPO2=""
+
+cleanup() {
+    [[ -n "${TMPDIR_PKGS}" ]] && rm -rf "${TMPDIR_PKGS}"
+    [[ -n "${TMPDIR_REPO}" ]] && rm -rf "${TMPDIR_REPO}"
+    [[ -n "${TMPDIR_REPO2}" ]] && rm -rf "${TMPDIR_REPO2}"
+}
+trap cleanup EXIT
+
+TMPDIR_PKGS="$(mktemp -d)"
+
+# Single mock controlled by MOCK_REPO_DIR. Strips the absolute prefix so the
+# output is always relative (e.g. packages/nginx_otel), matching what the real
+# list_all_directories returns in production.
+MOCK_REPO_DIR="${TMPDIR_PKGS}"
+list_all_directories() {
+    find "${MOCK_REPO_DIR}/packages" -mindepth 1 -maxdepth 1 -type d | sort | sed "s|${MOCK_REPO_DIR}/||"
+}
+
+source "${REPO_ROOT}/.buildkite/scripts/backport_branch_lib.sh"
+source "${REPO_ROOT}/.buildkite/scripts/test_helpers.sh"
+
+pass=0
+fail=0
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+make_package() {
+    local dir="${TMPDIR_PKGS}/packages/${1}"
+    mkdir -p "${dir}"
+    printf '%s\n' "${2}" > "${dir}/manifest.yml"
+}
+
+# ---------------------------------------------------------------------------
+# Tests: get_required_package_names
+# ---------------------------------------------------------------------------
+echo "--- get_required_package_names tests"
+
+# 1. No requires key at all
+make_package "pkg_plain" "name: pkg_plain"
+assert_equals "no requires key → empty output" \
+    "" \
+    "$(get_required_package_names "${TMPDIR_PKGS}/packages/pkg_plain")"
+
+# 2. requires.input only
+make_package "pkg_input_only" "$(cat <<'EOF'
+name: pkg_input_only
+requires:
+  input:
+    - package: filelog_otel
+      version: "0.2.0"
+    - package: nginx_otel_input
+      version: 0.1.0
+EOF
+)"
+assert_equals "requires.input only → two names" \
+    $'filelog_otel\nnginx_otel_input' \
+    "$(get_required_package_names "${TMPDIR_PKGS}/packages/pkg_input_only")"
+
+# 3. requires.content only
+make_package "pkg_content_only" "$(cat <<'EOF'
+name: pkg_content_only
+requires:
+  content:
+    - package: nginx_otel
+      version: 0.3.0
+EOF
+)"
+assert_equals "requires.content only → one name" \
+    "nginx_otel" \
+    "$(get_required_package_names "${TMPDIR_PKGS}/packages/pkg_content_only")"
+
+# 4. Both requires.input and requires.content
+make_package "pkg_composable" "$(cat <<'EOF'
+name: pkg_composable
+requires:
+  input:
+    - package: filelog_otel
+      version: "0.2.0"
+    - package: nginx_otel_input
+      version: 0.1.0
+  content:
+    - package: nginx_otel
+      version: 0.3.0
+EOF
+)"
+assert_equals "both input+content → three names" \
+    $'filelog_otel\nnginx_otel_input\nnginx_otel' \
+    "$(get_required_package_names "${TMPDIR_PKGS}/packages/pkg_composable")"
+
+# 5. Missing manifest file
+assert_equals "missing manifest → empty output" \
+    "" \
+    "$(get_required_package_names "${TMPDIR_PKGS}/packages/nonexistent")"
+
+# ---------------------------------------------------------------------------
+# Tests: get_package_path
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- get_package_path tests"
+
+assert_equals "finds pkg_plain by name" \
+    "packages/pkg_plain" \
+    "$(cd "${TMPDIR_PKGS}" && get_package_path "pkg_plain")"
+
+assert_equals "finds pkg_composable by name" \
+    "packages/pkg_composable" \
+    "$(cd "${TMPDIR_PKGS}" && get_package_path "pkg_composable")"
+
+exit_code=0
+(cd "${TMPDIR_PKGS}" && get_package_path "nonexistent_package") || exit_code=$?
+assert_exit_code "unknown package name returns non-zero" "1" "${exit_code}"
+
+# ---------------------------------------------------------------------------
+# Tests: remove_other_packages
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- remove_other_packages tests"
+
+TMPDIR_REPO="$(mktemp -d)"
+mkdir -p "${TMPDIR_REPO}/.github"
+mkdir -p "${TMPDIR_REPO}/packages/"{pkg_a,pkg_b,pkg_c}
+printf '/packages/pkg_a/ @team-a\n/packages/pkg_b/ @team-b\n/packages/pkg_c/ @team-c\n' \
+    > "${TMPDIR_REPO}/.github/CODEOWNERS"
+
+MOCK_REPO_DIR="${TMPDIR_REPO}"
+
+(cd "${TMPDIR_REPO}" && remove_other_packages "packages/pkg_a" "packages/pkg_b")
+
+assert_equals "pkg_a is kept" \
+    "true" "$([[ -d "${TMPDIR_REPO}/packages/pkg_a" ]] && echo true || echo false)"
+
+assert_equals "pkg_b is kept" \
+    "true" "$([[ -d "${TMPDIR_REPO}/packages/pkg_b" ]] && echo true || echo false)"
+
+assert_equals "pkg_c is removed" \
+    "true" "$([[ ! -d "${TMPDIR_REPO}/packages/pkg_c" ]] && echo true || echo false)"
+
+assert_equals "pkg_c entry removed from CODEOWNERS" \
+    "false" "$(grep -q 'pkg_c' "${TMPDIR_REPO}/.github/CODEOWNERS" && echo true || echo false)"
+
+assert_equals "pkg_a entry kept in CODEOWNERS" \
+    "true" "$(grep -q 'pkg_a' "${TMPDIR_REPO}/.github/CODEOWNERS" && echo true || echo false)"
+
+# ---------------------------------------------------------------------------
+# Tests: remove_other_packages with composable package dependencies
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- remove_other_packages with requires-based dependencies tests"
+
+# Set up a fresh repo with a composable package and its dependencies
+TMPDIR_REPO2="$(mktemp -d)"
+mkdir -p "${TMPDIR_REPO2}/.github"
+mkdir -p "${TMPDIR_REPO2}/packages/"{nginx_integration_otel,filelog_otel,nginx_otel_input,nginx_otel,unrelated_pkg}
+
+cat > "${TMPDIR_REPO2}/packages/nginx_integration_otel/manifest.yml" <<'EOF'
+name: nginx_integration_otel
+requires:
+  input:
+    - package: filelog_otel
+      version: "0.2.0"
+    - package: nginx_otel_input
+      version: 0.1.0
+  content:
+    - package: nginx_otel
+      version: 0.3.0
+EOF
+printf 'name: filelog_otel\n'     > "${TMPDIR_REPO2}/packages/filelog_otel/manifest.yml"
+printf 'name: nginx_otel_input\n' > "${TMPDIR_REPO2}/packages/nginx_otel_input/manifest.yml"
+printf 'name: nginx_otel\n'       > "${TMPDIR_REPO2}/packages/nginx_otel/manifest.yml"
+printf 'name: unrelated_pkg\n'    > "${TMPDIR_REPO2}/packages/unrelated_pkg/manifest.yml"
+
+printf '/packages/nginx_integration_otel/ @team\n/packages/filelog_otel/ @team\n/packages/nginx_otel_input/ @team\n/packages/nginx_otel/ @team\n/packages/unrelated_pkg/ @team\n' \
+    > "${TMPDIR_REPO2}/.github/CODEOWNERS"
+
+MOCK_REPO_DIR="${TMPDIR_REPO2}"
+
+# Replicate the logic from updateBackportBranchContents: resolve required package paths
+# then call remove_other_packages with the full keep list. Everything runs from
+# TMPDIR_REPO2 so relative paths (packages/<name>) resolve correctly.
+(
+    cd "${TMPDIR_REPO2}"
+    target_path="packages/nginx_integration_otel"
+    packages_to_keep=("${target_path}")
+    while IFS= read -r req_name; do
+        req_path="$(get_package_path "${req_name}" || true)"
+        [[ -n "${req_path}" ]] && packages_to_keep+=("${req_path}")
+    done < <(get_required_package_names "${target_path}")
+    remove_other_packages "${packages_to_keep[@]}"
+)
+
+assert_equals "target package nginx_integration_otel is kept" \
+    "true" "$([[ -d "${TMPDIR_REPO2}/packages/nginx_integration_otel" ]] && echo true || echo false)"
+
+assert_equals "required input package filelog_otel is kept" \
+    "true" "$([[ -d "${TMPDIR_REPO2}/packages/filelog_otel" ]] && echo true || echo false)"
+
+assert_equals "required input package nginx_otel_input is kept" \
+    "true" "$([[ -d "${TMPDIR_REPO2}/packages/nginx_otel_input" ]] && echo true || echo false)"
+
+assert_equals "required content package nginx_otel is kept" \
+    "true" "$([[ -d "${TMPDIR_REPO2}/packages/nginx_otel" ]] && echo true || echo false)"
+
+assert_equals "unrelated package is removed" \
+    "true" "$([[ ! -d "${TMPDIR_REPO2}/packages/unrelated_pkg" ]] && echo true || echo false)"
+
+assert_equals "unrelated_pkg entry removed from CODEOWNERS" \
+    "false" "$(grep -q 'unrelated_pkg' "${TMPDIR_REPO2}/.github/CODEOWNERS" && echo true || echo false)"
+
+assert_equals "nginx_integration_otel entry kept in CODEOWNERS" \
+    "true" "$(grep -q 'nginx_integration_otel' "${TMPDIR_REPO2}/.github/CODEOWNERS" && echo true || echo false)"
+
+assert_equals "filelog_otel entry kept in CODEOWNERS" \
+    "true" "$(grep -q 'filelog_otel' "${TMPDIR_REPO2}/.github/CODEOWNERS" && echo true || echo false)"
+
+assert_equals "nginx_otel_input entry kept in CODEOWNERS" \
+    "true" "$(grep -q 'nginx_otel_input' "${TMPDIR_REPO2}/.github/CODEOWNERS" && echo true || echo false)"
+
+assert_equals "nginx_otel entry kept in CODEOWNERS" \
+    "true" "$(grep -q 'nginx_otel' "${TMPDIR_REPO2}/.github/CODEOWNERS" && echo true || echo false)"
+
+rm -rf "${TMPDIR_REPO2}"
+
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Results: ${pass} passed, ${fail} failed"
+if [[ "${fail}" -gt 0 ]]; then
+    exit 1
+fi
diff --git a/.buildkite/scripts/test_check_backport_owners.sh b/.buildkite/scripts/test_check_backport_owners.sh
new file mode 100755
index 00000000000..551e8369328
--- /dev/null
+++ b/.buildkite/scripts/test_check_backport_owners.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Unit tests for check_backport_owners.sh.
+# Run directly or via .buildkite/scripts/run_buildkite_scripts_tests.sh.
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+
+# Source the script without executing main so its functions are available.
+source "${REPO_ROOT}/.buildkite/scripts/check_backport_owners.sh"
+source "${REPO_ROOT}/.buildkite/scripts/test_helpers.sh"
+
+pass=0
+fail=0
+
+# ---------------------------------------------------------------------------
+# Tests: build_owner_check_comment
+#
+# Input is the JSON array emitted by `mage CheckBackportOwners -asJSON`: one
+# object per changed package that either needs an owner sync (with a
+# pre-resolved, deduped "teams" list) or couldn't be checked (with an
+# "error" string instead). A package fully in sync with main is simply
+# absent from the array — it never appears here.
+# ---------------------------------------------------------------------------
+echo "--- build_owner_check_comment tests"
+
+assert_equals "empty array renders the in-sync confirmation" \
+    ":white_check_mark: Package owners are in sync with \`main\`." \
+    "$(build_owner_check_comment '[]')"
+
+assert_equals "single mismatch mentions the resolved team" \
+    "**Package owners are out of sync with \`main\`:**"$'\n\n'"- \`aws\` — should now be owned by @elastic/team-b" \
+    "$(build_owner_check_comment '[{"package":"aws","teams":["@elastic/team-b"]}]')"
+
+assert_equals "multiple teams for one package are joined with a comma" \
+    "**Package owners are out of sync with \`main\`:**"$'\n\n'"- \`aws\` — should now be owned by @elastic/team-a, @elastic/team-b" \
+    "$(build_owner_check_comment '[{"package":"aws","teams":["@elastic/team-a","@elastic/team-b"]}]')"
+
+assert_equals "an error entry is reported without a team mention" \
+    "**Package owners are out of sync with \`main\`:**"$'\n\n'"- \`nginx\` — could not check ownership on \`main\`: reading main manifest.yml: network error" \
+    "$(build_owner_check_comment '[{"package":"nginx","error":"reading main manifest.yml: network error"}]')"
+
+assert_equals "multiple packages render one line each, in order" \
+    "**Package owners are out of sync with \`main\`:**"$'\n\n'"- \`aws\` — should now be owned by @elastic/team-b"$'\n'"- \`nginx\` — could not check ownership on \`main\`: network error" \
+    "$(build_owner_check_comment '[{"package":"aws","teams":["@elastic/team-b"]},{"package":"nginx","error":"network error"}]')"
+
+# ---------------------------------------------------------------------------
+# Tests: build_owner_check_failure_comment
+#
+# Rendered instead of build_owner_check_comment when the check itself failed
+# to run entirely (e.g. mage checkBackportOwners exited non-zero) — a
+# distinct state from "no mismatches found", so it must never look like the
+# in-sync confirmation.
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- build_owner_check_failure_comment tests"
+
+assert_equals "with a build URL, includes a link to it" \
+    ":warning: The backport owner check failed to run — it could not determine whether package owners are in sync with \`main\`."$'\n\n'"See the [build log](https://buildkite.example/builds/123) for details." \
+    "$(build_owner_check_failure_comment "https://buildkite.example/builds/123")"
+
+assert_equals "with no build URL, omits the link section" \
+    ":warning: The backport owner check failed to run — it could not determine whether package owners are in sync with \`main\`." \
+    "$(build_owner_check_failure_comment "")"
+
+assert_equals "with no argument at all, omits the link section" \
+    ":warning: The backport owner check failed to run — it could not determine whether package owners are in sync with \`main\`." \
+    "$(build_owner_check_failure_comment)"
+
+echo ""
+echo "--- Results: ${pass} passed, ${fail} failed"
+if [[ "${fail}" -gt 0 ]]; then
+    exit 1
+fi
diff --git a/.buildkite/scripts/test_check_changelog_entries.sh b/.buildkite/scripts/test_check_changelog_entries.sh
new file mode 100755
index 00000000000..99f80901222
--- /dev/null
+++ b/.buildkite/scripts/test_check_changelog_entries.sh
@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+# Unit tests for check_changelog_entries.sh.
+# Run directly or via .buildkite/scripts/run_buildkite_scripts_tests.sh.
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+
+# Source the script without executing main so its functions are available.
+source "${REPO_ROOT}/.buildkite/scripts/check_changelog_entries.sh"
+source "${REPO_ROOT}/.buildkite/scripts/test_helpers.sh"
+
+pass=0
+fail=0
+
+# ---------------------------------------------------------------------------
+# Helpers: set up / tear down a minimal git repo that mimics a PR diff.
+#
+# The repo has a base commit followed by a second commit that adds a new
+# changelog entry — the second commit is what tests diff against.
+# ---------------------------------------------------------------------------
+
+DUMMY_REPO=""
+
+cleanup() {
+    [[ -n "${DUMMY_REPO}" ]] && rm -rf "${DUMMY_REPO}"
+}
+trap cleanup EXIT
+
+setup_dummy_repo() {
+    local tmpdir
+    tmpdir="$(mktemp -d)"
+    git -C "${tmpdir}" init -q
+    git -C "${tmpdir}" config user.email "test@test.com"
+    git -C "${tmpdir}" config user.name "Test"
+
+    # Base commit: existing changelog entry
+    mkdir -p "${tmpdir}/packages/test_pkg"
+    cat > "${tmpdir}/packages/test_pkg/changelog.yml" << 'EOF'
+# newer versions go on top
+- version: "1.0.0"
+  changes:
+    - description: Initial release.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/100
+EOF
+    git -C "${tmpdir}" add .
+    git -C "${tmpdir}" commit -q -m "Initial release"
+
+    echo "${tmpdir}"
+}
+
+add_changelog_entry() {
+    local repo="$1"
+    local changelog_file="$2"
+    local link="$3"
+
+    # Prepend the new entry on top of the existing file
+    local tmp
+    tmp="$(mktemp)"
+    cat > "${tmp}" << EOF
+# newer versions go on top
+- version: "1.1.0"
+  changes:
+    - description: New feature.
+      type: enhancement
+      link: ${link}
+EOF
+    # Keep existing entries below
+    grep -v '^# newer' "${repo}/${changelog_file}" >> "${tmp}" || true
+    mv "${tmp}" "${repo}/${changelog_file}"
+
+    git -C "${repo}" add "${changelog_file}"
+    git -C "${repo}" commit -q -m "Add changelog entry"
+}
+
+# ---------------------------------------------------------------------------
+# Tests: github_repo_path
+# ---------------------------------------------------------------------------
+echo "--- github_repo_path tests"
+
+assert_equals "parses SSH remote URL" \
+    "elastic/integrations" \
+    "$(github_repo_path "git@github.com:elastic/integrations.git")"
+
+assert_equals "parses HTTPS remote URL with .git suffix" \
+    "elastic/integrations" \
+    "$(github_repo_path "https://github.com/elastic/integrations.git")"
+
+assert_equals "parses HTTPS remote URL without .git suffix" \
+    "elastic/integrations" \
+    "$(github_repo_path "https://github.com/elastic/integrations")"
+
+assert_equals "preserves org name" \
+    "my-org/my-repo" \
+    "$(github_repo_path "git@github.com:my-org/my-repo.git")"
+
+# ---------------------------------------------------------------------------
+# Tests: check_changelog_file
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- check_changelog_file tests"
+
+DUMMY_REPO="$(setup_dummy_repo)"
+CHANGELOG="packages/test_pkg/changelog.yml"
+EXPECTED_LINK="https://github.com/elastic/integrations/pull/999"
+
+# Correct PR link
+add_changelog_entry "${DUMMY_REPO}" "${CHANGELOG}" "${EXPECTED_LINK}"
+BASE_REF="HEAD~1"
+exit_code=0
+(cd "${DUMMY_REPO}" && check_changelog_file "${BASE_REF}" "${CHANGELOG}" "${EXPECTED_LINK}") || exit_code=$?
+assert_exit_code "correct PR link returns 0" "0" "${exit_code}"
+
+# Wrong PR link
+add_changelog_entry "${DUMMY_REPO}" "${CHANGELOG}" "https://github.com/elastic/integrations/pull/000"
+BASE_REF="HEAD~1"
+exit_code=0
+(cd "${DUMMY_REPO}" && check_changelog_file "${BASE_REF}" "${CHANGELOG}" "${EXPECTED_LINK}") || exit_code=$?
+assert_exit_code "wrong PR link returns non-zero" "1" "${exit_code}"
+
+# Issue link is accepted
+add_changelog_entry "${DUMMY_REPO}" "${CHANGELOG}" "https://github.com/elastic/integrations/issues/42"
+BASE_REF="HEAD~1"
+exit_code=0
+(cd "${DUMMY_REPO}" && check_changelog_file "${BASE_REF}" "${CHANGELOG}" "${EXPECTED_LINK}") || exit_code=$?
+assert_exit_code "issue link returns 0" "0" "${exit_code}"
+
+# No new link entries (changelog unchanged since base)
+exit_code=0
+(cd "${DUMMY_REPO}" && check_changelog_file "HEAD" "${CHANGELOG}" "${EXPECTED_LINK}") || exit_code=$?
+assert_exit_code "no added links returns 0" "0" "${exit_code}"
+
+# Deleted file is skipped
+exit_code=0
+(cd "${DUMMY_REPO}" && check_changelog_file "HEAD~1" "packages/nonexistent/changelog.yml" "${EXPECTED_LINK}") || exit_code=$?
+assert_exit_code "deleted/missing file returns 0" "0" "${exit_code}"
+
+# Multiple wrong links accumulate errors
+add_changelog_entry "${DUMMY_REPO}" "${CHANGELOG}" "https://github.com/elastic/integrations/pull/111"
+add_changelog_entry "${DUMMY_REPO}" "${CHANGELOG}" "https://github.com/elastic/integrations/pull/222"
+BASE_REF="HEAD~2"
+exit_code=0
+(cd "${DUMMY_REPO}" && check_changelog_file "${BASE_REF}" "${CHANGELOG}" "${EXPECTED_LINK}") || exit_code=$?
+assert_exit_code "two wrong links returns 2" "2" "${exit_code}"
+
+# ---------------------------------------------------------------------------
+# Tests: get_pr_mention
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- get_pr_mention tests"
+
+assert_equals "empty user returns empty string" \
+    "" \
+    "$(get_pr_mention "")"
+
+assert_equals "regular user returns mention" \
+    $'\n'"@johndoe" \
+    "$(get_pr_mention "johndoe")"
+
+assert_equals "github-actions[bot] returns elastic/ecosystem mention" \
+    $'\n'"@elastic/ecosystem" \
+    "$(get_pr_mention "github-actions[bot]")"
+
+assert_equals "no argument returns empty string" \
+    "" \
+    "$(get_pr_mention)"
+
+# ---------------------------------------------------------------------------
+# Tests: should_skip_changelog_check
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- should_skip_changelog_check tests"
+
+exit_code=0
+should_skip_changelog_check "changelog-link-check:skip" || exit_code=$?
+assert_exit_code "exact label returns 0" "0" "${exit_code}"
+
+exit_code=0
+should_skip_changelog_check "foo,changelog-link-check:skip,bar" || exit_code=$?
+assert_exit_code "label in comma-separated list returns 0" "0" "${exit_code}"
+
+exit_code=0
+should_skip_changelog_check "skip-changelog" && exit_code=0 || exit_code=$?
+assert_exit_code "wrong label 'skip-changelog' returns non-zero" "1" "${exit_code}"
+
+exit_code=0
+should_skip_changelog_check "" && exit_code=0 || exit_code=$?
+assert_exit_code "empty labels returns non-zero" "1" "${exit_code}"
+
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Results: ${pass} passed, ${fail} failed"
+if [[ "${fail}" -gt 0 ]]; then
+    exit 1
+fi
diff --git a/.buildkite/scripts/test_helpers.sh b/.buildkite/scripts/test_helpers.sh
new file mode 100644
index 00000000000..b1e0a49764e
--- /dev/null
+++ b/.buildkite/scripts/test_helpers.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Shared assert helpers for shell unit tests.
+# Source this file — do not execute it directly.
+
+assert_equals() {
+    local description="$1"
+    local expected="$2"
+    local actual="$3"
+    if [[ "${actual}" == "${expected}" ]]; then
+        echo "PASS: ${description}"
+        (( pass++ )) || true
+    else
+        echo "FAIL: ${description} — expected '${expected}', got '${actual}'"
+        (( fail++ )) || true
+    fi
+}
+
+assert_exit_code() {
+    local description="$1"
+    local expected="$2"
+    local actual="$3"
+    if [[ "${actual}" == "${expected}" ]]; then
+        echo "PASS: ${description}"
+        (( pass++ )) || true
+    else
+        echo "FAIL: ${description} — expected exit code '${expected}', got '${actual}'"
+        (( fail++ )) || true
+    fi
+}
+
+assert_file_contains() {
+    local description="$1"
+    local needle="$2"
+    local file="$3"
+    if grep -qF "${needle}" "${file}" 2>/dev/null; then
+        echo "PASS: ${description}"
+        (( pass++ )) || true
+    else
+        echo "FAIL: ${description} — '${needle}' not found in ${file}"
+        (( fail++ )) || true
+    fi
+}
+
+assert_file_not_contains() {
+    local description="$1"
+    local needle="$2"
+    local file="$3"
+    if ! grep -qF "${needle}" "${file}" 2>/dev/null; then
+        echo "PASS: ${description}"
+        (( pass++ )) || true
+    else
+        echo "FAIL: ${description} — '${needle}' unexpectedly found in ${file}"
+        (( fail++ )) || true
+    fi
+}
diff --git a/.buildkite/scripts/test_integrations_with_serverless.sh b/.buildkite/scripts/test_integrations_with_serverless.sh
index a87ba5be21f..8d2bedbba17 100755
--- a/.buildkite/scripts/test_integrations_with_serverless.sh
+++ b/.buildkite/scripts/test_integrations_with_serverless.sh
@@ -22,7 +22,7 @@ if running_on_buildkite; then
 fi
 
 SERVERLESS_PROJECT=${SERVERLESS_PROJECT:-"observability"}
-echo "Running packages on Serverles project type: ${SERVERLESS_PROJECT}"
+echo "Running packages on Serverless project type: ${SERVERLESS_PROJECT}"
 if running_on_buildkite; then
     buildkite-agent annotate "Serverless Project: ${SERVERLESS_PROJECT}" --context "ctx-info-${SERVERLESS_PROJECT}" --style "info"
 fi
@@ -64,48 +64,31 @@ echo "Done."
 echo "--- Get from and to changesets"
 from="$(get_from_changeset)"
 if [[ "${from}" == "" ]]; then
-    echo "Missing \"from\" changset".
+    echo "Missing \"from\" changeset".
     exit 1
 fi
 to="$(get_to_changeset)"
 if [[ "${to}" == "" ]]; then
-    echo "Missing \"to\" changset".
+    echo "Missing \"to\" changeset".
     exit 1
 fi
 echo "Checking with commits: from: '${from}' to: '${to}'"
 
 any_package_failing=0
 
-pushd packages > /dev/null
-for package in $(list_all_directories); do
-    echo "--- [$package] check if it is required to be tested"
-    pushd "${package}" > /dev/null
-    skip_package=false
-    failure=false
-    if ! reason=$(is_pr_affected "${package}" "${from}" "${to}") ; then
-        skip_package=true
-        if [[ "${reason}" == "${FATAL_ERROR}" ]]; then
-            failure=true
-        fi
-    fi
-    popd > /dev/null
-    if [[ "${failure}" == "true" ]]; then
-        echo "Unexpected failure checking ${package}"
-        exit 1
-    fi
-
-    echo "${reason}"
-
-    if [[ "${skip_package}" == "true" ]]; then
-        echo "- ${reason}" >> "${SKIPPED_PACKAGES_FILE_PATH}"
+echo "--- List all directories"
+PACKAGE_LIST=$(list_all_directories)
+for package_path in ${PACKAGE_LIST}; do
+    echo "--- [$package_path] check if it is required to be tested"
+    if ! should_test_package "${package_path}" "${from}" "${to}"; then
+        echo "- ${package_path}" >> "${SKIPPED_PACKAGES_FILE_PATH}"
         continue
     fi
 
-    if ! process_package "${package}" "${FAILED_PACKAGES_FILE_PATH}" ; then
+    if ! process_package "${package_path}" "${FAILED_PACKAGES_FILE_PATH}" ; then
         any_package_failing=1
     fi
 done
-popd > /dev/null
 
 if running_on_buildkite ; then
     if [ -f "${SKIPPED_PACKAGES_FILE_PATH}" ]; then
diff --git a/.buildkite/scripts/test_non_package_patterns.sh b/.buildkite/scripts/test_non_package_patterns.sh
new file mode 100755
index 00000000000..9487d0616cc
--- /dev/null
+++ b/.buildkite/scripts/test_non_package_patterns.sh
@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+# Unit tests for pr_has_package_related_files() in common.sh.
+# Run directly (from repo root) or via run_buildkite_scripts_tests.sh.
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+# shellcheck source=.buildkite/scripts/common.sh
+source "${REPO_ROOT}/.buildkite/scripts/common.sh"
+source "${REPO_ROOT}/.buildkite/scripts/test_helpers.sh"
+
+pass=0
+fail=0
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+# Wraps pr_has_package_related_files for a single path.
+# Returns 0 if the path would trigger package tests, 1 if it would not.
+path_triggers_tests() {
+    printf '%s\n' "$1" | pr_has_package_related_files
+}
+
+# ---------------------------------------------------------------------------
+# Paths covered by non_package_patterns: must NOT trigger tests
+# ---------------------------------------------------------------------------
+echo "--- pr_has_package_related_files: non-package paths do NOT trigger tests"
+
+NON_PACKAGE_PATHS=(
+    "packages/aws/manifest.yml"
+    "packages/nginx/changelog.yml"
+    ".agents/skills/some_skill.yml"
+    ".backports.yml"
+    ".buildkite/pipeline.backport.yml"
+    ".buildkite/pipeline.publish.yml"
+    ".buildkite/pipeline.schedule-daily.yml"
+    ".buildkite/pipeline.schedule-weekly.yml"
+    ".buildkite/pipeline.serverless.yml"
+    ".buildkite/pull-requests.json"
+    ".buildkite/scripts/backport_branch.sh"
+    ".buildkite/scripts/backport_branch_lib.sh"
+    ".buildkite/scripts/check_backports_inventory.sh"
+    ".buildkite/scripts/notify_backport_pr.sh"
+    ".buildkite/scripts/trigger_backport.sh"
+    ".buildkite/scripts/trigger_backport_lib.sh"
+    ".buildkite/scripts/build_packages.sh"
+    ".buildkite/scripts/check_backport_owners.sh"
+    ".buildkite/scripts/check_changelog_entries.sh"
+    ".buildkite/scripts/packages/aws.sh"
+    ".buildkite/scripts/packages/nginx.sh"
+    ".buildkite/scripts/requirements-ci-python-scripts.txt"
+    ".buildkite/scripts/run_buildkite_scripts_tests.sh"
+    ".buildkite/scripts/run_dev_scripts_tests.sh"
+    ".buildkite/scripts/test_backport_branch.sh"
+    ".buildkite/scripts/test_check_backport_owners.sh"
+    ".buildkite/scripts/test_check_changelog_entries.sh"
+    ".buildkite/scripts/test_helpers.sh"
+    ".buildkite/scripts/test_non_package_patterns.sh"
+    ".buildkite/scripts/test_trigger_backport.sh"
+    ".github/dependabot.yml"
+    ".github/stale.yml"
+    ".github/workflows/test.yml"
+    ".github/CODEOWNERS"
+    ".github/ISSUE_TEMPLATE/bug_report.md"
+    ".github/PULL_REQUEST_TEMPLATE.md"
+    ".gitignore"
+    ".mergify.yml"
+    "catalog-info.yaml"
+    "dev/backports/some_script.sh"
+    "dev/codeowners/codeowners.go"
+    "dev/gitutil/git.go"
+    "dev/requiresupdate/requiresupdate.go"
+    "dev/scripts/foo.sh"
+    "docs/extend/developer-workflow.md"
+    "docs/some/nested/page.md"
+    "CODE_OF_CONDUCT.md"
+    "CONTRIBUTING.md"
+    "README.md"
+)
+
+for path in "${NON_PACKAGE_PATHS[@]}"; do
+    exit_code=0
+    path_triggers_tests "${path}" && exit_code=0 || exit_code=$?
+    assert_exit_code "only '${path}' changed → tests NOT triggered" "1" "${exit_code}"
+done
+
+# ---------------------------------------------------------------------------
+# Paths NOT covered by non_package_patterns: must trigger tests
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- pr_has_package_related_files: infra-file changes DO trigger tests"
+
+TRIGGERING_PATHS=(
+    ".buildkite/scripts/common.sh"
+    ".buildkite/pipeline.yml"
+    "Makefile"
+    ".buildkite/scripts/build_packages_serverless.sh"
+)
+
+for path in "${TRIGGERING_PATHS[@]}"; do
+    exit_code=0
+    path_triggers_tests "${path}" || exit_code=$?
+    assert_exit_code "change to '${path}' → tests triggered" "0" "${exit_code}"
+done
+
+# ---------------------------------------------------------------------------
+# Mixed changeset: one triggering file among non-package files → still triggers
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- pr_has_package_related_files: mixed changesets are classified correctly"
+
+exit_code=0
+printf '%s\n' "README.md" ".buildkite/pipeline.yml" "docs/foo.md" \
+    | pr_has_package_related_files || exit_code=$?
+assert_exit_code "non-package + pipeline.yml → tests triggered" "0" "${exit_code}"
+
+exit_code=0
+printf '%s\n' "README.md" "docs/foo.md" ".github/workflows/ci.yml" \
+    | pr_has_package_related_files && exit_code=0 || exit_code=$?
+assert_exit_code "only non-package files → tests NOT triggered" "1" "${exit_code}"
+
+# ---------------------------------------------------------------------------
+# Anchoring: patterns are anchored at ^ so a prefix must not cause false matches
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- pr_has_package_related_files: ^ anchoring prevents false positives"
+
+ANCHORING_CASES=(
+    "vendor/docs/foo.md"           # must not match 'docs/'
+    "my_packages/aws/manifest.yml" # must not match 'packages/'
+    "not_readme/README.md"         # must not match 'README\.md' mid-path
+)
+
+for path in "${ANCHORING_CASES[@]}"; do
+    exit_code=0
+    path_triggers_tests "${path}" || exit_code=$?
+    assert_exit_code "'^'-anchored pattern does not match '${path}'" "0" "${exit_code}"
+done
+
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Results: ${pass} passed, ${fail} failed"
+if [[ "${fail}" -gt 0 ]]; then
+    exit 1
+fi
diff --git a/.buildkite/scripts/test_one_package.sh b/.buildkite/scripts/test_one_package.sh
index 58cffaa4921..1e7e7d4731c 100755
--- a/.buildkite/scripts/test_one_package.sh
+++ b/.buildkite/scripts/test_one_package.sh
@@ -4,8 +4,9 @@ source .buildkite/scripts/common.sh
 
 set -euo pipefail
 
-# package name
-package="$1"
+# package path
+package_path="$1"
+package_name="$(basename "${package_path}")"
 
 if [ ! -d packages ]; then
     echo "Missing packages folder"
@@ -25,23 +26,21 @@ with_kubernetes
 
 use_elastic_package
 
-pushd packages > /dev/null
 exit_code=0
-if ! process_package "${package}" ; then
+if ! process_package "${package_path}" ; then
     # keep this message as a collapsed group in Buildkite, so it
     # is not hidden by the previous collapsed group.
-    echo "--- [${package}] failed"
+    echo "--- [${package_name}] failed"
     exit_code=1
 fi
-popd > /dev/null
 
 if [ "${exit_code}" -ne 0 ] ; then
   exit "${exit_code}"
 fi
 
-custom_package_checker_script_path="${SCRIPTS_BUILDKITE_PATH}/packages/${package}.sh"
+custom_package_checker_script_path="${SCRIPTS_BUILDKITE_PATH}/${package_path}.sh"
 
 if [ -x "$custom_package_checker_script_path" ]; then
-  echo "--- [${package}] Run individual package checker"
+  echo "--- [${package_name}] Run individual package checker"
   "$custom_package_checker_script_path"
-fi
\ No newline at end of file
+fi
diff --git a/.buildkite/scripts/test_trigger_backport.sh b/.buildkite/scripts/test_trigger_backport.sh
new file mode 100755
index 00000000000..ca85ba7c3f3
--- /dev/null
+++ b/.buildkite/scripts/test_trigger_backport.sh
@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+# Unit tests for generate_trigger_pipeline() from trigger_backport_lib.sh.
+# Run directly or via .buildkite/scripts/run_buildkite_scripts_tests.sh.
+#
+# Requires: yq (installed via with_yq in CI; must be available locally too).
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+
+source "${REPO_ROOT}/.buildkite/scripts/trigger_backport_lib.sh"
+source "${REPO_ROOT}/.buildkite/scripts/test_helpers.sh"
+
+pass=0
+fail=0
+
+# ---------------------------------------------------------------------------
+# Mock: mage — per-target exit code control.
+#   MOCK_MAGE_VALIDATE_EXIT controls ValidateBackportsInventory (default 0 = pass)
+#   MOCK_MAGE_CHECK_EXIT    controls CheckBackportBranchActive  (default 0 = active,
+#                                                                        1 = inactive,
+#                                                                        2 = error)
+# ---------------------------------------------------------------------------
+mage() {
+    case "$1" in
+        ValidateBackportsInventory) return "${MOCK_MAGE_VALIDATE_EXIT:-0}" ;;
+        CheckBackportBranchActive)  return "${MOCK_MAGE_CHECK_EXIT:-0}" ;;
+    esac
+}
+MOCK_MAGE_VALIDATE_EXIT=0
+MOCK_MAGE_CHECK_EXIT=0
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+WORK_DIR=""
+cleanup() {
+    [[ -n "${WORK_DIR}" ]] && rm -rf "${WORK_DIR}"
+}
+trap cleanup EXIT
+WORK_DIR="$(mktemp -d)"
+
+# Write a .backports.yml with one or more entries.
+# Each entry requires exactly 5 args: branch pkg base_version base_commit archived
+# Usage: write_inventory <file> <branch> <pkg> <base_version> <base_commit> <archived> ...
+write_inventory() {
+    local file="$1"; shift
+    printf 'backports:\n' > "${file}"
+    while [[ $# -ge 5 ]]; do
+        local branch="$1" pkg="$2" base_version="$3" base_commit="$4" archived="$5"
+        cat >> "${file}" <<EOF
+  - package: ${pkg}
+    branch: ${branch}
+    base_version: "${base_version}"
+    base_commit: "${base_commit}"
+    maintained_until: null
+    archived: ${archived}
+EOF
+        shift 5
+    done
+}
+
+# Run generate_trigger_pipeline into a fresh output file.
+# Usage: run_generate <old> <new> <dry_run> <pr_number> <out_file> [buildkite_pr] [buildkite_commit]
+run_generate() {
+    local old="$1" new="$2" dry_run="$3" pr_number="$4" out="$5" buildkite_pr="${6:-}" buildkite_commit="${7:-}"
+    : > "${out}"
+    local exit_code=0
+    generate_trigger_pipeline "${old}" "${new}" "${dry_run}" "${pr_number}" "${out}" "${buildkite_pr}" "${buildkite_commit}" || exit_code=$?
+    assert_exit_code "generate_trigger_pipeline exits 0" "0" "${exit_code}"
+}
+
+OLD="${WORK_DIR}/old.yml"
+NEW="${WORK_DIR}/new.yml"
+OUT="${WORK_DIR}/pipeline.yml"
+
+# ---------------------------------------------------------------------------
+# Test: new entry in dry-run mode
+# ---------------------------------------------------------------------------
+echo "--- new entry — dry-run mode"
+
+write_inventory "${OLD}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false"
+write_inventory "${NEW}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false" \
+    "backport-aws-2.0"  "aws" "2.0.0"  "def456" "false"
+
+run_generate "${OLD}" "${NEW}" "true" "" "${OUT}"
+
+assert_file_contains     "dry-run: step header present"           "steps:"                                   "${OUT}"
+assert_file_contains     "dry-run: label is Backport dry-run"    'Backport dry-run: backport-aws-2.0'       "${OUT}"
+assert_file_contains     "dry-run: DRY_RUN is true"              'DRY_RUN: "true"'                          "${OUT}"
+assert_file_contains     "dry-run: PACKAGE_NAME correct"         'PACKAGE_NAME: "aws"'                      "${OUT}"
+assert_file_contains     "dry-run: PACKAGE_VERSION correct"      'PACKAGE_VERSION: "2.0.0"'                 "${OUT}"
+assert_file_contains     "dry-run: BASE_COMMIT correct"          'BASE_COMMIT: "def456"'                    "${OUT}"
+assert_file_contains     "dry-run: BACKPORT_BRANCH_NAME correct" 'BACKPORT_BRANCH_NAME: "backport-aws-2.0"' "${OUT}"
+assert_file_not_contains "dry-run: PR_NUMBER absent when empty"  "PR_NUMBER"                                "${OUT}"
+
+# ---------------------------------------------------------------------------
+# Test: new entry in create mode
+# ---------------------------------------------------------------------------
+echo "--- new entry — create mode"
+
+run_generate "${OLD}" "${NEW}" "false" "" "${OUT}"
+
+assert_file_contains "create: label is Backport create" 'Backport create: backport-aws-2.0' "${OUT}"
+assert_file_contains "create: DRY_RUN is false"         'DRY_RUN: "false"'                  "${OUT}"
+
+# ---------------------------------------------------------------------------
+# Test: PR_NUMBER included when provided, omitted when empty
+# ---------------------------------------------------------------------------
+echo "--- PR_NUMBER"
+
+run_generate "${OLD}" "${NEW}" "false" "9999" "${OUT}"
+assert_file_contains     "PR_NUMBER included when set"  'PR_NUMBER: "9999"' "${OUT}"
+
+run_generate "${OLD}" "${NEW}" "false" "" "${OUT}"
+assert_file_not_contains "PR_NUMBER omitted when empty" "PR_NUMBER"         "${OUT}"
+
+# ---------------------------------------------------------------------------
+# Test: existing entry is skipped
+# ---------------------------------------------------------------------------
+echo "--- existing entry skipped"
+
+write_inventory "${OLD}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false"
+write_inventory "${NEW}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false"
+
+run_generate "${OLD}" "${NEW}" "true" "" "${OUT}"
+assert_equals "existing entry: no steps generated" "" "$(cat "${OUT}")"
+
+# ---------------------------------------------------------------------------
+# Test: inactive entry (mage returns 1) is skipped
+# ---------------------------------------------------------------------------
+echo "--- inactive entry skipped"
+
+write_inventory "${OLD}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false"
+write_inventory "${NEW}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false" \
+    "backport-aws-2.0"  "aws" "2.0.0"  "def456" "true"
+
+MOCK_MAGE_CHECK_EXIT=1
+run_generate "${OLD}" "${NEW}" "true" "" "${OUT}"
+MOCK_MAGE_CHECK_EXIT=0
+
+assert_equals "inactive entry: no steps generated" "" "$(cat "${OUT}")"
+
+# ---------------------------------------------------------------------------
+# Test: mage error (exit code 2) causes function to return non-zero
+# ---------------------------------------------------------------------------
+echo "--- mage error propagated"
+
+write_inventory "${OLD}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false"
+write_inventory "${NEW}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false" \
+    "backport-aws-2.0"  "aws" "2.0.0"  "def456" "false"
+
+MOCK_MAGE_CHECK_EXIT=2
+err_exit=0
+: > "${OUT}"
+generate_trigger_pipeline "${OLD}" "${NEW}" "true" "" "${OUT}" "" "" || err_exit=$?
+MOCK_MAGE_CHECK_EXIT=0
+
+assert_exit_code "mage error: non-zero exit returned" "1" "${err_exit}"
+
+# ---------------------------------------------------------------------------
+# Test: ValidateBackportsInventory failure causes function to return non-zero
+# ---------------------------------------------------------------------------
+echo "--- validate inventory failure returns non-zero"
+
+write_inventory "${OLD}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false"
+write_inventory "${NEW}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false" \
+    "backport-aws-2.0"  "aws" "2.0.0"  "def456" "false"
+
+MOCK_MAGE_VALIDATE_EXIT=1
+val_exit=0
+: > "${OUT}"
+generate_trigger_pipeline "${OLD}" "${NEW}" "true" "" "${OUT}" "" "" || val_exit=$?
+MOCK_MAGE_VALIDATE_EXIT=0
+
+assert_exit_code "validate failure: non-zero exit returned" "1" "${val_exit}"
+
+# ---------------------------------------------------------------------------
+# Test: multiple new entries all appear in pipeline
+# ---------------------------------------------------------------------------
+echo "--- multiple new entries"
+
+write_inventory "${OLD}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false"
+write_inventory "${NEW}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false" \
+    "backport-aws-2.0"  "aws" "2.0.0"  "def456" "false" \
+    "backport-gcp-1.5"  "gcp" "1.5.0"  "ghi789" "false"
+
+run_generate "${OLD}" "${NEW}" "true" "" "${OUT}"
+
+assert_file_contains "multiple: aws step present" "backport-aws-2.0" "${OUT}"
+assert_file_contains "multiple: gcp step present" "backport-gcp-1.5" "${OUT}"
+
+# ---------------------------------------------------------------------------
+# Test: invalid old inventory returns non-zero
+# ---------------------------------------------------------------------------
+echo "--- invalid inventory"
+
+echo "not: yaml: backports" > "${OLD}"
+write_inventory "${NEW}" \
+    "backport-aws-2.0" "aws" "2.0.0" "def456" "false"
+
+inv_exit=0
+: > "${OUT}"
+generate_trigger_pipeline "${OLD}" "${NEW}" "true" "" "${OUT}" "" "" || inv_exit=$?
+
+assert_exit_code "invalid old inventory: non-zero exit" "1" "${inv_exit}"
+
+# ---------------------------------------------------------------------------
+# Test: PR build — BUILDKITE_PULL_REQUEST and BUILDKITE_COMMIT written as comments
+# ---------------------------------------------------------------------------
+echo "--- PR build: buildkite_pr and buildkite_commit written as comments"
+
+write_inventory "${OLD}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false"
+write_inventory "${NEW}" \
+    "backport-aws-1.19" "aws" "1.19.5" "abc123" "false" \
+    "backport-aws-2.0"  "aws" "2.0.0"  "def456" "false"
+
+run_generate "${OLD}" "${NEW}" "false" "" "${OUT}" "42" "sha1234"
+
+assert_file_contains     "pr build: BUILDKITE_REFSPEC comment written" \
+    '# BUILDKITE_REFSPEC: "refs/pull/42/head"'  "${OUT}"
+assert_file_contains     "pr build: BUILDKITE_COMMIT comment written" \
+    '# BUILDKITE_COMMIT: "sha1234"'             "${OUT}"
+
+run_generate "${OLD}" "${NEW}" "false" "" "${OUT}" "false" ""
+
+assert_file_not_contains "non-pr build: BUILDKITE_REFSPEC comment absent" \
+    "BUILDKITE_REFSPEC"                         "${OUT}"
+assert_file_not_contains "non-pr build: BUILDKITE_COMMIT comment absent" \
+    "BUILDKITE_COMMIT"                          "${OUT}"
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "Results: ${pass} passed, ${fail} failed"
+if [[ "${fail}" -gt 0 ]]; then
+    exit 1
+fi
diff --git a/.buildkite/scripts/trigger_backport.sh b/.buildkite/scripts/trigger_backport.sh
new file mode 100755
index 00000000000..d18f209a154
--- /dev/null
+++ b/.buildkite/scripts/trigger_backport.sh
@@ -0,0 +1,107 @@
+#!/bin/bash
+# Triggers the integrations-backport pipeline when .backports.yml changes.
+# In PR builds: validates new entries via a dry run against the base branch.
+# On push to main: creates backport branches for new entries.
+
+source .buildkite/scripts/common.sh
+source .buildkite/scripts/trigger_backport_lib.sh
+
+set -euo pipefail
+
+main() {
+    add_bin_path
+    with_yq
+    with_mage
+
+    local dry_run old_inventory_ref diff_from diff_to pr_number="" label
+    local new_entry_msg new_entry_hint
+
+    if [[ "${BUILDKITE_PULL_REQUEST}" != "false" ]]; then
+        if [[ "${BUILDKITE_PULL_REQUEST_BASE_BRANCH}" != "main" ]]; then
+            echo "Pull request does not target main (base branch: ${BUILDKITE_PULL_REQUEST_BASE_BRANCH}), skipping"
+            exit 0
+        fi
+        dry_run="true"
+        label="dry-run"
+        local from to
+        from="$(get_from_changeset)"
+        to="$(get_to_changeset)"
+        diff_from="$(git merge-base "${from}" "${to}")"
+        diff_to="${to}"
+        old_inventory_ref="origin/${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
+        new_entry_msg="skipping dry-runs for initial entries"
+        new_entry_hint="To validate new entries, add them in a follow-up PR after this one merges."
+    else
+        if [[ "${BUILDKITE_BRANCH}" != "main" ]]; then
+            echo "Not on main branch (branch: ${BUILDKITE_BRANCH}), skipping"
+            exit 0
+        fi
+        if [[ "${BUILDKITE_PIPELINE_SLUG}" != "integrations-backport-dispatch" ]]; then
+            echo "Backport branch creation can only run from the 'integrations-backport-dispatch' pipeline (got: ${BUILDKITE_PIPELINE_SLUG})"
+            exit 1
+        fi
+        dry_run="false"
+        label="create"
+        diff_from="HEAD^"
+        diff_to="HEAD"
+        old_inventory_ref="HEAD^"
+        new_entry_msg="skipping create for initial entries"
+        new_entry_hint="To create branches for these entries, trigger the integrations-backport pipeline manually."
+    fi
+
+    backports_yml_changed_exit=0
+    backports_yml_changed "${diff_from}" "${diff_to}" || backports_yml_changed_exit=$?
+    if [[ "${backports_yml_changed_exit}" -eq 2 ]]; then
+        exit 1
+    fi
+    if [[ "${backports_yml_changed_exit}" -ne 0 ]]; then
+        echo ".backports.yml not changed, skipping backport ${label} trigger"
+        exit 0
+    fi
+
+    echo "--- .backports.yml changed — finding new entries"
+
+    if [[ "${BUILDKITE_PULL_REQUEST}" == "false" ]]; then
+        with_github_cli
+        pr_number="$(retry 3 resolve_pr_number "${BUILDKITE_COMMIT}")" || {
+            echo "Warning: could not resolve PR number after retries, PR comments will be skipped" >&2
+        }
+    fi
+
+    OLD_INVENTORY=""
+    PIPELINE_FILE=""
+
+    cleanup() {
+        local exit_code=$?
+        [[ -n "${OLD_INVENTORY}" ]] && rm -f "${OLD_INVENTORY}"
+        [[ -n "${PIPELINE_FILE}" ]] && rm -f "${PIPELINE_FILE}"
+        exit "${exit_code}"
+    }
+    trap cleanup EXIT
+
+    OLD_INVENTORY="$(mktemp)"
+    NEW_INVENTORY=".backports.yml"
+
+    if ! load_old_backports_inventory "${old_inventory_ref}" "${OLD_INVENTORY}"; then
+        echo ".backports.yml is new — ${new_entry_msg}"
+        echo "${new_entry_hint}"
+        exit 0
+    fi
+
+    PIPELINE_FILE="$(mktemp --suffix=.yml)"
+
+    generate_trigger_pipeline "${OLD_INVENTORY}" "${NEW_INVENTORY}" "${dry_run}" "${pr_number}" "${PIPELINE_FILE}" "${BUILDKITE_PULL_REQUEST:-false}" "${BUILDKITE_COMMIT:-}"
+
+    if [[ ! -s "${PIPELINE_FILE}" ]]; then
+        echo "No new non-archived entries found, skipping ${label} trigger"
+        exit 0
+    fi
+
+    echo "--- Uploading ${label} trigger(s)"
+    cat "${PIPELINE_FILE}"
+    buildkite-agent pipeline upload "${PIPELINE_FILE}"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    main
+fi
diff --git a/.buildkite/scripts/trigger_backport_lib.sh b/.buildkite/scripts/trigger_backport_lib.sh
new file mode 100644
index 00000000000..6b1b23962e8
--- /dev/null
+++ b/.buildkite/scripts/trigger_backport_lib.sh
@@ -0,0 +1,148 @@
+#!/bin/bash
+# Shared library for trigger_backport.sh.
+# Source this file — do not execute directly.
+#
+# Provides resolve_pr_number(), backports_yml_changed(), load_old_backports_inventory(),
+# and generate_trigger_pipeline().
+# resolve_pr_number() looks up the PR that introduced a given commit via the GitHub API.
+# backports_yml_changed() checks whether .backports.yml was modified between two git refs.
+# load_old_backports_inventory() extracts .backports.yml at a given git ref into a file.
+# generate_trigger_pipeline() validates the new inventory via mage ValidateBackportsInventory,
+# iterates over a new .backports.yml, finds entries absent from the old inventory, and writes
+# Buildkite trigger steps to a pipeline file. The caller decides whether to upload the result.
+
+resolve_pr_number() {
+    local commit="$1"
+    local pr_number
+    if ! pr_number="$(gh api "repos/elastic/integrations/commits/${commit}/pulls" \
+            --jq '.[0].number // empty')"; then
+        echo "Failed to call GitHub API for commit ${commit}" >&2
+        return 1
+    fi
+    if [[ -n "${pr_number}" ]]; then
+        echo "Associated PR: #${pr_number}" >&2
+    else
+        echo "No PR found for commit ${commit}" >&2
+    fi
+    echo "${pr_number}"
+}
+
+load_old_backports_inventory() {
+    local git_ref="$1"
+    local output_file="$2"
+    if ! git show "${git_ref}:.backports.yml" > "${output_file}" 2>/dev/null; then
+        echo "Note: .backports.yml not found at ref '${git_ref}'" >&2
+        return 1
+    fi
+}
+
+backports_yml_changed() {
+    local from="$1"
+    local to="$2"
+    local changed
+    if ! changed="$(git diff --name-only "${from}" "${to}" -- .backports.yml)"; then
+        echo "ERROR: git diff failed for refs '${from}' '${to}'" >&2
+        return 2
+    fi
+    [[ -n "${changed}" ]]
+}
+
+generate_trigger_pipeline() {
+    local old_inventory="$1"    # path to the pre-change inventory
+    local new_inventory="$2"    # path to the post-change inventory
+    local dry_run="$3"          # "true" or "false" — passed to the triggered build
+    local pr_number="$4"        # merged PR number, may be empty
+    local pipeline_file="$5"    # output file; written only if new entries are found
+    local buildkite_pr="${6:-}" # BUILDKITE_PULL_REQUEST value; empty or "false" means not a PR build
+    local buildkite_commit="${7:-}" # BUILDKITE_COMMIT value; only used when buildkite_pr is set
+
+    if ! yq -e '.backports' "${old_inventory}" > /dev/null 2>&1; then
+        echo "ERROR: old inventory is not valid YAML or missing 'backports' key: ${old_inventory}" >&2
+        return 1
+    fi
+
+    if ! yq -e '.backports' "${new_inventory}" > /dev/null 2>&1; then
+        echo "ERROR: new inventory is not valid YAML or missing 'backports' key: ${new_inventory}" >&2
+        return 1
+    fi
+
+    if ! mage ValidateBackportsInventory; then
+        echo "ERROR: new inventory failed schema validation" >&2
+        return 1
+    fi
+
+    local label_prefix="Backport create"
+    if [[ "${dry_run}" == "true" ]]; then
+        label_prefix="Backport dry-run"
+    fi
+
+    while IFS= read -r branch; do
+        local entry=".backports[] | select(.branch == \"${branch}\")"
+
+        # Only trigger for entries that are new (absent from the old inventory).
+        # If the entry already existed, the branch is already created; nothing to provision.
+        # This also covers re-activating a previously archived entry (archived:true → false):
+        # the branch exists, so no trigger is needed.
+        local old_branch
+        old_branch="$(yq "${entry} | .branch" "${old_inventory}")"
+        if [[ -n "${old_branch}" ]]; then
+            echo "  Skipping existing entry: ${branch} (already present)"
+            continue
+        fi
+
+        local active_exit=0
+        mage CheckBackportBranchActive "${branch}" || active_exit=$?
+        if [[ "${active_exit}" -eq 2 ]]; then
+            echo "ERROR: failed to check active status for branch '${branch}'" >&2
+            return 1
+        fi
+        if [[ "${active_exit}" -ne 0 ]]; then
+            echo "  Skipping inactive entry: ${branch}"
+            continue
+        fi
+
+        local pkg base_version base_commit remove_other_packages
+        pkg="$(yq "${entry} | .package" "${new_inventory}")"
+        base_version="$(yq "${entry} | .base_version" "${new_inventory}")"
+        base_commit="$(yq "${entry} | .base_commit" "${new_inventory}")"
+        remove_other_packages="$(yq "${entry} | .remove_other_packages" "${new_inventory}")"
+        # Default to true if not set in the inventory entry
+        if [[ -z "${remove_other_packages}" ]] || [[ "${remove_other_packages}" == "null" ]]; then
+            remove_other_packages="true"
+        fi
+
+        echo "  Queuing ${label_prefix}: ${branch} (package=${pkg} version=${base_version} base_commit=${base_commit})"
+
+        if [[ ! -s "${pipeline_file}" ]]; then
+            printf 'steps:\n' > "${pipeline_file}"
+        fi
+
+        cat >> "${pipeline_file}" <<EOF
+  - label: ":git: ${label_prefix}: ${branch}"
+    key: "trigger-${branch//./-}"
+    trigger: "integrations-backport"
+    build:
+      env:
+        DRY_RUN: "${dry_run}"
+        PACKAGE_NAME: "${pkg}"
+        PACKAGE_VERSION: "${base_version}"
+        BASE_COMMIT: "${base_commit}"
+        BACKPORT_BRANCH_NAME: "${branch}"
+        REMOVE_OTHER_PACKAGES: "${remove_other_packages}"
+EOF
+        # Only write PR-specific overrides when running inside a pull request build.
+        # Uncommenting them lets backport_branch.sh run from the PR's HEAD instead of main.
+        if [[ -n "${buildkite_pr}" ]] && [[ "${buildkite_pr}" != "false" ]]; then
+            cat >> "${pipeline_file}" <<EOF
+        # BUILDKITE_REFSPEC: "refs/pull/${buildkite_pr}/head"
+        # BUILDKITE_COMMIT: "${buildkite_commit}"
+EOF
+        fi
+        if [[ -n "${pr_number}" ]]; then
+            cat >> "${pipeline_file}" <<EOF
+        PR_NUMBER: "${pr_number}"
+EOF
+        fi
+
+    done < <(yq '.backports[].branch' "${new_inventory}")
+}
diff --git a/.buildkite/scripts/trigger_integrations_in_parallel.sh b/.buildkite/scripts/trigger_integrations_in_parallel.sh
index 30bf325b683..a219844e9fe 100755
--- a/.buildkite/scripts/trigger_integrations_in_parallel.sh
+++ b/.buildkite/scripts/trigger_integrations_in_parallel.sh
@@ -9,9 +9,8 @@ add_bin_path
 with_yq
 with_mage
 
-pushd packages > /dev/null
+echo "--- List all directories"
 PACKAGE_LIST=$(list_all_directories)
-popd > /dev/null
 
 PIPELINE_FILE="packages_pipeline.yml"
 touch packages_pipeline.yml
@@ -28,12 +27,12 @@ EOF
 echo "--- Get from and to changesets"
 from="$(get_from_changeset)"
 if [[ "${from}" == "" ]]; then
-    echo "Missing \"from\" changset".
+    echo "Missing \"from\" changeset".
     exit 1
 fi
 to="$(get_to_changeset)"
 if [[ "${to}" == "" ]]; then
-    echo "Missing \"to\" changset".
+    echo "Missing \"to\" changeset".
     exit 1
 fi
 
@@ -51,35 +50,24 @@ fi
 
 packages_to_test=0
 
-for package in ${PACKAGE_LIST}; do
+for package_path in ${PACKAGE_LIST}; do
     # check if needed to create an step for this package
-    echo "--- [$package] check if it is required to be tested"
-    pushd "packages/${package}" > /dev/null
-    skip_package="false"
-    failure="false"
-    if ! reason=$(is_pr_affected "${package}" "${from}" "${to}") ; then
-        skip_package="true"
-        if [[ "${reason}" == "${FATAL_ERROR}" ]]; then
-            failure=true
-        fi
-    fi
-    popd > /dev/null
-    if [[ "${failure}" == "true" ]]; then
-        echo "Unexpected failure checking ${package}"
-        exit 1
-    fi
-
-    echoerr "${reason}"
-    if [[ "${skip_package}" == "true" ]] ; then
+    echo "--- [$package_path] check if it is required to be tested"
+    if ! should_test_package "${package_path}" "${from}" "${to}"; then
         continue
     fi
 
+    # package names (manifest.yml) are unique, so it can be used as key for the step
+    pushd "${package_path}" > /dev/null
+    package_name=$(package_name_manifest)
+    popd > /dev/null
+
     packages_to_test=$((packages_to_test+1))
     cat << EOF >> ${PIPELINE_FILE}
-    - label: "Check integrations ${package}"
-      key: "test-integrations-${package}"
-      command: ".buildkite/scripts/test_one_package.sh ${package} ${from} ${to}"
-      timeout_in_minutes: 240
+    - label: "Check integrations ${package_name}"
+      key: "test-integrations-${package_name}"
+      command: ".buildkite/scripts/test_one_package.sh ${package_path} ${from} ${to}"
+      timeout_in_minutes: 300
       agents:
         provider: gcp
         image: ${IMAGE_UBUNTU_X86_64}
@@ -92,11 +80,11 @@ for package in ${PACKAGE_LIST}; do
         # See https://github.com/elastic/oblt-infra/blob/main/conf/resources/repos/integrations/01-aws-buildkite-oidc.tf
         # This plugin creates the environment variables required by the service deployer (AWS_SECRET_ACCESS_KEY and AWS_SECRET_KEY_ID)
         - elastic/oblt-aws-auth#v0.1.0:
-            duration: 10800 # seconds
+            duration: 18000 # seconds
         # See https://github.com/elastic/oblt-infra/blob/main/conf/resources/repos/integrations/01-gcp-buildkite-oidc.tf
         # This plugin authenticates to Google Cloud using the OIDC token.
         - elastic/oblt-google-auth#v1.3.0:
-            lifetime: 10800 # seconds
+            lifetime: 18000 # seconds
             project-id: "elastic-observability-ci"
             project-number: "911195782929"
       artifact_paths:
diff --git a/.github/workflows/auto-backport.yml b/.github/workflows/auto-backport.yml
new file mode 100644
index 00000000000..8ecb11ccf35
--- /dev/null
+++ b/.github/workflows/auto-backport.yml
@@ -0,0 +1,176 @@
+---
+name: Backport — auto create PRs
+
+on:
+  push:
+    branches:
+      - main
+  issue_comment:
+    types: [edited]
+
+permissions:
+  contents: read
+
+jobs:
+  auto-backport:
+    runs-on: ubuntu-latest
+    # Skip bot-authored edits to break the infinite self-trigger loop:
+    # patching the checklist comment (✅ / ⚠️ suffix) fires another
+    # issue_comment edited event — filtering on actor stops it here.
+    # For issue_comment events also require:
+    #   - the event is on a pull request (not a plain issue)
+    #   - the edited comment contains the checklist marker (zero-cost body check,
+    #     no API call needed — the full comment body is in the event payload)
+    if: >-
+      ${{
+        github.actor != 'github-actions[bot]' &&
+        (
+          github.event_name == 'push' ||
+          (
+            github.event.issue.pull_request != null &&
+            contains(github.event.comment.body, '<!-- backport-checklist -->')
+          )
+        )
+      }}
+    concurrency:
+      # Serialise runs per PR:
+      # - push to main:          keyed on merge SHA (one run per merge)
+      # - issue_comment edited:  keyed on PR number (serialises re-checklist runs)
+      group: auto-backport-${{ github.event_name == 'push' && github.sha || github.event.issue.number }}
+      cancel-in-progress: true
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Check PR is merged
+        id: pr-check
+        if: github.event_name == 'issue_comment'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          STATE=$(gh pr view "$ISSUE_NUMBER" --repo "$REPOSITORY" --json state --jq '.state')
+          if [[ "$STATE" == "MERGED" ]]; then
+            echo "merged=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "PR #$ISSUE_NUMBER is not merged (state: $STATE) — skipping"
+          fi
+
+      - name: Check actor permission
+        id: actor-check
+        if: github.event_name == 'issue_comment' && steps.pr-check.outputs.merged == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          PERMISSION=$(gh api "repos/$REPOSITORY/collaborators/$ACTOR/permission" \
+            --jq '.permission' 2>/dev/null || echo "none")
+          if [[ "$PERMISSION" == "write" || "$PERMISSION" == "admin" ]]; then
+            echo "permitted=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Actor $ACTOR lacks write/admin permission ($PERMISSION) — skipping"
+          fi
+
+      - name: Resolve merge SHA and PR metadata
+        id: resolve
+        if: >-
+          ${{
+            github.event_name == 'push' ||
+            steps.actor-check.outputs.permitted == 'true'
+          }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          PUSH_SHA: ${{ github.sha }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          if [[ "$EVENT_NAME" == "push" ]]; then
+            MERGE_SHA="$PUSH_SHA"
+            PR_DATA=$(gh api "repos/$REPOSITORY/commits/$MERGE_SHA/pulls" \
+              --jq 'map(select(.base.ref == "main")) | first // empty')
+            if [[ -z "$PR_DATA" ]]; then
+              echo "No PR found for commit $MERGE_SHA — skipping"
+              exit 0
+            fi
+            PR_NUMBER=$(jq -r '.number'          <<< "$PR_DATA")
+            LABELS=$(jq -r  '[.labels[].name] | join(",")' <<< "$PR_DATA")
+            PR_AUTHOR=$(jq -r '.user.login'      <<< "$PR_DATA")
+          else
+            PR_NUMBER="$ISSUE_NUMBER"
+            PR_DATA=$(gh pr view "$PR_NUMBER" --repo "$REPOSITORY" \
+              --json mergeCommit,labels,author)
+            MERGE_SHA=$(jq -r '.mergeCommit.oid'            <<< "$PR_DATA")
+            LABELS=$(jq -r   '[.labels[].name] | join(",")' <<< "$PR_DATA")
+            PR_AUTHOR=$(jq -r '.author.login'               <<< "$PR_DATA")
+          fi
+
+          if [[ "$LABELS" == *"backport:sync-changelog"* ]]; then
+            echo "PR carries backport:sync-changelog label — skipping"
+            exit 0
+          fi
+
+          echo "merge_sha=$MERGE_SHA" >> "$GITHUB_OUTPUT"
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+          echo "pr_author=$PR_AUTHOR" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@v7
+        if: steps.resolve.outputs.pr_number != ''
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        if: steps.resolve.outputs.pr_number != ''
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: .go-version
+
+      - name: Install mage
+        if: steps.resolve.outputs.pr_number != ''
+        run: go install github.com/magefile/mage
+
+      - name: Find checklist comment
+        id: find-comment
+        if: steps.resolve.outputs.pr_number != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ steps.resolve.outputs.pr_number }}
+        run: |
+          MATCHING=$(gh api "repos/$REPOSITORY/issues/$PR_NUMBER/comments" \
+            --paginate \
+            --jq '.[] | select(.body | contains("<!-- backport-checklist -->"))' \
+            | jq -s '.')
+
+          COUNT=$(jq 'length' <<< "$MATCHING")
+          if [[ "$COUNT" -eq 0 ]]; then
+            echo "No checklist comment found on PR #$PR_NUMBER — skipping"
+            exit 0
+          fi
+
+          BODY_FILE="$RUNNER_TEMP/checklist-body.txt"
+          jq -r '.[0].body' <<< "$MATCHING" > "$BODY_FILE"
+
+          echo "comment_id=$(jq -r '.[0].id' <<< "$MATCHING")" >> "$GITHUB_OUTPUT"
+          echo "body_file=$BODY_FILE"                          >> "$GITHUB_OUTPUT"
+
+      - name: Configure git
+        if: steps.find-comment.outputs.comment_id != ''
+        uses: elastic/oblt-actions/git/setup@v1
+        with:
+          username: 'github-actions[bot]'
+          email: '41898282+github-actions[bot]@users.noreply.github.com'
+
+      - name: Process checked branches
+        if: steps.find-comment.outputs.comment_id != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+          MERGE_SHA: ${{ steps.resolve.outputs.merge_sha }}
+          PR_AUTHOR: ${{ steps.resolve.outputs.pr_author }}
+          COMMENT_ID: ${{ steps.find-comment.outputs.comment_id }}
+          BODY_FILE: ${{ steps.find-comment.outputs.body_file }}
+        run: .github/scripts/backport/process-checked-branches.sh
diff --git a/.github/workflows/backport-packages-detect.yml b/.github/workflows/backport-packages-detect.yml
new file mode 100644
index 00000000000..efe5a6dbead
--- /dev/null
+++ b/.github/workflows/backport-packages-detect.yml
@@ -0,0 +1,59 @@
+---
+name: Backport — detect packages
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+
+jobs:
+  detect-packages:
+    runs-on: ubuntu-latest
+    # Skip PRs created by the sync-changelog workflow — those backport changelog
+    # entries back to main and do not need a backport checklist of their own.
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'backport:sync-changelog') }}
+    # No permissions — this job runs in the restricted pull_request context
+    # and must be fork-safe. Write permissions live in post-backport-checklist.yml
+    # which is triggered via workflow_run and runs in the base repository context.
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          # Full history is required so that git diff can resolve both the PR
+          # base SHA and the head SHA, which may not be present in a shallow clone.
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: .go-version
+
+      - name: Install mage
+        run: go install github.com/magefile/mage
+
+      - name: Detect packages touched by this PR
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          PACKAGES_JSON=$(mage -d "$GITHUB_WORKSPACE" detectBackportPackages "$BASE_SHA" "$HEAD_SHA" -asJSON)
+
+          jq -n \
+            --argjson pkgs "$PACKAGES_JSON" \
+            --argjson pr "$PR_NUMBER" \
+            '{"pr_number": $pr, "packages": $pkgs}' > pr-packages.json
+
+          echo "Detected packages: $PACKAGES_JSON"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: pr-packages-${{ github.run_id }}
+          path: pr-packages.json
+          if-no-files-found: ignore
+          retention-days: 1
diff --git a/.github/workflows/bump-elastic-stack-version.yml b/.github/workflows/bump-elastic-stack-version.yml
index 9452fa40a69..90ae96391d7 100644
--- a/.github/workflows/bump-elastic-stack-version.yml
+++ b/.github/workflows/bump-elastic-stack-version.yml
@@ -22,10 +22,18 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: .go-version
+
+      - name: Install mage
+        run: go install github.com/magefile/mage
 
       - name: Install Updatecli in the runner
-        uses: updatecli/updatecli-action@4fd2c16d992120bd5355264a03ad0cddec013e1b #v2.99.0
+        uses: updatecli/updatecli-action@5dfc616e57b07d2302c3f37e5b72a4ead82dbbf8 #v3.4.0
 
       - name: Select diff action
         if: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/catalog-info.yml b/.github/workflows/catalog-info.yml
index 3f4320ae16d..b5fdc7b37a4 100644
--- a/.github/workflows/catalog-info.yml
+++ b/.github/workflows/catalog-info.yml
@@ -18,7 +18,7 @@ jobs:
       contents: read
       packages: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: elastic/oblt-actions/elastic/validate-catalog@v1
 
diff --git a/.github/workflows/ci-comment.yml b/.github/workflows/ci-comment.yml
new file mode 100644
index 00000000000..16c94d01346
--- /dev/null
+++ b/.github/workflows/ci-comment.yml
@@ -0,0 +1,55 @@
+name: "ci-comment"
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  contents: none
+
+jobs:
+  triage:
+    permissions:
+      id-token: write
+    runs-on: ubuntu-latest
+    steps:
+
+    - uses: elastic/oblt-actions/github/create-token@v1
+      id: fetch-token
+
+    - id: is_elastic_member
+      uses: elastic/oblt-actions/github/is-member-of@v1
+      with:
+        github-org: "elastic"
+        github-user: ${{ github.actor }}
+        github-token: ${{ steps.fetch-token.outputs.token }}
+
+    - id: user_type
+      uses: elastic/oblt-actions/github/user-type@v1
+      with:
+        github-user: ${{ github.actor }}
+        github-token: ${{ steps.fetch-token.outputs.token }}
+
+    - name: debug
+      run: |
+        echo "::notice:: is_elastic_member=${{ steps.is_elastic_member.outputs.result }}"
+        echo "::notice:: user_type=${{ steps.user_type.outputs.result }}"
+        echo "::notice:: github.actor=${{ github.actor }}"
+        echo "::notice:: github.event_name=${{ github.event_name }}"
+
+    - name: Comment (or update)
+      if: steps.is_elastic_member.outputs.result == 'false' && steps.user_type.outputs.result == 'user'
+      uses: edumserrano/find-create-or-update-comment@fb101dd7a690f32dc65d250bf2997d7d5c9544e9
+      with:
+        token: ${{ steps.fetch-token.outputs.token }}
+        issue-number: ${{ github.event.pull_request.number }}
+        body-includes: "<!-- buildkite-comments -->"
+        comment-author: "elastic-vault-github-plugin-prod[bot]"
+        edit-mode: replace
+        body: |
+          <!-- buildkite-comments -->
+          ### Reviewers
+
+          Buildkite won't run for external contributors automatically; you need to add a comment:
+          - `/test` : will kick off a build in Buildkite.
+
+          **NOTE**: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.
diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml
index adf95da5d96..41643049a97 100644
--- a/.github/workflows/docs-build.yml
+++ b/.github/workflows/docs-build.yml
@@ -1,19 +1,13 @@
 name: docs-build
-
 on:
+  pull_request:
+    types: [opened, synchronize, reopened]
   push:
-    branches:
-      - main
-  pull_request_target: ~
+    branches: [main]
   merge_group: ~
-
+permissions:
+  contents: read
+  pull-requests: read
 jobs:
-  docs-preview:
-    uses: elastic/docs-builder/.github/workflows/preview-build.yml@main
-    with:
-      path-pattern: docs/**
-    permissions:
-      deployments: write
-      id-token: write
-      contents: read
-      pull-requests: write
+  build:
+    uses: elastic/docs-actions/.github/workflows/docs-build.yml@v1
diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
new file mode 100644
index 00000000000..8ee433c2c27
--- /dev/null
+++ b/.github/workflows/docs-deploy.yml
@@ -0,0 +1,14 @@
+name: docs-deploy
+on:
+  workflow_run:
+    workflows: [docs-build]
+    types: [completed]
+permissions:
+  contents: read
+  deployments: write
+  id-token: write
+  pull-requests: write
+  actions: read
+jobs:
+  deploy:
+    uses: elastic/docs-actions/.github/workflows/docs-deploy.yml@v1
diff --git a/.github/workflows/docs-edit-automation.yml b/.github/workflows/docs-edit-automation.yml
index 21332abd971..76ffa9ec2d4 100644
--- a/.github/workflows/docs-edit-automation.yml
+++ b/.github/workflows/docs-edit-automation.yml
@@ -8,6 +8,9 @@ on:
     paths:
       - 'packages/*/_dev/build/docs/README.md'
 
+permissions:
+  contents: none
+
 jobs:
   help-with-docs:
     if: |
@@ -21,7 +24,7 @@ jobs:
       PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Analyze documentation changes and generate commands
         id: analyze
diff --git a/.github/workflows/docs-preview-cleanup.yml b/.github/workflows/docs-preview-cleanup.yml
new file mode 100644
index 00000000000..b234c235826
--- /dev/null
+++ b/.github/workflows/docs-preview-cleanup.yml
@@ -0,0 +1,11 @@
+name: docs-preview-cleanup
+on:
+  pull_request_target:
+    types: [closed]
+permissions:
+  contents: none
+  deployments: write
+  id-token: write
+jobs:
+  cleanup:
+    uses: elastic/docs-actions/.github/workflows/docs-preview-cleanup.yml@v1
diff --git a/.github/workflows/notify-package-docs-failure.yml b/.github/workflows/notify-package-docs-failure.yml
new file mode 100644
index 00000000000..5fd14b7856b
--- /dev/null
+++ b/.github/workflows/notify-package-docs-failure.yml
@@ -0,0 +1,57 @@
+name: Notify on Package Docs Validation Failure
+
+on:
+  workflow_run:
+    workflows: ["Validate Package Docs"]
+    types: [completed]
+
+permissions:
+  contents: none
+
+jobs:
+  notify:
+    name: Comment on PR
+    if: github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      actions: read
+    steps:
+      - name: Download failure signal
+        id: artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: docs-validation-failed
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+          path: validate-result
+        continue-on-error: true
+
+      - name: Comment on PR
+        if: steps.artifact.outcome == 'success'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.event.workflow_run.html_url }}
+          REPO: ${{ github.repository }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          PR_NUMBER=$(cat validate-result/pr_number 2>/dev/null || true)
+          if [ -z "$PR_NUMBER" ] || [ "$PR_NUMBER" = "null" ]; then
+            echo "Could not read PR number from artifact"
+            exit 0
+          fi
+          # Verify the PR number matches the head SHA to prevent
+          # a forked PR from targeting a different PR's comments
+          ACTUAL_PR=$(gh api "repos/${REPO}/commits/${HEAD_SHA}/pulls" \
+            --jq '.[0].number' 2>/dev/null || true)
+          if [ "$PR_NUMBER" != "$ACTUAL_PR" ]; then
+            echo "PR number mismatch: artifact=$PR_NUMBER actual=$ACTUAL_PR"
+            exit 0
+          fi
+          # Avoid duplicate comments
+          EXISTING=$(gh api "repos/${REPO}/issues/${PR_NUMBER}/comments" \
+            --jq '[.[] | select(.body | contains("Package docs validation failed"))] | length')
+          if [ "$EXISTING" = "0" ]; then
+            printf '⚠️ **Package docs validation failed.** Please check the [workflow run](%s) for details.\n\nFor support, reach out in the #docs Slack channel.\n\ncc @elastic/integration-docs\n' "$RUN_URL" > comment-body.md
+            gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file comment-body.md
+          fi
diff --git a/.github/workflows/post-backport-checklist.yml b/.github/workflows/post-backport-checklist.yml
new file mode 100644
index 00000000000..4d273935acc
--- /dev/null
+++ b/.github/workflows/post-backport-checklist.yml
@@ -0,0 +1,120 @@
+---
+name: Backport — post checklist
+
+on:
+  workflow_run:
+    workflows: ["Backport — detect packages"]
+    types: [completed]
+
+permissions:
+  contents: read
+
+jobs:
+  post-checklist:
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.conclusion == 'success'
+    # Cancel any in-progress run for the same branch when rapid pushes trigger
+    # overlapping workflow_run jobs — the newest run wins.
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}
+      cancel-in-progress: true
+    permissions:
+      contents: read
+      pull-requests: write
+      # Required by actions/download-artifact when fetching from another workflow run.
+      actions: read
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: .go-version
+
+      - name: Install mage
+        run: go install github.com/magefile/mage
+
+      - name: Download artifact
+        # continue-on-error so a missing artifact (e.g. detect job was skipped due to
+        # backport:sync-changelog label) does not fail the job — the next step checks
+        # for the file and exits cleanly when it is absent.
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          name: pr-packages-${{ github.event.workflow_run.id }}
+          path: artifacts
+
+      - name: Validate artifact and find checklist comment
+        id: find-comment
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+          ARTIFACT: artifacts/pr-packages.json
+        run: |
+          if [[ ! -f "$ARTIFACT" ]]; then
+            echo "Artifact not found — exiting"
+            exit 0
+          fi
+
+          PR_NUMBER=$(jq -r '.pr_number' "$ARTIFACT")
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+
+          # Collect all comments that contain the checklist marker across all pages.
+          MATCHING=$(gh api "repos/$REPOSITORY/issues/$PR_NUMBER/comments" \
+            --paginate \
+            --jq '.[] | select(.body | contains("<!-- backport-checklist -->"))' \
+            | jq -s '.')
+
+          COUNT=$(jq 'length' <<< "$MATCHING")
+          if [[ "$COUNT" -gt 1 ]]; then
+            IDS=$(jq -r '.[].id' <<< "$MATCHING" | paste -sd ', ')
+            gh api --method POST \
+              "repos/$REPOSITORY/issues/$PR_NUMBER/comments" \
+              --field body=":warning: **Backport checklist error**: found ${COUNT} duplicate checklist comments (IDs: ${IDS}). Please delete the extras manually so the checklist can be updated automatically."
+            echo "Duplicate checklist comments found — posted notice to PR #$PR_NUMBER" >&2
+            exit 1
+          fi
+
+          echo "comment_id=$(jq -r 'first.id // empty' <<< "$MATCHING")" >> "$GITHUB_OUTPUT"
+
+      - name: Render and post checklist comment
+        if: steps.find-comment.outputs.pr_number != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+          ARTIFACT: artifacts/pr-packages.json
+          PR_NUMBER: ${{ steps.find-comment.outputs.pr_number }}
+          COMMENT_ID: ${{ steps.find-comment.outputs.comment_id }}
+        run: |
+          EXISTING_BODY=""
+          if [[ -n "$COMMENT_ID" ]]; then
+            EXISTING_BODY=$(gh api "repos/$REPOSITORY/issues/comments/$COMMENT_ID" \
+              --jq '.body // empty')
+          fi
+
+          # Render the new comment body. The existing body is piped into stdin so
+          # the mage target can parse previously-checked branches and preserve their
+          # state. Prints nothing when no package has any active branch.
+          NEW_BODY=$(printf '%s' "$EXISTING_BODY" | \
+            mage -d "$GITHUB_WORKSPACE" renderBackportChecklist "$ARTIFACT")
+
+          if [[ -z "$NEW_BODY" ]]; then
+            echo "No active backport branches — nothing to post"
+            exit 0
+          fi
+
+          # Write to a file to avoid quoting issues when passing to gh api.
+          BODY_FILE=$(mktemp)
+          trap 'rm -f "$BODY_FILE"' EXIT
+          printf '%s' "$NEW_BODY" > "$BODY_FILE"
+
+          if [[ -n "$COMMENT_ID" ]]; then
+            gh api --method DELETE "repos/$REPOSITORY/issues/comments/$COMMENT_ID"
+          fi
+          gh api --method POST \
+            "repos/$REPOSITORY/issues/$PR_NUMBER/comments" \
+            --field body=@"$BODY_FILE"
+          echo "Recreated checklist comment on PR #$PR_NUMBER"
diff --git a/.github/workflows/pr-buildkite-detective.yml b/.github/workflows/pr-buildkite-detective.yml
new file mode 100644
index 00000000000..1bf14f3688a
--- /dev/null
+++ b/.github/workflows/pr-buildkite-detective.yml
@@ -0,0 +1,39 @@
+name: PR Buildkite Detective
+on:
+  status:
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: write  # required by gh-aw compiler for add-comment
+
+jobs:
+  check-pr:
+    if: >-
+      github.event.state == 'failure' &&
+      contains(github.event.context, 'buildkite')
+    runs-on: ubuntu-latest
+    outputs:
+      has-open-pr: ${{ steps.find-pr.outputs.has-open-pr }}
+    steps:
+      - name: Check for open PR associated with commit
+        id: find-pr
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          count=$(gh api "repos/${{ github.repository }}/commits/${{ github.event.sha }}/pulls" \
+            --jq '[.[] | select(.state == "open")] | length')
+          if [ "$count" -gt 0 ]; then
+            echo "has-open-pr=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has-open-pr=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  run:
+    needs: check-pr
+    if: needs.check-pr.outputs.has-open-pr == 'true'
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-estc-pr-buildkite-detective.lock.yml@v0
+    secrets:
+      BUILDKITE_API_TOKEN: ${{ secrets.BUILDKITE_LOGS_API_TOKEN }}
diff --git a/.github/workflows/requires-update.yml b/.github/workflows/requires-update.yml
new file mode 100644
index 00000000000..18444d546f8
--- /dev/null
+++ b/.github/workflows/requires-update.yml
@@ -0,0 +1,81 @@
+---
+name: Update required package versions
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Preview proposals without applying changes or publishing'
+        type: boolean
+        default: false
+      preview:
+        description: 'Print what would be published without touching git or GitHub'
+        type: boolean
+        default: false
+  schedule:
+    # Every weekday at 02:30 UTC.
+    - cron: '30 2 * * 1-5'
+
+permissions:
+  contents: read
+
+jobs:
+  requires-update:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: .go-version
+
+      - name: Install mage
+        run: go install github.com/magefile/mage
+
+      - name: Install elastic-package
+        # No version suffix: `go install` then resolves elastic-package from
+        # this module's go.mod build list, i.e. exactly the pin Dependabot
+        # bumps deliberately via PR (gomod ecosystem) — not the latest
+        # release. That pin matters because this job runs unattended and
+        # depends on exact elastic-package JSON output fields (kind,
+        # codeowner, kibana_constraint, new_version, skip_reason).
+        run: |
+          go install github.com/elastic/elastic-package
+          echo "ELASTIC_PACKAGE_BIN=$(go env GOPATH)/bin/elastic-package" >> $GITHUB_ENV
+
+      - name: Configure git
+        uses: elastic/oblt-actions/git/setup@v1
+        with:
+          username: 'github-actions[bot]'
+          email: 'github-actions[bot]@users.noreply.github.com'
+
+      - name: Run RequiresUpdate
+        # Scans packages, applies proposals, and opens one PR (or issue) per
+        # package — see dev/requiresupdate.
+        # Scheduled runs always use dryRun=false and preview=false;
+        # workflow_dispatch inputs are only read for manual runs.
+        id: requires_update
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run || 'false' }}
+          PREVIEW: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.preview || 'false' }}
+        run: >-
+          mage RequiresUpdate
+          -dryRun=${{ env.DRY_RUN }}
+          -preview=${{ env.PREVIEW }}
+        continue-on-error: true
+
+      - name: Fail if RequiresUpdate reported errors
+        # continue-on-error above lets already-succeeded packages still get a
+        # PR/issue when one package errors, but that must not make the job
+        # look green — otherwise a real failure and "nothing to do" (today's
+        # expected state) are indistinguishable in the Actions UI.
+        if: always() && steps.requires_update.outcome == 'failure'
+        run: |
+          echo "::error::RequiresUpdate reported errors — see the 'Run RequiresUpdate' step log above."
+          exit 1
diff --git a/.github/workflows/sweep-dashboard-data-scope.yml b/.github/workflows/sweep-dashboard-data-scope.yml
new file mode 100644
index 00000000000..0fe35cb5d01
--- /dev/null
+++ b/.github/workflows/sweep-dashboard-data-scope.yml
@@ -0,0 +1,101 @@
+name: "Sweeper: Dashboard Data Scope and Filter Integrity"
+on:
+  schedule:
+    - cron: "0 9 * * 4"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-code-quality-audit.lock.yml@v0
+    with:
+      title-prefix: "[dashboard-data-scope]"
+      severity-threshold: "high"
+      additional-instructions: |
+        You are auditing dashboards in the elastic/integrations repository for data scope
+        bugs. Find cases that would matter to a real user: dashboards where opening the page
+        shows data from unrelated integrations, or where a panel is completely broken because
+        its data source reference does not exist. One confirmed bug that any user with multiple
+        integrations installed would immediately notice is worth more than a list of dashboards
+        with broad-looking patterns that turn out to be harmless.
+
+        ## What dashboards guarantee
+
+        Dashboard JSON files live at `packages/<pkg>/kibana/dashboard/*.json`. Each dashboard
+        belongs to exactly one integration and should only query that integration's own data
+        streams. A dashboard that queries `logs-*` instead of `logs-aws.cloudtrail-*` shows
+        data from every other integration installed in the cluster — the user opens the AWS
+        CloudTrail dashboard and sees Kubernetes, Windows, and Cisco logs mixed in. Control
+        panels are the most damaging: a filter dropdown querying `logs-*` shows field values
+        from every integration's data, making it impossible to filter meaningfully.
+
+        Stale `indexPatternId` references — a static Kibana saved object ID rather than a
+        dynamically resolved data view — produce "no data source" errors on panels in Kibana
+        installations where that saved object does not exist.
+
+        ## How to investigate
+
+        Scan for candidates:
+        ```bash
+        python3 -c "
+        import json, glob, re
+        for f in glob.glob('packages/*/kibana/dashboard/*.json'):
+            with open(f) as fh:
+                try: content = fh.read()
+                except: continue
+            if re.search(r'\"(logs|metrics)-\*\"', content):
+                print(f)
+        " 2>/dev/null
+        ```
+
+        For each candidate, open the file and understand what role the broad pattern plays.
+        This is the critical judgment: a `logs-*` string in the `indexRefName` of a
+        visualization or the data source of a control panel is always wrong. A `logs-*`
+        string in a panel title, description, or filter label that does not affect what data
+        is actually queried is harmless. Do not file the harmless ones.
+
+        For confirmed scope bugs, determine the correct scoped pattern for the package. It
+        is always `<type>-<package>.<datastream>-*`, e.g. `logs-aws.cloudtrail-*`. Read
+        the package's `manifest.yml` and data stream definitions to confirm.
+
+        Check `validation.yml` for suppressed `SVR00002` checks:
+        ```bash
+        grep -rl 'SVR00002\|exclude_checks' packages/*/validation.yml 2>/dev/null
+        ```
+        A suppressed check without a comment explaining why is itself a finding — the
+        problem was identified by the validator and deliberately left unresolved.
+
+        For any confirmed finding in a high-traffic package, check the git history:
+        `git log --oneline -- packages/<pkg>/kibana/dashboard/`
+        Dashboards are sometimes regenerated in bulk migrations that inadvertently broaden
+        data view references. A broad pattern introduced in a recent bulk commit is a
+        regression affecting everyone who updated.
+
+        ## Verify before filing
+
+        For each scope finding, confirm all three:
+        1. The broad pattern is the actual data source for a query or control panel, not an
+           incidental string in metadata
+        2. The package has a correct scoped pattern that should be used instead
+        3. The bug is visible to any user who has more than one integration installed
+
+        For stale `indexPatternId` references, confirm the referenced ID is not a data view
+        the integration installs as part of its own assets.
+
+        ## Output
+
+        File a single issue containing:
+        - Control panels and visualizations with over-broad data sources, by dashboard, with
+          the correct scoped pattern for each
+        - Stale `indexPatternId` references that produce "no data source" errors, by package
+        - Packages with `SVR00002` suppressed without explanation
+        - Total dashboards scanned and number with confirmed findings
diff --git a/.github/workflows/sweep-field-mapping-conflicts.yml b/.github/workflows/sweep-field-mapping-conflicts.yml
new file mode 100644
index 00000000000..8194042422a
--- /dev/null
+++ b/.github/workflows/sweep-field-mapping-conflicts.yml
@@ -0,0 +1,98 @@
+name: "Sweeper: Field Mapping Type Conflicts"
+on:
+  schedule:
+    - cron: "0 9 * * 2"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-code-quality-audit.lock.yml@v0
+    with:
+      title-prefix: "[field-mapping-conflicts]"
+      severity-threshold: "high"
+      additional-instructions: |
+        You are auditing field mapping declarations in the elastic/integrations repository
+        for type conflicts that cause real indexing failures. Produce findings that would
+        impress a senior engineer: a small number of thoroughly investigated cases where a
+        real document would be rejected by Elasticsearch because the declared type cannot
+        hold the actual value. One confirmed conflict that causes guaranteed data loss is
+        worth more than a list of fields that might theoretically overflow.
+
+        ## What field mappings guarantee
+
+        Field mapping declarations under `packages/<pkg>/data_stream/<stream>/fields/` are
+        compiled into Elasticsearch index templates. The guarantee is: every document the
+        integration produces can be indexed without type errors. A mismatch between the
+        declared type and the actual data causes Elasticsearch to reject the document —
+        silently, from the user's perspective.
+
+        ## How to investigate
+
+        **The constant_keyword conflict — start here.** Find every data stream where
+        `event.kind` is declared as `constant_keyword` AND the pipeline's `on_failure`
+        handler sets `event.kind: pipeline_error`. These are directly contradictory: the
+        mapping says the field always holds one value, the pipeline sets a different value
+        on failure. Every document that fails to parse is rejected by Elasticsearch — not
+        indexed in a degraded state, just silently lost. To confirm a finding, read both
+        files and verify both conditions are present in the same data stream.
+
+        **Integer overflow risks.** Do not file every field declared as `integer`. Instead,
+        reason about what the field actually receives. Fields named `bytes`, `packets`,
+        `duration`, `sequence_number`, or `timestamp_ms` on network, security, or
+        high-volume integrations are high risk — real production traffic regularly exceeds
+        2.1 billion for byte counters, nanosecond timestamps, and 64-bit sequence numbers.
+        Fields named `priority`, `retry_count`, or `version` are low risk. For each
+        candidate, read the ingest pipeline to understand what value is assigned to the
+        field, then reason about whether real production data from this source will exceed
+        the type's range.
+
+        **Cross-data-stream conflicts.** Two data streams in the same package that declare
+        the same field with different types produce a mapping conflict when both write to a
+        shared index template. Most likely in large packages: `windows`, `aws`, `azure`,
+        `cisco_*`. These are worth checking for any package that has gone through major
+        restructuring.
+
+        For any finding, check the git history of the affected files:
+        `git log --oneline -p -- packages/<pkg>/data_stream/<stream>/fields/`
+
+        A field that was declared as `long` and changed to `integer` is a regression —
+        check whether the commit message explains why. A `constant_keyword` declaration
+        added after a pipeline already had a `pipeline_error` handler is a regression.
+        Regressions affect users who were previously working and are always higher priority
+        than original omissions.
+
+        These patterns are starting points. If you understand the mapping and pipeline well
+        enough to find a conflict not described here, file it.
+
+        ## The reproduction is the argument
+
+        For the `event.kind` constant_keyword conflict: show (1) the exact field declaration
+        with its constant value, (2) the `on_failure` handler that sets a different value,
+        and (3) what Elasticsearch does — it rejects the document because the value does not
+        match the constant. You must trace all three steps explicitly; "these seem contradictory"
+        is not a reproduction.
+
+        For integer overflow: show the specific field, the source data context, and why real
+        production data will exceed 2.1 billion. "Byte counts can be large" is not a
+        reproduction. "This integration monitors network interfaces and the pipeline assigns
+        `interface.ingress.bytes` from a 64-bit counter that will overflow a 32-bit integer
+        within hours on any gigabit link" is a reproduction.
+
+        ## Output
+
+        File a single issue containing:
+        - `event.kind` constant_keyword conflicts first — these cause guaranteed, silent data
+          loss for every document that fails to parse
+        - High-confidence integer overflow risks with the field, the source context, and
+          the concrete reason the range will be exceeded
+        - Cross-data-stream type conflicts, by package
diff --git a/.github/workflows/sweep-httpjson-pagination.yml b/.github/workflows/sweep-httpjson-pagination.yml
new file mode 100644
index 00000000000..28582cf806b
--- /dev/null
+++ b/.github/workflows/sweep-httpjson-pagination.yml
@@ -0,0 +1,105 @@
+name: "Sweeper: httpjson and CEL Pagination and Cursor Integrity"
+on:
+  schedule:
+    - cron: "0 9 * * 5"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-code-quality-audit.lock.yml@v0
+    with:
+      title-prefix: "[httpjson-pagination]"
+      severity-threshold: "high"
+      additional-instructions: |
+        You are auditing httpjson and CEL input configurations in the elastic/integrations
+        repository for pagination and cursor bugs. Produce findings that would impress a
+        senior engineer: a small number of thoroughly investigated cases where a real
+        integration running against a real API would produce duplicate events, miss events,
+        hammer the API indefinitely, or silently stop collecting after the first poll. One
+        confirmed failure traced to a specific runtime behavior is worth more than a list of
+        configurations that look structurally incomplete.
+
+        ## What these inputs guarantee
+
+        HTTP-based integrations configure their inputs using agent stream templates at
+        `packages/<pkg>/data_stream/<stream>/agent/stream/*.yml.hbs`. The integration makes
+        three guarantees: events are collected exactly once with no gaps or duplicates,
+        pagination terminates when all available data has been fetched, and the cursor
+        accurately represents the last successfully processed position so the next poll
+        starts from the right place.
+
+        ## How to investigate
+
+        Pick 3-5 integrations that use pagination and read their full agent stream template.
+        Before looking for bugs, understand the intended polling flow: how does it page
+        through results, what does the cursor represent, and when does it advance? Then
+        reason about where that flow breaks.
+
+        **Cursor type drift through JSON serialization.** If the cursor is a large integer —
+        a Unix timestamp in milliseconds, a sequence number, a large event ID — trace what
+        happens when it is written to the cursor store and read back. The httpjson input
+        serializes cursor state to JSON. A 64-bit integer read back without explicit type
+        handling becomes a `float64`. The value `1700000000000` formatted as float64 renders
+        as `1.7e+12` when interpolated into a URL parameter. Most APIs reject this or
+        misinterpret it, silently breaking pagination after the first poll. Read the cursor
+        definition and the URL construction to confirm the integer survives the round-trip.
+
+        **Pagination that never terminates.** In `httpjson` chain configurations, pagination
+        continues until a `terminate` processor fires. Read the termination condition and ask:
+        is there a response the API can legitimately return — an empty page, a page with
+        fewer items than the page size, a missing next-page token — that does not trigger
+        the condition? If so, the integration requests the same last page indefinitely.
+
+        **Cursor not advanced on empty response.** When the API returns no new events, the
+        cursor should advance to now so the next poll starts from the current time. If the
+        cursor is not advanced on empty response, every subsequent poll re-requests the same
+        window, generating redundant API calls and potentially re-indexing old events.
+
+        **Rate limit headers exposed but not wired.** If `manifest.yml` exposes
+        `rate_limit.limit` and `rate_limit.reset` variables to users, check whether the
+        agent stream template actually wires them into the `httpjson` `rate_limit` config
+        block. An integration that advertises rate limit support but ignores the API's
+        rate limit headers will get rate-limited or banned despite users believing they
+        have configured it correctly.
+
+        For any candidate finding, check the git history of the template:
+        `git log --oneline -p -- packages/<pkg>/data_stream/<stream>/agent/stream/`
+
+        Cursor type handling and termination conditions are the areas most often changed
+        when an integration is updated for a new API version. A recent change that simplified
+        a cursor definition or modified a termination condition may have introduced the bug.
+
+        These patterns are starting points. If you understand a template's polling flow well
+        enough to find a correctness failure not described here, file it.
+
+        ## The reproduction is the argument
+
+        When you think you have found something, trace the complete runtime execution before
+        filing. What is the exact cursor value after the first successful poll? What does
+        JSON serialization do to it? What URL does the next request construct? What does the
+        API receive? What does it return, and what does the integration do next?
+
+        For termination failures, show the exact API response that should terminate
+        pagination and explain precisely why the `terminate` condition does not fire for it.
+        For empty-response cursor failures, show the cursor state before and after the empty
+        response is processed.
+
+        "This config looks incomplete" is not a reproduction. A step-by-step trace of the
+        runtime behavior that ends in a concrete incorrect outcome is.
+
+        ## Output
+
+        File a single issue containing:
+        - Each confirmed bug: the template file, the exact runtime failure traced step by
+          step, and the correct fix
+        - Configurations you investigated and found correct, with why
diff --git a/.github/workflows/sweep-ingest-pipeline-safety.yml b/.github/workflows/sweep-ingest-pipeline-safety.yml
new file mode 100644
index 00000000000..b35427fb90a
--- /dev/null
+++ b/.github/workflows/sweep-ingest-pipeline-safety.yml
@@ -0,0 +1,97 @@
+name: "Sweeper: Ingest Pipeline Null-Safety and Grok Robustness"
+on:
+  schedule:
+    - cron: "0 9 * * 1"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-code-quality-audit.lock.yml@v0
+    with:
+      title-prefix: "[ingest-pipeline-safety]"
+      severity-threshold: "high"
+      additional-instructions: |
+        You are auditing ingest pipelines in the elastic/integrations repository for
+        robustness against real-world log variation. Produce findings that would impress a
+        senior engineer: a small number of thoroughly investigated cases where a log variant
+        that actually occurs in production causes a document to fail indexing silently. One
+        confirmed failure with a concrete triggering document is worth more than a list of
+        processors that look suspicious.
+
+        ## What ingest pipelines guarantee
+
+        Every ingest pipeline under `packages/<pkg>/data_stream/<stream>/elasticsearch/ingest_pipeline/`
+        processes raw log documents before indexing. The guarantee is: every document either
+        parses successfully and is indexed, or fails and is captured by the `on_failure`
+        handler in a degraded-but-visible state. Silent loss — a document that is neither
+        indexed correctly nor surfaced as a failure — is the failure mode to find.
+
+        ## How to investigate
+
+        Pick 3-5 pipelines from high-traffic integrations (`cisco_asa`, `crowdstrike`, `aws`,
+        `panw`, `fortinet_fortigate`) and read them thoroughly. Before looking for bugs,
+        understand what logs this pipeline actually processes: what does a normal document
+        look like, and what format variations does the source system produce? Then trace the
+        pipeline against those variations.
+
+        **Painless scripts.** Read every `script` processor and trace every dot-path access.
+        The question is not "is there a null check somewhere" but "does the null check cover
+        every level of the path for every log variant this integration receives?" A guard on
+        `ctx.cisco` does not protect `ctx.cisco.asa.message_id` when the `asa` object is
+        absent in certain message types. Read the vendor documentation or look at the
+        integration's own test fixtures in `_dev/test/pipeline/` to understand which fields
+        are actually optional.
+
+        **Grok patterns.** For each `grok` processor on a variable field — IP addresses,
+        timestamps, user agents, status codes — ask whether the source system ever produces
+        this field in a format the pattern does not match. A pattern handling only IPv4 will
+        fail silently on IPv6 addresses. A fixed-field dissection will fail on log lines with
+        optional trailing fields. If the test fixtures do not cover the variant, the pipeline
+        has probably never been tested against it.
+
+        **Type conversions.** For each `convert` processor without `ignore_failure: true`,
+        check whether the field is always the expected type. Status codes, byte counts, and
+        duration fields frequently arrive as strings in some firmware versions and as numbers
+        in others.
+
+        Before filing any finding, check the git history for the pipeline file:
+        `git log --oneline -p -- packages/<pkg>/data_stream/<stream>/elasticsearch/ingest_pipeline/`
+
+        A null guard that was present and then removed in a recent refactor is a regression —
+        the commit message will usually confirm whether it was intentional. A recently added
+        script processor that accesses new fields is a candidate if those fields are not
+        guaranteed to be present. Regressions are higher priority than original omissions
+        because they affect users who were previously working correctly.
+
+        These patterns are starting points. If you understand a pipeline well enough to find
+        a failure mode not described here, that is exactly what we want.
+
+        ## The reproduction is the argument
+
+        When you think you have found something, construct the exact document that triggers
+        the failure. Trace it through the pipeline step by step — which processor throws,
+        what the exception is, what the resulting indexed document looks like, and why that
+        is incorrect. If you can express this as an Elasticsearch Simulate API call
+        (`POST /_ingest/pipeline/<id>/_simulate`), include it.
+
+        If you cannot construct a concrete document that fails, keep investigating. You may
+        find that a prior processor guarantees the field is present, that the log source
+        never actually omits it, or that `ignore_failure` on a preceding processor already
+        handles the variant.
+
+        ## Output
+
+        File a single issue containing:
+        - Each confirmed bug: the pipeline file, the processor, the exact triggering document,
+          what the failure looks like, and the one-line fix
+        - Pipelines you read thoroughly and found safe, with what protects them
diff --git a/.github/workflows/sweep-pipeline-error-handling.yml b/.github/workflows/sweep-pipeline-error-handling.yml
new file mode 100644
index 00000000000..874826db4d4
--- /dev/null
+++ b/.github/workflows/sweep-pipeline-error-handling.yml
@@ -0,0 +1,116 @@
+name: "Sweeper: Pipeline Error Handler Compliance"
+on:
+  schedule:
+    - cron: "0 9 * * 3"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-code-quality-audit.lock.yml@v0
+    with:
+      title-prefix: "[pipeline-error-handling]"
+      severity-threshold: "high"
+      additional-instructions: |
+        You are auditing ingest pipeline error handling in the elastic/integrations repository.
+        Find the cases that would matter most to a real operator: pipelines on free-form log
+        sources where parse failures are inevitable, and where those failures are currently
+        invisible — either because there is no `on_failure` handler at all, or because a
+        user-facing feature (`preserve_original_event`) silently does nothing when it is
+        needed most.
+
+        ## What error handling guarantees
+
+        Every ingest pipeline will eventually fail to parse a document. When it does, the
+        `on_failure` handler is the operator's only tool for understanding what happened.
+        Without `event.kind: pipeline_error`, failed documents are indexed with no signal
+        that anything went wrong — they appear in the index, missing all parsed fields, with
+        no way to find them. Without `error.message`, there is nothing to diagnose. A missing
+        or incomplete handler makes every pipeline failure invisible in production.
+
+        The `preserve_original_event` feature makes this worse when it goes wrong: users
+        enable it specifically to retain the raw log when parsing fails. A pipeline whose
+        `on_failure` handler does not check the `preserve_original_event` tag silently
+        discards the raw log regardless of the user's setting. The user believes they have
+        a safety net. They do not.
+
+        ## How to investigate
+
+        Start with a scan to understand the full landscape:
+
+        ```bash
+        python3 -c "
+        import yaml, glob
+        missing, incomplete = [], []
+        for f in glob.glob('packages/*/data_stream/*/elasticsearch/ingest_pipeline/*.yml'):
+            with open(f) as fh:
+                try: p = yaml.safe_load(fh) or {}
+                except: continue
+            on_fail = p.get('on_failure', [])
+            if not on_fail:
+                missing.append(f)
+                continue
+            has_kind = any('event.kind' in str(proc) for proc in on_fail)
+            has_msg  = any('error.message' in str(proc) for proc in on_fail)
+            if not (has_kind and has_msg):
+                incomplete.append((f, has_kind, has_msg))
+        print('MISSING on_failure:', len(missing))
+        for f in missing[:20]: print(' ', f)
+        print('INCOMPLETE on_failure:', len(incomplete))
+        for f, hk, hm in incomplete[:20]: print(f'  {f} (kind={hk}, msg={hm})')
+        " 2>/dev/null
+        ```
+
+        The scan gives you scope. Now apply judgment. A missing handler on a network device
+        syslog pipeline (`cisco_asa`, `cisco_ftd`, `panw`, `fortinet_fortigate`) guarantees
+        real-world failures — these sources produce format variants in every production
+        deployment. A missing handler on a tightly controlled API pipeline is lower priority.
+
+        For each high-priority missing handler, check the git history:
+        `git log --oneline -p -- packages/<pkg>/data_stream/<stream>/elasticsearch/ingest_pipeline/`
+
+        A handler that was present and removed during a refactor is a regression — the commit
+        message will often confirm whether it was intentional. A recently simplified pipeline
+        that used to have more careful error handling is always higher priority than one that
+        never had it, because it affects users who were previously working correctly.
+
+        For `preserve_original_event`, find packages that expose it in `manifest.yml`:
+        ```bash
+        grep -rl 'preserve_original_event' packages/*/manifest.yml | sed 's|/manifest.yml||'
+        ```
+        For each, read the pipeline's `on_failure` handler. Does it contain a conditional
+        that checks `preserve_original_event` before deciding whether to keep `event.original`?
+        If not, the feature is advertised but non-functional when it matters most.
+
+        ## Verify before filing
+
+        For missing or incomplete handlers: confirm that parse failures are realistic for
+        this integration. Every syslog and agent-based integration will produce failures;
+        structured API integrations are lower risk. Confirm the gap is real — some pipelines
+        rely on child pipelines that have their own handlers, or use `ignore_failure` on
+        every processor as a deliberate choice.
+
+        For `preserve_original_event` gaps: confirm the variable is user-visible in
+        `manifest.yml`, that the `on_failure` handler does not use it, and that the
+        integration processes logs where parse failures will occur.
+
+        ## Output
+
+        File a single issue containing:
+        - Total pipelines scanned and counts by category
+        - The highest-priority missing handler cases: integrations on free-form log sources
+          where failures are certain, especially any that appear to be regressions from git
+          history
+        - The `preserve_original_event` gaps, by package, with confirmation that both
+          conditions are present
+        - Do not list every pipeline with a gap — focus on the ones where real users will
+          be affected
diff --git a/.github/workflows/sync-backport-changelog.yml b/.github/workflows/sync-backport-changelog.yml
new file mode 100644
index 00000000000..338b0b69b19
--- /dev/null
+++ b/.github/workflows/sync-backport-changelog.yml
@@ -0,0 +1,79 @@
+---
+name: Sync backport changelog to main
+
+on:
+  push:
+    branches:
+      - 'backport-*'
+    paths:
+      - '**/changelog.yml'
+
+permissions:
+  contents: none
+
+jobs:
+  sync-changelog:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write      # push the changelog sync branch
+      pull-requests: write # create sync PR and comment on backport PR
+    steps:
+      - name: Guard — zero-SHA check
+        id: guard
+        env:
+          BEFORE: ${{ github.event.before }}
+        run: |
+          # Branch-creation pushes carry a zero before-SHA — there is no previous commit to diff against.
+          if [[ "$BEFORE" == "0000000000000000000000000000000000000000" ]]; then
+            echo "proceed=false" >> "$GITHUB_OUTPUT"
+            echo "Skipping: branch-creation push"
+            exit 0
+          fi
+          echo "proceed=true" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@v7
+        if: steps.guard.outputs.proceed == 'true'
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        if: steps.guard.outputs.proceed == 'true'
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: .go-version
+
+      - name: Install mage
+        if: steps.guard.outputs.proceed == 'true'
+        run: go install github.com/magefile/mage
+
+      - name: Configure git
+        if: steps.guard.outputs.proceed == 'true'
+        uses: elastic/oblt-actions/git/setup@v1
+        with:
+          username: 'github-actions[bot]'
+          email: '41898282+github-actions[bot]@users.noreply.github.com'
+
+      - name: Sync backport changelog
+        id: sync
+        if: steps.guard.outputs.proceed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BEFORE: ${{ github.event.before }}
+          AFTER: ${{ github.event.after }}
+          REPOSITORY: ${{ github.repository }}
+          BACKPORT_BRANCH: ${{ github.ref_name }}
+          PACKAGES_DIR: ${{ github.workspace }}/packages
+        run: |
+          mage -d "$GITHUB_WORKSPACE" syncBackportChangelog
+
+      - name: Comment on backport PR
+        if: always() && steps.guard.outputs.proceed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BACKPORT_PR_NUMBER: ${{ steps.sync.outputs.backport_pr_number }}
+          WORKING_BRANCH: ${{ steps.sync.outputs.working_branch }}
+          NOT_FOUND_PACKAGES: ${{ steps.sync.outputs.not_found_packages }}
+          CREATE_OUTCOME: ${{ steps.sync.outputs.create_outcome }}
+          RUN_ID: ${{ github.run_id }}
+          REPOSITORY: ${{ github.repository }}
+        run: mage -d "$GITHUB_WORKSPACE" postBackportComment
diff --git a/.github/workflows/trigger-breaking-change-detector.yml b/.github/workflows/trigger-breaking-change-detector.yml
new file mode 100644
index 00000000000..9676c2eb807
--- /dev/null
+++ b/.github/workflows/trigger-breaking-change-detector.yml
@@ -0,0 +1,29 @@
+name: Breaking Change Detector
+on:
+  schedule:
+    - cron: "0 13 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-breaking-change-detector.lock.yml@v0
+    with:
+      additional-instructions: |
+        Do NOT flag changes to `conditions.kibana.version` or
+        `conditions.elastic.subscription` in any package's `manifest.yml`
+        as breaking changes. The Elastic package registry is version-aware:
+        when a package narrows its Kibana version constraint, users on
+        older Kibana versions are not broken — they continue to see and
+        use the latest package version compatible with their stack. The
+        newer version is simply not offered to them. Narrowing stack
+        version constraints is a normal, non-breaking operation in this
+        repository.
diff --git a/.github/workflows/trigger-bug-hunter.yml b/.github/workflows/trigger-bug-hunter.yml
new file mode 100644
index 00000000000..724316dac98
--- /dev/null
+++ b/.github/workflows/trigger-bug-hunter.yml
@@ -0,0 +1,19 @@
+name: Bug Hunter
+on:
+  schedule:
+    - cron: "0 11 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — this workflow has no current owner. Re-enabling
+    # requires removing this line via a reviewed PR, so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-bug-hunter.lock.yml@v0
diff --git a/.github/workflows/trigger-docs-patrol.yml b/.github/workflows/trigger-docs-patrol.yml
new file mode 100644
index 00000000000..51253875f24
--- /dev/null
+++ b/.github/workflows/trigger-docs-patrol.yml
@@ -0,0 +1,20 @@
+name: Docs Patrol
+on:
+  schedule:
+    - cron: "0 10 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-docs-patrol.lock.yml@v0
+    with:
+      title-prefix: "[docs-patrol]"
diff --git a/.github/workflows/trigger-duplicate-issue-detector.yml b/.github/workflows/trigger-duplicate-issue-detector.yml
new file mode 100644
index 00000000000..8337d5b9b45
--- /dev/null
+++ b/.github/workflows/trigger-duplicate-issue-detector.yml
@@ -0,0 +1,21 @@
+name: Duplicate Issue Detector
+on:
+  issues:
+    types: [opened]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  copilot-requests: write
+  discussions: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-duplicate-issue-detector.lock.yml@v0
+    with:
+      detect-related-issues: false
diff --git a/.github/workflows/trigger-issue-triage.yml b/.github/workflows/trigger-issue-triage.yml
new file mode 100644
index 00000000000..f0c65783edc
--- /dev/null
+++ b/.github/workflows/trigger-issue-triage.yml
@@ -0,0 +1,29 @@
+name: Issue Triage
+on:
+  issues:
+    types: [opened, labeled]
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  discussions: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  run:
+    # Access control is enforced by the upstream reusable workflow pre_activation
+    # check (required roles: admin, maintainer, write).
+    #
+    # Disabled 2026-07-02 — no current owner. To re-enable, remove `if: false`
+    # and restore the original activation condition below via a reviewed PR:
+    #   if: >-
+    #     github.event.action == 'opened' ||
+    #     (github.event.action == 'labeled' && github.event.label.name == 'claude-plz-triage')
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-issue-triage.lock.yml@v0
+    with:
+      setup-commands: |
+        export GOTOOLCHAIN=auto
+        go install github.com/elastic/elastic-package@latest
diff --git a/.github/workflows/trigger-mention-in-issue.yml b/.github/workflows/trigger-mention-in-issue.yml
new file mode 100644
index 00000000000..d2133356bdc
--- /dev/null
+++ b/.github/workflows/trigger-mention-in-issue.yml
@@ -0,0 +1,31 @@
+name: Mention in Issue
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  actions: read
+  contents: write
+  copilot-requests: write
+  discussions: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  run:
+    # Access control is enforced by the upstream reusable workflow pre_activation
+    # check (required roles: admin, maintainer, write).
+    #
+    # Disabled 2026-07-02 — no current owner. To re-enable, remove `if: false`
+    # and restore the original activation condition below via a reviewed PR:
+    #   if: >-
+    #     github.event.issue.pull_request == null &&
+    #     (startsWith(github.event.comment.body, '/ai') || contains(github.event.comment.body, '@claude'))
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-issue.lock.yml@v0
+    with:
+      setup-commands: |
+        export GOTOOLCHAIN=auto
+        go install github.com/elastic/elastic-package@latest
+      additional-instructions: |
+        If you do make a pull request, please add the label "ai" to it.
diff --git a/.github/workflows/trigger-mention-in-pr.yml b/.github/workflows/trigger-mention-in-pr.yml
new file mode 100644
index 00000000000..048140d1fcf
--- /dev/null
+++ b/.github/workflows/trigger-mention-in-pr.yml
@@ -0,0 +1,31 @@
+name: Mention in PR
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+permissions:
+  actions: read
+  contents: write
+  copilot-requests: write
+  pull-requests: write
+  discussions: write
+  issues: write
+
+jobs:
+  run:
+    # Access control is enforced by the upstream reusable workflow pre_activation
+    # check (required roles: admin, maintainer, write).
+    #
+    # Disabled 2026-07-02 — no current owner. To re-enable, remove `if: false`
+    # and restore the original activation condition below via a reviewed PR:
+    #   if: >-
+    #     (startsWith(github.event.comment.body, '/ai') || contains(github.event.comment.body, '@claude')) &&
+    #     (github.event.issue.pull_request != null || github.event_name == 'pull_request_review_comment')
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-pr.lock.yml@v0
+    with:
+      setup-commands: |
+        export GOTOOLCHAIN=auto
+        go install github.com/elastic/elastic-package@latest
diff --git a/.github/workflows/trigger-newbie-contributor-patrol.yml b/.github/workflows/trigger-newbie-contributor-patrol.yml
new file mode 100644
index 00000000000..5c3bccc1cb9
--- /dev/null
+++ b/.github/workflows/trigger-newbie-contributor-patrol.yml
@@ -0,0 +1,18 @@
+name: Newbie Contributor Patrol
+on:
+  schedule:
+    - cron: "0 11 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-newbie-contributor-patrol.lock.yml@v0
diff --git a/.github/workflows/trigger-package-tests-security-ml.yml b/.github/workflows/trigger-package-tests-security-ml.yml
new file mode 100644
index 00000000000..efc80cb2d1b
--- /dev/null
+++ b/.github/workflows/trigger-package-tests-security-ml.yml
@@ -0,0 +1,79 @@
+name: CI Trigger Security-ML Package Tests
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+    paths:
+      - "packages/beaconing/**"
+      - "packages/ded/**"
+      - "packages/dga/**"
+      - "packages/hta/**"
+      - "packages/lmd/**"
+      - "packages/pad/**"
+      - "packages/problemchild/**"
+      - ".github/workflows/trigger-package-tests-security-ml.yml"
+
+concurrency:
+  group: trigger-secml-itp-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: none
+
+jobs:
+  trigger:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Fetch ephemeral token for security-ml dispatch
+        id: auth
+        uses: elastic/ci-gh-actions/fetch-github-token@v1.5.3
+        with:
+          vault-instance: ci-prod
+
+      - name: Detect changed packages
+        id: packages
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          VALID_PACKAGES="beaconing ded dga hta lmd pad problemchild"
+          CHANGED=$(gh api repos/${REPO}/pulls/${PR_NUMBER}/files \
+            --paginate \
+            --jq '.[].filename')
+          PACKAGES=""
+          if echo "$CHANGED" | grep -q "^\.github/workflows/trigger-package-tests-security-ml\.yml$"; then
+            PACKAGES=$(echo "$VALID_PACKAGES" | tr ' ' ',')
+          else
+            for pkg in $VALID_PACKAGES; do
+              if echo "$CHANGED" | grep -q "^packages/${pkg}/"; then
+                PACKAGES="${PACKAGES:+$PACKAGES,}$pkg"
+              fi
+            done
+          fi
+          echo "packages=$PACKAGES" >> "$GITHUB_OUTPUT"
+          echo "Changed packages: $PACKAGES"
+
+      - name: Trigger security-ml integration tests
+        if: steps.packages.outputs.packages != ''
+        env:
+          GH_TOKEN: ${{ steps.auth.outputs.token }}
+          PACKAGES: ${{ steps.packages.outputs.packages }}
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_REPO: ${{ github.repository }}
+        run: |
+          gh workflow run itp-dispatch-integrations.yml \
+            --repo elastic/security-ml \
+            --ref main \
+            -f packages="$PACKAGES" \
+            -f branch="$PR_BRANCH" \
+            -f pr_number="$PR_NUMBER" \
+            -f pr_repo="$PR_REPO"
diff --git a/.github/workflows/trigger-pr-actions-detective.yml b/.github/workflows/trigger-pr-actions-detective.yml
new file mode 100644
index 00000000000..d2035424f81
--- /dev/null
+++ b/.github/workflows/trigger-pr-actions-detective.yml
@@ -0,0 +1,48 @@
+name: PR Actions Detective
+on:
+  workflow_run:
+    workflows:
+      [
+        "Validate Dashboard Compilation",
+        "Vale Lint",
+        "Documentation edit helper",
+        "catalog-info",
+        "docs-cleanup",
+        "docs-build",
+      ]
+    types: [completed]
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  gate:
+    if: >-
+      github.event.workflow_run.conclusion == 'failure' &&
+      toJSON(github.event.workflow_run.pull_requests) != '[]'
+    runs-on: ubuntu-latest
+    outputs:
+      enabled: ${{ steps.gate.outputs.enabled }}
+    steps:
+      - id: gate
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const prNumber = context.payload.workflow_run.pull_requests[0].number;
+            const pr = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+            const enabled = !(pr.data.labels || []).some((label) => label.name === "no-pr-actions-detective");
+            core.info(`PR #${prNumber} no-pr-actions-detective absent (enabled): ${enabled}`);
+            core.setOutput("enabled", enabled ? "true" : "false");
+
+  run:
+    needs: gate
+    if: needs.gate.outputs.enabled == 'true'
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-pr-actions-detective.lock.yml@v0
diff --git a/.github/workflows/trigger-pr-review.yml b/.github/workflows/trigger-pr-review.yml
new file mode 100644
index 00000000000..e0682c34fc9
--- /dev/null
+++ b/.github/workflows/trigger-pr-review.yml
@@ -0,0 +1,25 @@
+name: PR Review
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
+
+permissions:
+  actions: read
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. To re-enable, remove `if: false`
+    # and restore the original activation condition below via a reviewed PR:
+    #   if: >-
+    #     (contains(fromJSON('["Copilot","dependabot[bot]","github-actions[bot]"]'), github.event.pull_request.user.login)) &&
+    #     github.event.pull_request.draft == false &&
+    #     !contains(github.event.pull_request.labels.*.name, 'no-pr-review')
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-pr-review.lock.yml@v0
+    with:
+      intensity: aggressive
+      minimum_severity: nitpick
diff --git a/.github/workflows/trigger-stale-issues.yml b/.github/workflows/trigger-stale-issues.yml
new file mode 100644
index 00000000000..82ae1e3f1f8
--- /dev/null
+++ b/.github/workflows/trigger-stale-issues.yml
@@ -0,0 +1,18 @@
+name: Stale Issues
+on:
+  schedule:
+    - cron: "0 15 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-stale-issues.lock.yml@v0
diff --git a/.github/workflows/trigger-text-auditor.yml b/.github/workflows/trigger-text-auditor.yml
new file mode 100644
index 00000000000..7fe9a418b0f
--- /dev/null
+++ b/.github/workflows/trigger-text-auditor.yml
@@ -0,0 +1,20 @@
+name: Text Auditor
+on:
+  schedule:
+    - cron: "0 10 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  copilot-requests: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    # Disabled 2026-07-02 — no current owner. Re-enable by removing this
+    # `if: false` line via a reviewed PR so the change is visible.
+    if: false
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-text-auditor.lock.yml@v0
+    with:
+      title-prefix: "[text-auditor]"
diff --git a/.github/workflows/updatecli/updatecli.d/sync-packages-to-bug-issue-template.yml b/.github/workflows/updatecli/updatecli.d/sync-packages-to-bug-issue-template.yml
index 92212f12bf5..6fa9da44f3f 100644
--- a/.github/workflows/updatecli/updatecli.d/sync-packages-to-bug-issue-template.yml
+++ b/.github/workflows/updatecli/updatecli.d/sync-packages-to-bug-issue-template.yml
@@ -23,19 +23,20 @@ targets:
       environments:
         - name: PATH
         - name: HOME
-      # This script collects titles and package names (as determined by their
-      # directory name) from source. Then updates the issue template. It uses
+      # This script uses `mage listPackages` to collect package paths, then it reads
+      # title and name from each manifest.yml. It updates the issue template and uses
       # 'git diff' to satisfy the conditions needed by updatecli to determine
       # if any changes occurred.
       command: |
         #!/usr/bin/env bash
         set -eu
 
-        pkgs=$(for i in $(LC_ALL=C ls packages); do
-          title=$(yq .title packages/$i/manifest.yml)
-          pkg=$i
-          echo "- $title [$pkg]"
-        done | sort -s -f | yq -o json .)
+        package_paths=$(mage listPackages)
+
+        pkgs=$(echo "$package_paths" | while IFS= read -r package_path; do
+          title=$(yq .title "${package_path}/manifest.yml")
+          echo "- $title [$package_path]"
+        done | LC_ALL=C sort -s -f | yq -o json .)
         
         yq eval ".body[1].attributes.options = $pkgs" -i '.github/ISSUE_TEMPLATE/integration_bug.yml'
         yq eval ".body[1].attributes.options = $pkgs" -i '.github/ISSUE_TEMPLATE/integration_feature_request.yml'
diff --git a/.github/workflows/vale-lint.yml b/.github/workflows/vale-lint.yml
index 861364de443..1e333a1bb23 100644
--- a/.github/workflows/vale-lint.yml
+++ b/.github/workflows/vale-lint.yml
@@ -1,6 +1,6 @@
 # Vale Lint Workflow
 #
-# This workflow runs Vale linting on documentation changes.
+# This workflow runs Vale linting on documentation and user-facing metadata changes.
 #
 # IMPORTANT: This workflow works with report.yml to post PR comments.
 # Both files must be present for full functionality.
@@ -13,30 +13,94 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
-      - '**.md'
-      - '**.mdx'
-      - 'packages/**/docs/**'
+      - 'packages/**/_dev/build/docs/README.md'
+      - 'packages/**/docs/README.md'
+      - 'packages/**/manifest.yml'
+      - 'packages/**/data_stream/*/fields/fields.yml'
+      - 'packages/**/data_stream/*/manifest.yml'
+      - 'packages/**/changelog.yml'
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   vale-lint:
-    name: Lint Documentation
+    name: Lint user-facing content
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
+      - name: Select files to lint
+        id: select-files
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          mapfile -t changed_files < <(
+            gh api "repos/${GH_REPOSITORY}/pulls/${PR_NUMBER}/files" \
+              --paginate \
+              | jq -rs 'add // [] | .[] | select(.status != "removed") | .filename'
+          )
+
+          files_to_lint=()
+          for file in "${changed_files[@]}"; do
+            case "$file" in
+              packages/**/_dev/build/docs/README.md|\
+              packages/**/manifest.yml|\
+              packages/**/data_stream/*/fields/fields.yml|\
+              packages/**/data_stream/*/manifest.yml|\
+              packages/**/changelog.yml)
+                files_to_lint+=("$file")
+                ;;
+              packages/**/docs/README.md)
+                package_dir="${file%/docs/README.md}"
+                if [ ! -f "$package_dir/_dev/build/docs/README.md" ]; then
+                  files_to_lint+=("$file")
+                else
+                  echo "Skipping $file because $package_dir/_dev/build/docs/README.md exists"
+                fi
+                ;;
+            esac
+          done
+
+          if [ "${#files_to_lint[@]}" -eq 0 ]; then
+            echo "has_files=false" >> "$GITHUB_OUTPUT"
+            echo "No matching files to lint"
+            exit 0
+          fi
+
+          printf 'Files to lint:\n'
+          printf '  %s\n' "${files_to_lint[@]}"
+          files=$(printf '%s ' "${files_to_lint[@]}")
+          echo "files=${files% }" >> "$GITHUB_OUTPUT"
+          echo "has_files=true" >> "$GITHUB_OUTPUT"
+
       - name: Run Elastic Vale Linter
-        uses: elastic/vale-rules/lint@main
+        if: steps.select-files.outputs.has_files == 'true'
+        uses: elastic/docs-actions/vale/lint@v1
         with:
+          files: ${{ steps.select-files.outputs.files }}
+
           # Fail the workflow if Vale finds error-level issues
           # Set to 'true' to enforce style as a required check
           fail_on_error: false
+          vale-overrides: |
+            [*.{yml,yaml}]
+            BasedOnStyles = Elastic
+            Elastic.Spelling = NO
+          vale-paths: |
+            packages/**/_dev/build/docs/README.md
+            packages/**/docs/README.md
+            packages/**/manifest.yml
+            packages/**/data_stream/*/fields/fields.yml
+            packages/**/data_stream/*/manifest.yml
+            packages/**/changelog.yml
 
           # Optional: Enable debug output for troubleshooting
           # debug: true
diff --git a/.github/workflows/vale-report.yml b/.github/workflows/vale-report.yml
index bc58ce9c7d3..49f2320f465 100644
--- a/.github/workflows/vale-report.yml
+++ b/.github/workflows/vale-report.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Post Vale Results
-        uses: elastic/vale-rules/report@main
+        uses: elastic/docs-actions/vale/report@v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           # download_artifacts: true (default)
diff --git a/.github/workflows/validate-package-docs.yml b/.github/workflows/validate-package-docs.yml
new file mode 100644
index 00000000000..bacaa9929ae
--- /dev/null
+++ b/.github/workflows/validate-package-docs.yml
@@ -0,0 +1,96 @@
+name: Validate Package Docs
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'packages/*/docs/*.md'
+      - 'packages/*/*/docs/*.md'
+
+permissions:
+  contents: read
+
+jobs:
+  validate-package-docs:
+    name: Validate Package Docs (docs-builder)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Find changed package docs
+        id: changed-docs
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          FILES=$(git diff --name-only --diff-filter=d "origin/$BASE_REF"...HEAD \
+            | grep '^packages/.*/docs/[^/]*\.md$' \
+            | grep -v '_dev/build/' || true)
+          echo "files<<EOF" >> $GITHUB_OUTPUT
+          echo "$FILES" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+          if [ -z "$FILES" ]; then
+            echo "skip=true" >> $GITHUB_OUTPUT
+          else
+            echo "skip=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Validate with docs-builder
+        id: validate
+        if: steps.changed-docs.outputs.skip != 'true'
+        continue-on-error: true
+        env:
+          CHANGED_FILES: ${{ steps.changed-docs.outputs.files }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          # Build an isolated directory so docs-builder only sees our
+          # generated docset and not docs/docset.yml or other repo files.
+          mkdir -p .validate
+          git init .validate
+          echo "$CHANGED_FILES" | while read f; do
+            [ -n "$f" ] || continue
+            dir=".validate/$(dirname "$f")"
+            mkdir -p "$dir"
+            # docs-builder requires lowercase filenames
+            base="$(basename "$f" | tr '[:upper:]' '[:lower:]')"
+            cp "$f" "$dir/$base"
+            # Copy sibling img/ directory so image references resolve
+            pkg_dir="$(dirname "$(dirname "$f")")"
+            if [ -d "$pkg_dir/img" ] && [ ! -d ".validate/$pkg_dir/img" ]; then
+              cp -r "$pkg_dir/img" ".validate/$pkg_dir/img"
+            fi
+          done
+          {
+            echo "project: 'Package Docs Validation'"
+            echo "cross_links:"
+            echo "  - beats"
+            echo "  - docs-content"
+            echo "  - ecs"
+            echo "  - elasticsearch"
+            echo "  - integrations"
+            echo "toc:"
+            echo "$CHANGED_FILES" | while read f; do
+              [ -n "$f" ] || continue
+              dir="$(dirname "$f")"
+              base="$(basename "$f" | tr '[:upper:]' '[:lower:]')"
+              echo "  - file: $dir/$base"
+            done
+          } > .validate/docset.yml
+          cat .validate/docset.yml
+          mkdir -p "$PWD/validate-result"
+          if ! docker run --rm -v "$PWD/.validate:/workspace" -w /workspace \
+            ghcr.io/elastic/docs-builder:edge \
+            --metadata-only --strict; then
+            echo "${PR_NUMBER}" > "$PWD/validate-result/pr_number"
+          fi
+
+      - name: Upload failure signal
+        if: steps.changed-docs.outputs.skip != 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: docs-validation-failed
+          path: validate-result/pr_number
+          if-no-files-found: ignore
+          retention-days: 1
diff --git a/.github/workflows/validate-yaml-dashboards.requirements.txt b/.github/workflows/validate-yaml-dashboards.requirements.txt
new file mode 100644
index 00000000000..6210008356c
--- /dev/null
+++ b/.github/workflows/validate-yaml-dashboards.requirements.txt
@@ -0,0 +1,2 @@
+kb-dashboard-cli==0.4.1 --hash=sha256:dc35aec2dea9370b1597d0b1d6545d55aaf4aaf5bd5fe49fecde91570a95465a
+kb-dashboard-lint==0.4.1 --hash=sha256:8cf3b3129f1ae174f37d6c9a55be895ed1afe255e07cbc7ba6289793f527bb3b
diff --git a/.github/workflows/validate-yaml-dashboards.yml b/.github/workflows/validate-yaml-dashboards.yml
new file mode 100644
index 00000000000..0673f9e5d4f
--- /dev/null
+++ b/.github/workflows/validate-yaml-dashboards.yml
@@ -0,0 +1,223 @@
+---
+name: Validate Dashboard Compilation
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'packages/**/_dev/shared/**/*.yaml'
+      - 'packages/**/kibana/dashboard/*.json'
+      - '.github/workflows/validate-yaml-dashboards.yml'
+      - '.github/workflows/validate-yaml-dashboards.requirements.txt'
+
+permissions:
+  contents: read
+
+jobs:
+  validate-dashboards:
+    runs-on: ubuntu-latest
+    env:
+      KB_DASHBOARD_REQUIREMENTS: .github/workflows/validate-yaml-dashboards.requirements.txt
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install UV
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Find changed YAML dashboard files
+        id: find-changed
+        run: |
+          set -e
+          
+          # Find YAML files changed in the PR diff
+          CHANGED_YAML_FILES=$(git diff --name-only origin/main...HEAD -- \
+            'packages/**/_dev/shared/**/*.yaml' \
+            'packages/**/_dev/shared/kibana/**/*.yaml' \
+            2>/dev/null || true)
+          
+          if [ -z "$CHANGED_YAML_FILES" ]; then
+            echo "No YAML dashboard files changed in this PR"
+            echo "changed_files=" >> $GITHUB_OUTPUT
+            echo "unique_dirs=" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          
+          echo "Found changed YAML dashboard files:"
+          echo "$CHANGED_YAML_FILES"
+          echo ""
+          
+          # Store the list of changed files for linting (we lint each file individually)
+          CHANGED_FILES_ESCAPED=$(echo "$CHANGED_YAML_FILES" | tr '\n' ' ' | sed 's/ $//')
+          echo "changed_files=$CHANGED_FILES_ESCAPED" >> $GITHUB_OUTPUT
+          
+          # Find unique input directories to avoid redundant compilation
+          # Group files by their input directory (e.g., packages/aws_vpcflow_otel/_dev/shared/kibana)
+          UNIQUE_DIRS=$(echo "$CHANGED_YAML_FILES" | xargs -n1 dirname | sort -u | tr '\n' ' ' | sed 's/ $//')
+          echo "Unique input directories (for compilation):"
+          echo "$UNIQUE_DIRS"
+          echo ""
+          echo "unique_dirs=$UNIQUE_DIRS" >> $GITHUB_OUTPUT
+
+      - name: Lint changed YAML dashboards
+        id: lint
+        if: steps.find-changed.outputs.changed_files != ''
+        continue-on-error: true
+        run: |
+          set +e  # Don't exit on error, we'll handle it manually
+          
+          CHANGED_FILES="${{ steps.find-changed.outputs.changed_files }}"
+          
+          # Track linting results
+          LINT_FAILED=0
+          
+          # Process each changed YAML file
+          for yaml_file in $CHANGED_FILES; do
+            echo "=========================================="
+            echo "Linting: $yaml_file"
+            echo "=========================================="
+            echo ""
+            
+            # First, show all linting results (warnings, info, errors)
+            echo "Linting results:"
+            uvx --with-requirements "$KB_DASHBOARD_REQUIREMENTS" --from kb-dashboard-lint==0.4.1 kb-dashboard-lint check \
+                --input-file "$yaml_file" || true
+            echo ""
+            
+            # Then check specifically for errors (this will exit non-zero on warnings or errors)
+            if ! uvx --with-requirements "$KB_DASHBOARD_REQUIREMENTS" --from kb-dashboard-lint==0.4.1 kb-dashboard-lint check \
+                --input-file "$yaml_file" \
+                --severity-threshold error > /dev/null 2>&1; then
+              echo "❌ ERROR: Linting found warnings or errors in $yaml_file"
+              LINT_FAILED=1
+            else
+              echo "✅ No errors found in $yaml_file (info may be present above)"
+            fi
+            
+            echo ""
+          done
+          
+          set -e  # Re-enable exit on error
+          
+          if [ $LINT_FAILED -eq 1 ]; then
+            echo ""
+            echo "=========================================="
+            echo "❌ Dashboard linting FAILED (warnings or errors found)"
+            echo "=========================================="
+            exit 1
+          else
+            echo "=========================================="
+            echo "✅ All dashboard linting PASSED (no warnings or errors)"
+            echo "=========================================="
+          fi
+
+      - name: Check YAML schema upgrades
+        id: upgrade-check
+        if: steps.find-changed.outputs.changed_files != ''
+        run: |
+          set +e
+          
+          CHANGED_FILES="${{ steps.find-changed.outputs.changed_files }}"
+          UPGRADE_FAILED=0
+          
+          for yaml_file in $CHANGED_FILES; do
+            echo "=========================================="
+            echo "Checking schema upgrade requirements: $yaml_file"
+            echo "=========================================="
+            
+            if ! uvx --with-requirements "$KB_DASHBOARD_REQUIREMENTS" --from kb-dashboard-cli==0.4.1 kb-dashboard upgrade \
+                --input-file "$yaml_file" \
+                --fail-on-change > /dev/null 2>&1; then
+              echo "❌ ERROR: $yaml_file requires schema upgrade. Run:"
+              echo "  uvx --with-requirements $KB_DASHBOARD_REQUIREMENTS --from kb-dashboard-cli==0.4.1 kb-dashboard upgrade --input-file $yaml_file --write"
+              UPGRADE_FAILED=1
+            else
+              echo "✅ No schema upgrade required for $yaml_file"
+            fi
+            
+            echo ""
+          done
+          
+          set -e
+          
+          if [ $UPGRADE_FAILED -eq 1 ]; then
+            echo "=========================================="
+            echo "❌ YAML schema upgrade check FAILED"
+            echo "=========================================="
+            exit 1
+          fi
+
+      - name: Validate YAML dashboards match committed JSON
+        id: validate
+        if: steps.find-changed.outputs.unique_dirs != ''
+        run: |
+          set -e
+          
+          UNIQUE_DIRS="${{ steps.find-changed.outputs.unique_dirs }}"
+          VALIDATION_FAILED=0
+          
+          # Process each unique input directory
+          for input_dir in $UNIQUE_DIRS; do
+            echo "=========================================="
+            echo "Validating: $input_dir"
+            echo "=========================================="
+            
+            # Extract package name from path (e.g., packages/aws_vpcflow_otel/_dev/...)
+            package_name=$(echo "$input_dir" | sed 's|packages/\([^/]*\)/.*|\1|')
+            output_dir="packages/${package_name}/kibana/dashboard"
+            
+            echo "Input directory: $input_dir"
+            echo "Output directory: $output_dir"
+            echo ""
+            
+            # Compile directly to the output directory with --exit-non-zero-on-change.
+            # This flag makes the exit code equal to the number of files that changed
+            # (capped at 125). It only checks files produced by the compiler, so
+            # non-compiled (pre-existing) JSON dashboards are ignored.
+            set +e
+            uvx --with-requirements "$KB_DASHBOARD_REQUIREMENTS" --from kb-dashboard-cli==0.4.1 kb-dashboard compile \
+                --input-dir "$input_dir" \
+                --output-dir "$output_dir" \
+                --format elastic-integrations \
+                --exit-non-zero-on-change
+            exit_code=$?
+            set -e
+            
+            if [ $exit_code -eq 0 ]; then
+              echo "✅ PASSED: YAML dashboards in $input_dir match committed JSON"
+            else
+              echo ""
+              echo "❌ ERROR: $exit_code compiled dashboard(s) differ from committed JSON in $output_dir"
+              echo ""
+              echo "Differences:"
+              git diff -- "$output_dir" || true
+              echo ""
+              echo "The YAML source and committed JSON are out of sync."
+              echo "Please recompile with:"
+              echo "  uvx --with-requirements $KB_DASHBOARD_REQUIREMENTS --from kb-dashboard-cli==0.4.1 kb-dashboard compile --input-dir $input_dir --output-dir $output_dir --format elastic-integrations"
+              echo ""
+              VALIDATION_FAILED=1
+            fi
+            
+            echo ""
+          done
+          
+          # Restore any files modified during validation
+          git checkout -- . 2>/dev/null || true
+          
+          if [ $VALIDATION_FAILED -eq 1 ]; then
+            echo ""
+            echo "=========================================="
+            echo "❌ Dashboard validation FAILED"
+            echo "=========================================="
+            exit 1
+          else
+            echo "=========================================="
+            echo "✅ All dashboard validations PASSED"
+            echo "=========================================="
+          fi
diff --git a/.gitignore b/.gitignore
index b4f8e46d069..e28ec9f1ace 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,18 @@
 .DS_Store
 
 .idea
-.claude
+
+# Claude Code state.
+# - Any .claude/ directory nested under a package or subdirectory (e.g.
+#   packages/*/.claude/) is fully ignored - it's local scratch state.
+# - The root .claude/ is ignored EXCEPT for settings.json, which is checked
+#   in to register the elastic-integration-skills plugin marketplace for all
+#   contributors (see CLAUDE.md).
+.claude/
+!/.claude/
+/.claude/*
+!/.claude/settings.json
+
 /build
 
 dev/packages
@@ -10,3 +21,6 @@ elastic-package
 
 # Folder created by the Sonar Scanner
 .scannerwork/
+
+# Buildkite Python CI scripts test venv
+.buildkite/.venv-ci-python-scripts/
diff --git a/dev/backports/apply/apply.go b/dev/backports/apply/apply.go
new file mode 100644
index 00000000000..ece0505f62f
--- /dev/null
+++ b/dev/backports/apply/apply.go
@@ -0,0 +1,1030 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package apply
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"maps"
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/cli/go-gh/v2"
+	"gopkg.in/yaml.v3"
+
+	"github.com/elastic/integrations/dev/backports"
+	"github.com/elastic/integrations/dev/backports/changelog"
+	"github.com/elastic/integrations/dev/backports/owners"
+	"github.com/elastic/integrations/dev/citools"
+	"github.com/elastic/integrations/dev/codeowners"
+	"github.com/elastic/integrations/dev/gitutil"
+)
+
+// ownersSourceBranch is the ownership source of truth for syncOwners — main
+// is always authoritative. A named constant (not an env var or Options
+// field) purely so the value lives in one place, easy to tweak here for
+// local debugging/testing; check_backport_owners.sh keeps its own identical
+// constant since the two run in separate processes.
+const ownersSourceBranch = "main"
+
+// Options controls the behaviour of Apply.
+type Options struct {
+	SHA         string // commit to cherry-pick (required)
+	Package     string // package name as in manifest.yml (required)
+	Target      string // "6.14", "6.x", or full "backport-aws-6.14" (required)
+	OpenPR      bool   // create a GitHub PR when true
+	DryRun      bool   // commit locally but skip push and PR creation
+	AsJSON      bool   // emit JSON output instead of human-readable text
+	Remote      string // git remote to fetch from and push to; default "origin"
+	PackagesDir string // path to packages dir; default "packages"
+	Repository  string // "org/repo" e.g. "elastic/integrations"
+	WorkDir     string // absolute path to the repository root; defaults to the current working directory
+}
+
+// Result is the structured output of Apply.
+type Result struct {
+	Status           string   `json:"status"` // "success" or "conflict"
+	SHA              string   `json:"sha"`
+	TargetBranch     string   `json:"target_branch"`
+	NewVersion       string   `json:"new_version,omitempty"`
+	WorkingBranch    string   `json:"working_branch,omitempty"` // populated on dry run
+	PRURL            string   `json:"pr_url,omitempty"`
+	ConflictingFiles []string `json:"conflicting_files,omitempty"`
+	SuggestedCommand string   `json:"suggested_command,omitempty"`
+	OwnerSyncWarning string   `json:"owner_sync_warning,omitempty"` // non-empty when owner sync was skipped
+}
+
+// branchRE matches valid backport branch names (mirrors dev/backports/inventory.go).
+var branchRE = regexp.MustCompile(`^backport-[a-zA-Z0-9_]+-[0-9][0-9.]*x?$`)
+
+// applier holds the shared git context used by the apply pipeline steps.
+type applier struct {
+	git     gitutil.Git
+	workDir string
+}
+
+// Apply cherry-picks SHA onto the resolved backport branch, bumps the package's
+// patch version, writes a new changelog entry, and optionally opens a GitHub PR.
+// It uses the current working directory as the repository root.
+func Apply(opts Options) (*Result, error) {
+	if opts.SHA == "" || opts.Package == "" || opts.Target == "" {
+		return nil, fmt.Errorf("SHA, Package, and Target are all required")
+	}
+	if len(opts.SHA) < 8 {
+		return nil, fmt.Errorf("SHA must be at least 8 characters, got %q", opts.SHA)
+	}
+
+	workDir := opts.WorkDir
+	if workDir == "" {
+		wd, err := os.Getwd()
+		if err != nil {
+			return nil, fmt.Errorf("getting working directory: %w", err)
+		}
+		workDir = wd
+	}
+	workDir, err := filepath.Abs(workDir)
+	if err != nil {
+		return nil, fmt.Errorf("resolving work dir: %w", err)
+	}
+	a := applier{git: gitutil.Git{Dir: workDir}, workDir: workDir}
+
+	packagesDir := opts.PackagesDir
+	if packagesDir == "" {
+		packagesDir = "packages"
+	}
+	if !filepath.IsAbs(packagesDir) {
+		packagesDir = filepath.Join(workDir, packagesDir)
+	}
+	packagesDir = filepath.Clean(packagesDir)
+	remote := opts.Remote
+	if remote == "" {
+		remote = "origin"
+	}
+	repository := opts.Repository
+	if repository == "" {
+		repository = "elastic/integrations"
+	}
+	sha8 := opts.SHA[:8]
+
+	pkgDir, err := resolvePackage(packagesDir, opts.Package)
+	if err != nil {
+		return nil, err
+	}
+
+	branchName, err := resolveBranchName(opts.Target, opts.Package)
+	if err != nil {
+		return nil, err
+	}
+	if err := checkBranchReady(filepath.Join(workDir, ".backports.yml"), branchName, opts.AsJSON); err != nil {
+		return nil, err
+	}
+
+	workingBranch := workingBranchName(opts.Package, branchName, sha8)
+	if err := a.prepareWorkingBranch(remote, branchName, workingBranch); err != nil {
+		return nil, err
+	}
+
+	// Clean up the working branch if any subsequent step fails, so that a retry
+	// with the same SHA does not fail with "branch already exists".
+	success := false
+	defer func() {
+		if !success {
+			_ = a.git.RunToStderr("checkout", "-")
+			_ = a.git.RunToStderr("branch", "-D", workingBranch)
+		}
+	}()
+
+	changelogPath := filepath.Join(pkgDir, "changelog.yml")
+	manifestPath := filepath.Join(pkgDir, "manifest.yml")
+
+	conflict, err := a.cherryPickOrConflict(opts.SHA, branchName, opts.Package, changelogPath, manifestPath)
+	if err != nil {
+		return nil, err
+	}
+	if conflict != nil {
+		return conflict, nil
+	}
+
+	changes, err := a.extractChangelogFields(opts.SHA, changelogPath)
+	if err != nil {
+		return nil, err
+	}
+
+	// Replace every source-commit link with a sentinel: the actual backport PR
+	// URL is not known until after the PR is opened. The post-PR step calls
+	// changelog.UpdateEntryLinks to fix the sentinel once the URL is available.
+	sentinel := sentinelURL(repository)
+	for i := range changes {
+		changes[i].Link = sentinel
+	}
+
+	newVersion, err := a.resetAndWriteChanges(manifestPath, changelogPath, changes)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := a.commitChanges(pkgDir, opts.SHA, newVersion); err != nil {
+		return nil, err
+	}
+
+	ownerSyncWarning := a.syncOwners(remote, ownersSourceBranch, opts.Package, pkgDir)
+
+	if opts.DryRun {
+		success = true
+		return &Result{
+			Status:           "success",
+			SHA:              opts.SHA,
+			TargetBranch:     branchName,
+			NewVersion:       newVersion,
+			WorkingBranch:    workingBranch,
+			OwnerSyncWarning: ownerSyncWarning,
+		}, nil
+	}
+
+	if err := a.git.RunToStderr("push", remote, "HEAD"); err != nil {
+		return nil, fmt.Errorf("pushing: %w", err)
+	}
+
+	prURL, err := maybeOpenPR(opts.OpenPR, workingBranch, branchName, opts.Package, changes[0].Description, newVersion, opts.SHA, repository)
+	if err != nil {
+		return nil, err
+	}
+
+	if prURL != "" {
+		if err := a.fixChangelogLink(changelogPath, newVersion, prURL, remote); err != nil {
+			fmt.Fprintf(os.Stderr, "warning: could not update changelog link in backport PR: %v\n", err)
+		}
+	}
+
+	// Restore the branch that was active before Apply() started. The working
+	// branch has been pushed (and the PR opened if --open-pr was set), so local
+	// presence is no longer needed. Callers running mage targets after this
+	// function returns rely on the working tree still holding the tooling code
+	// from the calling branch, not the backport branch content.
+	if err := a.git.RunToStderr("checkout", "-"); err != nil {
+		fmt.Fprintf(os.Stderr, "warning: could not restore original branch: %v\n", err)
+	}
+
+	success = true
+	return &Result{
+		Status:           "success",
+		SHA:              opts.SHA,
+		TargetBranch:     branchName,
+		NewVersion:       newVersion,
+		PRURL:            prURL,
+		OwnerSyncWarning: ownerSyncWarning,
+	}, nil
+}
+
+// fixChangelogLink replaces the sentinel link in changelog.yml with the real
+// backport PR URL, commits the change, and pushes it as a second commit on the
+// working branch. Failures are non-fatal: the caller logs a warning and returns
+// success since the PR already exists.
+func (a applier) fixChangelogLink(changelogPath, version, prURL, remote string) error {
+	if err := changelog.UpdateEntryLinks(changelogPath, version, prURL); err != nil {
+		return fmt.Errorf("updating changelog link failed: %w", err)
+	}
+	relPath, err := filepath.Rel(a.workDir, changelogPath)
+	if err != nil {
+		return fmt.Errorf("computing relative path for %s failed: %w", changelogPath, err)
+	}
+	if err := a.git.RunToStderr("add", relPath); err != nil {
+		return fmt.Errorf("staging changelog failed: %w", err)
+	}
+	if err := a.git.RunToStderr("commit", "-m", "Fix changelog link to backport PR"); err != nil {
+		return fmt.Errorf("committing changelog link fix failed: %w", err)
+	}
+	if err := a.git.RunToStderr("push", remote, "HEAD"); err != nil {
+		return fmt.Errorf("pushing changelog link fix failed: %w", err)
+	}
+	return nil
+}
+
+// resolvePackage looks up the package directory for the given package name.
+func resolvePackage(packagesDir, pkg string) (string, error) {
+	pkgIndex, err := changelog.BuildPackageIndex(packagesDir)
+	if err != nil {
+		return "", fmt.Errorf("building package index: %w", err)
+	}
+	dir, ok := pkgIndex[pkg]
+	if !ok {
+		return "", fmt.Errorf("package %q not found under %s", pkg, packagesDir)
+	}
+	return dir, nil
+}
+
+// checkBranchReady verifies the branch is in the backports inventory file.
+// An inactive branch is a warning in human mode and an error in JSON mode.
+func checkBranchReady(backportsFile, branchName string, asJSON bool) error {
+	result, err := backports.CheckActive(backportsFile, branchName, time.Now().UTC())
+	if err != nil {
+		return fmt.Errorf(
+			"branch %q not found in .backports.yml — add an entry and open a PR to have it created first: %w",
+			branchName, err,
+		)
+	}
+	if !result.Active {
+		msg := fmt.Sprintf("branch %q is inactive (archived or past maintained_until)", branchName)
+		if asJSON {
+			return fmt.Errorf("%s", msg)
+		}
+		fmt.Fprintf(os.Stderr, "warning: %s\n", msg)
+	}
+	return nil
+}
+
+// workingBranchName derives the local working branch name for this backport.
+func workingBranchName(pkg, branchName, sha8 string) string {
+	versionSuffix := strings.TrimPrefix(branchName, "backport-"+pkg+"-")
+	return fmt.Sprintf("auto-backport/%s-%s-%s", pkg, versionSuffix, sha8)
+}
+
+// prepareWorkingBranch fetches the backport branch from remote and creates a
+// local working branch off it.
+func (a applier) prepareWorkingBranch(remote, branchName, workingBranch string) error {
+	if err := a.git.RunToStderr("fetch", remote, branchName); err != nil {
+		return fmt.Errorf(
+			"fetching %q from remote %q failed — verify that the .backports.yml PR was merged and the creation pipeline succeeded: %w",
+			branchName, remote, err,
+		)
+	}
+	if err := a.git.RunToStderr("checkout", "-b", workingBranch, remote+"/"+branchName); err != nil {
+		return fmt.Errorf("creating working branch %s: %w", workingBranch, err)
+	}
+	return nil
+}
+
+// cherryPickOrConflict attempts the cherry-pick. changelog.yml is always
+// restored to HEAD afterwards — its entries are fully regenerated by this
+// pipeline (see extractChangelogFields/InsertEntry), so cherry-picked changes
+// to it are redundant. manifest.yml is left as cherry-pick merges it: any
+// legitimate, non-version content change is preserved, and a conflict that is
+// purely a "version:" line difference (expected, since each backport branch
+// bumps its own version independently) is auto-resolved in favor of the
+// current branch — bumpPatchVersion recomputes the version afterwards. A
+// manifest.yml conflict block containing anything else is left as a genuine
+// conflict, as is manifest.yml going missing entirely — whether it was
+// already missing before the cherry-pick started, or a delete/modify
+// conflict, or the cherry-picked commit cleanly removing/renaming the
+// package — either way there's no manifest left to version-bump, so it's
+// reported the same way as any other unresolved conflict. If conflicts
+// remain in any file after this, it resets the index and returns a populated
+// conflict Result; the caller's defer is responsible for branch cleanup. On
+// success it returns (nil, nil).
+func (a applier) cherryPickOrConflict(sha, branchName, pkg, changelogPath, manifestPath string) (*Result, error) {
+	if conflict := a.manifestMissingConflict(sha, branchName, pkg, manifestPath); conflict != nil {
+		return conflict, nil
+	}
+
+	baseVersion, err := readManifestVersion(manifestPath)
+	if err != nil {
+		return nil, fmt.Errorf("reading current version from %s: %w", manifestPath, err)
+	}
+
+	// Force the default 2-way conflict marker style regardless of the caller's
+	// git config: resolveManifestVersionConflict below parses "<<<<<<<"/"======="/
+	// ">>>>>>>" text directly, and a diff3/zdiff3 style would make every block
+	// look unresolvable.
+	cherryErr := a.git.RunToStderr("-c", "merge.conflictStyle=merge", "cherry-pick", "-n", sha)
+
+	if err := a.git.RunToStderr("checkout", "HEAD", "--", changelogPath); err != nil {
+		a.abortCherryPick()
+		return nil, fmt.Errorf("restoring changelog after cherry-pick: %w", err)
+	}
+
+	if conflict := a.manifestMissingConflict(sha, branchName, pkg, manifestPath); conflict != nil {
+		return conflict, nil
+	}
+
+	if cherryErr != nil {
+		manifestHadConflict, manifestResolved, err := resolveManifestVersionConflict(manifestPath)
+		if err != nil {
+			a.abortCherryPick()
+			return nil, fmt.Errorf("resolving manifest.yml conflict: %w", err)
+		}
+		if manifestResolved {
+			if err := a.git.RunToStderr("add", manifestPath); err != nil {
+				a.abortCherryPick()
+				return nil, fmt.Errorf("staging resolved manifest.yml: %w", err)
+			}
+			if manifestHadConflict {
+				fmt.Fprintf(os.Stderr, "note: %s had a version-only conflict, auto-resolved by keeping the incoming change\n", manifestPath)
+			}
+		} else {
+			fmt.Fprintf(os.Stderr, "note: %s has conflicts beyond the version line — manual resolution required\n", manifestPath)
+		}
+
+		// cherry-pick failed; check whether conflicts remain.
+		files, err := a.conflictingFiles()
+		if err != nil {
+			a.abortCherryPick()
+			return nil, fmt.Errorf("checking conflict state after cherry-pick: %w", err)
+		}
+		if len(files) > 0 {
+			// Branch checkout and deletion are left to the caller's defer.
+			a.abortCherryPick()
+			return buildConflictResult(sha, branchName, pkg, files), nil
+		}
+	}
+
+	// The backport pipeline owns package versioning independently of the source
+	// branch: force manifest.yml's version back to what it was before the
+	// cherry-pick, so bumpPatchVersion below increments the target branch's own
+	// version rather than whatever the cherry-picked commit set it to.
+	if err := setManifestVersion(manifestPath, baseVersion); err != nil {
+		a.abortCherryPick()
+		return nil, fmt.Errorf("restoring manifest.yml version: %w", err)
+	}
+	return nil, nil
+}
+
+// abortCherryPick resets the working tree and index back to HEAD, discarding
+// any in-progress cherry-pick state. Used instead of "cherry-pick --abort":
+// with -n, git does not always write CHERRY_PICK_HEAD, so --abort may fail
+// and leave the index dirty.
+func (a applier) abortCherryPick() {
+	_ = a.git.RunToStderr("reset", "--hard", "HEAD")
+}
+
+// manifestMissingConflict reports a conflict Result if manifestPath does not
+// exist in the working tree. Called both before the cherry-pick (the
+// package doesn't exist on the target backport branch at all yet) and after
+// (a delete/modify conflict, or the cherry-picked commit cleanly
+// deletes/renames the package). Either way there's no manifest.yml left to
+// version-bump, so this needs a human decision rather than a downstream
+// os.ReadFile failing with an opaque error. Returns nil if manifestPath is
+// present, or if statting it fails for some other reason (that error
+// surfaces naturally from the next operation that reads the file instead).
+func (a applier) manifestMissingConflict(sha, branchName, pkg, manifestPath string) *Result {
+	_, err := os.Stat(manifestPath)
+	if !errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	a.abortCherryPick()
+	relPath, relErr := filepath.Rel(a.workDir, manifestPath)
+	if relErr != nil {
+		relPath = manifestPath
+	}
+	return buildConflictResult(sha, branchName, pkg, []string{relPath})
+}
+
+// buildConflictResult constructs the conflict Result returned by
+// cherryPickOrConflict when one or more files remain conflicted.
+func buildConflictResult(sha, branchName, pkg string, files []string) *Result {
+	return &Result{
+		Status:           "conflict",
+		SHA:              sha,
+		TargetBranch:     branchName,
+		ConflictingFiles: files,
+		SuggestedCommand: fmt.Sprintf(
+			"dev/scripts/backport_apply.sh --sha %s --package %s --target %s --open-pr",
+			sha, pkg, branchName,
+		),
+	}
+}
+
+// resolveManifestVersionConflict looks for cherry-pick conflict markers in
+// manifestPath and auto-resolves any conflict block where the current
+// branch's side ("ours") is purely a "version:" line difference. Such a block
+// keeps the incoming ("theirs") side instead of ours: git groups a changed
+// line together with any content the source commit inserted right next to it
+// (e.g. a new field added directly below the version bump) into the same
+// conflict block, so discarding "theirs" here would silently drop that
+// content. The version field itself doesn't need to be ours at this point —
+// cherryPickOrConflict normalizes it back to the target branch's own version
+// afterwards regardless of which side's value ends up on disk. A block where
+// "ours" contains anything other than a single version line is left
+// untouched so it still surfaces as a real conflict.
+// It assumes the default (non-diff3) conflict marker style; cherryPickOrConflict
+// forces this via "-c merge.conflictStyle=merge" on the cherry-pick itself, so
+// this is independent of the caller's own git config.
+// version is a mandatory, singular manifest.yml field: since "ours" is a
+// valid, existing file, it has exactly one line matching "version:", so at
+// most one conflict block can ever match the auto-resolve condition above.
+// After resolving, the merged content is required to still contain exactly
+// one such line before it's accepted; otherwise the whole file is left
+// untouched and reported as a conflict instead. This isn't expected to
+// trigger from two legitimately-committed manifest.yml states — a valid
+// "theirs" can't drop or duplicate a mandatory field either — but guards
+// against writing an invalid manifest.yml if that assumption is ever wrong.
+// hadConflict reports whether manifestPath contained any conflict markers at
+// all (false if the cherry-pick failed for an unrelated file and manifest.yml
+// merged cleanly on its own). resolved reports whether the file has no
+// remaining conflict markers (either none were present, or all were
+// resolved) — the caller uses this, not hadConflict, to decide whether to
+// stage the file.
+func resolveManifestVersionConflict(manifestPath string) (hadConflict, resolved bool, err error) {
+	const (
+		conflictStartPrefix = "<<<<<<<"
+		conflictMidPrefix   = "======="
+		conflictEndPrefix   = ">>>>>>>"
+	)
+
+	data, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return false, false, fmt.Errorf("reading %s: %w", manifestPath, err)
+	}
+	lines := strings.Split(string(data), "\n")
+	if !slices.ContainsFunc(lines, func(l string) bool { return strings.HasPrefix(l, conflictStartPrefix) }) {
+		return false, true, nil
+	}
+
+	info, err := os.Stat(manifestPath)
+	if err != nil {
+		return true, false, err
+	}
+
+	var out []string
+	fullyResolved := true
+	for i := 0; i < len(lines); {
+		line := lines[i]
+		if !strings.HasPrefix(line, conflictStartPrefix) {
+			out = append(out, line)
+			i++
+			continue
+		}
+		startLine := line
+		i++
+		oursStart := i
+		for i < len(lines) && !strings.HasPrefix(lines[i], conflictMidPrefix) {
+			i++
+		}
+		if i >= len(lines) {
+			return true, false, fmt.Errorf("malformed conflict markers in %s: missing %q", manifestPath, conflictMidPrefix)
+		}
+		ours := lines[oursStart:i]
+		midLine := lines[i]
+		i++
+		theirsStart := i
+		for i < len(lines) && !strings.HasPrefix(lines[i], conflictEndPrefix) {
+			i++
+		}
+		if i >= len(lines) {
+			return true, false, fmt.Errorf("malformed conflict markers in %s: missing %q", manifestPath, conflictEndPrefix)
+		}
+		theirs := lines[theirsStart:i]
+		endLine := lines[i]
+		i++
+
+		if len(ours) == 1 && strings.HasPrefix(ours[0], "version:") {
+			out = append(out, theirs...)
+			continue
+		}
+		fullyResolved = false
+		out = append(out, startLine)
+		out = append(out, ours...)
+		out = append(out, midLine)
+		out = append(out, theirs...)
+		out = append(out, endLine)
+	}
+
+	if !fullyResolved {
+		return true, false, nil
+	}
+
+	versionLines := 0
+	for _, l := range out {
+		if strings.HasPrefix(l, "version:") {
+			versionLines++
+		}
+	}
+	if versionLines != 1 {
+		return true, false, nil
+	}
+
+	if err := os.WriteFile(manifestPath, []byte(strings.Join(out, "\n")), info.Mode()); err != nil {
+		return true, false, fmt.Errorf("writing resolved %s: %w", manifestPath, err)
+	}
+	return true, true, nil
+}
+
+// extractChangelogFields reads changelog.yml directly from the source commit
+// and returns the change items from its first (newest) entry.
+func (a applier) extractChangelogFields(sha, changelogPath string) ([]changeItem, error) {
+	relPath, err := filepath.Rel(a.workDir, changelogPath)
+	if err != nil {
+		return nil, fmt.Errorf("computing repo-relative path for %s: %w", changelogPath, err)
+	}
+	content, err := a.git.Output("show", sha+":"+relPath)
+	if err != nil {
+		return nil, fmt.Errorf("reading changelog from commit %s: %w", sha, err)
+	}
+	changes := parseEntryFields(content)
+	if len(changes) == 0 {
+		return nil, fmt.Errorf("no changelog entries found in commit %s", sha)
+	}
+	if changes[0].Description == "" || changes[0].Type == "" || changes[0].Link == "" {
+		return nil, fmt.Errorf("no valid changelog entry found in commit %s", sha)
+	}
+	return changes, nil
+}
+
+// resetAndWriteChanges resets changelog.yml to the backport-branch state
+// (discarding the cherry-picked entry), bumps manifest.yml's patch version,
+// and inserts a fresh changelog entry. Returns the new version string.
+// manifest.yml is intentionally left as cherryPickOrConflict prepared it: any
+// legitimate cherry-picked content is preserved, and its version field was
+// already restored to the target branch's own version.
+func (a applier) resetAndWriteChanges(manifestPath, changelogPath string, changes []changeItem) (string, error) {
+	// cherryPickOrConflict already restores changelog.yml on the success path, so
+	// this checkout is redundant in normal flow. It is kept here so this function
+	// remains self-contained and correct if ever called from a different context.
+	if err := a.git.RunToStderr("checkout", "HEAD", "--", changelogPath); err != nil {
+		return "", fmt.Errorf("resetting changelog: %w", err)
+	}
+	newVersion, err := bumpPatchVersion(manifestPath)
+	if err != nil {
+		return "", fmt.Errorf("bumping version in %s: %w", manifestPath, err)
+	}
+	entryBlock, err := buildEntryBlock(newVersion, changes)
+	if err != nil {
+		return "", err
+	}
+	if err := changelog.InsertEntry(changelogPath, newVersion, entryBlock); err != nil {
+		return "", fmt.Errorf("inserting changelog entry: %w", err)
+	}
+	return newVersion, nil
+}
+
+// commitChanges stages all package changes and commits with the original commit
+// message plus a cherry-pick annotation.
+func (a applier) commitChanges(pkgDir, sha, newVersion string) error {
+	originalMsg, err := a.git.Output("log", "--format=%B", "-n", "1", sha)
+	if err != nil {
+		return fmt.Errorf("reading original commit message for %s: %w", sha, err)
+	}
+	commitMsg := strings.TrimRight(originalMsg, "\n") +
+		fmt.Sprintf("\n\n(cherry picked from commit %s)\n\nBackport version: %s", sha, newVersion)
+	if err := a.git.RunToStderr("add", pkgDir); err != nil {
+		return fmt.Errorf("staging changes: %w", err)
+	}
+	if err := a.git.RunToStderr("commit", "-m", commitMsg); err != nil {
+		return fmt.Errorf("committing: %w", err)
+	}
+	return nil
+}
+
+// syncOwners brings pkgDir's manifest.yml owner and CODEOWNERS entries in
+// line with sourceBranch's, as its own commit on top of the cherry-pick. It is
+// best-effort: any failure reading or parsing sourceBranch's state (fetch
+// failure, unparsable manifest, missing CODEOWNERS) is returned as a warning
+// string (and printed to stderr for human-mode callers) rather than failing the
+// whole backport. The CI check on PRs targeting backport-* branches
+// (elastic/integrations#19686) is the actual enforcement mechanism; this is a
+// convenience that keeps most backport PRs correct without it.
+// Returns "" on success or no-op, or a non-empty warning message when skipped.
+func (a applier) syncOwners(remote, sourceBranch, pkg, pkgDir string) string {
+	warn := func(format string, args ...any) string {
+		msg := fmt.Sprintf(format, args...)
+		fmt.Fprintf(os.Stderr, "warning: %s\n", msg)
+		return msg
+	}
+
+	plan, pkgPath, err := a.computeOwnerSyncPlan(remote, sourceBranch, pkgDir)
+	if err != nil {
+		return warn("skipping owner sync for %s: %v", pkg, err)
+	}
+	if plan.Empty() {
+		return ""
+	}
+
+	manifestPath := filepath.Join(pkgDir, "manifest.yml")
+	codeownersPath := filepath.Join(a.workDir, codeowners.DefaultCodeownersPath)
+	rollback := func() {
+		if rbErr := a.git.Run("checkout", "--", manifestPath, codeownersPath); rbErr != nil {
+			fmt.Fprintf(os.Stderr, "warning: could not restore files after owner sync failure for %s: %v\n", pkg, rbErr)
+		}
+	}
+
+	if err := writeOwnerSyncPlan(a.workDir, pkgDir, pkgPath, plan); err != nil {
+		rollback()
+		return warn("skipping owner sync for %s: %v", pkg, err)
+	}
+	if err := a.commitOwnerSync(pkg, manifestPath); err != nil {
+		rollback()
+		return warn("committing owner sync for %s: %v", pkg, err)
+	}
+	return ""
+}
+
+// computeOwnerSyncPlan fetches remote/sourceBranch and compares pkgDir's
+// current CODEOWNERS/manifest.yml owner against sourceBranch's, returning the
+// changes needed (if any) and pkgDir's CODEOWNERS path (e.g.
+// "/packages/aws"). A found-false result from owners.Plan (e.g. the package
+// no longer exists on sourceBranch) is reported as an empty, no-error plan:
+// it's a normal skip, not a failure.
+//
+// This fetch is a second network round-trip on top of the backport-branch
+// fetch already done in prepareWorkingBranch. It is intentional: ownership
+// comparison requires a current view of sourceBranch — a cached remote ref
+// could be arbitrarily stale — and there is no safe way to skip it.
+func (a applier) computeOwnerSyncPlan(remote, sourceBranch, pkgDir string) (plan owners.SyncPlan, pkgPath string, err error) {
+	if err := a.git.Run("fetch", remote, sourceBranch); err != nil {
+		return owners.SyncPlan{}, "", fmt.Errorf("fetching %s: %w", sourceBranch, err)
+	}
+	remoteRef := remote + "/" + sourceBranch
+
+	relPkgDir, err := filepath.Rel(a.workDir, pkgDir)
+	if err != nil {
+		return owners.SyncPlan{}, "", fmt.Errorf("resolving package path: %w", err)
+	}
+	relPkgDir = filepath.ToSlash(relPkgDir)
+	pkgPath = "/" + relPkgDir
+
+	syncPlan, found, err := owners.Compare(a.git, a.workDir, pkgDir, relPkgDir, remoteRef)
+	if err != nil {
+		return owners.SyncPlan{}, "", err
+	}
+	if !found {
+		return owners.SyncPlan{}, pkgPath, nil
+	}
+	return syncPlan, pkgPath, nil
+}
+
+// writeOwnerSyncPlan applies plan's changes to pkgDir/manifest.yml and
+// workDir/.github/CODEOWNERS.
+func writeOwnerSyncPlan(workDir, pkgDir, pkgPath string, plan owners.SyncPlan) error {
+	if plan.ManifestOwner != "" {
+		if err := setManifestOwner(filepath.Join(pkgDir, "manifest.yml"), plan.ManifestOwner); err != nil {
+			return fmt.Errorf("updating manifest owner: %w", err)
+		}
+	}
+
+	updates := make(map[string][]string, len(plan.SubPaths)+1)
+	if plan.PackageOwner != nil {
+		updates[pkgPath] = plan.PackageOwner
+	}
+	maps.Copy(updates, plan.SubPaths)
+	if len(updates) == 0 {
+		return nil
+	}
+
+	codeownersPath := filepath.Join(workDir, codeowners.DefaultCodeownersPath)
+	data, err := os.ReadFile(codeownersPath)
+	if err != nil {
+		return fmt.Errorf("reading %s: %w", codeowners.DefaultCodeownersPath, err)
+	}
+	info, err := os.Stat(codeownersPath)
+	if err != nil {
+		return err
+	}
+
+	updated := owners.ApplyUpdates(string(data), updates, pkgPath)
+	if err := os.WriteFile(codeownersPath, []byte(updated), info.Mode()); err != nil {
+		return fmt.Errorf("writing %s: %w", codeowners.DefaultCodeownersPath, err)
+	}
+	return nil
+}
+
+// setManifestOwner rewrites the "github:" line inside manifest.yml's "owner:"
+// block to newOwner, preserving the rest of the file's formatting.
+func setManifestOwner(manifestPath, newOwner string) error {
+	data, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return fmt.Errorf("reading %s: %w", manifestPath, err)
+	}
+	info, err := os.Stat(manifestPath)
+	if err != nil {
+		return err
+	}
+
+	lines := bytes.Split(data, []byte("\n"))
+	ownerIdx := slices.IndexFunc(lines, func(l []byte) bool {
+		return bytes.HasPrefix(l, []byte("owner:"))
+	})
+	if ownerIdx == -1 {
+		return fmt.Errorf("owner block not found in %s", manifestPath)
+	}
+
+	githubIdx := -1
+	for i := ownerIdx + 1; i < len(lines); i++ {
+		if len(lines[i]) > 0 && lines[i][0] != ' ' && lines[i][0] != '\t' {
+			break // left the owner block
+		}
+		// TrimLeft drops the indentation so the prefix check matches the key
+		// itself, not a comment mentioning "github:" further into the line.
+		if bytes.HasPrefix(bytes.TrimLeft(lines[i], " \t"), []byte("github:")) {
+			githubIdx = i
+			break
+		}
+	}
+	if githubIdx == -1 {
+		return fmt.Errorf("owner.github line not found in %s", manifestPath)
+	}
+
+	prefixEnd := bytes.Index(lines[githubIdx], []byte("github:")) + len("github:")
+	lines[githubIdx] = append(append([]byte{}, lines[githubIdx][:prefixEnd]...), []byte(" "+newOwner)...)
+
+	updated := bytes.Join(lines, []byte("\n"))
+	return os.WriteFile(manifestPath, updated, info.Mode())
+}
+
+// commitOwnerSync stages manifest.yml and CODEOWNERS and commits them
+// separately from the cherry-pick commit.
+func (a applier) commitOwnerSync(pkg, manifestPath string) error {
+	if err := a.git.Run("add", manifestPath); err != nil {
+		return fmt.Errorf("staging manifest.yml: %w", err)
+	}
+	if err := a.git.Run("add", filepath.Join(a.workDir, codeowners.DefaultCodeownersPath)); err != nil {
+		return fmt.Errorf("staging CODEOWNERS: %w", err)
+	}
+	if err := a.git.Run("commit", "-m", fmt.Sprintf("Sync %s package owners from main", pkg)); err != nil {
+		return fmt.Errorf("committing owner sync: %w", err)
+	}
+	return nil
+}
+
+// conflictingFiles returns files in a conflict state after a failed cherry-pick.
+func (a applier) conflictingFiles() ([]string, error) {
+	out, err := a.git.Output("status", "--porcelain")
+	if err != nil {
+		return nil, err
+	}
+	var files []string
+	// strings.SplitSeq requires go1.23; go.mod pins go1.22 for backport compatibility with older base commits.
+	for _, line := range strings.Split(string(out), "\n") {
+		if len(line) < 3 {
+			continue
+		}
+		xy := line[:2]
+		if strings.ContainsRune(xy, 'U') || xy == "AA" || xy == "DD" {
+			files = append(files, strings.TrimSpace(line[3:]))
+		}
+	}
+	return files, nil
+}
+
+// sentinelURL returns the placeholder link written into changelog.yml before
+// the backport PR URL is known. UpdateEntryLinks replaces it once the PR exists.
+func sentinelURL(repository string) string {
+	if repository == "" {
+		repository = "elastic/integrations"
+	}
+	return "https://github.com/" + repository + "/pull/REPLACE_ME"
+}
+
+// maybeOpenPR creates a GitHub PR if openPR is true, returning the PR URL.
+func maybeOpenPR(openPR bool, workingBranch, branchName, pkg, description, newVersion, sha, repository string) (string, error) {
+	if !openPR {
+		return "", nil
+	}
+	title := fmt.Sprintf("[%s] Backport %s (%s)", pkg, description, newVersion)
+	body := buildPRBody(sha, branchName, repository)
+	stdout, _, err := gh.Exec("pr", "create",
+		"--base", branchName,
+		"--head", workingBranch,
+		"--title", title,
+		"--body", body,
+	)
+	if err != nil {
+		return "", fmt.Errorf("creating PR: %w", err)
+	}
+	return strings.TrimSpace(stdout.String()), nil
+}
+
+// buildPRBody constructs the PR description, including origin links and an
+// author checklist.
+func buildPRBody(sha, branchName, repository string) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "Automated backport of commit `%s` onto `%s`.\n", sha, branchName)
+
+	if repository != "" {
+		fmt.Fprintf(&b, "\n## Origin\n\n")
+		fmt.Fprintf(&b, "- Commit: https://github.com/%s/commit/%s\n", repository, sha)
+		if prURL := findOriginPR(sha, repository); prURL != "" {
+			fmt.Fprintf(&b, "- Source PR: %s\n", prURL)
+		}
+	}
+
+	b.WriteString("\n## Author's checklist\n\n")
+	b.WriteString("- [ ] Review the version set in `manifest.yml` and `changelog.yml`\n")
+	b.WriteString("- [ ] Compare the `manifest.yml` changes here against the original PR (linked above under Origin) and confirm they match — a conflict limited to the version line is auto-resolved by keeping the incoming change as-is, with no compatibility check against this branch\n")
+	b.WriteString("- [ ] Review the links set in `changelog.yml`\n")
+
+	return b.String()
+}
+
+// findOriginPR returns the HTML URL of the first PR associated with sha in
+// repository (e.g. "elastic/integrations"). Returns an empty string when the
+// PR cannot be determined (no repository given, API error, or no associated PR).
+func findOriginPR(sha, repository string) string {
+	if repository == "" {
+		return ""
+	}
+	stdout, _, err := gh.Exec("api",
+		fmt.Sprintf("repos/%s/commits/%s/pulls", repository, sha),
+		"--jq", ".[0].html_url",
+	)
+	if err != nil {
+		return ""
+	}
+	url := strings.TrimSpace(stdout.String())
+	if url == "null" {
+		return ""
+	}
+	return url
+}
+
+// resolveBranchName derives the full backport branch name from target.
+// If target already matches the branch pattern it is returned as-is.
+// Otherwise "backport-<packageName>-<target>" is constructed and validated.
+func resolveBranchName(target, packageName string) (string, error) {
+	if branchRE.MatchString(target) {
+		return target, nil
+	}
+	branch := "backport-" + packageName + "-" + target
+	if !branchRE.MatchString(branch) {
+		return "", fmt.Errorf(
+			"cannot derive a valid branch name from package %q and target %q: "+
+				"constructed %q does not match backport-<package>-<version>",
+			packageName, target, branch,
+		)
+	}
+	return branch, nil
+}
+
+// bumpPatchVersion reads manifestPath, increments the patch version by one,
+// writes the file back preserving existing formatting, and returns the new version.
+func bumpPatchVersion(manifestPath string) (string, error) {
+	current, err := readManifestVersion(manifestPath)
+	if err != nil {
+		return "", err
+	}
+	ver, err := semver.StrictNewVersion(current)
+	if err != nil {
+		return "", fmt.Errorf("parsing version %q from %s: %w", current, manifestPath, err)
+	}
+	newVersion := fmt.Sprintf("%d.%d.%d", ver.Major(), ver.Minor(), ver.Patch()+1)
+	if err := setManifestVersion(manifestPath, newVersion); err != nil {
+		return "", fmt.Errorf("bumping version in %s: %w", manifestPath, err)
+	}
+	return newVersion, nil
+}
+
+// readManifestVersion returns the value of the "version" field in manifestPath.
+func readManifestVersion(manifestPath string) (string, error) {
+	m, err := citools.ReadPackageManifest(manifestPath)
+	if err != nil {
+		return "", fmt.Errorf("reading %s: %w", manifestPath, err)
+	}
+	if m.Version == "" {
+		return "", fmt.Errorf("version field not found in %s", manifestPath)
+	}
+	return m.Version, nil
+}
+
+// setManifestVersion rewrites the line starting with "version:" in manifestPath
+// to version, preserving quoting and the rest of the file's formatting.
+func setManifestVersion(manifestPath, version string) error {
+	current, err := readManifestVersion(manifestPath)
+	if err != nil {
+		return err
+	}
+	if current == version {
+		return nil
+	}
+
+	data, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return fmt.Errorf("reading %s: %w", manifestPath, err)
+	}
+	info, err := os.Stat(manifestPath)
+	if err != nil {
+		return err
+	}
+
+	// Replace the version digits only on the line that starts with "version:",
+	// preserving quotes and surrounding fields.
+	lines := bytes.Split(data, []byte("\n"))
+	idx := slices.IndexFunc(lines, func(l []byte) bool {
+		return bytes.HasPrefix(l, []byte("version:"))
+	})
+	if idx == -1 {
+		return fmt.Errorf("version line not found in %s", manifestPath)
+	}
+	lines[idx] = bytes.Replace(lines[idx], []byte(current), []byte(version), 1)
+	updated := bytes.Join(lines, []byte("\n"))
+	if err := os.WriteFile(manifestPath, updated, info.Mode()); err != nil {
+		return fmt.Errorf("writing %s: %w", manifestPath, err)
+	}
+	return nil
+}
+
+// changeItem represents a single entry in a changelog changes list.
+type changeItem struct {
+	Description string
+	Type        string
+	Link        string
+}
+
+type changelogEntryYAML struct {
+	Version string `yaml:"version"`
+	Changes []struct {
+		Description string `yaml:"description"`
+		Type        string `yaml:"type"`
+		Link        string `yaml:"link"`
+	} `yaml:"changes"`
+}
+
+// parseEntryFields extracts all change items from a changelog entry block.
+// Returns nil when the block cannot be parsed or contains no change items.
+func parseEntryFields(entryBlock string) []changeItem {
+	if entryBlock == "" {
+		return nil
+	}
+	var entries []changelogEntryYAML
+	if err := yaml.Unmarshal([]byte(entryBlock), &entries); err != nil || len(entries) == 0 {
+		return nil
+	}
+	changes := make([]changeItem, 0, len(entries[0].Changes))
+	for _, c := range entries[0].Changes {
+		changes = append(changes, changeItem{Description: c.Description, Type: c.Type, Link: c.Link})
+	}
+	return changes
+}
+
+// buildEntryBlock constructs the YAML changelog entry block for the given
+// version and change items. The version is double-quoted to match the format
+// used by elastic-package. All string fields are encoded via yaml.Marshal so
+// that special characters (e.g. ": " in a description) are quoted correctly.
+func buildEntryBlock(version string, changes []changeItem) (string, error) {
+	changeNodes := make([]*yaml.Node, 0, len(changes))
+	for _, c := range changes {
+		changeNodes = append(changeNodes, &yaml.Node{
+			Kind: yaml.MappingNode,
+			Content: []*yaml.Node{
+				{Kind: yaml.ScalarNode, Value: "description"},
+				{Kind: yaml.ScalarNode, Value: c.Description},
+				{Kind: yaml.ScalarNode, Value: "type"},
+				{Kind: yaml.ScalarNode, Value: c.Type},
+				{Kind: yaml.ScalarNode, Value: "link"},
+				{Kind: yaml.ScalarNode, Value: c.Link},
+			},
+		})
+	}
+	n := &yaml.Node{
+		Kind: yaml.SequenceNode,
+		Content: []*yaml.Node{{
+			Kind: yaml.MappingNode,
+			Content: []*yaml.Node{
+				{Kind: yaml.ScalarNode, Value: "version"},
+				{Kind: yaml.ScalarNode, Value: version, Style: yaml.DoubleQuotedStyle},
+				{Kind: yaml.ScalarNode, Value: "changes"},
+				{Kind: yaml.SequenceNode, Content: changeNodes},
+			},
+		}},
+	}
+	out, err := yaml.Marshal(n)
+	if err != nil {
+		return "", fmt.Errorf("marshalling changelog entry: %w", err)
+	}
+	return strings.TrimRight(string(out), "\n"), nil
+}
diff --git a/dev/backports/apply/apply_integration_test.go b/dev/backports/apply/apply_integration_test.go
new file mode 100644
index 00000000000..9888203056c
--- /dev/null
+++ b/dev/backports/apply/apply_integration_test.go
@@ -0,0 +1,1103 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package apply
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/elastic/integrations/dev/gitutil"
+)
+
+// setupIntegrationRepo creates a bare remote and a local clone pre-populated
+// with a kubernetes package at version 1.0.0, a matching backport branch on
+// the remote, and a single fix commit on main that bumps to 1.0.1. It returns
+// the local clone directory and the full SHA of the fix commit. This models
+// the very first backport onto a freshly cut branch: the branch hasn't
+// diverged yet, so its version still matches main's parent commit and the
+// cherry-pick applies cleanly with no version-line conflict at all.
+func setupIntegrationRepo(t *testing.T) (workDir, fixSHA string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+		return strings.TrimRight(string(out), "\n")
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	pkgDir := filepath.Join(workDir, "packages", "kubernetes")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+
+	// Commit the base state to get a real SHA for base_commit in .backports.yml.
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Initial release")
+	baseCommit := run(workDir, "rev-parse", "--short=10", "HEAD")
+
+	write(".backports.yml", "backports:\n"+
+		"  - package: kubernetes\n"+
+		"    branch: backport-kubernetes-1.x\n"+
+		"    base_version: \"1.0.0\"\n"+
+		"    base_commit: \""+baseCommit+"\"\n"+
+		"    maintained_until: null\n"+
+		"    archived: false\n"+
+		"    remove_other_packages: false\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add backports config")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	// Create the backport branch at the base state and push it to the remote.
+	run(workDir, "checkout", "-q", "-b", "backport-kubernetes-1.x")
+	run(workDir, "push", "-q", "origin", "backport-kubernetes-1.x")
+	run(workDir, "checkout", "-q", "main")
+
+	// Create the fix commit on main — this is the SHA to cherry-pick.
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.1\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.1\"\n"+
+		"  changes:\n"+
+		"    - description: Fix timeout in metrics collection.\n"+
+		"      type: bugfix\n"+
+		"      link: https://github.com/elastic/integrations/pull/999\n"+
+		"- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Fix timeout in metrics collection")
+	fixSHA = run(workDir, "rev-parse", "HEAD")
+
+	return workDir, fixSHA
+}
+
+// setupIntegrationRepoWithDivergedManifest is like setupIntegrationRepo, but
+// models the typical backport shape: the branch was cut from an elder commit
+// and has only advanced through one independent bump of its own (1.0.0 ->
+// 1.0.1), while main kept moving and the fix commit being cherry-picked
+// carries a much higher version (1.0.0 -> 1.4.0) — main is normally ahead of
+// any given backport branch. That gives a genuine version-line conflict
+// (base 1.0.0, branch 1.0.1, main's commit 1.4.0, all different). The fix
+// commit also adds an unrelated "categories" field that does not overlap
+// with anything the branch changed, so it should merge cleanly regardless of
+// the version conflict. The expected final version is 1.0.2 — the branch's
+// own lineage bumped by one — never anything derived from main's 1.4.0.
+func setupIntegrationRepoWithDivergedManifest(t *testing.T) (workDir, fixSHA string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+		return strings.TrimRight(string(out), "\n")
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	pkgDir := filepath.Join(workDir, "packages", "kubernetes")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Initial release")
+	baseCommit := run(workDir, "rev-parse", "--short=10", "HEAD")
+
+	write(".backports.yml", "backports:\n"+
+		"  - package: kubernetes\n"+
+		"    branch: backport-kubernetes-1.x\n"+
+		"    base_version: \"1.0.0\"\n"+
+		"    base_commit: \""+baseCommit+"\"\n"+
+		"    maintained_until: null\n"+
+		"    archived: false\n"+
+		"    remove_other_packages: false\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add backports config")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	// Create the backport branch, cut from the elder "Add backports config"
+	// commit, and give it one small independent bump of its own — a much
+	// smaller step than main will have taken by the time the fix below lands.
+	run(workDir, "checkout", "-q", "-b", "backport-kubernetes-1.x")
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.1\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Previous backport bump")
+	run(workDir, "push", "-q", "origin", "backport-kubernetes-1.x")
+	run(workDir, "checkout", "-q", "main")
+
+	// Create the fix commit on main: by now main has advanced well past the
+	// branch's own version (1.4.0 vs. the branch's 1.0.1), so the version line
+	// conflicts, while the unrelated "categories" field addition should merge
+	// cleanly and be preserved regardless.
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.4.0\ncategories:\n  - kubernetes\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.4.0\"\n"+
+		"  changes:\n"+
+		"    - description: Add categories field.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/999\n"+
+		"- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add categories field")
+	fixSHA = run(workDir, "rev-parse", "HEAD")
+
+	return workDir, fixSHA
+}
+
+func TestApplyIntegration_PreservesUnrelatedManifestChanges(t *testing.T) {
+	workDir, fixSHA := setupIntegrationRepoWithDivergedManifest(t)
+
+	result, err := Apply(Options{
+		SHA:         fixSHA,
+		Package:     "kubernetes",
+		Target:      "backport-kubernetes-1.x",
+		Remote:      "origin",
+		DryRun:      true,
+		PackagesDir: "packages",
+		Repository:  "elastic/integrations",
+		WorkDir:     workDir,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	// The branch's own version (1.0.1) wins the version-line conflict and is
+	// bumped from there (to 1.0.2), ignoring main's much further-advanced 1.4.0.
+	assert.Equal(t, "success", result.Status)
+	assert.Equal(t, "1.0.2", result.NewVersion)
+
+	manifestData, err := os.ReadFile(filepath.Join(workDir, "packages", "kubernetes", "manifest.yml"))
+	require.NoError(t, err)
+	assert.Contains(t, string(manifestData), "version: 1.0.2")
+	// The unrelated "categories" field added by the cherry-picked commit must
+	// survive, instead of being discarded along with the version conflict.
+	assert.Contains(t, string(manifestData), "categories:\n  - kubernetes\n")
+}
+
+// setupIntegrationRepoWithGenuineManifestConflict is like
+// setupIntegrationRepoWithDivergedManifest (elder branch at a small bump of
+// its own, main's fix commit carrying a much higher version), but both the
+// backport branch and the fix commit also change the "description" field
+// right next to their respective version bumps. That overlap falls outside
+// the version-only auto-resolution and must still be reported as a real
+// conflict requiring manual resolution — the final version never matters
+// here since the whole cherry-pick gets reset.
+func setupIntegrationRepoWithGenuineManifestConflict(t *testing.T) (workDir, fixSHA string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+		return strings.TrimRight(string(out), "\n")
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	pkgDir := filepath.Join(workDir, "packages", "kubernetes")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\ndescription: Original description.\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Initial release")
+	baseCommit := run(workDir, "rev-parse", "--short=10", "HEAD")
+
+	write(".backports.yml", "backports:\n"+
+		"  - package: kubernetes\n"+
+		"    branch: backport-kubernetes-1.x\n"+
+		"    base_version: \"1.0.0\"\n"+
+		"    base_commit: \""+baseCommit+"\"\n"+
+		"    maintained_until: null\n"+
+		"    archived: false\n"+
+		"    remove_other_packages: false\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add backports config")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	// Backport branch takes one small independent bump of its own, changing
+	// the description field right next to it.
+	run(workDir, "checkout", "-q", "-b", "backport-kubernetes-1.x")
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.1\ndescription: Branch description.\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Previous backport bump")
+	run(workDir, "push", "-q", "origin", "backport-kubernetes-1.x")
+	run(workDir, "checkout", "-q", "main")
+
+	// Fix commit on main has advanced much further (1.4.0) and also changes the
+	// description field, so the description change genuinely conflicts.
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.4.0\ndescription: Main description.\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.4.0\"\n"+
+		"  changes:\n"+
+		"    - description: Update description.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/999\n"+
+		"- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Update description")
+	fixSHA = run(workDir, "rev-parse", "HEAD")
+
+	return workDir, fixSHA
+}
+
+func TestApplyIntegration_ReportsGenuineManifestConflict(t *testing.T) {
+	workDir, fixSHA := setupIntegrationRepoWithGenuineManifestConflict(t)
+
+	result, err := Apply(Options{
+		SHA:         fixSHA,
+		Package:     "kubernetes",
+		Target:      "backport-kubernetes-1.x",
+		Remote:      "origin",
+		DryRun:      true,
+		PackagesDir: "packages",
+		Repository:  "elastic/integrations",
+		WorkDir:     workDir,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	assert.Equal(t, "conflict", result.Status)
+	assert.Contains(t, result.ConflictingFiles, "packages/kubernetes/manifest.yml")
+
+	// The working branch must be cleaned up so a retry doesn't fail with
+	// "branch already exists".
+	branches, err := gitutil.Git{Dir: workDir}.Output("branch", "--list", "auto-backport/*")
+	require.NoError(t, err)
+	assert.Empty(t, strings.TrimSpace(branches))
+}
+
+// setupIntegrationRepoWithDeletedManifest is like setupIntegrationRepo, but
+// the fix commit being cherry-picked removes the whole kubernetes package
+// (including manifest.yml) — modeling a package deprecation/removal on main
+// that the branch hasn't caught up with. The branch never touches
+// manifest.yml itself, so the deletion applies cleanly during cherry-pick
+// (no conflict markers at all, cherryErr == nil) — exactly the gap
+// manifestMissingConflict guards: without it, the pipeline would try to
+// version-bump a file that no longer exists and crash instead of reporting a
+// normal conflict.
+func setupIntegrationRepoWithDeletedManifest(t *testing.T) (workDir, fixSHA string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+		return strings.TrimRight(string(out), "\n")
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	pkgDir := filepath.Join(workDir, "packages", "kubernetes")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Initial release")
+	baseCommit := run(workDir, "rev-parse", "--short=10", "HEAD")
+
+	write(".backports.yml", "backports:\n"+
+		"  - package: kubernetes\n"+
+		"    branch: backport-kubernetes-1.x\n"+
+		"    base_version: \"1.0.0\"\n"+
+		"    base_commit: \""+baseCommit+"\"\n"+
+		"    maintained_until: null\n"+
+		"    archived: false\n"+
+		"    remove_other_packages: false\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add backports config")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	// Backport branch never touches the package itself.
+	run(workDir, "checkout", "-q", "-b", "backport-kubernetes-1.x")
+	run(workDir, "push", "-q", "origin", "backport-kubernetes-1.x")
+	run(workDir, "checkout", "-q", "main")
+
+	// Fix commit on main removes the whole package.
+	run(workDir, "rm", "-r", "-q", "packages/kubernetes")
+	run(workDir, "commit", "-q", "-m", "Remove deprecated kubernetes package")
+	fixSHA = run(workDir, "rev-parse", "HEAD")
+
+	// resolvePackage runs against whatever is physically checked out before
+	// Apply() switches to its own working branch, so leave the checkout on the
+	// backport branch (which still has the package) rather than main
+	// (post-deletion) — matching what the other setup helpers do implicitly.
+	run(workDir, "checkout", "-q", "backport-kubernetes-1.x")
+
+	return workDir, fixSHA
+}
+
+func TestApplyIntegration_ReportsConflictWhenManifestDeleted(t *testing.T) {
+	workDir, fixSHA := setupIntegrationRepoWithDeletedManifest(t)
+
+	result, err := Apply(Options{
+		SHA:         fixSHA,
+		Package:     "kubernetes",
+		Target:      "backport-kubernetes-1.x",
+		Remote:      "origin",
+		DryRun:      true,
+		PackagesDir: "packages",
+		Repository:  "elastic/integrations",
+		WorkDir:     workDir,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	assert.Equal(t, "conflict", result.Status)
+	assert.Contains(t, result.ConflictingFiles, "packages/kubernetes/manifest.yml")
+
+	// The working branch must be cleaned up so a retry doesn't fail with
+	// "branch already exists".
+	branches, err := gitutil.Git{Dir: workDir}.Output("branch", "--list", "auto-backport/*")
+	require.NoError(t, err)
+	assert.Empty(t, strings.TrimSpace(branches))
+}
+
+// setupIntegrationRepoWithMissingManifestBeforeCherryPick is like
+// setupIntegrationRepo, but the backport branch is cut before the kubernetes
+// package is ever added to the repo — it never has packages/kubernetes at
+// all, let alone a manifest.yml. The package only exists on main, where
+// resolvePackage (which runs against whatever is checked out before
+// prepareWorkingBranch switches to the backport branch) can find it and
+// resolve manifestPath — but that path doesn't exist once cherryPickOrConflict
+// actually looks for it on the checked-out backport branch, before any
+// cherry-pick has even run. This is the gap the pre-cherry-pick
+// manifestMissingConflict call guards: without it, readManifestVersion would
+// crash with an opaque os.ReadFile error instead of reporting a normal
+// conflict.
+func setupIntegrationRepoWithMissingManifestBeforeCherryPick(t *testing.T) (workDir, fixSHA string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+		return strings.TrimRight(string(out), "\n")
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	// The package doesn't exist yet at all — only .backports.yml does, as if
+	// the branch was pre-provisioned ahead of the package's addition.
+	write(".backports.yml", "backports:\n"+
+		"  - package: kubernetes\n"+
+		"    branch: backport-kubernetes-1.x\n"+
+		"    base_version: \"1.0.0\"\n"+
+		"    base_commit: \"0000000000\"\n"+
+		"    maintained_until: null\n"+
+		"    archived: false\n"+
+		"    remove_other_packages: false\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add backports config ahead of the package")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	// Cut the backport branch here: it never has packages/kubernetes.
+	run(workDir, "checkout", "-q", "-b", "backport-kubernetes-1.x")
+	run(workDir, "push", "-q", "origin", "backport-kubernetes-1.x")
+	run(workDir, "checkout", "-q", "main")
+
+	// The package is only added afterwards, on main.
+	pkgDir := filepath.Join(workDir, "packages", "kubernetes")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add kubernetes package")
+
+	// A later fix commit on main — this is the SHA to cherry-pick onto the
+	// backport branch, which still has never seen the package.
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.1\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.1\"\n"+
+		"  changes:\n"+
+		"    - description: Fix timeout in metrics collection.\n"+
+		"      type: bugfix\n"+
+		"      link: https://github.com/elastic/integrations/pull/999\n"+
+		"- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Fix timeout in metrics collection")
+	fixSHA = run(workDir, "rev-parse", "HEAD")
+
+	// Leave the checkout on main: resolvePackage needs the package to be
+	// present in whatever is physically checked out before Apply() switches to
+	// the backport branch, and main is the only ref that has it.
+	return workDir, fixSHA
+}
+
+func TestApplyIntegration_ReportsConflictWhenManifestMissingBeforeCherryPick(t *testing.T) {
+	workDir, fixSHA := setupIntegrationRepoWithMissingManifestBeforeCherryPick(t)
+
+	result, err := Apply(Options{
+		SHA:         fixSHA,
+		Package:     "kubernetes",
+		Target:      "backport-kubernetes-1.x",
+		Remote:      "origin",
+		DryRun:      true,
+		PackagesDir: "packages",
+		Repository:  "elastic/integrations",
+		WorkDir:     workDir,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	assert.Equal(t, "conflict", result.Status)
+	assert.Contains(t, result.ConflictingFiles, "packages/kubernetes/manifest.yml")
+
+	// The working branch must be cleaned up so a retry doesn't fail with
+	// "branch already exists".
+	branches, err := gitutil.Git{Dir: workDir}.Output("branch", "--list", "auto-backport/*")
+	require.NoError(t, err)
+	assert.Empty(t, strings.TrimSpace(branches))
+}
+
+// setupFixChangelogLinkRepo creates a bare remote and a local clone with a
+// working branch (auto-backport/kubernetes-1.x-abc12345) already checked out
+// and pushed, containing a changelog.yml with the sentinel link. This models
+// the state of the repo immediately after Apply() pushes the working branch
+// but before the link-fix commit is made.
+// Returns workDir, the absolute changelog path, and the version string.
+func setupFixChangelogLinkRepo(t *testing.T) (workDir, changelogPath, version string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	// An initial commit is required before we can push.
+	require.NoError(t, os.WriteFile(filepath.Join(workDir, "README"), []byte("init"), 0o644))
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Initial commit")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	// Create the working branch with the sentinel already committed.
+	version = "1.0.1"
+	pkgDir := filepath.Join(workDir, "packages", "kubernetes")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+	changelogPath = filepath.Join(pkgDir, "changelog.yml")
+
+	sentinel := sentinelURL("elastic/integrations")
+	require.NoError(t, os.WriteFile(changelogPath,
+		[]byte("- version: \"1.0.1\"\n  changes:\n    - description: Fix a bug.\n      type: bugfix\n      link: "+sentinel+"\n"),
+		0o644,
+	))
+	run(workDir, "checkout", "-q", "-b", "auto-backport/kubernetes-1.x-abc12345")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Fix a bug\n\nBackport version: 1.0.1")
+	run(workDir, "push", "-q", "origin", "HEAD")
+
+	return workDir, changelogPath, version
+}
+
+func TestFixChangelogLink_Success(t *testing.T) {
+	workDir, changelogPath, version := setupFixChangelogLinkRepo(t)
+
+	const realPRURL = "https://github.com/elastic/integrations/pull/5678"
+
+	a := applier{git: gitutil.Git{Dir: workDir}, workDir: workDir}
+	require.NoError(t, a.fixChangelogLink(changelogPath, version, realPRURL, "origin"))
+
+	// changelog.yml must contain the real PR URL, not the sentinel.
+	data, err := os.ReadFile(changelogPath)
+	require.NoError(t, err)
+	assert.Contains(t, string(data), realPRURL)
+	assert.NotContains(t, string(data), "REPLACE_ME")
+
+	// A second commit must exist with the expected message.
+	log, err := gitutil.Git{Dir: workDir}.Output("log", "--format=%s", "-n", "1")
+	require.NoError(t, err)
+	assert.Equal(t, "Fix changelog link to backport PR", strings.TrimSpace(log))
+
+	// The commit must have been pushed to the remote.
+	remoteLog, err := gitutil.Git{Dir: workDir}.Output("log", "--format=%s", "-n", "1", "origin/auto-backport/kubernetes-1.x-abc12345")
+	require.NoError(t, err)
+	assert.Equal(t, "Fix changelog link to backport PR", strings.TrimSpace(remoteLog))
+}
+
+func TestFixChangelogLink_PushFails(t *testing.T) {
+	workDir, changelogPath, version := setupFixChangelogLinkRepo(t)
+
+	// Break the remote so the push step fails.
+	cmd := exec.Command("git", "remote", "set-url", "origin", "/no/such/remote")
+	cmd.Dir = workDir
+	require.NoError(t, cmd.Run())
+
+	const realPRURL = "https://github.com/elastic/integrations/pull/5678"
+
+	a := applier{git: gitutil.Git{Dir: workDir}, workDir: workDir}
+	err := a.fixChangelogLink(changelogPath, version, realPRURL, "origin")
+	assert.Error(t, err)
+}
+
+// setupIntegrationRepoWithOwnerDrift is like setupIntegrationRepo, but adds
+// a .github/CODEOWNERS entry and a manifest.yml owner.github field for the
+// kubernetes package, then changes both on main — after the backport branch
+// was cut, but independently of the fix commit being cherry-picked — to
+// model ownership changing hands on main over a branch's lifetime.
+func setupIntegrationRepoWithOwnerDrift(t *testing.T) (workDir, fixSHA string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+		return strings.TrimRight(string(out), "\n")
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	pkgDir := filepath.Join(workDir, "packages", "kubernetes")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(workDir, ".github"), 0o755))
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\nowner:\n  github: elastic/obs-old-team\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	write(".github/CODEOWNERS", "/packages/kubernetes @elastic/obs-old-team\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Initial release")
+	baseCommit := run(workDir, "rev-parse", "--short=10", "HEAD")
+
+	write(".backports.yml", "backports:\n"+
+		"  - package: kubernetes\n"+
+		"    branch: backport-kubernetes-1.x\n"+
+		"    base_version: \"1.0.0\"\n"+
+		"    base_commit: \""+baseCommit+"\"\n"+
+		"    maintained_until: null\n"+
+		"    archived: false\n"+
+		"    remove_other_packages: false\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add backports config")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	// Create the backport branch here — ownership still matches main.
+	run(workDir, "checkout", "-q", "-b", "backport-kubernetes-1.x")
+	run(workDir, "push", "-q", "origin", "backport-kubernetes-1.x")
+	run(workDir, "checkout", "-q", "main")
+
+	// Ownership changes hands on main, unrelated to the upcoming fix commit.
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\nowner:\n  github: elastic/obs-new-team\n")
+	write(".github/CODEOWNERS", "/packages/kubernetes @elastic/obs-new-team\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Reassign kubernetes ownership")
+
+	// The fix commit to cherry-pick — a normal bugfix, unrelated to ownership.
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.1\nowner:\n  github: elastic/obs-new-team\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.1\"\n"+
+		"  changes:\n"+
+		"    - description: Fix timeout in metrics collection.\n"+
+		"      type: bugfix\n"+
+		"      link: https://github.com/elastic/integrations/pull/999\n"+
+		"- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Fix timeout in metrics collection")
+	fixSHA = run(workDir, "rev-parse", "HEAD")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+	run(workDir, "checkout", "-q", "main")
+
+	return workDir, fixSHA
+}
+
+func TestApplyIntegration_SyncsOwnersFromMain(t *testing.T) {
+	workDir, fixSHA := setupIntegrationRepoWithOwnerDrift(t)
+
+	result, err := Apply(Options{
+		SHA:         fixSHA,
+		Package:     "kubernetes",
+		Target:      "backport-kubernetes-1.x",
+		Remote:      "origin",
+		DryRun:      true,
+		PackagesDir: "packages",
+		Repository:  "elastic/integrations",
+		WorkDir:     workDir,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	assert.Equal(t, "success", result.Status)
+
+	// The backport branch's manifest owner and CODEOWNERS entry must now match
+	// main's current owner, even though the cherry-picked fix commit itself
+	// never touched ownership.
+	manifestData, err := os.ReadFile(filepath.Join(workDir, "packages", "kubernetes", "manifest.yml"))
+	require.NoError(t, err)
+	assert.Contains(t, string(manifestData), "github: elastic/obs-new-team")
+
+	codeownersData, err := os.ReadFile(filepath.Join(workDir, ".github", "CODEOWNERS"))
+	require.NoError(t, err)
+	assert.Contains(t, string(codeownersData), "/packages/kubernetes @elastic/obs-new-team")
+
+	// The owner sync must be its own commit, separate from the cherry-pick
+	// commit, so both are clearly attributable in review — and it must have
+	// been created before the (skipped, DryRun) push, i.e. it's visible in the
+	// local log immediately.
+	subjects, err := gitutil.Git{Dir: workDir}.Output("log", "--format=%s", "-n", "2")
+	require.NoError(t, err)
+	lines := strings.Split(strings.TrimSpace(subjects), "\n")
+	require.Len(t, lines, 2)
+	assert.Contains(t, lines[0], "owner")
+	assert.Contains(t, lines[1], "Fix timeout in metrics collection")
+}
+
+// setupIntegrationRepoWithMatchingOwners is like
+// setupIntegrationRepoWithOwnerDrift, but ownership never changes on main —
+// the backport branch and main agree throughout. This models the common case
+// where sync has nothing to do.
+func setupIntegrationRepoWithMatchingOwners(t *testing.T) (workDir, fixSHA string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+		return strings.TrimRight(string(out), "\n")
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	pkgDir := filepath.Join(workDir, "packages", "kubernetes")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(workDir, ".github"), 0o755))
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\nowner:\n  github: elastic/obs-team\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	write(".github/CODEOWNERS", "/packages/kubernetes @elastic/obs-team\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Initial release")
+	baseCommit := run(workDir, "rev-parse", "--short=10", "HEAD")
+
+	write(".backports.yml", "backports:\n"+
+		"  - package: kubernetes\n"+
+		"    branch: backport-kubernetes-1.x\n"+
+		"    base_version: \"1.0.0\"\n"+
+		"    base_commit: \""+baseCommit+"\"\n"+
+		"    maintained_until: null\n"+
+		"    archived: false\n"+
+		"    remove_other_packages: false\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add backports config")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	run(workDir, "checkout", "-q", "-b", "backport-kubernetes-1.x")
+	run(workDir, "push", "-q", "origin", "backport-kubernetes-1.x")
+	run(workDir, "checkout", "-q", "main")
+
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.1\nowner:\n  github: elastic/obs-team\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.1\"\n"+
+		"  changes:\n"+
+		"    - description: Fix timeout in metrics collection.\n"+
+		"      type: bugfix\n"+
+		"      link: https://github.com/elastic/integrations/pull/999\n"+
+		"- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Fix timeout in metrics collection")
+	fixSHA = run(workDir, "rev-parse", "HEAD")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+	run(workDir, "checkout", "-q", "main")
+
+	return workDir, fixSHA
+}
+
+func TestApplyIntegration_SkipsOwnerSyncCommitWhenOwnersMatch(t *testing.T) {
+	workDir, fixSHA := setupIntegrationRepoWithMatchingOwners(t)
+
+	result, err := Apply(Options{
+		SHA:         fixSHA,
+		Package:     "kubernetes",
+		Target:      "backport-kubernetes-1.x",
+		Remote:      "origin",
+		DryRun:      true,
+		PackagesDir: "packages",
+		Repository:  "elastic/integrations",
+		WorkDir:     workDir,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	assert.Equal(t, "success", result.Status)
+
+	// No owner drift, so no separate sync commit — only the cherry-pick commit.
+	subjects, err := gitutil.Git{Dir: workDir}.Output("log", "--format=%s", "-n", "2")
+	require.NoError(t, err)
+	lines := strings.Split(strings.TrimSpace(subjects), "\n")
+	require.Len(t, lines, 2)
+	assert.Contains(t, lines[0], "Fix timeout in metrics collection")
+	assert.NotContains(t, lines[0], "owner")
+	assert.Contains(t, lines[1], "Add backports config")
+}
+
+// setupIntegrationRepoWithUnreadableMainOwner is like
+// setupIntegrationRepoWithMatchingOwners, but main clears its manifest.yml
+// owner.github value (to "") in a commit ahead of the branch, unrelated to
+// the fix commit. The owner.github line itself is present throughout, on
+// both sides, and only its value changes — the same clean, value-only-change
+// shape as setupIntegrationRepoWithOwnerDrift, so the cherry-pick merges
+// without conflict (see the two 3-way-merge cases side by side: a line
+// theirs never touches always keeps ours' value, no matter how different
+// ours is from base — only a *structural* add/remove adjacent to a line
+// theirs does touch is conflict-prone, which this deliberately avoids). This
+// models a sync failure that isn't "package removed from main" (which Plan
+// already handles by skipping cleanly) but a genuine parse/read failure on
+// main's side: an empty owner.github is invalid, not merely absent.
+func setupIntegrationRepoWithUnreadableMainOwner(t *testing.T) (workDir, fixSHA string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+		return strings.TrimRight(string(out), "\n")
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	pkgDir := filepath.Join(workDir, "packages", "kubernetes")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(workDir, ".github"), 0o755))
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\nowner:\n  github: elastic/obs-team\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	write(".github/CODEOWNERS", "/packages/kubernetes @elastic/obs-team\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Initial release")
+	baseCommit := run(workDir, "rev-parse", "--short=10", "HEAD")
+
+	write(".backports.yml", "backports:\n"+
+		"  - package: kubernetes\n"+
+		"    branch: backport-kubernetes-1.x\n"+
+		"    base_version: \"1.0.0\"\n"+
+		"    base_commit: \""+baseCommit+"\"\n"+
+		"    maintained_until: null\n"+
+		"    archived: false\n"+
+		"    remove_other_packages: false\n")
+
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Add backports config")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	run(workDir, "checkout", "-q", "-b", "backport-kubernetes-1.x")
+	run(workDir, "push", "-q", "origin", "backport-kubernetes-1.x")
+	run(workDir, "checkout", "-q", "main")
+
+	// Main clears the owner value (not the line itself) — unrelated to the fix.
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.0\nowner:\n  github: \"\"\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Clear kubernetes owner")
+
+	write("packages/kubernetes/manifest.yml", "format_version: \"3.0.0\"\nname: kubernetes\ntype: integration\nversion: 1.0.1\nowner:\n  github: \"\"\n")
+	write("packages/kubernetes/changelog.yml", "- version: \"1.0.1\"\n"+
+		"  changes:\n"+
+		"    - description: Fix timeout in metrics collection.\n"+
+		"      type: bugfix\n"+
+		"      link: https://github.com/elastic/integrations/pull/999\n"+
+		"- version: \"1.0.0\"\n"+
+		"  changes:\n"+
+		"    - description: Initial release.\n"+
+		"      type: enhancement\n"+
+		"      link: https://github.com/elastic/integrations/pull/1\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Fix timeout in metrics collection")
+	fixSHA = run(workDir, "rev-parse", "HEAD")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+	run(workDir, "checkout", "-q", "main")
+
+	return workDir, fixSHA
+}
+
+func TestApplyIntegration_ContinuesWhenMainOwnerUnreadable(t *testing.T) {
+	workDir, fixSHA := setupIntegrationRepoWithUnreadableMainOwner(t)
+
+	result, err := Apply(Options{
+		SHA:         fixSHA,
+		Package:     "kubernetes",
+		Target:      "backport-kubernetes-1.x",
+		Remote:      "origin",
+		DryRun:      true,
+		PackagesDir: "packages",
+		Repository:  "elastic/integrations",
+		WorkDir:     workDir,
+	})
+	require.NoError(t, err, "a best-effort sync failure must not fail the whole backport")
+	require.NotNil(t, result)
+	assert.Equal(t, "success", result.Status)
+
+	// No sync commit was possible, so the branch's own owner is left as-is —
+	// and there must be no second commit at all.
+	manifestData, err := os.ReadFile(filepath.Join(workDir, "packages", "kubernetes", "manifest.yml"))
+	require.NoError(t, err)
+	assert.Contains(t, string(manifestData), "github: elastic/obs-team")
+
+	subjects, err := gitutil.Git{Dir: workDir}.Output("log", "--format=%s", "-n", "2")
+	require.NoError(t, err)
+	lines := strings.Split(strings.TrimSpace(subjects), "\n")
+	require.Len(t, lines, 2)
+	assert.Contains(t, lines[0], "Fix timeout in metrics collection")
+	assert.Contains(t, lines[1], "Add backports config")
+}
+
+func TestApplyIntegration_DryRun(t *testing.T) {
+	workDir, fixSHA := setupIntegrationRepo(t)
+
+	result, err := Apply(Options{
+		SHA:         fixSHA,
+		Package:     "kubernetes",
+		Target:      "backport-kubernetes-1.x",
+		Remote:      "origin",
+		DryRun:      true,
+		PackagesDir: "packages",
+		Repository:  "elastic/integrations",
+		WorkDir:     workDir,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	assert.Equal(t, "success", result.Status)
+	assert.Equal(t, "1.0.1", result.NewVersion)
+	assert.Equal(t, "backport-kubernetes-1.x", result.TargetBranch)
+	assert.Equal(t, "auto-backport/kubernetes-1.x-"+fixSHA[:8], result.WorkingBranch)
+
+	// Verify manifest was bumped to 1.0.1 on the working branch.
+	manifestData, err := os.ReadFile(filepath.Join(workDir, "packages", "kubernetes", "manifest.yml"))
+	require.NoError(t, err)
+	assert.Contains(t, string(manifestData), "version: 1.0.1")
+
+	// Verify the changelog contains the cherry-picked change description with
+	// the sentinel link — the original PR link (pull/999) must not appear.
+	changelogData, err := os.ReadFile(filepath.Join(workDir, "packages", "kubernetes", "changelog.yml"))
+	require.NoError(t, err)
+	assert.Contains(t, string(changelogData), "Fix timeout in metrics collection")
+	assert.Contains(t, string(changelogData), "pull/REPLACE_ME", "changelog must contain sentinel URL")
+	assert.NotContains(t, string(changelogData), "pull/999", "original PR link must not appear in backport changelog")
+
+	// Verify the backport commit was created with the expected message.
+	commitMsg, err := gitutil.Git{Dir: workDir}.Output("log", "--format=%B", "-n", "1")
+	require.NoError(t, err)
+	assert.Contains(t, commitMsg, "Fix timeout in metrics collection")
+	assert.Contains(t, commitMsg, "cherry picked from commit")
+	assert.Contains(t, commitMsg, "Backport version: 1.0.1")
+}
+
+func TestApplyIntegration_RestoresBranchAfterSuccess(t *testing.T) {
+	workDir, fixSHA := setupIntegrationRepo(t)
+
+	g := gitutil.Git{Dir: workDir}
+	before, err := g.Output("rev-parse", "--abbrev-ref", "HEAD")
+	require.NoError(t, err)
+	require.Equal(t, "main", strings.TrimSpace(before), "test pre-condition: must start on main")
+
+	result, err := Apply(Options{
+		SHA:         fixSHA,
+		Package:     "kubernetes",
+		Target:      "backport-kubernetes-1.x",
+		Remote:      "origin",
+		DryRun:      false,
+		OpenPR:      false,
+		PackagesDir: "packages",
+		Repository:  "elastic/integrations",
+		WorkDir:     workDir,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	assert.Equal(t, "success", result.Status)
+
+	// Apply() must restore the branch it found at entry — callers running mage
+	// targets after this call rely on the working tree holding the calling
+	// branch's tooling code, not the backport branch content.
+	after, err := g.Output("rev-parse", "--abbrev-ref", "HEAD")
+	require.NoError(t, err)
+	assert.Equal(t, "main", strings.TrimSpace(after), "Apply() must restore the original branch on success")
+}
diff --git a/dev/backports/apply/apply_test.go b/dev/backports/apply/apply_test.go
new file mode 100644
index 00000000000..9ce5d6cda3e
--- /dev/null
+++ b/dev/backports/apply/apply_test.go
@@ -0,0 +1,576 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package apply
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/elastic/integrations/dev/backports/owners"
+)
+
+func TestSentinelURL(t *testing.T) {
+	tests := []struct {
+		repository string
+		want       string
+	}{
+		{"elastic/integrations", "https://github.com/elastic/integrations/pull/REPLACE_ME"},
+		{"elastic/elastic-agent", "https://github.com/elastic/elastic-agent/pull/REPLACE_ME"},
+		{"", "https://github.com/elastic/integrations/pull/REPLACE_ME"},
+	}
+	for _, tc := range tests {
+		got := sentinelURL(tc.repository)
+		assert.Equal(t, tc.want, got)
+	}
+}
+
+func TestResolveBranchName(t *testing.T) {
+	tests := []struct {
+		target  string
+		pkg     string
+		want    string
+		wantErr bool
+	}{
+		{target: "6.14", pkg: "aws", want: "backport-aws-6.14"},
+		{target: "6.x", pkg: "aws", want: "backport-aws-6.x"},
+		{target: "backport-aws-6.14", pkg: "aws", want: "backport-aws-6.14"},
+		{target: "backport-prometheus-1.24", pkg: "prometheus", want: "backport-prometheus-1.24"},
+		{target: "bad version!", pkg: "aws", wantErr: true},
+		{target: "6.14", pkg: "bad pkg!", wantErr: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.target+"/"+tc.pkg, func(t *testing.T) {
+			got, err := resolveBranchName(tc.target, tc.pkg)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestWorkingBranchName(t *testing.T) {
+	tests := []struct {
+		pkg, branch, sha8, want string
+	}{
+		{"aws", "backport-aws-6.14", "abc12345", "auto-backport/aws-6.14-abc12345"},
+		{"prometheus", "backport-prometheus-1.24", "deadbeef", "auto-backport/prometheus-1.24-deadbeef"},
+	}
+	for _, tc := range tests {
+		got := workingBranchName(tc.pkg, tc.branch, tc.sha8)
+		assert.Equal(t, tc.want, got)
+	}
+}
+
+func TestBumpPatchVersion(t *testing.T) {
+	tests := []struct {
+		name        string
+		content     string
+		wantVersion string
+		wantContent string
+		wantErr     bool
+	}{
+		{
+			name:        "unquoted",
+			content:     "name: aws\nversion: 6.14.2\nformat_version: 3.0.0\n",
+			wantVersion: "6.14.3",
+			wantContent: "name: aws\nversion: 6.14.3\nformat_version: 3.0.0\n",
+		},
+		{
+			name:        "double-quoted",
+			content:     "name: zscaler\nversion: \"1.23.3\"\nformat_version: 3.0.0\n",
+			wantVersion: "1.23.4",
+			wantContent: "name: zscaler\nversion: \"1.23.4\"\nformat_version: 3.0.0\n",
+		},
+		{
+			name:        "single-quoted",
+			content:     "name: prom\nversion: '2.0.1'\nformat_version: 3.0.0\n",
+			wantVersion: "2.0.2",
+			wantContent: "name: prom\nversion: '2.0.2'\nformat_version: 3.0.0\n",
+		},
+		{
+			name:        "patch zero",
+			content:     "version: 1.0.0\n",
+			wantVersion: "1.0.1",
+			wantContent: "version: 1.0.1\n",
+		},
+		{
+			name:        "preserves rest of file",
+			content:     "name: mypackage\nformat_version: 3.0.0\nversion: 2.5.9\ndescription: A package.\n",
+			wantVersion: "2.5.10",
+			wantContent: "name: mypackage\nformat_version: 3.0.0\nversion: 2.5.10\ndescription: A package.\n",
+		},
+		{
+			name:    "missing version field",
+			content: "name: pkg\nformat_version: 3.0.0\n",
+			wantErr: true,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "manifest.yml")
+			require.NoError(t, os.WriteFile(path, []byte(tc.content), 0o644))
+
+			got, err := bumpPatchVersion(path)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantVersion, got)
+
+			updated, err := os.ReadFile(path)
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantContent, string(updated))
+		})
+	}
+}
+
+// TestResolveManifestVersionConflict follows the version convention of a
+// real backport: "ours" (the HEAD side of the conflict) is the backport
+// branch's own, older version — the branch was cut from an elder commit and
+// only advances through its own independent patch bumps. "theirs" is the
+// version the cherry-picked commit carries on main, which is normally ahead
+// since main keeps advancing on its own. Resolving a version-only conflict
+// keeps "theirs" content verbatim for now (including its higher version and
+// any adjacent field it added) — cherryPickOrConflict normalizes the version
+// back to the branch's own lineage immediately afterward, so the version
+// value seen here never survives into the final commit.
+func TestResolveManifestVersionConflict(t *testing.T) {
+	tests := []struct {
+		name            string
+		content         string
+		wantContent     string
+		wantHadConflict bool
+		wantResolved    bool
+	}{
+		{
+			name:            "no conflict markers",
+			content:         "name: aws\nversion: 6.14.2\nformat_version: 3.0.0\n",
+			wantContent:     "name: aws\nversion: 6.14.2\nformat_version: 3.0.0\n",
+			wantHadConflict: false,
+			wantResolved:    true,
+		},
+		{
+			// Branch is at 6.14.2 (its own lineage); main's commit shows 6.15.0,
+			// having advanced past where the branch branched off. Resolved content
+			// keeps 6.15.0 for now — bumpPatchVersion later produces 6.14.3, not
+			// 6.15.x, once cherryPickOrConflict normalizes the version back down.
+			name: "version-only conflict on our side keeps theirs",
+			content: "name: aws\n" +
+				"<<<<<<< HEAD\n" +
+				"version: 6.14.2\n" +
+				"=======\n" +
+				"version: 6.15.0\n" +
+				">>>>>>> abc1234 (Add feature)\n" +
+				"format_version: 3.0.0\n",
+			wantContent: "name: aws\n" +
+				"version: 6.15.0\n" +
+				"format_version: 3.0.0\n",
+			wantHadConflict: true,
+			wantResolved:    true,
+		},
+		{
+			// Branch is at 6.14.2; by the time this fix landed, main had advanced
+			// much further (6.18.0) and also added a "categories" field in the
+			// same commit. The resolved content preserves both the higher version
+			// and the new field — the field survives into the final commit, but
+			// the version is later normalized back to the branch's own lineage
+			// (6.14.3), same as the previous case.
+			name: "version-only conflict on our side preserves theirs' adjacent addition",
+			content: "name: aws\n" +
+				"<<<<<<< HEAD\n" +
+				"version: 6.14.2\n" +
+				"=======\n" +
+				"version: 6.18.0\n" +
+				"categories:\n" +
+				"  - kubernetes\n" +
+				">>>>>>> abc1234 (Add categories field)\n" +
+				"format_version: 3.0.0\n",
+			wantContent: "name: aws\n" +
+				"version: 6.18.0\n" +
+				"categories:\n" +
+				"  - kubernetes\n" +
+				"format_version: 3.0.0\n",
+			wantHadConflict: true,
+			wantResolved:    true,
+		},
+		{
+			// Not a realistic git shape: theirs dropping the version field
+			// without re-adding it anywhere else in the file would require an
+			// already-invalid, schema-violating main commit. This exists to
+			// exercise the versionLines-count safety net in
+			// resolveManifestVersionConflict as defense-in-depth, per its doc
+			// comment, not to simulate a plausible cherry-pick conflict.
+			name: "version-only conflict that would drop the version field entirely is left untouched",
+			content: "name: aws\n" +
+				"<<<<<<< HEAD\n" +
+				"version: 6.14.2\n" +
+				"=======\n" +
+				">>>>>>> abc1234 (Delete version)\n" +
+				"format_version: 3.0.0\n",
+			wantContent: "name: aws\n" +
+				"<<<<<<< HEAD\n" +
+				"version: 6.14.2\n" +
+				"=======\n" +
+				">>>>>>> abc1234 (Delete version)\n" +
+				"format_version: 3.0.0\n",
+			wantHadConflict: true,
+			wantResolved:    false,
+		},
+		{
+			name: "conflict with other content is left untouched",
+			content: "name: aws\n" +
+				"<<<<<<< HEAD\n" +
+				"version: 6.14.2\n" +
+				"owner:\n" +
+				"  github: elastic/obs-infraobs-integrations\n" +
+				"=======\n" +
+				"version: 6.15.0\n" +
+				">>>>>>> abc1234 (Add feature)\n" +
+				"format_version: 3.0.0\n",
+			wantContent: "name: aws\n" +
+				"<<<<<<< HEAD\n" +
+				"version: 6.14.2\n" +
+				"owner:\n" +
+				"  github: elastic/obs-infraobs-integrations\n" +
+				"=======\n" +
+				"version: 6.15.0\n" +
+				">>>>>>> abc1234 (Add feature)\n" +
+				"format_version: 3.0.0\n",
+			wantHadConflict: true,
+			wantResolved:    false,
+		},
+		{
+			name: "unrelated conflict on both sides is left untouched",
+			content: "name: aws\n" +
+				"version: 6.14.2\n" +
+				"<<<<<<< HEAD\n" +
+				"description: Old description.\n" +
+				"=======\n" +
+				"description: New description.\n" +
+				">>>>>>> abc1234 (Add feature)\n",
+			wantContent: "name: aws\n" +
+				"version: 6.14.2\n" +
+				"<<<<<<< HEAD\n" +
+				"description: Old description.\n" +
+				"=======\n" +
+				"description: New description.\n" +
+				">>>>>>> abc1234 (Add feature)\n",
+			wantHadConflict: true,
+			wantResolved:    false,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "manifest.yml")
+			require.NoError(t, os.WriteFile(path, []byte(tc.content), 0o644))
+
+			gotHadConflict, gotResolved, err := resolveManifestVersionConflict(path)
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantHadConflict, gotHadConflict, "hadConflict")
+			assert.Equal(t, tc.wantResolved, gotResolved, "resolved")
+
+			updated, err := os.ReadFile(path)
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantContent, string(updated))
+		})
+	}
+}
+
+func TestSetManifestVersion(t *testing.T) {
+	tests := []struct {
+		name        string
+		content     string
+		version     string
+		wantContent string
+	}{
+		{
+			name:        "unquoted",
+			content:     "name: aws\nversion: 6.14.2\nformat_version: 3.0.0\n",
+			version:     "6.14.5",
+			wantContent: "name: aws\nversion: 6.14.5\nformat_version: 3.0.0\n",
+		},
+		{
+			name:        "double-quoted",
+			content:     "name: zscaler\nversion: \"1.23.3\"\nformat_version: 3.0.0\n",
+			version:     "1.23.9",
+			wantContent: "name: zscaler\nversion: \"1.23.9\"\nformat_version: 3.0.0\n",
+		},
+		{
+			name:        "no-op when already set",
+			content:     "name: aws\nversion: 6.14.2\nformat_version: 3.0.0\n",
+			version:     "6.14.2",
+			wantContent: "name: aws\nversion: 6.14.2\nformat_version: 3.0.0\n",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "manifest.yml")
+			require.NoError(t, os.WriteFile(path, []byte(tc.content), 0o644))
+
+			require.NoError(t, setManifestVersion(path, tc.version))
+
+			updated, err := os.ReadFile(path)
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantContent, string(updated))
+		})
+	}
+}
+
+func TestSetManifestOwner(t *testing.T) {
+	tests := []struct {
+		name        string
+		content     string
+		newOwner    string
+		wantContent string
+		wantErr     bool
+	}{
+		{
+			name:        "basic replace",
+			content:     "name: aws\nversion: 6.14.2\nowner:\n  github: elastic/obs-old-team\n",
+			newOwner:    "elastic/obs-new-team",
+			wantContent: "name: aws\nversion: 6.14.2\nowner:\n  github: elastic/obs-new-team\n",
+		},
+		{
+			// The whole point of a targeted line rewrite (mirroring
+			// setManifestVersion) is that every other field — before the
+			// owner block, and the sibling "type:" field inside it — must
+			// survive byte-for-byte, not just "look similar".
+			name: "preserves rest of file, including sibling owner.type field",
+			content: "format_version: \"3.0.0\"\nname: aws\ntype: integration\nversion: 6.14.2\n" +
+				"owner:\n  github: elastic/obs-old-team\n  type: elastic\ndescription: An integration.\n",
+			newOwner: "elastic/obs-new-team",
+			wantContent: "format_version: \"3.0.0\"\nname: aws\ntype: integration\nversion: 6.14.2\n" +
+				"owner:\n  github: elastic/obs-new-team\n  type: elastic\ndescription: An integration.\n",
+		},
+		{
+			name:    "missing owner block",
+			content: "name: aws\nversion: 6.14.2\n",
+			wantErr: true,
+		},
+		{
+			name:    "owner block without a github field",
+			content: "name: aws\nversion: 6.14.2\nowner:\n  type: elastic\n",
+			wantErr: true,
+		},
+		{
+			// A comment mentioning "github:" ahead of the real field must not
+			// be mistaken for it — the match has to be anchored to the key,
+			// not just look for the substring anywhere on the line.
+			name:        "ignores a comment mentioning github: before the real field",
+			content:     "name: aws\nversion: 6.14.2\nowner:\n  # see github: https://example.com/teams\n  github: elastic/obs-old-team\n",
+			newOwner:    "elastic/obs-new-team",
+			wantContent: "name: aws\nversion: 6.14.2\nowner:\n  # see github: https://example.com/teams\n  github: elastic/obs-new-team\n",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "manifest.yml")
+			require.NoError(t, os.WriteFile(path, []byte(tc.content), 0o644))
+
+			err := setManifestOwner(path, tc.newOwner)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+
+			updated, err := os.ReadFile(path)
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantContent, string(updated))
+		})
+	}
+}
+
+// The CODEOWNERS-rewriting logic itself is tested directly in
+// dev/backports/owners (owners.ApplyUpdates) — writeOwnerSyncPlan is a thin
+// file-I/O wrapper around it plus setManifestOwner, tested here.
+func TestWriteOwnerSyncPlan(t *testing.T) {
+	workDir := t.TempDir()
+	pkgDir := filepath.Join(workDir, "packages", "aws")
+	require.NoError(t, os.MkdirAll(filepath.Join(workDir, ".github"), 0o755))
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(workDir, ".github", "CODEOWNERS"),
+		[]byte("/packages/aws @elastic/obs-old-team\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(pkgDir, "manifest.yml"),
+		[]byte("name: aws\nowner:\n  github: elastic/obs-old-team\n"), 0o644))
+
+	plan := owners.SyncPlan{
+		ManifestOwner: "elastic/obs-new-team",
+		PackageOwner:  []string{"@elastic/obs-new-team"},
+		SubPaths: map[string][]string{
+			"/packages/aws/data_stream/cloudtrail": {"@elastic/security-team"},
+		},
+	}
+
+	require.NoError(t, writeOwnerSyncPlan(workDir, pkgDir, "/packages/aws", plan))
+
+	manifestData, err := os.ReadFile(filepath.Join(pkgDir, "manifest.yml"))
+	require.NoError(t, err)
+	assert.Contains(t, string(manifestData), "github: elastic/obs-new-team")
+
+	codeownersData, err := os.ReadFile(filepath.Join(workDir, ".github", "CODEOWNERS"))
+	require.NoError(t, err)
+	assert.Equal(t,
+		"/packages/aws @elastic/obs-new-team\n/packages/aws/data_stream/cloudtrail @elastic/security-team\n",
+		string(codeownersData))
+}
+
+func TestWriteOwnerSyncPlan_SkipsCodeownersWhenPlanHasNoCodeownersChanges(t *testing.T) {
+	workDir := t.TempDir()
+	pkgDir := filepath.Join(workDir, "packages", "aws")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(pkgDir, "manifest.yml"),
+		[]byte("name: aws\nowner:\n  github: elastic/obs-old-team\n"), 0o644))
+
+	// No .github/CODEOWNERS file exists at all — writeOwnerSyncPlan must not
+	// try to read/write it when the plan has no PackageOwner/SubPaths changes.
+	plan := owners.SyncPlan{ManifestOwner: "elastic/obs-new-team"}
+
+	require.NoError(t, writeOwnerSyncPlan(workDir, pkgDir, "/packages/aws", plan))
+
+	manifestData, err := os.ReadFile(filepath.Join(pkgDir, "manifest.yml"))
+	require.NoError(t, err)
+	assert.Contains(t, string(manifestData), "github: elastic/obs-new-team")
+}
+
+func TestParseEntryFields(t *testing.T) {
+	tests := []struct {
+		name  string
+		block string
+		want  []changeItem
+	}{
+		{
+			name: "single item",
+			block: `- version: "1.2.3"
+  changes:
+    - description: Fix a bug in the ingestion pipeline.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/123`,
+			want: []changeItem{
+				{Description: "Fix a bug in the ingestion pipeline.", Type: "bugfix", Link: "https://github.com/elastic/integrations/pull/123"},
+			},
+		},
+		{
+			name: "multiple items",
+			block: `- version: "1.2.3"
+  changes:
+    - description: Fix a bug.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/1
+    - description: Add a feature.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/2`,
+			want: []changeItem{
+				{Description: "Fix a bug.", Type: "bugfix", Link: "https://github.com/elastic/integrations/pull/1"},
+				{Description: "Add a feature.", Type: "enhancement", Link: "https://github.com/elastic/integrations/pull/2"},
+			},
+		},
+		{
+			name: "missing link",
+			block: `- version: "1.2.3"
+  changes:
+    - description: Some enhancement.
+      type: enhancement`,
+			want: []changeItem{{Description: "Some enhancement.", Type: "enhancement"}},
+		},
+		{
+			name:  "empty block",
+			block: "",
+			want:  nil,
+		},
+		{
+			name:  "invalid yaml",
+			block: "not: [valid yaml: {",
+			want:  nil,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := parseEntryFields(tc.block)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestBuildEntryBlock(t *testing.T) {
+	tests := []struct {
+		name    string
+		version string
+		changes []changeItem
+		want    string
+	}{
+		{
+			name:    "single item",
+			version: "1.2.4",
+			changes: []changeItem{{Description: "Fix the thing.", Type: "bugfix", Link: "https://github.com/elastic/integrations/pull/999"}},
+			want: "- version: \"1.2.4\"\n" +
+				"  changes:\n" +
+				"    - description: Fix the thing.\n" +
+				"      type: bugfix\n" +
+				"      link: https://github.com/elastic/integrations/pull/999",
+		},
+		{
+			name:    "multiple items",
+			version: "1.2.4",
+			changes: []changeItem{
+				{Description: "Fix a bug.", Type: "bugfix", Link: "https://github.com/elastic/integrations/pull/1"},
+				{Description: "Add a feature.", Type: "enhancement", Link: "https://github.com/elastic/integrations/pull/2"},
+			},
+			want: "- version: \"1.2.4\"\n" +
+				"  changes:\n" +
+				"    - description: Fix a bug.\n" +
+				"      type: bugfix\n" +
+				"      link: https://github.com/elastic/integrations/pull/1\n" +
+				"    - description: Add a feature.\n" +
+				"      type: enhancement\n" +
+				"      link: https://github.com/elastic/integrations/pull/2",
+		},
+		{
+			name:    "colon-space in description",
+			version: "1.0.1",
+			changes: []changeItem{{Description: "Fix error: timeout in handler", Type: "bugfix", Link: "https://github.com/elastic/integrations/pull/1"}},
+			want: "- version: \"1.0.1\"\n" +
+				"  changes:\n" +
+				"    - description: 'Fix error: timeout in handler'\n" +
+				"      type: bugfix\n" +
+				"      link: https://github.com/elastic/integrations/pull/1",
+		},
+		{
+			name:    "leading bracket in description",
+			version: "1.0.1",
+			changes: []changeItem{{Description: "[aws] fix panic on nil", Type: "bugfix", Link: "https://github.com/elastic/integrations/pull/1"}},
+			want: "- version: \"1.0.1\"\n" +
+				"  changes:\n" +
+				"    - description: '[aws] fix panic on nil'\n" +
+				"      type: bugfix\n" +
+				"      link: https://github.com/elastic/integrations/pull/1",
+		},
+		{
+			name:    "hash in description",
+			version: "1.0.1",
+			changes: []changeItem{{Description: "remove # legacy field", Type: "bugfix", Link: "https://github.com/elastic/integrations/pull/1"}},
+			want: "- version: \"1.0.1\"\n" +
+				"  changes:\n" +
+				"    - description: 'remove # legacy field'\n" +
+				"      type: bugfix\n" +
+				"      link: https://github.com/elastic/integrations/pull/1",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := buildEntryBlock(tc.version, tc.changes)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
diff --git a/dev/backports/changelog/collect.go b/dev/backports/changelog/collect.go
new file mode 100644
index 00000000000..56421cc6a4d
--- /dev/null
+++ b/dev/backports/changelog/collect.go
@@ -0,0 +1,272 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/cli/go-gh/v2"
+
+	"github.com/elastic/integrations/dev/citools"
+	"github.com/elastic/integrations/dev/gitutil"
+)
+
+// CollectResult holds the outputs produced by Collect.
+type CollectResult struct {
+	HasChanges       bool
+	EntriesTSV       string // path to the written TSV file
+	WorkingBranch    string
+	BackportPRNumber string
+}
+
+// Collect finds changelog entries introduced between before and after that are
+// not yet present on main, writes them to a temp TSV file, and returns a
+// CollectResult. Returns HasChanges=false when nothing actionable is found.
+func Collect(before, after, repository string) (*CollectResult, error) {
+	prNumber, err := backportPRNumber(repository, after)
+	if err != nil {
+		return nil, fmt.Errorf("resolving backport PR number: %w", err)
+	}
+	if prNumber == "" {
+		fmt.Fprintf(os.Stderr, "no backport PR found for commit %s\n", after)
+		return &CollectResult{HasChanges: false}, nil
+	}
+
+	workingBranch := "changelog/pr-" + prNumber
+	exists, err := syncPRExists(workingBranch)
+	if err != nil {
+		return nil, fmt.Errorf("checking for existing sync PR: %w", err)
+	}
+	if exists {
+		return &CollectResult{HasChanges: false, BackportPRNumber: prNumber, WorkingBranch: workingBranch}, nil
+	}
+
+	git := gitutil.Git{}
+
+	changelogs, err := changedChangelogs(git, before, after)
+	if err != nil {
+		return nil, fmt.Errorf("listing changed changelogs: %w", err)
+	}
+
+	var lines []string
+	for _, cl := range changelogs {
+		line, err := collectChangelogEntry(git, before, after, cl)
+		if err != nil {
+			return nil, err
+		}
+		if line != "" {
+			lines = append(lines, line)
+		}
+	}
+
+	if len(lines) == 0 {
+		fmt.Fprintf(os.Stderr, "no changelog entry found for backport PR %s or already present in main branch\n", prNumber)
+		return &CollectResult{HasChanges: false, BackportPRNumber: prNumber, WorkingBranch: workingBranch}, nil
+	}
+
+	tsvFile, err := os.CreateTemp("", "changelog-entries-*.tsv")
+	if err != nil {
+		return nil, fmt.Errorf("creating temp file: %w", err)
+	}
+	defer tsvFile.Close()
+	for _, line := range lines {
+		fmt.Fprintln(tsvFile, line)
+	}
+
+	return &CollectResult{
+		HasChanges:       true,
+		EntriesTSV:       tsvFile.Name(),
+		WorkingBranch:    workingBranch,
+		BackportPRNumber: prNumber,
+	}, nil
+}
+
+// CheckVersionsAgainstMain finds changelog files that changed between before
+// and after and reports any versions that already exist in origin/main.
+// Each conflict is returned as a human-readable string "path: version X.Y.Z".
+// Intended for use in PR checks to catch duplicate version entries early.
+func CheckVersionsAgainstMain(git gitutil.Git, before, after string) ([]string, error) {
+	changelogs, err := changedChangelogs(git, before, after)
+	if err != nil {
+		return nil, err
+	}
+	var conflicts []string
+	for _, cl := range changelogs {
+		diff, err := gitDiff(git, before, after, cl)
+		if err != nil {
+			return nil, fmt.Errorf("diffing %s: %w", cl, err)
+		}
+		ver, _, err := ExtractFromDiff(diff)
+		if err != nil {
+			return nil, err
+		}
+		if ver == "" {
+			continue
+		}
+		inMain, err := versionInMain(git, cl, ver)
+		if err != nil {
+			return nil, err
+		}
+		if inMain {
+			conflicts = append(conflicts, fmt.Sprintf("%s: version %s", cl, ver))
+		}
+	}
+	return conflicts, nil
+}
+
+// collectChangelogEntry processes a single changelog path cl and returns the
+// TSV line to record ("pkg\tversion\tentryFilePath"), or "" when there is
+// nothing new to sync for that changelog.
+func collectChangelogEntry(git gitutil.Git, before, after, cl string) (string, error) {
+	pkgDir := filepath.Dir(cl)
+	// cl comes from a git diff, so it is a tracked file; its sibling manifest.yml
+	// must exist. A missing or unreadable manifest is a real error, not a skip.
+	pkgName, err := manifestName(pkgDir)
+	if err != nil {
+		return "", fmt.Errorf("reading manifest for %s: %w", pkgDir, err)
+	}
+
+	diff, err := gitDiff(git, before, after, cl)
+	if err != nil {
+		return "", fmt.Errorf("diffing %s: %w", cl, err)
+	}
+
+	ver, entry, err := ExtractFromDiff(diff)
+	if err != nil {
+		return "", err
+	}
+	if ver == "" {
+		return "", nil
+	}
+
+	alreadyInMain, err := versionInMain(git, cl, ver)
+	if err != nil {
+		return "", err
+	}
+	if alreadyInMain {
+		return "", nil
+	}
+
+	entryFile, err := os.CreateTemp("", "entry-*.yml")
+	if err != nil {
+		return "", err
+	}
+	defer entryFile.Close()
+
+	if _, err := fmt.Fprintln(entryFile, entry); err != nil {
+		return "", err
+	}
+
+	return fmt.Sprintf("%s\t%s\t%s", pkgName, ver, entryFile.Name()), nil
+}
+
+// backportPRNumber returns the PR number associated with the given commit SHA,
+// or "" if none is found after retries. The GitHub API association between a
+// merge commit and its PR may not be immediately available after the push
+// event fires, so we retry a few times with exponential backoff.
+func backportPRNumber(repository, sha string) (string, error) {
+	delays := []time.Duration{0, 5 * time.Second, 15 * time.Second, 30 * time.Second}
+	for i, d := range delays {
+		if d > 0 {
+			fmt.Fprintf(os.Stderr, "backportPRNumber: attempt %d/%d — waiting %s\n", i+1, len(delays), d)
+			time.Sleep(d)
+		}
+		stdout, _, err := gh.Exec("api",
+			fmt.Sprintf("repos/%s/commits/%s/pulls", repository, sha),
+			"--jq", ".[0].number // empty",
+		)
+		if err != nil {
+			return "", err
+		}
+		if n := strings.TrimSpace(stdout.String()); n != "" {
+			return n, nil
+		}
+	}
+	return "", nil
+}
+
+// syncPRExists returns true if a PR (open or closed) already exists with the
+// given head branch.
+func syncPRExists(workingBranch string) (bool, error) {
+	stdout, _, err := gh.Exec("pr", "list",
+		"--head", workingBranch,
+		"--state", "all",
+		"--json", "number",
+	)
+	if err != nil {
+		return false, err
+	}
+	var prs []struct{ Number int }
+	if err := json.Unmarshal(stdout.Bytes(), &prs); err != nil {
+		return false, fmt.Errorf("parsing PR list: %w", err)
+	}
+	return len(prs) > 0, nil
+}
+
+// changedChangelogs returns the paths of changelog.yml files introduced
+// between the common ancestor of before/after and after — scoping the result
+// to what the PR itself adds, ignoring commits pushed to the base branch
+// after the PR was branched.
+func changedChangelogs(git gitutil.Git, before, after string) ([]string, error) {
+	out, err := git.Output("diff", "--name-only", before+"..."+after, "--", "**/changelog.yml")
+	if err != nil {
+		return nil, err
+	}
+	var paths []string
+	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		if line != "" {
+			paths = append(paths, line)
+		}
+	}
+	return paths, nil
+}
+
+// manifestName reads the manifest.yml in pkgDir and returns the package name.
+func manifestName(pkgDir string) (string, error) {
+	manifest, err := citools.ReadPackageManifest(filepath.Join(pkgDir, citools.ManifestFileName))
+	if err != nil {
+		return "", err
+	}
+	return manifest.Name, nil
+}
+
+// gitDiff returns the unified diff for path using the three-dot notation
+// (git diff before...after), which diffs against the common ancestor of
+// before and after rather than before itself.
+func gitDiff(git gitutil.Git, before, after, path string) (string, error) {
+	out, err := git.Output("diff", before+"..."+after, "--", path)
+	if err != nil {
+		return "", err
+	}
+	return out, nil
+}
+
+// versionInMain checks whether version already appears in the main branch copy
+// of changelogPath.
+func versionInMain(git gitutil.Git, changelogPath, version string) (bool, error) {
+	out, err := git.Output("show", "origin/main:"+changelogPath)
+	if err != nil {
+		// file may not exist on main yet
+		return false, nil
+	}
+	return versionInContent(out, version), nil
+}
+
+// versionInContent reports whether version appears as a version header line
+// in content, using the same regex as ExtractFromDiff for consistency.
+func versionInContent(content, version string) bool {
+	for _, line := range strings.Split(content, "\n") {
+		m := versionLineRE.FindStringSubmatch(line)
+		if m != nil && m[1] == version {
+			return true
+		}
+	}
+	return false
+}
diff --git a/dev/backports/changelog/collect_test.go b/dev/backports/changelog/collect_test.go
new file mode 100644
index 00000000000..1b05f9a6823
--- /dev/null
+++ b/dev/backports/changelog/collect_test.go
@@ -0,0 +1,229 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/elastic/integrations/dev/gitutil"
+)
+
+func TestVersionInContent(t *testing.T) {
+	cases := []struct {
+		title   string
+		content string
+		version string
+		want    bool
+	}{
+		{
+			title:   "unquoted version matches",
+			content: "- version: 1.2.3\n  changes:\n    - description: Fix",
+			version: "1.2.3",
+			want:    true,
+		},
+		{
+			title:   "double-quoted version matches",
+			content: "- version: \"1.2.3\"\n  changes:\n    - description: Fix",
+			version: "1.2.3",
+			want:    true,
+		},
+		{
+			title:   "single-quoted version matches",
+			content: "- version: '1.2.3'\n  changes:\n    - description: Fix",
+			version: "1.2.3",
+			want:    true,
+		},
+		{
+			title:   "different version does not match",
+			content: "- version: \"1.0.0\"\n  changes:",
+			version: "1.2.3",
+			want:    false,
+		},
+		{
+			title:   "prerelease version matches exactly",
+			content: "- version: \"8.15.0-preview-1716438434\"\n  changes:",
+			version: "8.15.0-preview-1716438434",
+			want:    true,
+		},
+		{
+			title:   "empty content returns false",
+			content: "",
+			version: "1.0.0",
+			want:    false,
+		},
+		{
+			title:   "version appearing only in description does not match",
+			content: "- version: \"2.0.0\"\n  changes:\n    - description: Includes fix from 1.2.3",
+			version: "1.2.3",
+			want:    false,
+		},
+		{
+			title:   "version that is a prefix of a longer version does not match",
+			content: "- version: 1.2.30\n  changes:",
+			version: "1.2.3",
+			want:    false,
+		},
+		{
+			title:   "version that is a prefix of a longer quoted version does not match",
+			content: "- version: \"1.2.30\"\n  changes:",
+			version: "1.2.3",
+			want:    false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.title, func(t *testing.T) {
+			got := versionInContent(tc.content, tc.version)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+// setupCheckVersionsRepo creates a bare remote and a local clone with:
+//   - origin/main at version 1.5.0 for packages/aws/changelog.yml
+//   - origin/backport-aws-1.x branched from main (same initial state)
+//
+// It returns the local clone directory and a run helper. The clone is left
+// checked out on the backport branch, ready for the caller to commit PR changes.
+func setupCheckVersionsRepo(t *testing.T) (workDir string, run func(...string)) {
+	t.Helper()
+
+	run = func(args ...string) {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = workDir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+	}
+
+	remoteDir := t.TempDir()
+	cmd := exec.Command("git", "init", "--bare", "-q")
+	cmd.Dir = remoteDir
+	require.NoError(t, cmd.Run())
+
+	workDir = t.TempDir()
+	run("clone", "-q", remoteDir, workDir)
+	run("config", "user.email", "test@test.com")
+	run("config", "user.name", "Test")
+	run("config", "commit.gpgsign", "false")
+
+	pkgDir := filepath.Join(workDir, "packages", "aws")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	write("packages/aws/changelog.yml",
+		"- version: \"1.5.0\"\n"+
+			"  changes:\n"+
+			"    - description: Feature.\n"+
+			"      type: enhancement\n"+
+			"      link: https://github.com/elastic/integrations/pull/100\n")
+
+	run("add", ".")
+	run("commit", "-q", "-m", "initial: aws 1.5.0")
+	run("push", "-q", "origin", "HEAD:main")
+
+	run("push", "-q", "origin", "HEAD:backport-aws-1.x")
+	run("fetch", "-q", "origin")
+	run("checkout", "-q", "-b", "backport-aws-1.x", "--track", "origin/backport-aws-1.x")
+
+	return workDir, run
+}
+
+func TestCheckVersionsAgainstMain(t *testing.T) {
+	t.Run("no conflict — new version not in main", func(t *testing.T) {
+		workDir, run := setupCheckVersionsRepo(t)
+		git := gitutil.Git{Dir: workDir}
+
+		require.NoError(t, os.WriteFile(
+			filepath.Join(workDir, "packages", "aws", "changelog.yml"),
+			[]byte("- version: \"1.4.1\"\n"+
+				"  changes:\n"+
+				"    - description: Backport patch.\n"+
+				"      type: bug fix\n"+
+				"      link: https://github.com/elastic/integrations/pull/101\n"+
+				"- version: \"1.5.0\"\n"+
+				"  changes:\n"+
+				"    - description: Feature.\n"+
+				"      type: enhancement\n"+
+				"      link: https://github.com/elastic/integrations/pull/100\n"),
+			0o644))
+		run("add", ".")
+		run("commit", "-q", "-m", "add 1.4.1")
+
+		conflicts, err := CheckVersionsAgainstMain(git, "origin/backport-aws-1.x", "HEAD")
+		require.NoError(t, err)
+		assert.Empty(t, conflicts)
+	})
+
+	t.Run("conflict — version already present in main", func(t *testing.T) {
+		workDir, run := setupCheckVersionsRepo(t)
+		git := gitutil.Git{Dir: workDir}
+
+		run("checkout", "-q", "main")
+		require.NoError(t, os.WriteFile(
+			filepath.Join(workDir, "packages", "aws", "changelog.yml"),
+			[]byte("- version: \"1.5.1\"\n"+
+				"  changes:\n"+
+				"    - description: Sync.\n"+
+				"      type: bug fix\n"+
+				"      link: https://github.com/elastic/integrations/pull/102\n"+
+				"- version: \"1.5.0\"\n"+
+				"  changes:\n"+
+				"    - description: Feature.\n"+
+				"      type: enhancement\n"+
+				"      link: https://github.com/elastic/integrations/pull/100\n"),
+			0o644))
+		run("add", ".")
+		run("commit", "-q", "-m", "add 1.5.1 to main")
+		run("push", "-q", "origin", "main")
+		run("fetch", "-q", "origin")
+
+		run("checkout", "-q", "backport-aws-1.x")
+		require.NoError(t, os.WriteFile(
+			filepath.Join(workDir, "packages", "aws", "changelog.yml"),
+			[]byte("- version: \"1.5.1\"\n"+
+				"  changes:\n"+
+				"    - description: Backport patch.\n"+
+				"      type: bug fix\n"+
+				"      link: https://github.com/elastic/integrations/pull/103\n"+
+				"- version: \"1.5.0\"\n"+
+				"  changes:\n"+
+				"    - description: Feature.\n"+
+				"      type: enhancement\n"+
+				"      link: https://github.com/elastic/integrations/pull/100\n"),
+			0o644))
+		run("add", ".")
+		run("commit", "-q", "-m", "add 1.5.1 on backport")
+
+		conflicts, err := CheckVersionsAgainstMain(git, "origin/backport-aws-1.x", "HEAD")
+		require.NoError(t, err)
+		require.Len(t, conflicts, 1)
+		assert.Contains(t, conflicts[0], "1.5.1")
+		assert.Contains(t, conflicts[0], "packages/aws/changelog.yml")
+	})
+
+	t.Run("no changelog changes — returns empty", func(t *testing.T) {
+		workDir, run := setupCheckVersionsRepo(t)
+		git := gitutil.Git{Dir: workDir}
+
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, "README.md"), []byte("hello"), 0o644))
+		run("add", ".")
+		run("commit", "-q", "-m", "non-changelog change")
+
+		conflicts, err := CheckVersionsAgainstMain(git, "origin/backport-aws-1.x", "HEAD")
+		require.NoError(t, err)
+		assert.Empty(t, conflicts)
+	})
+}
diff --git a/dev/backports/changelog/comment.go b/dev/backports/changelog/comment.go
new file mode 100644
index 00000000000..60bca5214e3
--- /dev/null
+++ b/dev/backports/changelog/comment.go
@@ -0,0 +1,103 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/cli/go-gh/v2"
+)
+
+// PostComment posts a result comment on the originating backport PR.
+// It is a no-op when backportPRNumber or workingBranch is empty.
+func PostComment(backportPRNumber, workingBranch, notFoundPackages, outcome, runID, repository string) error {
+	if backportPRNumber == "" || workingBranch == "" {
+		return nil
+	}
+
+	body, err := buildCommentBody(workingBranch, notFoundPackages, outcome, runID, repository, syncPRURL, branchExistsOnRemote)
+	if err != nil {
+		return fmt.Errorf("building comment body: %w", err)
+	}
+
+	_, _, err = gh.Exec("pr", "comment", backportPRNumber, "--body", body)
+	return err
+}
+
+func buildCommentBody(
+	workingBranch, notFoundPackages, outcome, runID, repository string,
+	syncURLFn func(string) (string, error),
+	branchExistsFn func(string, string) (bool, error),
+) (string, error) {
+	switch outcome {
+	case "skipped":
+		return "**Changelog sync skipped** — all changelog versions are already present on `main`.", nil
+
+	case "success":
+		syncURL, err := syncURLFn(workingBranch)
+		if err != nil {
+			return "", err
+		}
+
+		if syncURL != "" {
+			body := fmt.Sprintf("**Changelog sync PR created:** %s", syncURL)
+			if notFoundPackages != "" {
+				body += fmt.Sprintf("\n\n> ⚠️ The following packages were not found on `main` and were skipped: `%s`", notFoundPackages)
+			}
+			return body, nil
+		}
+
+		compareURL := fmt.Sprintf("https://github.com/%s/compare/main...%s", repository, workingBranch)
+		body := fmt.Sprintf(
+			"**Changelog sync PR created** but its URL could not be retrieved — [open it manually](%s).",
+			compareURL,
+		)
+		if notFoundPackages != "" {
+			body += fmt.Sprintf("\n\n> ⚠️ The following packages were not found on `main` and were skipped: `%s`", notFoundPackages)
+		}
+		return body, nil
+
+	default: // failure
+		runURL := fmt.Sprintf("https://github.com/%s/actions/runs/%s", repository, runID)
+		body := fmt.Sprintf("**Changelog sync failed.** [View workflow run](%s)", runURL)
+
+		pushed, err := branchExistsFn(workingBranch, repository)
+		if err != nil {
+			return "", err
+		}
+		if pushed {
+			compareURL := fmt.Sprintf("https://github.com/%s/compare/main...%s", repository, workingBranch)
+			body += fmt.Sprintf("\n\nThe working branch was pushed. You can [open a PR manually](%s).", compareURL)
+		}
+		return body, nil
+	}
+}
+
+// syncPRURL returns the URL of an open PR with the given head branch, or "".
+func syncPRURL(workingBranch string) (string, error) {
+	stdout, _, err := gh.Exec("pr", "list",
+		"--head", workingBranch,
+		"--state", "open",
+		"--json", "url",
+		"--jq", ".[0].url // empty",
+	)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(stdout.String()), nil
+}
+
+// branchExistsOnRemote returns true if the branch exists on the remote.
+func branchExistsOnRemote(workingBranch, repository string) (bool, error) {
+	stdout, _, err := gh.Exec("api",
+		fmt.Sprintf("repos/%s/branches/%s", repository, workingBranch),
+		"--jq", ".name // empty",
+	)
+	if err != nil {
+		return false, nil // branch not found
+	}
+	return strings.TrimSpace(stdout.String()) == workingBranch, nil
+}
diff --git a/dev/backports/changelog/comment_test.go b/dev/backports/changelog/comment_test.go
new file mode 100644
index 00000000000..6da790a3253
--- /dev/null
+++ b/dev/backports/changelog/comment_test.go
@@ -0,0 +1,136 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPostComment_NoOp(t *testing.T) {
+	t.Run("empty backport PR number is a no-op", func(t *testing.T) {
+		require.NoError(t, PostComment("", "changelog/pr-42", "", "success", "123", "org/repo"))
+	})
+	t.Run("empty working branch is a no-op", func(t *testing.T) {
+		require.NoError(t, PostComment("42", "", "", "success", "123", "org/repo"))
+	})
+}
+
+func TestBuildCommentBody(t *testing.T) {
+	noURL := func(_ string) (string, error) { return "", nil }
+	withURL := func(_ string) (string, error) {
+		return "https://github.com/org/repo/pull/99", nil
+	}
+	errURL := func(_ string) (string, error) { return "", fmt.Errorf("gh unavailable") }
+	noBranch := func(_, _ string) (bool, error) { return false, nil }
+	withBranch := func(_, _ string) (bool, error) { return true, nil }
+
+	cases := []struct {
+		title          string
+		outcome        string
+		workingBranch  string
+		notFound       string
+		runID          string
+		repository     string
+		syncURLFn      func(string) (string, error)
+		branchExistsFn func(string, string) (bool, error)
+		wantContains   []string
+		wantErr        bool
+	}{
+		{
+			title:          "skipped — reports versions already on main",
+			outcome:        "skipped",
+			workingBranch:  "changelog/pr-42",
+			syncURLFn:      noURL,
+			branchExistsFn: noBranch,
+			wantContains:   []string{"skipped", "main"},
+		},
+		{
+			title:          "success — includes sync PR URL",
+			outcome:        "success",
+			workingBranch:  "changelog/pr-42",
+			syncURLFn:      withURL,
+			branchExistsFn: noBranch,
+			wantContains:   []string{"https://github.com/org/repo/pull/99"},
+		},
+		{
+			title:          "success — appends warning for not-found packages",
+			outcome:        "success",
+			workingBranch:  "changelog/pr-42",
+			notFound:       "missing_pkg",
+			syncURLFn:      withURL,
+			branchExistsFn: noBranch,
+			wantContains:   []string{"https://github.com/org/repo/pull/99", "missing_pkg"},
+		},
+		{
+			title:          "success — no sync URL shows compare link and could-not-retrieve message",
+			outcome:        "success",
+			workingBranch:  "changelog/pr-42",
+			repository:     "org/repo",
+			syncURLFn:      noURL,
+			branchExistsFn: noBranch,
+			wantContains:   []string{"could not be retrieved", "org/repo/compare/main...changelog/pr-42"},
+		},
+		{
+			title:          "success — no sync URL with not-found packages shows compare link and warning",
+			outcome:        "success",
+			workingBranch:  "changelog/pr-42",
+			notFound:       "missing_pkg",
+			repository:     "org/repo",
+			syncURLFn:      noURL,
+			branchExistsFn: noBranch,
+			wantContains:   []string{"could not be retrieved", "org/repo/compare/main...changelog/pr-42", "missing_pkg"},
+		},
+		{
+			title:          "success — syncURL error propagates",
+			outcome:        "success",
+			workingBranch:  "changelog/pr-42",
+			syncURLFn:      errURL,
+			branchExistsFn: noBranch,
+			wantErr:        true,
+		},
+		{
+			title:          "failure — includes run URL",
+			outcome:        "failure",
+			workingBranch:  "changelog/pr-42",
+			runID:          "99999",
+			repository:     "org/repo",
+			syncURLFn:      noURL,
+			branchExistsFn: noBranch,
+			wantContains:   []string{"99999", "org/repo"},
+		},
+		{
+			title:          "failure — pushed branch includes compare URL",
+			outcome:        "failure",
+			workingBranch:  "changelog/pr-42",
+			runID:          "123",
+			repository:     "org/repo",
+			syncURLFn:      noURL,
+			branchExistsFn: withBranch,
+			wantContains:   []string{"changelog/pr-42", "org/repo/compare/main...changelog/pr-42"},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.title, func(t *testing.T) {
+			body, err := buildCommentBody(
+				tc.workingBranch, tc.notFound, tc.outcome,
+				tc.runID, tc.repository,
+				tc.syncURLFn, tc.branchExistsFn,
+			)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			for _, want := range tc.wantContains {
+				assert.Contains(t, body, want)
+			}
+		})
+	}
+}
diff --git a/dev/backports/changelog/extract.go b/dev/backports/changelog/extract.go
new file mode 100644
index 00000000000..12a56853a8a
--- /dev/null
+++ b/dev/backports/changelog/extract.go
@@ -0,0 +1,57 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"regexp"
+	"strings"
+)
+
+// versionLineRE matches a changelog version header line with optional quoting:
+//
+//   - version: 1.2.3
+//   - version: "1.2.3-preview"
+var versionLineRE = regexp.MustCompile(`^- version:\s*["']?([0-9]+\.[0-9]+\.[0-9][^\s"']*)["']?\s*$`)
+
+// ExtractFromDiff parses a unified diff of a changelog.yml and returns the
+// first newly-added version string and its full entry block (the lines from
+// that version header up to, but not including, the next version header).
+//
+// Returns ("", "", nil) when the diff contains no added version entry.
+func ExtractFromDiff(diffText string) (version, entryBlock string, err error) {
+	var added []string
+	for _, line := range strings.Split(diffText, "\n") {
+		if strings.HasPrefix(line, "+++ ") {
+			continue
+		}
+		if strings.HasPrefix(line, "+") {
+			added = append(added, line[1:])
+		}
+	}
+
+	start := -1
+	end := len(added)
+
+	for i, line := range added {
+		m := versionLineRE.FindStringSubmatch(line)
+		if m == nil {
+			continue
+		}
+		if start == -1 {
+			start = i
+			version = m[1]
+		} else {
+			end = i
+			break
+		}
+	}
+
+	if start == -1 {
+		return "", "", nil
+	}
+
+	entryBlock = strings.Join(added[start:end], "\n")
+	return version, entryBlock, nil
+}
diff --git a/dev/backports/changelog/extract_test.go b/dev/backports/changelog/extract_test.go
new file mode 100644
index 00000000000..8026ac3a079
--- /dev/null
+++ b/dev/backports/changelog/extract_test.go
@@ -0,0 +1,118 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestExtractFromDiff(t *testing.T) {
+	cases := []struct {
+		title        string
+		diff         string
+		wantVersion  string
+		wantContains string
+		wantEmpty    bool
+	}{
+		{
+			title: "single version entry extracted",
+			diff: `--- a/changelog.yml
++++ b/changelog.yml
+@@ -1,3 +1,8 @@
++- version: "1.5.0"
++  changes:
++    - description: Added new field
++      type: enhancement
++      link: https://github.com/elastic/integrations/pull/100
+ - version: "1.4.0"
+   changes:`,
+			wantVersion:  "1.5.0",
+			wantContains: "Added new field",
+		},
+		{
+			title: "two version entries — only first is extracted",
+			diff: `--- a/changelog.yml
++++ b/changelog.yml
+@@ -1,3 +1,10 @@
++- version: "2.0.0"
++  changes:
++    - description: Breaking change
++      type: breaking-change
++      link: https://github.com/elastic/integrations/pull/200
++- version: "1.9.0"
++  changes:
++    - description: Minor fix
+ - version: "1.8.0"`,
+			wantVersion:  "2.0.0",
+			wantContains: "Breaking change",
+		},
+		{
+			title: "single version with multiple change entries",
+			diff: `--- a/changelog.yml
++++ b/changelog.yml
+@@ -1,3 +1,13 @@
++- version: "2.1.0"
++  changes:
++    - description: First enhancement
++      type: enhancement
++      link: https://github.com/elastic/integrations/pull/300
++    - description: Second bugfix
++      type: bugfix
++      link: https://github.com/elastic/integrations/pull/301
+ - version: "2.0.0"
+   changes:`,
+			wantVersion:  "2.1.0",
+			wantContains: "Second bugfix",
+		},
+		{
+			title: "unquoted version line",
+			diff: `+- version: 3.1.0
++  changes:
++    - description: Unquoted version`,
+			wantVersion:  "3.1.0",
+			wantContains: "Unquoted version",
+		},
+		{
+			title: "prerelease version",
+			diff: `+- version: "8.15.0-preview-1716438434"
++  changes:
++    - description: Preview release`,
+			wantVersion:  "8.15.0-preview-1716438434",
+			wantContains: "Preview release",
+		},
+		{
+			title:     "no added lines — returns empty",
+			diff:      " - version: \"1.0.0\"\n   changes:",
+			wantEmpty: true,
+		},
+		{
+			title:     "added lines but no version header — returns empty",
+			diff:      "+  - description: orphan change\n+    type: enhancement",
+			wantEmpty: true,
+		},
+		{
+			title:     "empty diff — returns empty",
+			diff:      "",
+			wantEmpty: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.title, func(t *testing.T) {
+			ver, entry, err := ExtractFromDiff(tc.diff)
+			require.NoError(t, err)
+			if tc.wantEmpty {
+				assert.Empty(t, ver)
+				assert.Empty(t, entry)
+				return
+			}
+			assert.Equal(t, tc.wantVersion, ver)
+			assert.Contains(t, entry, tc.wantContains)
+		})
+	}
+}
diff --git a/dev/backports/changelog/insert.go b/dev/backports/changelog/insert.go
new file mode 100644
index 00000000000..03b15339227
--- /dev/null
+++ b/dev/backports/changelog/insert.go
@@ -0,0 +1,67 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+
+	"github.com/Masterminds/semver/v3"
+)
+
+// versionEntryRE matches a changelog version header and captures the version string.
+var versionEntryRE = regexp.MustCompile(`^- version:\s*["']?([^\s"']+)["']?\s*$`)
+
+// InsertEntry inserts entryBlock into the changelog at changelogPath, placing
+// it before the first existing entry whose version is lower than newVersion,
+// preserving semver-descending order. It is idempotent: if newVersion is
+// already present the file is left unchanged.
+func InsertEntry(changelogPath, newVersion, entryBlock string) error {
+	info, err := os.Stat(changelogPath)
+	if err != nil {
+		return fmt.Errorf("reading changelog %s: %w", changelogPath, err)
+	}
+	data, err := os.ReadFile(changelogPath)
+	if err != nil {
+		return fmt.Errorf("reading changelog %s: %w", changelogPath, err)
+	}
+
+	newVer, err := semver.NewVersion(newVersion)
+	if err != nil {
+		return fmt.Errorf("parsing version %q: %w", newVersion, err)
+	}
+
+	lines := strings.Split(string(data), "\n")
+	insertAt := len(lines)
+
+	for i, line := range lines {
+		m := versionEntryRE.FindStringSubmatch(line)
+		if m == nil {
+			continue
+		}
+		existing := m[1]
+		if existing == newVersion {
+			return nil // already present — idempotent
+		}
+		existingVer, err := semver.NewVersion(existing)
+		if err != nil {
+			continue
+		}
+		if newVer.GreaterThan(existingVer) {
+			insertAt = i
+			break
+		}
+	}
+
+	entryLines := strings.Split(entryBlock, "\n")
+	result := make([]string, 0, len(lines)+len(entryLines))
+	result = append(result, lines[:insertAt]...)
+	result = append(result, entryLines...)
+	result = append(result, lines[insertAt:]...)
+
+	return os.WriteFile(changelogPath, []byte(strings.Join(result, "\n")), info.Mode())
+}
diff --git a/dev/backports/changelog/insert_test.go b/dev/backports/changelog/insert_test.go
new file mode 100644
index 00000000000..78f51921bb9
--- /dev/null
+++ b/dev/backports/changelog/insert_test.go
@@ -0,0 +1,94 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func writeChangelog(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "changelog.yml")
+	require.NoError(t, os.WriteFile(path, []byte(content), 0600))
+	return path
+}
+
+func TestInsertEntry(t *testing.T) {
+	newEntry := "- version: \"1.5.0\"\n  changes:\n    - description: New feature\n      type: enhancement\n      link: https://example.com/100"
+
+	t.Run("inserts between versions in correct order", func(t *testing.T) {
+		path := writeChangelog(t, `- version: "2.0.0"
+  changes:
+    - description: Major release
+- version: "1.0.0"
+  changes:
+    - description: Initial release
+`)
+		require.NoError(t, InsertEntry(path, "1.5.0", newEntry))
+		got, _ := os.ReadFile(path)
+		content := string(got)
+		assert.Contains(t, content, "1.5.0")
+		v2 := indexOfVersion(content, "2.0.0")
+		v15 := indexOfVersion(content, "1.5.0")
+		v1 := indexOfVersion(content, "1.0.0")
+		assert.True(t, v2 < v15 && v15 < v1, "order should be 2.0.0 > 1.5.0 > 1.0.0")
+	})
+
+	t.Run("inserts at top when higher than all existing", func(t *testing.T) {
+		path := writeChangelog(t, `- version: "1.0.0"
+  changes:
+    - description: Initial release
+`)
+		entry := "- version: \"9.9.9\"\n  changes:\n    - description: Future"
+		require.NoError(t, InsertEntry(path, "9.9.9", entry))
+		got, _ := os.ReadFile(path)
+		assert.True(t, indexOfVersion(string(got), "9.9.9") < indexOfVersion(string(got), "1.0.0"))
+	})
+
+	t.Run("inserts at bottom when lower than all existing", func(t *testing.T) {
+		path := writeChangelog(t, `- version: "2.0.0"
+  changes:
+    - description: Latest
+`)
+		entry := "- version: \"0.1.0\"\n  changes:\n    - description: Oldest"
+		require.NoError(t, InsertEntry(path, "0.1.0", entry))
+		got, _ := os.ReadFile(path)
+		assert.True(t, indexOfVersion(string(got), "2.0.0") < indexOfVersion(string(got), "0.1.0"))
+	})
+
+	t.Run("idempotent — existing version not duplicated", func(t *testing.T) {
+		original := "- version: \"1.0.0\"\n  changes:\n    - description: Only entry\n"
+		path := writeChangelog(t, original)
+		require.NoError(t, InsertEntry(path, "1.0.0", newEntry))
+		got, _ := os.ReadFile(path)
+		assert.Equal(t, original, string(got))
+	})
+
+	t.Run("missing file returns error", func(t *testing.T) {
+		err := InsertEntry("/no/such/changelog.yml", "1.0.0", newEntry)
+		assert.Error(t, err)
+	})
+
+	t.Run("header comment preserved", func(t *testing.T) {
+		path := writeChangelog(t, `# Changelog
+- version: "1.0.0"
+  changes:
+    - description: Initial
+`)
+		require.NoError(t, InsertEntry(path, "1.5.0", newEntry))
+		got, _ := os.ReadFile(path)
+		assert.Contains(t, string(got), "# Changelog")
+	})
+}
+
+func indexOfVersion(content, version string) int {
+	return strings.Index(content, "- version: \""+version+"\"")
+}
diff --git a/dev/backports/changelog/resolve.go b/dev/backports/changelog/resolve.go
new file mode 100644
index 00000000000..bfffc66dadd
--- /dev/null
+++ b/dev/backports/changelog/resolve.go
@@ -0,0 +1,27 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"fmt"
+
+	"github.com/elastic/integrations/dev/citools"
+)
+
+// BuildPackageIndex returns a map of package name → directory for every
+// package found under packagesDir.
+func BuildPackageIndex(packagesDir string) (map[string]string, error) {
+	pkgs, err := citools.ListPackagesWithNames(packagesDir)
+	if err != nil {
+		return nil, fmt.Errorf("listing packages under %s: %w", packagesDir, err)
+	}
+
+	index := make(map[string]string, len(pkgs))
+	for _, p := range pkgs {
+		index[p.Name] = p.Path
+	}
+
+	return index, nil
+}
diff --git a/dev/backports/changelog/resolve_test.go b/dev/backports/changelog/resolve_test.go
new file mode 100644
index 00000000000..0542cf389eb
--- /dev/null
+++ b/dev/backports/changelog/resolve_test.go
@@ -0,0 +1,82 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func makePackage(t *testing.T, baseDir, dirName, manifestName string) {
+	t.Helper()
+	dir := filepath.Join(baseDir, dirName)
+	require.NoError(t, os.MkdirAll(dir, 0700))
+	manifest := "format_version: \"1.0.0\"\nname: " + manifestName + "\ntype: integration\nversion: \"1.0.0\"\n"
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "manifest.yml"), []byte(manifest), 0600))
+}
+
+func TestBuildPackageIndex(t *testing.T) {
+	t.Run("indexes all packages by manifest name", func(t *testing.T) {
+		base := t.TempDir()
+		makePackage(t, base, "aws", "aws")
+		makePackage(t, base, "azure", "azure")
+
+		idx, err := BuildPackageIndex(base)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(base, "aws"), idx["aws"])
+		assert.Equal(t, filepath.Join(base, "azure"), idx["azure"])
+	})
+
+	t.Run("manifest name differs from directory name", func(t *testing.T) {
+		base := t.TempDir()
+		makePackage(t, base, "my_pkg_dir", "actual_manifest_name")
+
+		idx, err := BuildPackageIndex(base)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(base, "my_pkg_dir"), idx["actual_manifest_name"])
+	})
+
+	t.Run("unknown package returns empty string from map lookup", func(t *testing.T) {
+		base := t.TempDir()
+		makePackage(t, base, "aws", "aws")
+
+		idx, err := BuildPackageIndex(base)
+		require.NoError(t, err)
+		assert.Empty(t, idx["no_such_package"])
+	})
+
+	t.Run("invalid packages dir returns error", func(t *testing.T) {
+		_, err := BuildPackageIndex("/no/such/dir")
+		assert.Error(t, err)
+	})
+
+	t.Run("package nested in a subdirectory is indexed", func(t *testing.T) {
+		// packagesDir
+		//   └── group/
+		//         └── aws/   ← manifest.yml lives here
+		base := t.TempDir()
+		makePackage(t, filepath.Join(base, "group"), "aws", "aws")
+
+		idx, err := BuildPackageIndex(base)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(base, "group", "aws"), idx["aws"])
+	})
+
+	t.Run("package nested inside another package is not indexed", func(t *testing.T) {
+		// ListPackages returns SkipDir once a package is found, so a manifest.yml
+		// inside a valid package directory is never visited.
+		base := t.TempDir()
+		makePackage(t, base, "aws", "aws")
+		makePackage(t, filepath.Join(base, "aws"), "subpkg", "aws_subpkg")
+
+		idx, err := BuildPackageIndex(base)
+		require.NoError(t, err)
+		assert.Empty(t, idx["aws_subpkg"], "nested package inside a found package must not be indexed")
+	})
+}
diff --git a/dev/backports/changelog/sync.go b/dev/backports/changelog/sync.go
new file mode 100644
index 00000000000..ed1a5c5bb9d
--- /dev/null
+++ b/dev/backports/changelog/sync.go
@@ -0,0 +1,140 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/cli/go-gh/v2"
+
+	"github.com/elastic/integrations/dev/gitutil"
+)
+
+// SyncResult holds outputs produced by CreateSyncPR.
+type SyncResult struct {
+	// NotFoundPackages lists package names that could not be resolved on main.
+	NotFoundPackages []string
+	// Outcome is "success", "skipped", or "error".
+	Outcome string
+}
+
+// CreateSyncPR applies the changelog entries from entriesTSV onto main,
+// commits them to workingBranch, and opens a GitHub PR.
+// workDir is the repository root; an empty string uses the current working directory.
+func CreateSyncPR(workDir, entriesTSV, workingBranch, backportPRNumber, backportBranch, packagesDir, repository string) (*SyncResult, error) {
+	git := gitutil.Git{Dir: workDir}
+
+	if !filepath.IsAbs(packagesDir) {
+		packagesDir = filepath.Join(workDir, packagesDir)
+	}
+
+	if err := git.RunToStderr("checkout", "-b", workingBranch, "origin/main"); err != nil {
+		return nil, fmt.Errorf("creating working branch: %w", err)
+	}
+
+	entries, err := readEntriesTSV(entriesTSV)
+	if err != nil {
+		return nil, fmt.Errorf("reading entries TSV: %w", err)
+	}
+
+	pkgIndex, err := BuildPackageIndex(packagesDir)
+	if err != nil {
+		return nil, fmt.Errorf("building package index: %w", err)
+	}
+
+	var notFound []string
+	var applied []tsvEntry
+
+	for _, e := range entries {
+		pkgDir, ok := pkgIndex[e.pkg]
+		if !ok {
+			notFound = append(notFound, e.pkg)
+			continue
+		}
+
+		changelogPath := filepath.Join(pkgDir, "changelog.yml")
+		entryBlock, err := os.ReadFile(e.entryFile)
+		if err != nil {
+			return nil, fmt.Errorf("reading entry file %s: %w", e.entryFile, err)
+		}
+		_ = os.Remove(e.entryFile)
+		if err := InsertEntry(changelogPath, e.version, strings.TrimRight(string(entryBlock), "\n")); err != nil {
+			return nil, fmt.Errorf("inserting entry for %s: %w", e.pkg, err)
+		}
+		if err := git.RunToStderr("add", changelogPath); err != nil {
+			return nil, err
+		}
+		applied = append(applied, e)
+	}
+
+	if len(applied) == 0 {
+		_ = git.RunToStderr("checkout", backportBranch)
+		return &SyncResult{NotFoundPackages: notFound, Outcome: "skipped"}, nil
+	}
+
+	commitMsg := buildCommitMessage(applied, backportPRNumber)
+	prTitle := buildPRTitle(applied, backportPRNumber)
+
+	if err := git.RunToStderr("commit", "-m", commitMsg); err != nil {
+		return nil, fmt.Errorf("committing: %w", err)
+	}
+	if err := git.RunToStderr("push", "origin", workingBranch); err != nil {
+		return nil, fmt.Errorf("pushing: %w", err)
+	}
+
+	body := fmt.Sprintf("Automated changelog sync from backport PR #%s.\n\nGenerated by the sync-backport-changelog workflow.", backportPRNumber)
+
+	_, _, err = gh.Exec("pr", "create",
+		"--base", "main",
+		"--head", workingBranch,
+		"--title", prTitle,
+		"--label", "backport:sync-changelog",
+		"--label", "changelog-link-check:skip",
+		"--reviewer", "elastic/ecosystem",
+		"--body", body,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("creating PR: %w", err)
+	}
+
+	_ = git.RunToStderr("checkout", backportBranch)
+	return &SyncResult{NotFoundPackages: notFound, Outcome: "success"}, nil
+}
+
+type tsvEntry struct{ pkg, version, entryFile string }
+
+func readEntriesTSV(path string) ([]tsvEntry, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	var entries []tsvEntry
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		parts := strings.SplitN(sc.Text(), "\t", 3)
+		if len(parts) != 3 {
+			continue
+		}
+		entries = append(entries, tsvEntry{pkg: parts[0], version: parts[1], entryFile: parts[2]})
+	}
+	return entries, sc.Err()
+}
+
+func buildCommitMessage(entries []tsvEntry, prNumber string) string {
+	if len(entries) == 1 {
+		return fmt.Sprintf("changelog: %s %s (backport sync from PR #%s)", entries[0].pkg, entries[0].version, prNumber)
+	}
+	return fmt.Sprintf("changelog: backport sync from PR #%s", prNumber)
+}
+
+func buildPRTitle(entries []tsvEntry, prNumber string) string {
+	return buildCommitMessage(entries, prNumber)
+}
diff --git a/dev/backports/changelog/sync_test.go b/dev/backports/changelog/sync_test.go
new file mode 100644
index 00000000000..4d01ad0d29a
--- /dev/null
+++ b/dev/backports/changelog/sync_test.go
@@ -0,0 +1,86 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func writeTSV(t *testing.T, content string) string {
+	t.Helper()
+	f, err := os.CreateTemp(t.TempDir(), "entries-*.tsv")
+	require.NoError(t, err)
+	_, err = fmt.Fprint(f, content)
+	require.NoError(t, err)
+	require.NoError(t, f.Close())
+	return f.Name()
+}
+
+func TestReadEntriesTSV(t *testing.T) {
+	t.Run("valid file with multiple entries", func(t *testing.T) {
+		path := writeTSV(t, "aws\t1.2.3\t/tmp/e1.yml\nazure\t2.0.0\t/tmp/e2.yml\n")
+		entries, err := readEntriesTSV(path)
+		require.NoError(t, err)
+		require.Len(t, entries, 2)
+		assert.Equal(t, tsvEntry{"aws", "1.2.3", "/tmp/e1.yml"}, entries[0])
+		assert.Equal(t, tsvEntry{"azure", "2.0.0", "/tmp/e2.yml"}, entries[1])
+	})
+
+	t.Run("empty file returns empty slice", func(t *testing.T) {
+		path := writeTSV(t, "")
+		entries, err := readEntriesTSV(path)
+		require.NoError(t, err)
+		assert.Empty(t, entries)
+	})
+
+	t.Run("lines with wrong field count are skipped", func(t *testing.T) {
+		path := writeTSV(t, "only-one-field\naws\t1.2.3\t/tmp/e.yml\n")
+		entries, err := readEntriesTSV(path)
+		require.NoError(t, err)
+		require.Len(t, entries, 1)
+		assert.Equal(t, "aws", entries[0].pkg)
+	})
+
+	t.Run("entry file path may contain tabs via SplitN limit", func(t *testing.T) {
+		// entryFile path should not be split even if it contained a tab
+		path := writeTSV(t, "aws\t1.2.3\t/tmp/entry file.yml\n")
+		entries, err := readEntriesTSV(path)
+		require.NoError(t, err)
+		require.Len(t, entries, 1)
+		assert.Equal(t, "/tmp/entry file.yml", entries[0].entryFile)
+	})
+
+	t.Run("file not found returns error", func(t *testing.T) {
+		_, err := readEntriesTSV("/no/such/file.tsv")
+		assert.Error(t, err)
+	})
+}
+
+func TestBuildCommitMessage(t *testing.T) {
+	t.Run("single entry names package and version", func(t *testing.T) {
+		entries := []tsvEntry{{pkg: "aws", version: "1.2.3", entryFile: "/tmp/e.yml"}}
+		msg := buildCommitMessage(entries, "42")
+		assert.Equal(t, "changelog: aws 1.2.3 (backport sync from PR #42)", msg)
+	})
+
+	t.Run("multiple entries uses generic message", func(t *testing.T) {
+		entries := []tsvEntry{
+			{pkg: "aws", version: "1.2.3", entryFile: "/tmp/e1.yml"},
+			{pkg: "azure", version: "2.0.0", entryFile: "/tmp/e2.yml"},
+		}
+		msg := buildCommitMessage(entries, "42")
+		assert.Equal(t, "changelog: backport sync from PR #42", msg)
+	})
+}
+
+func TestBuildPRTitle(t *testing.T) {
+	entries := []tsvEntry{{pkg: "gcp", version: "3.1.0", entryFile: "/tmp/e.yml"}}
+	assert.Equal(t, buildCommitMessage(entries, "99"), buildPRTitle(entries, "99"))
+}
diff --git a/dev/backports/changelog/update.go b/dev/backports/changelog/update.go
new file mode 100644
index 00000000000..7ac5542d77e
--- /dev/null
+++ b/dev/backports/changelog/update.go
@@ -0,0 +1,55 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+)
+
+// linkLineRE matches a changelog link field line and captures the leading
+// whitespace + key prefix so the URL value can be replaced without touching
+// indentation.
+var linkLineRE = regexp.MustCompile(`^(\s+link:\s+)\S.*$`)
+
+// UpdateEntryLinks replaces every link: value inside the changelog entry for
+// version with newURL. Entries for other versions are left untouched. If
+// version is not present the file is left unchanged and no error is returned.
+func UpdateEntryLinks(changelogPath, version, newURL string) error {
+	info, err := os.Stat(changelogPath)
+	if err != nil {
+		return fmt.Errorf("reading changelog %s: %w", changelogPath, err)
+	}
+	data, err := os.ReadFile(changelogPath)
+	if err != nil {
+		return fmt.Errorf("reading changelog %s: %w", changelogPath, err)
+	}
+
+	lines := strings.Split(string(data), "\n")
+	inTarget := false
+	changed := false
+
+	for i, line := range lines {
+		if m := versionEntryRE.FindStringSubmatch(line); m != nil {
+			inTarget = m[1] == version
+			continue
+		}
+		if !inTarget {
+			continue
+		}
+		if loc := linkLineRE.FindStringSubmatchIndex(line); loc != nil {
+			// loc[2]:loc[3] is the span of group 1: the "  link: " prefix.
+			lines[i] = line[loc[2]:loc[3]] + newURL
+			changed = true
+		}
+	}
+
+	if !changed {
+		return nil
+	}
+	return os.WriteFile(changelogPath, []byte(strings.Join(lines, "\n")), info.Mode())
+}
diff --git a/dev/backports/changelog/update_test.go b/dev/backports/changelog/update_test.go
new file mode 100644
index 00000000000..c18911e2271
--- /dev/null
+++ b/dev/backports/changelog/update_test.go
@@ -0,0 +1,114 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package changelog
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateEntryLinks(t *testing.T) {
+	const newURL = "https://github.com/elastic/integrations/pull/9999"
+
+	t.Run("replaces link in matching version entry", func(t *testing.T) {
+		path := writeChangelog(t, `- version: "1.5.0"
+  changes:
+    - description: New feature
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/REPLACE_ME
+`)
+		require.NoError(t, UpdateEntryLinks(path, "1.5.0", newURL))
+		got, err := os.ReadFile(path)
+		require.NoError(t, err)
+		assert.Contains(t, string(got), newURL)
+		assert.NotContains(t, string(got), "REPLACE_ME")
+	})
+
+	t.Run("replaces all links when entry has multiple change items", func(t *testing.T) {
+		path := writeChangelog(t, `- version: "1.5.0"
+  changes:
+    - description: Fix A
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/REPLACE_ME
+    - description: Fix B
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/REPLACE_ME
+`)
+		require.NoError(t, UpdateEntryLinks(path, "1.5.0", newURL))
+		got, err := os.ReadFile(path)
+		require.NoError(t, err)
+		content := string(got)
+		assert.NotContains(t, content, "REPLACE_ME")
+		// Both link lines now contain the new URL.
+		count := 0
+		for _, line := range splitLines(content) {
+			if line == "      link: "+newURL {
+				count++
+			}
+		}
+		assert.Equal(t, 2, count, "expected both link fields to be updated")
+	})
+
+	t.Run("leaves other version entries untouched", func(t *testing.T) {
+		const oldURL = "https://github.com/elastic/integrations/pull/1234"
+		path := writeChangelog(t, `- version: "1.5.0"
+  changes:
+    - description: New feature
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/REPLACE_ME
+- version: "1.4.0"
+  changes:
+    - description: Old fix
+      type: bugfix
+      link: `+oldURL+`
+`)
+		require.NoError(t, UpdateEntryLinks(path, "1.5.0", newURL))
+		got, err := os.ReadFile(path)
+		require.NoError(t, err)
+		content := string(got)
+		assert.Contains(t, content, newURL)
+		assert.Contains(t, content, oldURL, "unrelated entry must not be modified")
+		assert.NotContains(t, content, "REPLACE_ME")
+	})
+
+	t.Run("version not found — file unchanged, no error", func(t *testing.T) {
+		original := `- version: "1.0.0"
+  changes:
+    - description: Only entry
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/42
+`
+		path := writeChangelog(t, original)
+		require.NoError(t, UpdateEntryLinks(path, "9.9.9", newURL))
+		got, err := os.ReadFile(path)
+		require.NoError(t, err)
+		assert.Equal(t, original, string(got))
+	})
+
+	t.Run("missing file returns error", func(t *testing.T) {
+		err := UpdateEntryLinks("/no/such/changelog.yml", "1.0.0", newURL)
+		assert.Error(t, err)
+	})
+}
+
+// splitLines splits content into lines without the trailing newline element
+// that strings.Split produces for a newline-terminated string.
+func splitLines(content string) []string {
+	lines := make([]string, 0)
+	start := 0
+	for i, c := range content {
+		if c == '\n' {
+			lines = append(lines, content[start:i])
+			start = i + 1
+		}
+	}
+	if start < len(content) {
+		lines = append(lines, content[start:])
+	}
+	return lines
+}
diff --git a/dev/backports/checklist/checklist.go b/dev/backports/checklist/checklist.go
new file mode 100644
index 00000000000..09945b2d2fb
--- /dev/null
+++ b/dev/backports/checklist/checklist.go
@@ -0,0 +1,166 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+// Package checklist provides pure functions for building and parsing the
+// backport-checklist comment posted on pull requests targeting main.
+// No I/O is performed here — callers supply any dynamic data (active branches,
+// existing comment body) and receive back a rendered string.
+package checklist
+
+import (
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+
+	"github.com/elastic/integrations/dev/backports"
+)
+
+// marker is the HTML comment embedded at the start of every checklist comment.
+// It is used to find and update an existing checklist rather than posting a new one.
+const marker = "<!-- backport-checklist -->"
+
+// PackageBranches pairs a package name with its active backport branches.
+// Branches are in inventory order.
+type PackageBranches struct {
+	Package  string
+	Branches []backports.ActiveResult
+}
+
+// checkedLineRe matches a checked checkbox line: "- [x] `branch-name`..."
+var checkedLineRe = regexp.MustCompile("^- \\[[xX]\\] `([^`]+)`")
+
+// checklistItemRe matches any checkbox branch line (checked or unchecked).
+// Group 1: checkbox char (' ', 'x', or 'X'). Group 2: branch name.
+var checklistItemRe = regexp.MustCompile("^- \\[([xX ])\\] `([^`]+)`")
+
+// packageHeaderRe matches a bold package section header: **package-name**
+var packageHeaderRe = regexp.MustCompile(`^\*\*([^*]+)\*\*$`)
+
+// ChecklistItem represents a single branch entry parsed from a checklist comment body.
+type ChecklistItem struct {
+	Package   string
+	Branch    string
+	Checked   bool
+	Processed bool // true if the line already carries a ✅ or ⚠️ status suffix
+}
+
+// ParseChecklistItems scans body for package headers and checkbox branch lines and
+// returns one ChecklistItem per branch. An empty or marker-free body returns an
+// empty (non-nil) slice so callers never need a nil check.
+func ParseChecklistItems(body string) []ChecklistItem {
+	items := []ChecklistItem{}
+	if !strings.Contains(body, marker) {
+		return items
+	}
+	var currentPkg string
+	for _, line := range strings.Split(body, "\n") {
+		line = strings.TrimRight(line, "\r")
+		if m := packageHeaderRe.FindStringSubmatch(line); m != nil {
+			currentPkg = m[1]
+			continue
+		}
+		if m := checklistItemRe.FindStringSubmatch(line); m != nil {
+			items = append(items, ChecklistItem{
+				Package:   currentPkg,
+				Branch:    m[2],
+				Checked:   m[1] != " ",
+				Processed: strings.ContainsRune(line, '✅') || strings.ContainsRune(line, '⚠'),
+			})
+		}
+	}
+	return items
+}
+
+// UpdateBranchStatus finds the checkbox line for branch in body and appends
+// " — <status>" to it. If the line already carries a ✅ or ⚠️ suffix the body
+// is returned unchanged (defence-in-depth against workflow self-trigger loops).
+// Returns body unchanged when branch is not found.
+func UpdateBranchStatus(body, branch, status string) string {
+	lines := strings.Split(body, "\n")
+	for i, line := range lines {
+		trimmed := strings.TrimRight(line, "\r")
+		m := checklistItemRe.FindStringSubmatch(trimmed)
+		if m == nil || m[2] != branch {
+			continue
+		}
+		if strings.ContainsRune(trimmed, '✅') || strings.ContainsRune(trimmed, '⚠') {
+			return body
+		}
+		lines[i] = trimmed + " — " + status
+		return strings.Join(lines, "\n")
+	}
+	return body
+}
+
+// ParseCheckedBranches scans body for "- [x] `<branch>`" lines and returns the
+// set of branch names that are currently ticked. An empty or marker-free body
+// returns an empty (non-nil) map so callers never need a nil check.
+func ParseCheckedBranches(body string) map[string]bool {
+	checked := make(map[string]bool)
+	if !strings.Contains(body, marker) {
+		return checked
+	}
+	// strings.SplitSeq requires go1.23; go.mod pins go1.22 for backport compatibility with older base commits.
+	for _, line := range strings.Split(body, "\n") {
+		if m := checkedLineRe.FindStringSubmatch(strings.TrimRight(line, "\r")); m != nil {
+			checked[m[1]] = true
+		}
+	}
+	return checked
+}
+
+// BuildComment renders the full comment body starting with marker.
+// Packages that have no active branches are omitted, so stale sections disappear
+// automatically on recompute without any special removal logic.
+// Branches in checked are rendered with a filled checkbox; all others are unchecked.
+//
+// Returns "" when no package has any active branch; callers should skip posting.
+func BuildComment(pkgs []PackageBranches, checked map[string]bool) string {
+	if !slices.ContainsFunc(pkgs, func(p PackageBranches) bool { return len(p.Branches) > 0 }) {
+		return ""
+	}
+
+	var b strings.Builder
+
+	fmt.Fprintln(&b, marker)
+	fmt.Fprintln(&b, "## Backport branches")
+	fmt.Fprintln(&b)
+	fmt.Fprintln(&b, "> [!IMPORTANT]")
+	fmt.Fprintln(&b, "> Only branches for packages touched by this PR's current diff are shown.")
+	fmt.Fprintln(&b, "> This comment is updated automatically on each push — manual edits will be overwritten.")
+	fmt.Fprintln(&b)
+	fmt.Fprintln(&b, "Tick the branches you want to backport to. PRs will be created automatically on merge, or when you update this checklist after merge.")
+
+	for _, p := range pkgs {
+		if len(p.Branches) == 0 {
+			continue
+		}
+
+		// One blank line before every package header (between intro and first
+		// package, and between consecutive packages).
+		fmt.Fprintln(&b)
+		fmt.Fprintf(&b, "**%s**\n", p.Package)
+		for _, r := range p.Branches {
+			box := "[ ]"
+			if checked[r.Branch] {
+				box = "[x]"
+			}
+			line := fmt.Sprintf("- %s `%s`", box, r.Branch)
+			if r.MaintainedUntil != nil {
+				line += fmt.Sprintf(" (maintained until %s)", *r.MaintainedUntil)
+			}
+			fmt.Fprintln(&b, line)
+		}
+	}
+
+	fmt.Fprintln(&b)
+	fmt.Fprintln(&b, "---")
+	fmt.Fprintln(&b)
+	fmt.Fprintln(&b, "> [!TIP]")
+	fmt.Fprintln(&b, "> If a branch above is no longer required, set `archived: true` in its entry in `.backports.yml` to stop it appearing here.")
+	fmt.Fprintln(&b, `> If the branch has a known end-of-life date, prefer `+"`"+`maintained_until: "YYYY-MM-DD"`+"`"+` — it will be excluded automatically once that date passes.`)
+
+	return b.String()
+}
diff --git a/dev/backports/checklist/checklist_test.go b/dev/backports/checklist/checklist_test.go
new file mode 100644
index 00000000000..67780779e63
--- /dev/null
+++ b/dev/backports/checklist/checklist_test.go
@@ -0,0 +1,362 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package checklist
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/elastic/integrations/dev/backports"
+)
+
+// ptr returns a pointer to s, for constructing MaintainedUntil values inline.
+func ptr(s string) *string { return &s }
+
+// awsBranch returns an ActiveResult for the aws package with the given branch.
+func awsBranch(branch string) backports.ActiveResult {
+	return backports.ActiveResult{Branch: branch, Active: true}
+}
+
+func awsBranchUntil(branch, until string) backports.ActiveResult {
+	return backports.ActiveResult{Branch: branch, Active: true, MaintainedUntil: ptr(until)}
+}
+
+func TestBuildComment(t *testing.T) {
+	cases := []struct {
+		title        string
+		pkgs         []PackageBranches
+		checked      map[string]bool
+		wantEmpty    bool
+		wantContains []string
+		wantMissing  []string
+	}{
+		{
+			title:     "empty pkgs returns empty string",
+			pkgs:      nil,
+			wantEmpty: true,
+		},
+		{
+			title: "pkgs with no active branches returns empty string",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: nil},
+			},
+			wantEmpty: true,
+		},
+		{
+			title: "marker is present in output",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranch("backport-aws-6.14")}},
+			},
+			checked:      map[string]bool{},
+			wantContains: []string{marker},
+		},
+		{
+			title: "package header and branch line rendered",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranch("backport-aws-6.14")}},
+			},
+			checked:      map[string]bool{},
+			wantContains: []string{"**aws**", "- [ ] `backport-aws-6.14`"},
+		},
+		{
+			title: "maintained_until appended when set",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranchUntil("backport-aws-6.14", "2027-01-15")}},
+			},
+			checked:      map[string]bool{},
+			wantContains: []string{"(maintained until 2027-01-15)"},
+		},
+		{
+			title: "maintained_until omitted when nil",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranch("backport-aws-6.15")}},
+			},
+			checked:     map[string]bool{},
+			wantMissing: []string{"maintained until"},
+		},
+		{
+			title: "unchecked branch renders with empty checkbox",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranch("backport-aws-6.14")}},
+			},
+			checked:      map[string]bool{},
+			wantContains: []string{"- [ ] `backport-aws-6.14`"},
+			wantMissing:  []string{"- [x] `backport-aws-6.14`"},
+		},
+		{
+			title: "checked branch renders with filled checkbox",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranch("backport-aws-6.14")}},
+			},
+			checked:      map[string]bool{"backport-aws-6.14": true},
+			wantContains: []string{"- [x] `backport-aws-6.14`"},
+			wantMissing:  []string{"- [ ] `backport-aws-6.14`"},
+		},
+		{
+			title: "intro text mentions PRs will be created automatically for checked branches",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranch("backport-aws-6.14")}},
+			},
+			checked:      map[string]bool{},
+			wantContains: []string{"PRs will be created automatically on merge, or when you update this checklist after merge."},
+		},
+		{
+			title: "multiple packages both rendered",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranch("backport-aws-6.14")}},
+				{Package: "kubernetes", Branches: []backports.ActiveResult{awsBranch("backport-kubernetes-1.28")}},
+			},
+			checked:      map[string]bool{},
+			wantContains: []string{"**aws**", "backport-aws-6.14", "**kubernetes**", "backport-kubernetes-1.28"},
+		},
+		{
+			title: "package with no branches omitted from output",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranch("backport-aws-6.14")}},
+				{Package: "nginx", Branches: nil},
+			},
+			checked:      map[string]bool{},
+			wantContains: []string{"**aws**"},
+			wantMissing:  []string{"**nginx**"},
+		},
+		{
+			title: "tip footer always present",
+			pkgs: []PackageBranches{
+				{Package: "aws", Branches: []backports.ActiveResult{awsBranch("backport-aws-6.14")}},
+			},
+			checked:      map[string]bool{},
+			wantContains: []string{"[!TIP]", "archived: true", ".backports.yml"},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.title, func(t *testing.T) {
+			got := BuildComment(tc.pkgs, tc.checked)
+
+			if tc.wantEmpty {
+				assert.Empty(t, got)
+				return
+			}
+
+			for _, want := range tc.wantContains {
+				assert.Contains(t, got, want)
+			}
+			for _, missing := range tc.wantMissing {
+				assert.NotContains(t, got, missing)
+			}
+		})
+	}
+}
+
+func TestParseCheckedBranches(t *testing.T) {
+	cases := []struct {
+		title string
+		body  string
+		want  map[string]bool
+	}{
+		{
+			title: "empty body returns empty map",
+			body:  "",
+			want:  map[string]bool{},
+		},
+		{
+			title: "body without marker returns empty map",
+			body:  "- [x] `backport-aws-6.14`\nsome text",
+			want:  map[string]bool{},
+		},
+		{
+			title: "single checked branch",
+			body:  marker + "\n- [x] `backport-aws-6.14`\n",
+			want:  map[string]bool{"backport-aws-6.14": true},
+		},
+		{
+			title: "unchecked branch not collected",
+			body:  marker + "\n- [ ] `backport-aws-6.14`\n",
+			want:  map[string]bool{},
+		},
+		{
+			title: "mix of checked and unchecked",
+			body:  marker + "\n- [x] `backport-aws-6.14`\n- [ ] `backport-aws-6.15`\n",
+			want:  map[string]bool{"backport-aws-6.14": true},
+		},
+		{
+			title: "multiple checked branches across packages",
+			body: marker + "\n**aws**\n- [x] `backport-aws-6.14`\n- [ ] `backport-aws-6.15`\n\n" +
+				"**kubernetes**\n- [x] `backport-kubernetes-1.28`\n",
+			want: map[string]bool{"backport-aws-6.14": true, "backport-kubernetes-1.28": true},
+		},
+		{
+			title: "branch with maintained_until suffix still parsed",
+			body:  marker + "\n- [x] `backport-aws-6.14` (maintained until 2027-01-15)\n",
+			want:  map[string]bool{"backport-aws-6.14": true},
+		},
+		{
+			title: "uppercase [X] checkbox is treated as checked",
+			body:  marker + "\n- [X] `backport-aws-6.14`\n",
+			want:  map[string]bool{"backport-aws-6.14": true},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.title, func(t *testing.T) {
+			got := ParseCheckedBranches(tc.body)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestParseChecklistItems(t *testing.T) {
+	cases := []struct {
+		title string
+		body  string
+		want  []ChecklistItem
+	}{
+		{
+			title: "empty body returns empty slice",
+			body:  "",
+			want:  []ChecklistItem{},
+		},
+		{
+			title: "body without marker returns empty slice",
+			body:  "**aws**\n- [x] `backport-aws-6.14`\n",
+			want:  []ChecklistItem{},
+		},
+		{
+			title: "single unchecked branch",
+			body:  marker + "\n**aws**\n- [ ] `backport-aws-6.14`\n",
+			want: []ChecklistItem{
+				{Package: "aws", Branch: "backport-aws-6.14", Checked: false, Processed: false},
+			},
+		},
+		{
+			title: "single checked branch",
+			body:  marker + "\n**aws**\n- [x] `backport-aws-6.14`\n",
+			want: []ChecklistItem{
+				{Package: "aws", Branch: "backport-aws-6.14", Checked: true, Processed: false},
+			},
+		},
+		{
+			title: "checked branch with success status is Processed",
+			body:  marker + "\n**aws**\n- [x] `backport-aws-6.14` — ✅ #1234\n",
+			want: []ChecklistItem{
+				{Package: "aws", Branch: "backport-aws-6.14", Checked: true, Processed: true},
+			},
+		},
+		{
+			title: "checked branch with conflict status is Processed",
+			body:  marker + "\n**aws**\n- [x] `backport-aws-6.14` — ⚠️ conflict: please run manually\n",
+			want: []ChecklistItem{
+				{Package: "aws", Branch: "backport-aws-6.14", Checked: true, Processed: true},
+			},
+		},
+		{
+			title: "multiple packages with multiple branches each",
+			body: marker + "\n**aws**\n- [x] `backport-aws-6.14`\n- [ ] `backport-aws-6.15`\n\n" +
+				"**kubernetes**\n- [x] `backport-kubernetes-1.28` — ✅ #5678\n- [ ] `backport-kubernetes-1.29`\n",
+			want: []ChecklistItem{
+				{Package: "aws", Branch: "backport-aws-6.14", Checked: true, Processed: false},
+				{Package: "aws", Branch: "backport-aws-6.15", Checked: false, Processed: false},
+				{Package: "kubernetes", Branch: "backport-kubernetes-1.28", Checked: true, Processed: true},
+				{Package: "kubernetes", Branch: "backport-kubernetes-1.29", Checked: false, Processed: false},
+			},
+		},
+		{
+			title: "branch with maintained_until suffix is parsed correctly",
+			body:  marker + "\n**aws**\n- [ ] `backport-aws-6.14` (maintained until 2027-01-15)\n",
+			want: []ChecklistItem{
+				{Package: "aws", Branch: "backport-aws-6.14", Checked: false, Processed: false},
+			},
+		},
+		{
+			title: "branch with maintained_until suffix and success status is Processed",
+			body:  marker + "\n**aws**\n- [x] `backport-aws-6.14` (maintained until 2027-01-15) — ✅ #1234\n",
+			want: []ChecklistItem{
+				{Package: "aws", Branch: "backport-aws-6.14", Checked: true, Processed: true},
+			},
+		},
+		{
+			title: "branch with maintained_until suffix and conflict status is Processed",
+			body:  marker + "\n**aws**\n- [x] `backport-aws-6.14` (maintained until 2027-01-15) — ⚠️ conflict: please run manually\n",
+			want: []ChecklistItem{
+				{Package: "aws", Branch: "backport-aws-6.14", Checked: true, Processed: true},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.title, func(t *testing.T) {
+			got := ParseChecklistItems(tc.body)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestUpdateBranchStatus(t *testing.T) {
+	cases := []struct {
+		title  string
+		body   string
+		branch string
+		status string
+		want   string
+	}{
+		{
+			title:  "appends success status to matching checked branch line",
+			body:   marker + "\n**aws**\n- [x] `backport-aws-6.14`\n",
+			branch: "backport-aws-6.14",
+			status: "✅ #1234",
+			want:   marker + "\n**aws**\n- [x] `backport-aws-6.14` — ✅ #1234\n",
+		},
+		{
+			title:  "appends conflict status to matching checked branch line",
+			body:   marker + "\n**aws**\n- [x] `backport-aws-6.14`\n",
+			branch: "backport-aws-6.14",
+			status: "⚠️ conflict: please run manually",
+			want:   marker + "\n**aws**\n- [x] `backport-aws-6.14` — ⚠️ conflict: please run manually\n",
+		},
+		{
+			title:  "line already has success suffix is a no-op",
+			body:   marker + "\n**aws**\n- [x] `backport-aws-6.14` — ✅ #1234\n",
+			branch: "backport-aws-6.14",
+			status: "✅ #9999",
+			want:   marker + "\n**aws**\n- [x] `backport-aws-6.14` — ✅ #1234\n",
+		},
+		{
+			title:  "line already has conflict suffix is a no-op",
+			body:   marker + "\n**aws**\n- [x] `backport-aws-6.14` — ⚠️ conflict: please run manually\n",
+			branch: "backport-aws-6.14",
+			status: "✅ #9999",
+			want:   marker + "\n**aws**\n- [x] `backport-aws-6.14` — ⚠️ conflict: please run manually\n",
+		},
+		{
+			title:  "branch not found leaves body unchanged",
+			body:   marker + "\n**aws**\n- [x] `backport-aws-6.14`\n",
+			branch: "backport-aws-6.15",
+			status: "✅ #1234",
+			want:   marker + "\n**aws**\n- [x] `backport-aws-6.14`\n",
+		},
+		{
+			title:  "only the matching branch line is updated, others untouched",
+			body:   marker + "\n**aws**\n- [x] `backport-aws-6.14`\n- [ ] `backport-aws-6.15`\n",
+			branch: "backport-aws-6.14",
+			status: "✅ #1234",
+			want:   marker + "\n**aws**\n- [x] `backport-aws-6.14` — ✅ #1234\n- [ ] `backport-aws-6.15`\n",
+		},
+		{
+			title:  "branch with maintained_until suffix gets status appended",
+			body:   marker + "\n**aws**\n- [x] `backport-aws-6.14` (maintained until 2027-01-15)\n",
+			branch: "backport-aws-6.14",
+			status: "✅ #1234",
+			want:   marker + "\n**aws**\n- [x] `backport-aws-6.14` (maintained until 2027-01-15) — ✅ #1234\n",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.title, func(t *testing.T) {
+			got := UpdateBranchStatus(tc.body, tc.branch, tc.status)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
diff --git a/dev/backports/inventory.go b/dev/backports/inventory.go
new file mode 100644
index 00000000000..e503023b8f2
--- /dev/null
+++ b/dev/backports/inventory.go
@@ -0,0 +1,467 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package backports
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/Masterminds/semver/v3"
+	"gopkg.in/yaml.v3"
+
+	"github.com/elastic/integrations/dev/citools"
+)
+
+type inventory struct {
+	SkipChecklistPackages []string `yaml:"skip_checklist_packages"`
+	Backports             []entry  `yaml:"backports"`
+}
+
+type entry struct {
+	Package             string  `yaml:"package"`
+	Branch              string  `yaml:"branch"`
+	BaseVersion         string  `yaml:"base_version"`
+	BaseCommit          string  `yaml:"base_commit"`
+	MaintainedUntil     *string `yaml:"maintained_until"`      // null → nil; "YYYY-MM-DD" → &string
+	Archived            *bool   `yaml:"archived"`              // nil when field is absent
+	RemoveOtherPackages *bool   `yaml:"remove_other_packages"` // nil when field is absent
+}
+
+const maintainedUntilLayout = "2006-01-02"
+
+// shaRE matches a lowercase hexadecimal git SHA (short or full, 7–40 chars).
+var shaRE = regexp.MustCompile(`^[0-9a-f]{7,40}$`)
+
+// duplicatePackageVersionExceptions lists package@version pairs that are
+// intentionally allowed to appear more than once in the inventory.
+// Each entry must include a comment explaining why the exception exists.
+var duplicatePackageVersionExceptions = map[string]struct{}{
+	// backport-security_detection_engine-8.17 and -8.18 share the same base
+	// release (8.17.7) because the 8.18 branch was cut from the same tag.
+	"security_detection_engine@8.17.7": {},
+}
+
+// branchRE matches a valid backport branch name:
+//
+//	backport-<package>-<suffix>
+//
+// where <package> is one or more letters, digits, or underscores, and
+// <suffix> starts with a letter or digit and may contain letters, digits,
+// dots, underscores, or hyphens (e.g. "3.17", "6.x", "7.15.0", "2024-hotfix").
+// Whitespace, quotes, colons, semicolons, dollar signs, backticks, and all
+// other special characters are not permitted.
+var branchRE = regexp.MustCompile(`^backport-[a-zA-Z0-9_]+-[a-zA-Z0-9][a-zA-Z0-9_.\-]*$`)
+
+// ActiveResult is the result of a CheckActive call.
+type ActiveResult struct {
+	Branch          string  `json:"branch"`
+	Active          bool    `json:"active"`
+	Archived        bool    `json:"archived"`
+	MaintainedUntil *string `json:"maintained_until"`
+}
+
+// loadInventory reads and unmarshals the YAML inventory file at path.
+func loadInventory(path string) (inventory, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return inventory{}, fmt.Errorf("reading inventory: %w", err)
+	}
+	var inv inventory
+	if err := yaml.Unmarshal(data, &inv); err != nil {
+		return inventory{}, fmt.Errorf("parsing inventory: %w", err)
+	}
+	return inv, nil
+}
+
+// ListAllActiveBackportBranches returns the active backport branches for each
+// package in packages, parsing the inventory at path exactly once.
+// The returned map has one entry per name in packages; packages with no active
+// branches (or not present in the inventory) have an empty, non-nil slice.
+func ListAllActiveBackportBranches(path string, packages []string, now time.Time) (map[string][]ActiveResult, error) {
+	inv, err := loadInventory(path)
+	if err != nil {
+		return nil, err
+	}
+
+	want := make(map[string]struct{}, len(packages))
+	for _, p := range packages {
+		want[p] = struct{}{}
+	}
+
+	result := make(map[string][]ActiveResult, len(packages))
+	for _, p := range packages {
+		result[p] = []ActiveResult{}
+	}
+	for _, e := range inv.Backports {
+		if _, ok := want[e.Package]; !ok {
+			continue
+		}
+		if r := e.activeResult(now); r.Active {
+			result[e.Package] = append(result[e.Package], r)
+		}
+	}
+	return result, nil
+}
+
+// ListSkipChecklistPackages returns the package names that should be excluded
+// from the backport checklist comment. These packages still participate in
+// changelog syncing and other automated backport flows.
+func ListSkipChecklistPackages(path string) ([]string, error) {
+	inv, err := loadInventory(path)
+	if err != nil {
+		return nil, err
+	}
+	return inv.SkipChecklistPackages, nil
+}
+
+// CheckActive looks up branch in the inventory at path and reports whether it
+// is currently active. now is injected so callers can test with a fixed date.
+// Returns an error if the inventory cannot be read, parsed, or the branch is not found.
+func CheckActive(path, branch string, now time.Time) (ActiveResult, error) {
+	inv, err := loadInventory(path)
+	if err != nil {
+		return ActiveResult{}, err
+	}
+	for _, e := range inv.Backports {
+		if e.Branch == branch {
+			return e.activeResult(now), nil
+		}
+	}
+	return ActiveResult{}, fmt.Errorf("branch %q not found in %s", branch, path)
+}
+
+// activeResult applies the active-branch rules for a single entry.
+//
+// A branch is inactive when:
+//   - archived == true, OR
+//   - maintained_until is set and is strictly before today (UTC).
+func (e entry) activeResult(now time.Time) ActiveResult {
+	archived := e.Archived != nil && *e.Archived
+	result := ActiveResult{
+		Branch:          e.Branch,
+		Active:          true,
+		Archived:        archived,
+		MaintainedUntil: e.MaintainedUntil,
+	}
+	if archived {
+		result.Active = false
+		return result
+	}
+	if e.MaintainedUntil != nil {
+		t, err := time.Parse(maintainedUntilLayout, *e.MaintainedUntil)
+		today := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, time.UTC)
+		// On parse error the branch stays active (fail-open): better to show a branch
+		// that might be expired than to silently hide one that is still required.
+		// ValidateInventory enforces date format, so this path is only reachable via
+		// a direct unvalidated edit.
+		if err == nil && t.Before(today) {
+			result.Active = false
+		}
+	}
+	return result
+}
+
+// validateBranchFormat checks that branch matches the required backport branch format:
+// backport-<package>-<suffix>, where package is letters/digits/underscores and suffix
+// starts with a letter or digit and may contain letters, digits, dots, underscores, or hyphens.
+// Whitespace, quotes, colons, semicolons, dollar signs, backticks, and other special characters
+// are not permitted.
+func validateBranchFormat(branch string) error {
+	if !branchRE.MatchString(branch) {
+		return fmt.Errorf("invalid branch %q: must match backport-<package>-<suffix> "+
+			"(package: letters/digits/underscores; suffix: letters/digits/dots/underscores/hyphens; "+
+			"no whitespace, quotes, colons, semicolons, dollar signs, backticks or other special characters)", branch)
+	}
+	return nil
+}
+
+// ValidateBranchName checks that branch is a valid backport branch name for the given package:
+// it must pass ValidateBranchFormat and start with "backport-<packageName>-".
+func ValidateBranchName(packageName, branch string) error {
+	if err := validateBranchFormat(branch); err != nil {
+		return err
+	}
+	if !strings.HasPrefix(branch, "backport-"+packageName+"-") {
+		return fmt.Errorf("branch %q must start with \"backport-%s-\"", branch, packageName)
+	}
+	return nil
+}
+
+// AddEntry inserts a new backport entry into the inventory at path.
+// The branch name is derived as backport-<packageName>-<major>.<minor>.
+// archived is set to false and maintained_until to null.
+// The entry is placed in sorted order: package name ascending, then version descending (newest first).
+// packagesDir is the path to the packages/ directory used to verify that packageName names a real
+// package. Pass an empty string to skip this check.
+// Returns the derived branch name.
+func AddEntry(path, packageName, baseVersion, baseCommit, packagesDir string) (string, error) {
+	v, err := semver.StrictNewVersion(baseVersion)
+	if err != nil {
+		return "", fmt.Errorf("invalid base_version %q: %w", baseVersion, err)
+	}
+	branch := fmt.Sprintf("backport-%s-%d.%d", packageName, v.Major(), v.Minor())
+
+	knownPackages, err := buildKnownPackages(packagesDir)
+	if err != nil {
+		return "", fmt.Errorf("loading packages from %s: %w", packagesDir, err)
+	}
+	if knownPackages != nil {
+		if _, ok := knownPackages[packageName]; !ok {
+			return "", fmt.Errorf("unknown package %q: not found under %s", packageName, packagesDir)
+		}
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("reading inventory: %w", err)
+	}
+
+	var doc yaml.Node
+	if err := yaml.Unmarshal(data, &doc); err != nil {
+		return "", fmt.Errorf("parsing inventory: %w", err)
+	}
+
+	seq, err := backportsSequenceNode(&doc)
+	if err != nil {
+		return "", err
+	}
+
+	pos := entryInsertPos(seq, packageName, v)
+	newNode := newEntryNode(packageName, branch, baseVersion, baseCommit)
+
+	updated := make([]*yaml.Node, len(seq.Content)+1)
+	copy(updated, seq.Content[:pos])
+	updated[pos] = newNode
+	copy(updated[pos+1:], seq.Content[pos:])
+	seq.Content = updated
+
+	var buf bytes.Buffer
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	if err := enc.Encode(&doc); err != nil {
+		return "", fmt.Errorf("marshaling inventory: %w", err)
+	}
+	if err := os.WriteFile(path, buf.Bytes(), 0o644); err != nil {
+		return "", fmt.Errorf("writing inventory: %w", err)
+	}
+	return branch, nil
+}
+
+// backportsSequenceNode navigates from the document root to the sequence node
+// under the "backports" key.
+func backportsSequenceNode(doc *yaml.Node) (*yaml.Node, error) {
+	if doc.Kind != yaml.DocumentNode || len(doc.Content) == 0 {
+		return nil, fmt.Errorf("unexpected document structure")
+	}
+	root := doc.Content[0]
+	if root.Kind != yaml.MappingNode {
+		return nil, fmt.Errorf("expected mapping at document root")
+	}
+	for i := 0; i+1 < len(root.Content); i += 2 {
+		if root.Content[i].Value == "backports" {
+			seq := root.Content[i+1]
+			if seq.Kind != yaml.SequenceNode {
+				return nil, fmt.Errorf("'backports' is not a sequence")
+			}
+			return seq, nil
+		}
+	}
+	return nil, fmt.Errorf("'backports' key not found in inventory")
+}
+
+// entryInsertPos returns the index at which a new entry with the given package
+// and version should be inserted to keep the sequence sorted (package ascending,
+// then version descending within the same package — newest first).
+func entryInsertPos(seq *yaml.Node, newPkg string, newVer *semver.Version) int {
+	for i, node := range seq.Content {
+		pkg := mappingFieldValue(node, "package")
+		if pkg > newPkg {
+			return i
+		}
+		if pkg == newPkg {
+			ver, err := semver.StrictNewVersion(mappingFieldValue(node, "base_version"))
+			if err == nil && ver.LessThan(newVer) {
+				return i
+			}
+		}
+	}
+	return len(seq.Content)
+}
+
+// mappingFieldValue returns the scalar value for the given key in a YAML mapping node.
+func mappingFieldValue(node *yaml.Node, key string) string {
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		if node.Content[i].Value == key {
+			return node.Content[i+1].Value
+		}
+	}
+	return ""
+}
+
+// newEntryNode builds a YAML mapping node for a new backport entry.
+// base_version and base_commit are double-quoted to match the existing file style.
+func newEntryNode(pkg, branch, baseVersion, baseCommit string) *yaml.Node {
+	scalar := func(value, tag string, style yaml.Style) *yaml.Node {
+		return &yaml.Node{Kind: yaml.ScalarNode, Tag: tag, Value: value, Style: style}
+	}
+	key := func(k string) *yaml.Node { return scalar(k, "!!str", 0) }
+	str := func(v string) *yaml.Node { return scalar(v, "!!str", 0) }
+	quoted := func(v string) *yaml.Node { return scalar(v, "!!str", yaml.DoubleQuotedStyle) }
+
+	return &yaml.Node{
+		Kind: yaml.MappingNode,
+		Tag:  "!!map",
+		Content: []*yaml.Node{
+			key("package"), str(pkg),
+			key("branch"), str(branch),
+			key("base_version"), quoted(baseVersion),
+			key("base_commit"), quoted(baseCommit),
+			key("maintained_until"), scalar("null", "!!null", 0),
+			key("archived"), scalar("false", "!!bool", 0),
+			key("remove_other_packages"), scalar("true", "!!bool", 0),
+		},
+	}
+}
+
+// ValidateInventory reads the .backports.yml inventory at path and returns a
+// combined error listing every schema violation found across all entries.
+//
+// packagesDir is the path to the packages/ directory used to verify that each
+// entry's package field names a real package. Pass an empty string to skip
+// this check (useful in unit tests that do not have a full checkout).
+func ValidateInventory(path, packagesDir string) error {
+	inv, err := loadInventory(path)
+	if err != nil {
+		return err
+	}
+
+	knownPackages, err := buildKnownPackages(packagesDir)
+	if err != nil {
+		return fmt.Errorf("loading packages from %s: %w", packagesDir, err)
+	}
+
+	var errs []error
+	for i, e := range inv.Backports {
+		errs = append(errs, validateEntryFields(i, e, knownPackages, packagesDir)...)
+	}
+	errs = append(errs, validateDuplicates(inv.Backports)...)
+
+	return errors.Join(errs...)
+}
+
+// validateEntryFields checks that all required fields of a single entry are
+// present and contain valid values.
+func validateEntryFields(i int, e entry, knownPackages map[string]struct{}, packagesDir string) []error {
+	id := fmt.Sprintf("entry[%d]", i)
+	if e.Branch != "" {
+		id = fmt.Sprintf("branch %q", e.Branch)
+	}
+
+	var errs []error
+
+	if e.Package == "" {
+		errs = append(errs, fmt.Errorf("%s: missing required field 'package'", id))
+	} else if knownPackages != nil {
+		if _, ok := knownPackages[e.Package]; !ok {
+			errs = append(errs, fmt.Errorf("%s: unknown package %q: not found under %s", id, e.Package, packagesDir))
+		}
+	}
+
+	if e.Branch == "" {
+		errs = append(errs, fmt.Errorf("%s: missing required field 'branch'", id))
+	} else if e.Package != "" {
+		if err := ValidateBranchName(e.Package, e.Branch); err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", id, err))
+		}
+	} else if err := validateBranchFormat(e.Branch); err != nil {
+		errs = append(errs, fmt.Errorf("%s: %w", id, err))
+	}
+
+	if e.BaseVersion == "" {
+		errs = append(errs, fmt.Errorf("%s: missing required field 'base_version'", id))
+	} else if _, parseErr := semver.StrictNewVersion(e.BaseVersion); parseErr != nil {
+		errs = append(errs, fmt.Errorf("%s: invalid base_version %q: must be a valid semantic version", id, e.BaseVersion))
+	}
+
+	if e.BaseCommit == "" {
+		errs = append(errs, fmt.Errorf("%s: missing required field 'base_commit'", id))
+	} else if !shaRE.MatchString(e.BaseCommit) {
+		errs = append(errs, fmt.Errorf("%s: invalid base_commit %q: must be a lowercase hex SHA (7–40 chars)", id, e.BaseCommit))
+	}
+
+	if e.Archived == nil {
+		errs = append(errs, fmt.Errorf("%s: missing required field 'archived'", id))
+	}
+
+	if e.RemoveOtherPackages == nil {
+		errs = append(errs, fmt.Errorf("%s: missing required field 'remove_other_packages'", id))
+	}
+
+	if e.MaintainedUntil != nil {
+		if _, parseErr := time.Parse(maintainedUntilLayout, *e.MaintainedUntil); parseErr != nil {
+			errs = append(errs, fmt.Errorf("%s: invalid maintained_until %q: must be YYYY-MM-DD", id, *e.MaintainedUntil))
+		}
+	}
+
+	return errs
+}
+
+// validateDuplicates checks for duplicate branch names and duplicate
+// package/version pairs across all entries.
+func validateDuplicates(entries []entry) []error {
+	seenBranches := make(map[string]struct{})
+	seenPackageVersions := make(map[string]struct{})
+
+	var errs []error
+	for i, e := range entries {
+		id := fmt.Sprintf("entry[%d]", i)
+		if e.Branch != "" {
+			id = fmt.Sprintf("branch %q", e.Branch)
+		}
+
+		if e.Branch != "" {
+			if _, seen := seenBranches[e.Branch]; seen {
+				errs = append(errs, fmt.Errorf("%s: duplicate branch %q", id, e.Branch))
+			} else {
+				seenBranches[e.Branch] = struct{}{}
+			}
+		}
+
+		if e.Package != "" && e.BaseVersion != "" {
+			key := e.Package + "@" + e.BaseVersion
+			if _, isException := duplicatePackageVersionExceptions[key]; !isException {
+				if _, seen := seenPackageVersions[key]; seen {
+					errs = append(errs, fmt.Errorf("%s: duplicate package/version %q/%q", id, e.Package, e.BaseVersion))
+				} else {
+					seenPackageVersions[key] = struct{}{}
+				}
+			}
+		}
+	}
+
+	return errs
+}
+
+// buildKnownPackages scans packagesDir and returns a set of valid package names.
+// Returns nil (no error) when packagesDir is empty, skipping package validation.
+func buildKnownPackages(packagesDir string) (map[string]struct{}, error) {
+	if packagesDir == "" {
+		return nil, nil
+	}
+	pkgs, err := citools.ListPackagesWithNames(packagesDir)
+	if err != nil {
+		return nil, err
+	}
+	known := make(map[string]struct{}, len(pkgs))
+	for _, p := range pkgs {
+		known[p.Name] = struct{}{}
+	}
+	return known, nil
+}
diff --git a/dev/backports/inventory_test.go b/dev/backports/inventory_test.go
new file mode 100644
index 00000000000..a6ffe6438f3
--- /dev/null
+++ b/dev/backports/inventory_test.go
@@ -0,0 +1,1103 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package backports
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+)
+
+func writeTemp(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "backports.yml")
+	require.NoError(t, os.WriteFile(path, []byte(content), 0600))
+	return path
+}
+
+// writePackagesDir creates a minimal packages/ directory under t.TempDir()
+// containing one package per name, each with a valid manifest.yml.
+// Returns the path to the packages/ directory.
+func writePackagesDir(t *testing.T, packageNames ...string) string {
+	t.Helper()
+	base := t.TempDir()
+	for _, name := range packageNames {
+		dir := filepath.Join(base, "packages", name)
+		require.NoError(t, os.MkdirAll(dir, 0700))
+		manifest := "format_version: \"1.0.0\"\nname: " + name + "\ntype: integration\nversion: \"1.0.0\"\n"
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "manifest.yml"), []byte(manifest), 0600))
+	}
+	return filepath.Join(base, "packages")
+}
+
+const validEntry = `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`
+
+func TestValidateInventory(t *testing.T) {
+	cases := []struct {
+		title       string
+		contents    string
+		wantErr     bool
+		errContains []string
+	}{
+		{
+			title:    "valid entry with null maintained_until",
+			contents: validEntry,
+		},
+		{
+			title: "valid entry with date maintained_until",
+			contents: `backports:
+  - package: security_detection_engine
+    branch: backport-security_detection_engine-8.19
+    base_version: "8.19.0"
+    base_commit: "abcdef1234"
+    maintained_until: "2027-01-15"
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "valid entry with prerelease base_version",
+			contents: `backports:
+  - package: apm
+    branch: backport-apm-8.15
+    base_version: "8.15.0-preview-1716438434"
+    base_commit: "86356203eb"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title:    "empty backports list",
+			contents: "backports: []\n",
+		},
+		{
+			title: "missing package field",
+			contents: `backports:
+  - branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"missing required field 'package'"},
+		},
+		{
+			title: "missing branch field",
+			contents: `backports:
+  - package: aws
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"missing required field 'branch'"},
+		},
+		{
+			title: "missing base_version field",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"missing required field 'base_version'"},
+		},
+		{
+			title: "missing base_commit field",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"missing required field 'base_commit'"},
+		},
+		{
+			title: "missing archived field",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+`,
+			wantErr:     true,
+			errContains: []string{"missing required field 'archived'", "missing required field 'remove_other_packages'"},
+		},
+		{
+			title: "invalid base_version — not a semver",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "not-a-version"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid base_version", "semantic version"},
+		},
+		{
+			title: "invalid base_version — missing patch segment",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid base_version"},
+		},
+		{
+			title: "invalid base_commit — not hex",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "xyz_not_hex"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid base_commit", "lowercase hex SHA"},
+		},
+		{
+			title: "invalid base_commit — too short",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "abc12"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid base_commit", "lowercase hex SHA"},
+		},
+		{
+			title: "invalid base_commit — uppercase hex",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5B593F6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid base_commit", "lowercase hex SHA"},
+		},
+		{
+			title: "valid branch with x wildcard version",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-6.x
+    base_version: "6.0.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "valid branch — three-component version (major.minor.x)",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-6.14.x
+    base_version: "6.14.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "valid branch — three-component version (major.minor.patch)",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-1.2.3
+    base_version: "1.2.3"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "valid branch — three-component version (major.minor.patch) for aws",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-7.15.0
+    base_version: "7.15.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "valid branch — three-component version (major.minor.patch) for security_detection_engine",
+			contents: `backports:
+  - package: security_detection_engine
+    branch: backport-security_detection_engine-8.9.10
+    base_version: "8.9.10"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "invalid branch — missing backport- prefix",
+			contents: `backports:
+  - package: aws
+    branch: aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid branch"},
+		},
+		{
+			title: "invalid branch — package name mismatch",
+			contents: `backports:
+  - package: aws
+    branch: backport-nginx-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{`must start with "backport-aws-"`},
+		},
+		{
+			title: "valid branch — suffix starting with a letter",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-v3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "invalid branch — contains whitespace",
+			contents: `backports:
+  - package: aws
+    branch: "backport-aws 3.17"
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid branch"},
+		},
+		{
+			title: "invalid branch — contains colon",
+			contents: `backports:
+  - package: aws
+    branch: "backport-aws:3.17"
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid branch"},
+		},
+		{
+			title:       "invalid branch — contains single quote",
+			contents:    "backports:\n  - package: aws\n    branch: \"backport-aws-3'17\"\n    base_version: \"3.17.0\"\n    base_commit: \"5b593f6681\"\n    maintained_until: null\n    archived: false\n",
+			wantErr:     true,
+			errContains: []string{"invalid branch"},
+		},
+		{
+			title: "invalid branch — no version segment",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid branch"},
+		},
+		{
+			title: "invalid maintained_until format",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: "01/15/2027"
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid maintained_until", "must be YYYY-MM-DD"},
+		},
+		{
+			title: "multiple entries with errors are all reported",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+  - branch: backport-aws-1.51
+    base_version: "1.51.2"
+    base_commit: "88ad4b8432"
+    maintained_until: "not-a-date"
+    archived: true
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"missing required field 'package'", "invalid maintained_until"},
+		},
+		{
+			title: "duplicate branch name",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.18.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{`duplicate branch "backport-aws-3.17"`},
+		},
+		{
+			title: "duplicate package and base_version",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+  - package: aws
+    branch: backport-aws-3.17x
+    base_version: "3.17.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"duplicate package/version", "aws", "3.17.0"},
+		},
+		{
+			title: "same package different versions is valid",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+  - package: aws
+    branch: backport-aws-3.13
+    base_version: "3.13.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "same version different packages is valid",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-1.0
+    base_version: "1.0.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+  - package: azure
+    branch: backport-azure-1.0
+    base_version: "1.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "security_detection_engine 8.17.7 duplicate is allowed (known exception)",
+			contents: `backports:
+  - package: security_detection_engine
+    branch: backport-security_detection_engine-8.17
+    base_version: "8.17.7"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+  - package: security_detection_engine
+    branch: backport-security_detection_engine-8.18
+    base_version: "8.17.7"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+		},
+		{
+			title: "both duplicate branch and duplicate package/version are reported",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"duplicate branch", "duplicate package/version"},
+		},
+		{
+			title: "invalid branch with missing package",
+			contents: `backports:
+  - package: ""
+    branch: totally-wrong
+    base_version: "1.0.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`,
+			wantErr:     true,
+			errContains: []string{"invalid branch"},
+		},
+		{
+			title: "missing remove_other_packages field",
+			contents: `backports:
+  - package: aws
+    branch: backport-aws-3.17
+    base_version: "3.17.0"
+    base_commit: "5b593f6681"
+    maintained_until: null
+    archived: false
+`,
+			wantErr:     true,
+			errContains: []string{"missing required field 'remove_other_packages'"},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.title, func(t *testing.T) {
+			path := writeTemp(t, tc.contents)
+			err := ValidateInventory(path, "")
+			if tc.wantErr {
+				require.Error(t, err)
+				for _, substr := range tc.errContains {
+					assert.True(t, strings.Contains(err.Error(), substr),
+						"expected error to contain %q, got: %s", substr, err.Error())
+				}
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateInventoryPackageValidation(t *testing.T) {
+	contents := func(pkg string) string {
+		return `backports:
+  - package: ` + pkg + `
+    branch: backport-` + pkg + `-1.0
+    base_version: "1.0.0"
+    base_commit: "abcdef1234"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`
+	}
+
+	t.Run("known package passes", func(t *testing.T) {
+		packagesDir := writePackagesDir(t, "aws", "kubernetes")
+		path := writeTemp(t, contents("aws"))
+		require.NoError(t, ValidateInventory(path, packagesDir))
+	})
+
+	t.Run("unknown package fails", func(t *testing.T) {
+		packagesDir := writePackagesDir(t, "aws")
+		path := writeTemp(t, contents("no_such_package"))
+		err := ValidateInventory(path, packagesDir)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "unknown package")
+		assert.Contains(t, err.Error(), "no_such_package")
+	})
+
+	t.Run("empty packagesDir skips package check", func(t *testing.T) {
+		path := writeTemp(t, contents("totally_made_up"))
+		require.NoError(t, ValidateInventory(path, ""))
+	})
+}
+
+func TestValidateInventoryFileNotFound(t *testing.T) {
+	err := ValidateInventory("/no/such/file.yml", "")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "reading inventory")
+}
+
+const checkActiveInventory = `backports:
+  - package: mypkg
+    branch: backport-mypkg-1.0
+    base_version: "1.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+
+  - package: mypkg
+    branch: backport-mypkg-2.0
+    base_version: "2.0.0"
+    base_commit: "11223344ff"
+    maintained_until: null
+    archived: true
+    remove_other_packages: false
+
+  - package: mypkg
+    branch: backport-mypkg-3.0
+    base_version: "3.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: "2020-01-01"
+    archived: false
+    remove_other_packages: false
+
+  - package: mypkg
+    branch: backport-mypkg-4.0
+    base_version: "4.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: "2099-12-31"
+    archived: false
+    remove_other_packages: false
+
+  - package: mypkg
+    branch: backport-mypkg-5.0
+    base_version: "5.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: "2099-12-31"
+    archived: true
+    remove_other_packages: false
+`
+
+func TestCheckActive(t *testing.T) {
+	now := time.Date(2026, 6, 4, 12, 0, 0, 0, time.UTC)
+	path := writeTemp(t, checkActiveInventory)
+
+	cases := []struct {
+		branch         string
+		wantActive     bool
+		wantArchived   bool
+		wantMaintained *string
+		wantErr        bool
+	}{
+		{
+			branch:       "backport-mypkg-1.0",
+			wantActive:   true,
+			wantArchived: false,
+		},
+		{
+			branch:       "backport-mypkg-2.0",
+			wantActive:   false,
+			wantArchived: true,
+		},
+		{
+			branch:         "backport-mypkg-3.0",
+			wantActive:     false,
+			wantArchived:   false,
+			wantMaintained: ptr("2020-01-01"),
+		},
+		{
+			branch:         "backport-mypkg-4.0",
+			wantActive:     true,
+			wantArchived:   false,
+			wantMaintained: ptr("2099-12-31"),
+		},
+		{
+			branch:         "backport-mypkg-5.0",
+			wantActive:     false,
+			wantArchived:   true,
+			wantMaintained: ptr("2099-12-31"),
+		},
+		{
+			branch:  "backport-mypkg-no-such",
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.branch, func(t *testing.T) {
+			result, err := CheckActive(path, tc.branch, now)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.branch, result.Branch)
+			assert.Equal(t, tc.wantActive, result.Active)
+			assert.Equal(t, tc.wantArchived, result.Archived)
+			assert.Equal(t, tc.wantMaintained, result.MaintainedUntil)
+		})
+	}
+}
+
+func TestCheckActiveMaintainedUntilBoundary(t *testing.T) {
+	mu := "2026-06-04"
+	inv := `backports:
+  - package: mypkg
+    branch: backport-mypkg-1.0
+    base_version: "1.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: "` + mu + `"
+    archived: false
+    remove_other_packages: false
+`
+	path := writeTemp(t, inv)
+
+	t.Run("same day is still active", func(t *testing.T) {
+		now := time.Date(2026, 6, 4, 23, 59, 59, 0, time.UTC)
+		result, err := CheckActive(path, "backport-mypkg-1.0", now)
+		require.NoError(t, err)
+		assert.True(t, result.Active)
+	})
+
+	t.Run("day after is inactive", func(t *testing.T) {
+		now := time.Date(2026, 6, 5, 0, 0, 0, 0, time.UTC)
+		result, err := CheckActive(path, "backport-mypkg-1.0", now)
+		require.NoError(t, err)
+		assert.False(t, result.Active)
+	})
+}
+
+func TestCheckActiveFileNotFound(t *testing.T) {
+	_, err := CheckActive("/no/such/file.yml", "some-branch", time.Now())
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "reading inventory")
+}
+
+const listActiveInventory = `backports:
+  - package: mypkg
+    branch: backport-mypkg-1.0
+    base_version: "1.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+
+  - package: mypkg
+    branch: backport-mypkg-2.0
+    base_version: "2.0.0"
+    base_commit: "11223344ff"
+    maintained_until: null
+    archived: true
+    remove_other_packages: false
+
+  - package: mypkg
+    branch: backport-mypkg-3.0
+    base_version: "3.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: "2020-01-01"
+    archived: false
+    remove_other_packages: false
+
+  - package: mypkg
+    branch: backport-mypkg-4.0
+    base_version: "4.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: "2099-12-31"
+    archived: false
+    remove_other_packages: false
+
+  - package: other
+    branch: backport-other-1.0
+    base_version: "1.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`
+
+func TestListAllActiveBackportBranches(t *testing.T) {
+	now := time.Date(2026, 6, 4, 12, 0, 0, 0, time.UTC)
+	path := writeTemp(t, listActiveInventory)
+
+	t.Run("returns active branches for all requested packages in one call", func(t *testing.T) {
+		result, err := ListAllActiveBackportBranches(path, []string{"mypkg", "other"}, now)
+		require.NoError(t, err)
+		require.Len(t, result["mypkg"], 2)
+		assert.Equal(t, "backport-mypkg-1.0", result["mypkg"][0].Branch)
+		assert.Equal(t, "backport-mypkg-4.0", result["mypkg"][1].Branch)
+		require.Len(t, result["other"], 1)
+		assert.Equal(t, "backport-other-1.0", result["other"][0].Branch)
+	})
+
+	t.Run("package with no active branches gets empty non-nil slice", func(t *testing.T) {
+		result, err := ListAllActiveBackportBranches(path, []string{"no-such-pkg"}, now)
+		require.NoError(t, err)
+		branches, ok := result["no-such-pkg"]
+		assert.True(t, ok, "key must be present even when no branches match")
+		assert.NotNil(t, branches)
+		assert.Empty(t, branches)
+	})
+
+	t.Run("archived and expired branches are excluded", func(t *testing.T) {
+		result, err := ListAllActiveBackportBranches(path, []string{"mypkg"}, now)
+		require.NoError(t, err)
+		for _, r := range result["mypkg"] {
+			assert.NotEqual(t, "backport-mypkg-2.0", r.Branch, "archived branch must not appear")
+			assert.NotEqual(t, "backport-mypkg-3.0", r.Branch, "expired branch must not appear")
+		}
+	})
+
+	t.Run("only requested packages appear in the result", func(t *testing.T) {
+		result, err := ListAllActiveBackportBranches(path, []string{"other"}, now)
+		require.NoError(t, err)
+		assert.Len(t, result, 1)
+		_, ok := result["mypkg"]
+		assert.False(t, ok, "unrequested package must not appear in result")
+	})
+
+	t.Run("empty package list returns empty map", func(t *testing.T) {
+		result, err := ListAllActiveBackportBranches(path, []string{}, now)
+		require.NoError(t, err)
+		assert.Empty(t, result)
+	})
+
+	t.Run("file not found returns error", func(t *testing.T) {
+		_, err := ListAllActiveBackportBranches("/no/such/file.yml", []string{"mypkg"}, now)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "reading inventory")
+	})
+}
+
+func readInventory(t *testing.T, path string) inventory {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+	var inv inventory
+	require.NoError(t, yaml.Unmarshal(data, &inv))
+	return inv
+}
+
+func TestListSkipChecklistPackages(t *testing.T) {
+	t.Run("returns listed packages", func(t *testing.T) {
+		path := writeTemp(t, `skip_checklist_packages:
+  - security_detection_engine
+  - other_pkg
+backports: []
+`)
+		got, err := ListSkipChecklistPackages(path)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"security_detection_engine", "other_pkg"}, got)
+	})
+
+	t.Run("returns nil when field is absent", func(t *testing.T) {
+		path := writeTemp(t, "backports: []\n")
+		got, err := ListSkipChecklistPackages(path)
+		require.NoError(t, err)
+		assert.Nil(t, got)
+	})
+
+	t.Run("file not found returns error", func(t *testing.T) {
+		_, err := ListSkipChecklistPackages("/no/such/file.yml")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "reading inventory")
+	})
+}
+
+func TestValidateBranchFormat(t *testing.T) {
+	tests := []struct {
+		branch      string
+		wantErr     bool
+		errContains string
+	}{
+		{branch: "backport-aws-3.17", wantErr: false},
+		{branch: "backport-aws-6.x", wantErr: false},
+		{branch: "backport-aws-2024-hotfix", wantErr: false},
+		{branch: "backport-security_detection_engine-8.9", wantErr: false},
+		{branch: "aws-3.17", wantErr: true, errContains: "invalid branch"},
+		{branch: "backport-aws-", wantErr: true, errContains: "invalid branch"},
+		{branch: "backport-aws-3.17 extra", wantErr: true, errContains: "invalid branch"},
+		{branch: "totally-wrong", wantErr: true, errContains: "invalid branch"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.branch, func(t *testing.T) {
+			err := validateBranchFormat(tt.branch)
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errContains)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateBranchName(t *testing.T) {
+	tests := []struct {
+		packageName string
+		branch      string
+		wantErr     bool
+		errContains string
+	}{
+		{packageName: "aws", branch: "backport-aws-3.17", wantErr: false},
+		{packageName: "aws", branch: "backport-aws-6.x", wantErr: false},
+		{packageName: "aws", branch: "backport-aws-7.15.0", wantErr: false},
+		{packageName: "aws", branch: "backport-aws-2024-hotfix", wantErr: false},
+		{packageName: "security_detection_engine", branch: "backport-security_detection_engine-8.9", wantErr: false},
+		{
+			packageName: "aws", branch: "backport-nginx-3.17",
+			wantErr: true, errContains: `must start with "backport-aws-"`,
+		},
+		{
+			packageName: "aws", branch: "aws-3.17",
+			wantErr: true, errContains: "invalid branch",
+		},
+		{
+			packageName: "aws", branch: "backport-aws-3.17 extra",
+			wantErr: true, errContains: "invalid branch",
+		},
+		{
+			packageName: "aws", branch: "backport-aws-",
+			wantErr: true, errContains: "invalid branch",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.branch, func(t *testing.T) {
+			err := ValidateBranchName(tt.packageName, tt.branch)
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errContains)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestAddEntry(t *testing.T) {
+	const twoEntries = `backports:
+  - package: aws
+    branch: backport-aws-3.0
+    base_version: "3.0.0"
+    base_commit: "def5678901"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+  - package: aws
+    branch: backport-aws-1.19
+    base_version: "1.19.5"
+    base_commit: "abc1234567"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`
+
+	t.Run("inserts between versions of the same package", func(t *testing.T) {
+		path := writeTemp(t, twoEntries)
+		branch, err := AddEntry(path, "aws", "2.1.0", "aabbccddee", "")
+		require.NoError(t, err)
+		assert.Equal(t, "backport-aws-2.1", branch)
+
+		inv := readInventory(t, path)
+		require.Len(t, inv.Backports, 3)
+		assert.Equal(t, "backport-aws-3.0", inv.Backports[0].Branch)
+		assert.Equal(t, "backport-aws-2.1", inv.Backports[1].Branch)
+		assert.Equal(t, "backport-aws-1.19", inv.Backports[2].Branch)
+	})
+
+	t.Run("inserts between packages alphabetically", func(t *testing.T) {
+		inv := `backports:
+  - package: aws
+    branch: backport-aws-1.0
+    base_version: "1.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+  - package: gcp
+    branch: backport-gcp-1.0
+    base_version: "1.0.0"
+    base_commit: "ffeeddccbb"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`
+		path := writeTemp(t, inv)
+		branch, err := AddEntry(path, "elastic_agent", "2.3.0", "112233aabb", "")
+		require.NoError(t, err)
+		assert.Equal(t, "backport-elastic_agent-2.3", branch)
+
+		result := readInventory(t, path)
+		require.Len(t, result.Backports, 3)
+		assert.Equal(t, "backport-aws-1.0", result.Backports[0].Branch)
+		assert.Equal(t, "backport-elastic_agent-2.3", result.Backports[1].Branch)
+		assert.Equal(t, "backport-gcp-1.0", result.Backports[2].Branch)
+	})
+
+	t.Run("appends when new entry is last", func(t *testing.T) {
+		path := writeTemp(t, twoEntries)
+		branch, err := AddEntry(path, "zz_pkg", "1.0.0", "aabbccddee", "")
+		require.NoError(t, err)
+		assert.Equal(t, "backport-zz_pkg-1.0", branch)
+
+		inv := readInventory(t, path)
+		require.Len(t, inv.Backports, 3)
+		assert.Equal(t, "backport-zz_pkg-1.0", inv.Backports[2].Branch)
+	})
+
+	t.Run("prepends when new entry is first", func(t *testing.T) {
+		path := writeTemp(t, twoEntries)
+		branch, err := AddEntry(path, "aaa_pkg", "1.0.0", "aabbccddee", "")
+		require.NoError(t, err)
+		assert.Equal(t, "backport-aaa_pkg-1.0", branch)
+
+		inv := readInventory(t, path)
+		require.Len(t, inv.Backports, 3)
+		assert.Equal(t, "backport-aaa_pkg-1.0", inv.Backports[0].Branch)
+		assert.Equal(t, "backport-aws-3.0", inv.Backports[1].Branch)
+	})
+
+	t.Run("derives branch from major.minor only", func(t *testing.T) {
+		path := writeTemp(t, twoEntries)
+		branch, err := AddEntry(path, "aws", "2.5.3", "aabbccddee", "")
+		require.NoError(t, err)
+		assert.Equal(t, "backport-aws-2.5", branch)
+	})
+
+	t.Run("new entry has correct fields", func(t *testing.T) {
+		path := writeTemp(t, twoEntries)
+		_, err := AddEntry(path, "aws", "2.1.0", "aabbccddee", "")
+		require.NoError(t, err)
+
+		inv := readInventory(t, path)
+		require.Len(t, inv.Backports, 3)
+		e := inv.Backports[1]
+		assert.Equal(t, "aws", e.Package)
+		assert.Equal(t, "backport-aws-2.1", e.Branch)
+		assert.Equal(t, "2.1.0", e.BaseVersion)
+		assert.Equal(t, "aabbccddee", e.BaseCommit)
+		assert.Nil(t, e.MaintainedUntil)
+		require.NotNil(t, e.Archived)
+		assert.False(t, *e.Archived)
+		require.NotNil(t, e.RemoveOtherPackages)
+		assert.True(t, *e.RemoveOtherPackages)
+	})
+
+	t.Run("existing entries keep double-quoted style", func(t *testing.T) {
+		path := writeTemp(t, twoEntries)
+		_, err := AddEntry(path, "aws", "2.1.0", "aabbccddee", "")
+		require.NoError(t, err)
+
+		out, _ := os.ReadFile(path)
+		content := string(out)
+		assert.Contains(t, content, `base_version: "1.19.5"`)
+		assert.Contains(t, content, `base_version: "3.0.0"`)
+	})
+
+	t.Run("header comment is preserved", func(t *testing.T) {
+		inv := `# Backport inventory header
+#
+backports:
+  - package: aws
+    branch: backport-aws-1.0
+    base_version: "1.0.0"
+    base_commit: "aabbccddee"
+    maintained_until: null
+    archived: false
+    remove_other_packages: false
+`
+		path := writeTemp(t, inv)
+		_, err := AddEntry(path, "aws", "2.0.0", "ffeeddccbb", "")
+		require.NoError(t, err)
+
+		out, _ := os.ReadFile(path)
+		assert.Contains(t, string(out), "# Backport inventory header")
+	})
+
+	t.Run("invalid base_version returns error", func(t *testing.T) {
+		path := writeTemp(t, twoEntries)
+		_, err := AddEntry(path, "aws", "not-a-version", "aabbccddee", "")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "invalid base_version")
+	})
+
+	t.Run("file not found returns error", func(t *testing.T) {
+		_, err := AddEntry("/no/such/file.yml", "aws", "1.0.0", "aabbccddee", "")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "reading inventory")
+	})
+}
+
+func ptr(s string) *string { return &s }
diff --git a/dev/backports/owners/check.go b/dev/backports/owners/check.go
new file mode 100644
index 00000000000..bc3dd135004
--- /dev/null
+++ b/dev/backports/owners/check.go
@@ -0,0 +1,105 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package owners
+
+import (
+	"path/filepath"
+	"sort"
+
+	"github.com/elastic/integrations/dev/codeowners"
+	"github.com/elastic/integrations/dev/gitutil"
+)
+
+// Mismatch is one package's owner-check result against remoteRef. Exactly
+// one of Teams or Err is set. A package fully in sync with remoteRef, or no
+// longer present there, is neither — CheckPackages omits it entirely.
+type Mismatch struct {
+	Package string
+	// Teams is the resolved, deduped, "@"-prefixed set of owners the package
+	// should now have, derived from its SyncPlan.
+	Teams []string
+	// Err is set instead of Teams when the check itself couldn't run for
+	// this package (e.g. a read/parse failure) — no team could be resolved.
+	Err error
+}
+
+// CheckPackages reports owner mismatches for each named package against
+// remoteRef (e.g. "origin/main"). pkgDirs maps package name to its directory
+// relative to workDir (e.g. from dev/backports/changelog.BuildPackageIndex);
+// a name absent from pkgDirs (the package was removed in this PR) is
+// silently skipped, same as a package Compare reports as not found on
+// remoteRef.
+func CheckPackages(git gitutil.Git, workDir, remoteRef string, pkgNames []string, pkgDirs map[string]string) []Mismatch {
+	localPath := filepath.Join(workDir, codeowners.DefaultCodeownersPath)
+	remoteGitRef := remoteRef + ":" + codeowners.DefaultCodeownersPath
+	current, source, err := parseCodeowners(git, localPath, remoteGitRef)
+	if err != nil {
+		// Surface as an error on every package rather than silently checking nothing.
+		var mismatches []Mismatch
+		for _, name := range pkgNames {
+			if _, ok := pkgDirs[name]; ok {
+				mismatches = append(mismatches, Mismatch{Package: name, Err: err})
+			}
+		}
+		return mismatches
+	}
+
+	var mismatches []Mismatch
+	for _, name := range pkgNames {
+		pkgDir, ok := pkgDirs[name]
+		if !ok {
+			continue
+		}
+
+		relPkgDir := filepath.ToSlash(pkgDir)
+		if workDir != "" {
+			if rel, err := filepath.Rel(workDir, pkgDir); err == nil {
+				relPkgDir = filepath.ToSlash(rel)
+			}
+		}
+
+		plan, found, err := compareWith(git, workDir, pkgDir, relPkgDir, remoteRef, current, source)
+		if err != nil {
+			mismatches = append(mismatches, Mismatch{Package: name, Err: err})
+			continue
+		}
+		if !found || plan.Empty() {
+			continue
+		}
+		mismatches = append(mismatches, Mismatch{Package: name, Teams: dedupTeams(plan)})
+	}
+	return mismatches
+}
+
+// dedupTeams collects every distinct owner value named anywhere in plan
+// (manifest owner, package owner, and all sub-path owners), "@"-prefixing
+// the bare manifest.yml owner so every entry uses the same CODEOWNERS-style
+// format, and returns them sorted.
+func dedupTeams(plan SyncPlan) []string {
+	seen := make(map[string]bool)
+	var teams []string
+	add := func(t string) {
+		if t == "" || seen[t] {
+			return
+		}
+		seen[t] = true
+		teams = append(teams, t)
+	}
+
+	if plan.ManifestOwner != "" {
+		add("@" + plan.ManifestOwner)
+	}
+	for _, o := range plan.PackageOwner {
+		add(o)
+	}
+	for _, subOwners := range plan.SubPaths {
+		for _, o := range subOwners {
+			add(o)
+		}
+	}
+
+	sort.Strings(teams)
+	return teams
+}
diff --git a/dev/backports/owners/check_test.go b/dev/backports/owners/check_test.go
new file mode 100644
index 00000000000..c243ae102dd
--- /dev/null
+++ b/dev/backports/owners/check_test.go
@@ -0,0 +1,71 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package owners
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDedupTeams(t *testing.T) {
+	tests := []struct {
+		name string
+		plan SyncPlan
+		want []string
+	}{
+		{
+			name: "empty plan yields no teams",
+			plan: SyncPlan{},
+			want: nil,
+		},
+		{
+			name: "manifest owner is @-prefixed",
+			plan: SyncPlan{ManifestOwner: "elastic/team-a"},
+			want: []string{"@elastic/team-a"},
+		},
+		{
+			name: "package owner is used as-is (already @-prefixed)",
+			plan: SyncPlan{PackageOwner: []string{"@elastic/team-a"}},
+			want: []string{"@elastic/team-a"},
+		},
+		{
+			name: "duplicate across manifest, package, and sub-paths is deduped",
+			plan: SyncPlan{
+				ManifestOwner: "elastic/team-a",
+				PackageOwner:  []string{"@elastic/team-a"},
+				SubPaths: map[string][]string{
+					"/packages/aws/data_stream/cloudtrail": {"@elastic/team-a"},
+				},
+			},
+			want: []string{"@elastic/team-a"},
+		},
+		{
+			name: "distinct teams across fields are all included, sorted",
+			plan: SyncPlan{
+				ManifestOwner: "elastic/team-c",
+				PackageOwner:  []string{"@elastic/team-a"},
+				SubPaths: map[string][]string{
+					"/packages/aws/data_stream/cloudtrail": {"@elastic/team-b"},
+				},
+			},
+			want: []string{"@elastic/team-a", "@elastic/team-b", "@elastic/team-c"},
+		},
+		{
+			name: "multiple owners on one sub-path all included",
+			plan: SyncPlan{
+				SubPaths: map[string][]string{
+					"/packages/aws/data_stream/cloudtrail": {"@elastic/team-a", "@elastic/team-b"},
+				},
+			},
+			want: []string{"@elastic/team-a", "@elastic/team-b"},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, dedupTeams(tc.plan))
+		})
+	}
+}
diff --git a/dev/backports/owners/compare.go b/dev/backports/owners/compare.go
new file mode 100644
index 00000000000..bee2591413a
--- /dev/null
+++ b/dev/backports/owners/compare.go
@@ -0,0 +1,135 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package owners
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/elastic/integrations/dev/codeowners"
+	"github.com/elastic/integrations/dev/gitutil"
+)
+
+// parseCodeowners reads and parses CODEOWNERS from localPath on disk and
+// from remoteGitRef (e.g. "origin/main:.github/CODEOWNERS") via git show.
+func parseCodeowners(git gitutil.Git, localPath, remoteGitRef string) (current, source *codeowners.Owners, err error) {
+	currentData, err := os.ReadFile(localPath)
+	if err != nil {
+		return nil, nil, fmt.Errorf("reading %s: %w", localPath, err)
+	}
+	sourceData, err := git.Output("show", remoteGitRef)
+	if err != nil {
+		return nil, nil, fmt.Errorf("reading %s: %w", remoteGitRef, err)
+	}
+
+	current, err = codeowners.ParseOwners(string(currentData))
+	if err != nil {
+		return nil, nil, fmt.Errorf("parsing %s: %w", localPath, err)
+	}
+	source, err = codeowners.ParseOwners(sourceData)
+	if err != nil {
+		return nil, nil, fmt.Errorf("parsing %s: %w", remoteGitRef, err)
+	}
+	return current, source, nil
+}
+
+// parseManifestOwners reads and extracts the owner.github field from
+// localPath on disk and from remoteGitRef (e.g.
+// "origin/main:packages/aws/manifest.yml") via git show.
+func parseManifestOwners(git gitutil.Git, localPath, remoteGitRef string) (current, source string, err error) {
+	currentData, err := os.ReadFile(localPath)
+	if err != nil {
+		return "", "", fmt.Errorf("reading %s: %w", localPath, err)
+	}
+	sourceData, err := git.Output("show", remoteGitRef)
+	if err != nil {
+		return "", "", fmt.Errorf("reading %s: %w", remoteGitRef, err)
+	}
+
+	current, err = manifestOwner(currentData)
+	if err != nil {
+		return "", "", fmt.Errorf("parsing manifest owner from %s: %w", localPath, err)
+	}
+	source, err = manifestOwner([]byte(sourceData))
+	if err != nil {
+		return "", "", fmt.Errorf("parsing manifest owner from %s: %w", remoteGitRef, err)
+	}
+	return current, source, nil
+}
+
+// existingSubPaths returns the full CODEOWNERS paths nested under pkgPath
+// that actually exist in the current worktree checkout — the union of every
+// explicit entry current and source declare under pkgPath (data streams, a
+// kibana/ directory, or anything else), filtered down to the ones present on
+// disk. Plan never touches a sub-path outside this set.
+func existingSubPaths(workDir, pkgPath string, current, source *codeowners.Owners) []string {
+	candidates := make(map[string]bool)
+	for _, p := range current.EntriesUnder(pkgPath) {
+		candidates[p] = true
+	}
+	for _, p := range source.EntriesUnder(pkgPath) {
+		candidates[p] = true
+	}
+
+	paths := make([]string, 0, len(candidates))
+	for p := range candidates {
+		if _, err := os.Stat(filepath.Join(workDir, strings.TrimPrefix(p, "/"))); err == nil {
+			paths = append(paths, p)
+		}
+	}
+	return paths
+}
+
+// Compare reads pkgDir's current CODEOWNERS/manifest.yml owner and
+// remoteRef's version of the same, and computes the Plan needed to bring the
+// former in line with the latter. relPkgDir is pkgDir relative to workDir
+// (both slash-separated) — used to build the git show path for the remote
+// side; pkgPath (the CODEOWNERS-style path, e.g. "/packages/aws") is derived
+// from it. It's the one place apply.Apply's sync step and the
+// backport-branch CI check both call, so they can never see a different
+// answer for the same package.
+//
+// Callers checking multiple packages in one run should prefer compareWith to
+// avoid re-reading and re-parsing CODEOWNERS on every call.
+func Compare(git gitutil.Git, workDir, pkgDir, relPkgDir, remoteRef string) (plan SyncPlan, found bool, err error) {
+	localPath := filepath.Join(workDir, codeowners.DefaultCodeownersPath)
+	remoteGitRef := remoteRef + ":" + codeowners.DefaultCodeownersPath
+	current, source, err := parseCodeowners(git, localPath, remoteGitRef)
+	if err != nil {
+		return SyncPlan{}, false, err
+	}
+	return compareWith(git, workDir, pkgDir, relPkgDir, remoteRef, current, source)
+}
+
+// compareWith is like Compare but accepts pre-parsed CODEOWNERS for both the
+// current worktree and remoteRef, avoiding a re-read when checking multiple
+// packages in the same run. The current and source owners must have been
+// produced by parseCodeowners (or equivalent) against the same workDir and
+// remoteRef that are passed here.
+func compareWith(git gitutil.Git, workDir, pkgDir, relPkgDir, remoteRef string, current, source *codeowners.Owners) (plan SyncPlan, found bool, err error) {
+	pkgPath := "/" + relPkgDir
+
+	if _, ok := source.Resolve(pkgPath); !ok {
+		// The package no longer resolves to an owner on remoteRef (removed
+		// or renamed) — a normal skip, not a failure. Checked before reading
+		// manifest.yml, since that file may well not exist there either, and
+		// a missing-file error there would otherwise mask this clean case.
+		return SyncPlan{}, false, nil
+	}
+
+	manifestPath := filepath.Join(pkgDir, "manifest.yml")
+	remoteManifestRef := remoteRef + ":" + relPkgDir + "/manifest.yml"
+	currentManifestOwner, sourceManifestOwner, err := parseManifestOwners(git, manifestPath, remoteManifestRef)
+	if err != nil {
+		return SyncPlan{}, false, err
+	}
+
+	subPaths := existingSubPaths(workDir, pkgPath, current, source)
+
+	plan, found = Plan(pkgPath, subPaths, current, source, currentManifestOwner, sourceManifestOwner)
+	return plan, found, nil
+}
diff --git a/dev/backports/owners/compare_integration_test.go b/dev/backports/owners/compare_integration_test.go
new file mode 100644
index 00000000000..468b6a8531a
--- /dev/null
+++ b/dev/backports/owners/compare_integration_test.go
@@ -0,0 +1,111 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package owners
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/elastic/integrations/dev/gitutil"
+)
+
+// setupCheckPackagesRepo creates a bare remote and a local clone with two
+// packages: "aws", whose owner changes on main after this local checkout was
+// made (modeling a stale backport branch), and "nginx", whose owner never
+// changes. It returns the local clone directory, left checked out at the
+// pre-reassignment state.
+func setupCheckPackagesRepo(t *testing.T) (workDir string) {
+	t.Helper()
+
+	run := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, out)
+		return strings.TrimRight(string(out), "\n")
+	}
+
+	remoteDir := t.TempDir()
+	run(remoteDir, "init", "--bare", "-q")
+
+	workDir = t.TempDir()
+	run(workDir, "clone", "-q", remoteDir, ".")
+	run(workDir, "config", "user.email", "test@test.com")
+	run(workDir, "config", "user.name", "Test")
+	run(workDir, "config", "commit.gpgsign", "false")
+
+	write := func(rel, content string) {
+		t.Helper()
+		require.NoError(t, os.MkdirAll(filepath.Dir(filepath.Join(workDir, rel)), 0o755))
+		require.NoError(t, os.WriteFile(filepath.Join(workDir, rel), []byte(content), 0o644))
+	}
+
+	write(".github/CODEOWNERS", "/packages/aws @elastic/team-old\n/packages/nginx @elastic/team-nginx\n")
+	write("packages/aws/manifest.yml", "name: aws\nowner:\n  github: elastic/team-old\n")
+	write("packages/nginx/manifest.yml", "name: nginx\nowner:\n  github: elastic/team-nginx\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Initial state")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	// Ownership changes on main for aws only, after this local checkout was
+	// made — this local worktree (standing in for an existing backport
+	// branch) still has the old owner.
+	write(".github/CODEOWNERS", "/packages/aws @elastic/team-new\n/packages/nginx @elastic/team-nginx\n")
+	write("packages/aws/manifest.yml", "name: aws\nowner:\n  github: elastic/team-new\n")
+	run(workDir, "add", ".")
+	run(workDir, "commit", "-q", "-m", "Reassign aws ownership")
+	run(workDir, "push", "-q", "origin", "HEAD:main")
+
+	// Roll the local checkout back to the pre-reassignment state.
+	run(workDir, "reset", "-q", "--hard", "HEAD~1")
+
+	return workDir
+}
+
+func TestCheckPackages(t *testing.T) {
+	workDir := setupCheckPackagesRepo(t)
+	git := gitutil.Git{Dir: workDir}
+	require.NoError(t, git.Run("fetch", "origin", "main"))
+
+	pkgDirs := map[string]string{
+		"aws":   filepath.Join(workDir, "packages", "aws"),
+		"nginx": filepath.Join(workDir, "packages", "nginx"),
+	}
+
+	// "removed_pkg" is listed as changed (e.g. by a git diff) but has no
+	// entry in pkgDirs — CheckPackages must skip it silently, same as a
+	// package Compare itself reports as not found on remoteRef.
+	mismatches := CheckPackages(git, workDir, "origin/main", []string{"aws", "nginx", "removed_pkg"}, pkgDirs)
+
+	require.Len(t, mismatches, 1)
+	assert.Equal(t, "aws", mismatches[0].Package)
+	assert.NoError(t, mismatches[0].Err)
+	assert.Equal(t, []string{"@elastic/team-new"}, mismatches[0].Teams)
+}
+
+func TestCheckPackages_SkipsPackageRemovedFromMain(t *testing.T) {
+	workDir := setupCheckPackagesRepo(t)
+	git := gitutil.Git{Dir: workDir}
+	require.NoError(t, git.Run("fetch", "origin", "main"))
+
+	// "gone" only exists in this local checkout (standing in for a package
+	// still present on a stale backport branch but removed from main) — it
+	// has neither a CODEOWNERS entry nor a manifest.yml on origin/main.
+	pkgDir := filepath.Join(workDir, "packages", "gone")
+	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(pkgDir, "manifest.yml"),
+		[]byte("name: gone\nowner:\n  github: elastic/team-old\n"), 0o644))
+
+	mismatches := CheckPackages(git, workDir, "origin/main", []string{"gone"}, map[string]string{"gone": pkgDir})
+
+	assert.Empty(t, mismatches, "a package absent from main's CODEOWNERS must be skipped, not reported as an error")
+}
diff --git a/dev/backports/owners/owners.go b/dev/backports/owners/owners.go
new file mode 100644
index 00000000000..d27e6966e17
--- /dev/null
+++ b/dev/backports/owners/owners.go
@@ -0,0 +1,210 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+// Package owners compares package ownership (CODEOWNERS entries and
+// manifest.yml's owner.github field) between a backport branch's worktree and
+// another git ref (typically main), and computes the changes needed to bring
+// a single package's ownership in line with that ref.
+package owners
+
+import (
+	"fmt"
+	"maps"
+	"slices"
+	"sort"
+	"strings"
+
+	"github.com/elastic/integrations/dev/citools"
+	"github.com/elastic/integrations/dev/codeowners"
+)
+
+// parseEntryLine parses a single CODEOWNERS line. Returns ok=true only for
+// lines with both a path and at least one owner — blank lines, comments, and
+// single-field exclusion rules (no owners) all return ok=false. Used by
+// ApplyUpdates to identify entry lines without re-implementing the same logic.
+func parseEntryLine(line string) (p string, owners []string, ok bool) {
+	line = strings.TrimSpace(line)
+	if line == "" || strings.HasPrefix(line, "#") {
+		return "", nil, false
+	}
+
+	fields := strings.Fields(line)
+	if len(fields) < 2 {
+		return "", nil, false
+	}
+
+	return strings.TrimSuffix(fields[0], "/"), fields[1:], true
+}
+
+// manifestOwner extracts the owner.github field from manifest.yml content,
+// via dev/citools' shared manifest parser.
+func manifestOwner(manifestYAML []byte) (string, error) {
+	manifest, err := citools.ParsePackageManifest(manifestYAML)
+	if err != nil {
+		return "", fmt.Errorf("parsing manifest.yml: %w", err)
+	}
+	if manifest.Owner.Github == "" {
+		return "", fmt.Errorf("no owner specified in manifest.yml")
+	}
+
+	return manifest.Owner.Github, nil
+}
+
+// SyncPlan describes the writes needed to bring a package's owners in the
+// current worktree in line with another ref. A zero-value SyncPlan means no
+// changes are needed.
+type SyncPlan struct {
+	// ManifestOwner is the new value for manifest.yml's owner.github field.
+	// Empty means unchanged.
+	ManifestOwner string
+	// PackageOwner is the new value for the package's own CODEOWNERS line.
+	// Nil means unchanged.
+	PackageOwner []string
+	// SubPaths maps a full CODEOWNERS path nested under the package — a data
+	// stream (".../data_stream/<name>"), a kibana/ directory, or any other
+	// overridden subdirectory — to the new explicit line needed for it. Only
+	// sub-paths that need an explicit line written (new or updated) are
+	// present.
+	SubPaths map[string][]string
+}
+
+// Empty reports whether the plan requires no changes.
+func (p SyncPlan) Empty() bool {
+	return p.ManifestOwner == "" && p.PackageOwner == nil && len(p.SubPaths) == 0
+}
+
+// Plan computes the changes needed to bring pkgPath's owners (CODEOWNERS
+// package line, manifest.yml owner, and any explicit sub-path overrides —
+// data streams, a kibana/ directory, or anything else) in line with main's
+// resolution. existingSubPaths must be exactly the full CODEOWNERS paths
+// nested under pkgPath that actually exist in the current worktree checkout
+// for this package (e.g. "/packages/aws/data_stream/cloudtrail",
+// "/packages/aws/kibana"): Plan never adds a line for a sub-path absent from
+// existingSubPaths, since it may not exist in this backport branch's version
+// of the package.
+//
+// If a package no longer resolves to an owner on main (e.g. it was removed),
+// Plan returns (SyncPlan{}, false) so the caller can skip it cleanly.
+//
+// Plan only ever mirrors what main explicitly says about a given sub-path —
+// it never invents a new explicit override for one main leaves implicit,
+// even when a sibling sub-path in the same package does gain one.
+// Concretely, per sub-path:
+//   - if the current worktree already has an explicit line for it, that line
+//     is kept explicit and its value is synced to main's resolution (which
+//     falls back to the package owner if main consolidated an override back
+//     to the package level);
+//   - otherwise, a new explicit line is added only if main itself has an
+//     explicit entry for that exact sub-path;
+//   - if neither side calls it out explicitly, it's left alone, inheriting
+//     the package owner on both sides.
+//
+// This can leave a package's CODEOWNERS only partially split across its
+// sub-paths (failing dev/codeowners' all-or-nothing invariant for data
+// streams) when main itself hasn't defined owners for every one it shares
+// with this branch. That's intentional: deciding an owner for something
+// nobody has assigned is a human judgment call, not something to guess a
+// default for — codeowners.Check() (or the backport-branch CI check)
+// surfaces that gap for a person to resolve instead.
+func Plan(pkgPath string, existingSubPaths []string, current, main *codeowners.Owners, currentManifestOwner, mainManifestOwner string) (SyncPlan, bool) {
+	mainPkgOwner, found := main.Resolve(pkgPath)
+	if !found {
+		return SyncPlan{}, false
+	}
+
+	var plan SyncPlan
+
+	if mainManifestOwner != "" && mainManifestOwner != currentManifestOwner {
+		plan.ManifestOwner = mainManifestOwner
+	}
+
+	currentPkgOwner, _ := current.Resolve(pkgPath)
+	if !slices.Equal(currentPkgOwner, mainPkgOwner) {
+		plan.PackageOwner = mainPkgOwner
+	}
+
+	if len(existingSubPaths) == 0 {
+		return plan, true
+	}
+
+	subPathPlan := make(map[string][]string, len(existingSubPaths))
+	for _, subPath := range existingSubPaths {
+		if currentOwner, hasCurrentExplicit := current.ExplicitEntry(subPath); hasCurrentExplicit {
+			mainOwner, _ := main.Resolve(subPath)
+			if !slices.Equal(currentOwner, mainOwner) {
+				subPathPlan[subPath] = mainOwner
+			}
+			continue
+		}
+
+		mainOwner, hasMainExplicit := main.ExplicitEntry(subPath)
+		if !hasMainExplicit {
+			continue
+		}
+		currentOwner, _ := current.Resolve(subPath)
+		if !slices.Equal(currentOwner, mainOwner) {
+			subPathPlan[subPath] = mainOwner
+		}
+	}
+	if len(subPathPlan) > 0 {
+		plan.SubPaths = subPathPlan
+	}
+
+	return plan, true
+}
+
+// ApplyUpdates rewrites CODEOWNERS content so each path in updates resolves
+// to its given owners — updating an existing line in place, or inserting a
+// new one (immediately after packagePath's own line, if found; otherwise at
+// the end of the file) when none exists yet.
+func ApplyUpdates(content string, updates map[string][]string, packagePath string) string {
+	if len(updates) == 0 {
+		return content
+	}
+
+	remaining := make(map[string][]string, len(updates))
+	maps.Copy(remaining, updates)
+
+	lines := strings.Split(content, "\n")
+	packageLineIdx := -1
+	for i, line := range lines {
+		p, _, ok := parseEntryLine(line)
+		if !ok {
+			continue
+		}
+		if p == packagePath {
+			packageLineIdx = i
+		}
+		if newOwners, found := remaining[p]; found {
+			lines[i] = p + " " + strings.Join(newOwners, " ")
+			delete(remaining, p)
+		}
+	}
+
+	if len(remaining) > 0 {
+		insertAt := len(lines)
+		if packageLineIdx != -1 {
+			insertAt = packageLineIdx + 1
+		} else if len(lines) > 0 && lines[len(lines)-1] == "" {
+			// content ends with a trailing newline, represented by a final
+			// empty element — insert before it so appended lines land before
+			// that newline instead of after it.
+			insertAt = len(lines) - 1
+		}
+
+		remainingPaths := make([]string, 0, len(remaining))
+		for path := range remaining {
+			remainingPaths = append(remainingPaths, path)
+		}
+		sort.Strings(remainingPaths)
+
+		newLines := make([]string, 0, len(remainingPaths))
+		for _, path := range remainingPaths {
+			newLines = append(newLines, path+" "+strings.Join(remaining[path], " "))
+		}
+		lines = slices.Insert(lines, insertAt, newLines...)
+	}
+
+	return strings.Join(lines, "\n")
+}
diff --git a/dev/backports/owners/owners_test.go b/dev/backports/owners/owners_test.go
new file mode 100644
index 00000000000..ae3ded174cb
--- /dev/null
+++ b/dev/backports/owners/owners_test.go
@@ -0,0 +1,253 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package owners
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/elastic/integrations/dev/codeowners"
+)
+
+func TestManifestOwnerFn(t *testing.T) {
+	cases := []struct {
+		name          string
+		manifest      string
+		expected      string
+		expectedError bool
+	}{
+		{
+			name:     "owner present",
+			manifest: "name: aws\nowner:\n  github: elastic/obs-infraobs-integrations\n",
+			expected: "elastic/obs-infraobs-integrations",
+		},
+		{
+			name:          "owner missing",
+			manifest:      "name: aws\n",
+			expectedError: true,
+		},
+		{
+			name:          "invalid yaml",
+			manifest:      "not: [valid",
+			expectedError: true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got, err := manifestOwner([]byte(c.manifest))
+			if c.expectedError {
+				assert.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, c.expected, got)
+		})
+	}
+}
+
+func TestPlan(t *testing.T) {
+	cases := []struct {
+		name             string
+		current          string
+		main             string
+		pkgPath          string
+		existingSubPaths []string
+		currentManifest  string
+		mainManifest     string
+		expectedPlan     SyncPlan
+		expectedFound    bool
+	}{
+		{
+			name:             "matched: owners already in sync, no-op",
+			current:          "/packages/aws @elastic/obs-infraobs-integrations\n",
+			main:             "/packages/aws @elastic/obs-infraobs-integrations\n",
+			pkgPath:          "/packages/aws",
+			existingSubPaths: []string{"/packages/aws/data_stream/cloudtrail"},
+			currentManifest:  "elastic/obs-infraobs-integrations",
+			mainManifest:     "elastic/obs-infraobs-integrations",
+			expectedPlan:     SyncPlan{},
+			expectedFound:    true,
+		},
+		{
+			name:             "mismatched: package owner changed on main",
+			current:          "/packages/aws @elastic/obs-infraobs-integrations\n",
+			main:             "/packages/aws @elastic/obs-ds-hosted-services\n",
+			pkgPath:          "/packages/aws",
+			existingSubPaths: []string{"/packages/aws/data_stream/cloudtrail"},
+			currentManifest:  "elastic/obs-infraobs-integrations",
+			mainManifest:     "elastic/obs-ds-hosted-services",
+			expectedPlan: SyncPlan{
+				ManifestOwner: "elastic/obs-ds-hosted-services",
+				PackageOwner:  []string{"@elastic/obs-ds-hosted-services"},
+			},
+			expectedFound: true,
+		},
+		{
+			name:             "missing on main: package removed, plan skips cleanly",
+			current:          "/packages/aws @elastic/obs-infraobs-integrations\n",
+			main:             "/packages/other @elastic/obs-ds-hosted-services\n",
+			pkgPath:          "/packages/aws",
+			existingSubPaths: []string{"/packages/aws/data_stream/cloudtrail"},
+			currentManifest:  "elastic/obs-infraobs-integrations",
+			mainManifest:     "elastic/obs-infraobs-integrations",
+			expectedPlan:     SyncPlan{},
+			expectedFound:    false,
+		},
+		{
+			name:    "nested category package owner changed on main",
+			current: "/packages/aws/foo @elastic/team-a\n",
+			main:    "/packages/aws/foo @elastic/team-b\n",
+			pkgPath: "/packages/aws/foo",
+			expectedPlan: SyncPlan{
+				PackageOwner: []string{"@elastic/team-b"},
+			},
+			expectedFound: true,
+		},
+		{
+			// Regression case: a package with several data streams, where
+			// main assigns an explicit owner to just one of them. Sibling
+			// data streams that main leaves implicit must NOT get a
+			// synthesized owner — even though this can leave the branch's
+			// CODEOWNERS only partially split (failing the all-or-nothing
+			// invariant), inventing an owner for something nobody assigned
+			// is worse than surfacing the gap for a human to resolve.
+			name:    "main introduces an explicit override for one data stream; sibling data streams are left untouched",
+			current: "/packages/aws @elastic/obs-infraobs-integrations\n",
+			main:    "/packages/aws @elastic/obs-infraobs-integrations\n/packages/aws/data_stream/cloudtrail @elastic/security-service-integrations\n",
+			pkgPath: "/packages/aws",
+			existingSubPaths: []string{
+				"/packages/aws/data_stream/cloudtrail",
+				"/packages/aws/data_stream/vpcflow",
+				"/packages/aws/data_stream/apigateway_logs",
+			},
+			expectedPlan: SyncPlan{
+				SubPaths: map[string][]string{
+					"/packages/aws/data_stream/cloudtrail": {"@elastic/security-service-integrations"},
+				},
+			},
+			expectedFound: true,
+		},
+		{
+			name: "main consolidates a previously-split override back to the package level",
+			current: "/packages/aws @elastic/obs-infraobs-integrations\n" +
+				"/packages/aws/data_stream/cloudtrail @elastic/security-service-integrations\n",
+			main:             "/packages/aws @elastic/obs-infraobs-integrations\n",
+			pkgPath:          "/packages/aws",
+			existingSubPaths: []string{"/packages/aws/data_stream/cloudtrail"},
+			expectedPlan: SyncPlan{
+				SubPaths: map[string][]string{
+					"/packages/aws/data_stream/cloudtrail": {"@elastic/obs-infraobs-integrations"},
+				},
+			},
+			expectedFound: true,
+		},
+		{
+			name:             "sub-path absent from this worktree is never touched",
+			current:          "/packages/aws @elastic/obs-infraobs-integrations\n",
+			main:             "/packages/aws @elastic/obs-infraobs-integrations\n/packages/aws/data_stream/newly_added @elastic/security-service-integrations\n",
+			pkgPath:          "/packages/aws",
+			existingSubPaths: []string{"/packages/aws/data_stream/cloudtrail"},
+			expectedPlan:     SyncPlan{},
+			expectedFound:    true,
+		},
+		{
+			// A non-data-stream sub-path (e.g. a package's kibana/ assets
+			// directory) must be handled exactly the same way as a data
+			// stream — Plan has no special-cased notion of "data_stream/".
+			name:             "non-data-stream sub-path (kibana/) owner changed on main",
+			current:          "/packages/kubernetes @elastic/obs-ds-hosted-services\n/packages/kubernetes/kibana @elastic/obs-ds-hosted-services-old\n",
+			main:             "/packages/kubernetes @elastic/obs-ds-hosted-services\n/packages/kubernetes/kibana @elastic/obs-ds-hosted-services-new\n",
+			pkgPath:          "/packages/kubernetes",
+			existingSubPaths: []string{"/packages/kubernetes/kibana"},
+			expectedPlan: SyncPlan{
+				SubPaths: map[string][]string{
+					"/packages/kubernetes/kibana": {"@elastic/obs-ds-hosted-services-new"},
+				},
+			},
+			expectedFound: true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			current, err := codeowners.ParseOwners(c.current)
+			require.NoError(t, err)
+			main, err := codeowners.ParseOwners(c.main)
+			require.NoError(t, err)
+
+			plan, found := Plan(c.pkgPath, c.existingSubPaths, current, main, c.currentManifest, c.mainManifest)
+			assert.Equal(t, c.expectedFound, found)
+			assert.Equal(t, c.expectedPlan, plan)
+		})
+	}
+}
+
+func TestSyncPlanEmpty(t *testing.T) {
+	assert.True(t, SyncPlan{}.Empty())
+	assert.False(t, SyncPlan{ManifestOwner: "elastic/ecosystem"}.Empty())
+	assert.False(t, SyncPlan{PackageOwner: []string{"@elastic/ecosystem"}}.Empty())
+	assert.False(t, SyncPlan{SubPaths: map[string][]string{"/packages/aws/data_stream/cloudtrail": {"@elastic/ecosystem"}}}.Empty())
+}
+
+func TestApplyUpdates(t *testing.T) {
+	tests := []struct {
+		name        string
+		content     string
+		updates     map[string][]string
+		packagePath string
+		wantContent string
+	}{
+		{
+			name:        "no-op when there are no updates",
+			content:     "/packages/aws @elastic/obs-team\n",
+			updates:     nil,
+			packagePath: "/packages/aws",
+			wantContent: "/packages/aws @elastic/obs-team\n",
+		},
+		{
+			name:        "updates an existing line in place, preserving unrelated lines",
+			content:     "/packages/aws @elastic/obs-old-team\n/packages/other @elastic/other-team\n",
+			updates:     map[string][]string{"/packages/aws": {"@elastic/obs-new-team"}},
+			packagePath: "/packages/aws",
+			wantContent: "/packages/aws @elastic/obs-new-team\n/packages/other @elastic/other-team\n",
+		},
+		{
+			name:    "inserts a new data-stream line right after the package's own line",
+			content: "/packages/aws @elastic/obs-team\n/packages/other @elastic/other-team\n",
+			updates: map[string][]string{
+				"/packages/aws/data_stream/cloudtrail": {"@elastic/security-team"},
+			},
+			packagePath: "/packages/aws",
+			wantContent: "/packages/aws @elastic/obs-team\n/packages/aws/data_stream/cloudtrail @elastic/security-team\n" +
+				"/packages/other @elastic/other-team\n",
+		},
+		{
+			name:        "appends at end of file when the package line isn't found",
+			content:     "/packages/other @elastic/other-team\n",
+			updates:     map[string][]string{"/packages/aws": {"@elastic/obs-team"}},
+			packagePath: "/packages/aws",
+			wantContent: "/packages/other @elastic/other-team\n/packages/aws @elastic/obs-team\n",
+		},
+		{
+			// Comments and exclusion-only rules must survive untouched.
+			name: "preserves comments and unrelated rules",
+			content: "# top-level comment\n/packages/aws @elastic/obs-old-team\n" +
+				"/packages/aws/README.md\n/packages/other @elastic/other-team\n",
+			updates:     map[string][]string{"/packages/aws": {"@elastic/obs-new-team"}},
+			packagePath: "/packages/aws",
+			wantContent: "# top-level comment\n/packages/aws @elastic/obs-new-team\n" +
+				"/packages/aws/README.md\n/packages/other @elastic/other-team\n",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := ApplyUpdates(tc.content, tc.updates, tc.packagePath)
+			assert.Equal(t, tc.wantContent, got)
+		})
+	}
+}
diff --git a/dev/backports/packages/detect.go b/dev/backports/packages/detect.go
new file mode 100644
index 00000000000..53913bf4c92
--- /dev/null
+++ b/dev/backports/packages/detect.go
@@ -0,0 +1,52 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package packages
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/elastic/integrations/dev/citools"
+)
+
+// DetectPackages maps a list of changed file paths to the package names they belong to.
+// packagesDir is the path to the packages/ directory (e.g. "packages").
+//
+// It first calls citools.ListPackagesWithNames to discover all package roots, then checks
+// each changed file against those roots. This handles both flat structures
+// (packages/<name>/) and nested structures (packages/<technology>/<name>/) without
+// any custom tree-walking logic. Files not under any known package root are silently
+// skipped.
+//
+// Returns a deduplicated list of package names in the order they are first encountered.
+func DetectPackages(files []string, packagesDir string) ([]string, error) {
+	pkgs, err := citools.ListPackagesWithNames(packagesDir)
+	if err != nil {
+		return nil, fmt.Errorf("listing packages in %s: %w", packagesDir, err)
+	}
+
+	// Pre-append the separator once per package to avoid a string allocation on every
+	// (file, package) pair in the inner loop below.
+	sep := string(filepath.Separator)
+	for i := range pkgs {
+		pkgs[i].Path += sep
+	}
+
+	seen := make(map[string]struct{})
+	result := make([]string, 0) // non-nil so json.Marshal produces [] not null
+	for _, f := range files {
+		for _, p := range pkgs {
+			if strings.HasPrefix(f, p.Path) {
+				if _, ok := seen[p.Name]; !ok {
+					seen[p.Name] = struct{}{}
+					result = append(result, p.Name)
+				}
+				break
+			}
+		}
+	}
+	return result, nil
+}
diff --git a/dev/backports/packages/detect_test.go b/dev/backports/packages/detect_test.go
new file mode 100644
index 00000000000..fab5f5626d0
--- /dev/null
+++ b/dev/backports/packages/detect_test.go
@@ -0,0 +1,142 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package packages
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// writeManifest creates a valid manifest.yml in dir with the given package name.
+func writeManifest(t *testing.T, dir, name string) {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(dir, 0700))
+	manifest := "format_version: \"1.0.0\"\nname: " + name + "\ntype: integration\nversion: \"1.0.0\"\n"
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "manifest.yml"), []byte(manifest), 0600))
+}
+
+// pkgsDir creates a temp packages/ directory and returns its path.
+func pkgsDir(t *testing.T) string {
+	t.Helper()
+	return filepath.Join(t.TempDir(), "packages")
+}
+
+func TestDetectPackages(t *testing.T) {
+	t.Run("flat package detected from nested file", func(t *testing.T) {
+		pkgs := pkgsDir(t)
+		writeManifest(t, filepath.Join(pkgs, "nginx"), "nginx")
+
+		result, err := DetectPackages([]string{
+			filepath.Join(pkgs, "nginx", "data_stream", "access", "fields.yml"),
+		}, pkgs)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"nginx"}, result)
+	})
+
+	t.Run("nested package detected when intermediate dir has no manifest", func(t *testing.T) {
+		pkgs := pkgsDir(t)
+		// packages/technology/ has no manifest.yml
+		writeManifest(t, filepath.Join(pkgs, "technology", "apache"), "apache")
+
+		result, err := DetectPackages([]string{
+			filepath.Join(pkgs, "technology", "apache", "data_stream", "access", "fields.yml"),
+		}, pkgs)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"apache"}, result)
+	})
+
+	t.Run("file not under packagesDir is skipped", func(t *testing.T) {
+		pkgs := pkgsDir(t)
+		writeManifest(t, filepath.Join(pkgs, "nginx"), "nginx")
+
+		result, err := DetectPackages([]string{
+			".buildkite/scripts/common.sh",
+			"dev/backports/inventory.go",
+		}, pkgs)
+		require.NoError(t, err)
+		assert.Empty(t, result)
+	})
+
+	t.Run("multiple files from same package deduplicated", func(t *testing.T) {
+		pkgs := pkgsDir(t)
+		writeManifest(t, filepath.Join(pkgs, "aws"), "aws")
+
+		result, err := DetectPackages([]string{
+			filepath.Join(pkgs, "aws", "manifest.yml"),
+			filepath.Join(pkgs, "aws", "changelog.yml"),
+			filepath.Join(pkgs, "aws", "data_stream", "ec2", "fields.yml"),
+		}, pkgs)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"aws"}, result)
+	})
+
+	t.Run("multiple packages returned in order of first encounter", func(t *testing.T) {
+		pkgs := pkgsDir(t)
+		writeManifest(t, filepath.Join(pkgs, "aws"), "aws")
+		writeManifest(t, filepath.Join(pkgs, "kubernetes"), "kubernetes")
+
+		result, err := DetectPackages([]string{
+			filepath.Join(pkgs, "aws", "manifest.yml"),
+			filepath.Join(pkgs, "kubernetes", "manifest.yml"),
+		}, pkgs)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"aws", "kubernetes"}, result)
+	})
+
+	t.Run("package name read from manifest not from directory name", func(t *testing.T) {
+		pkgs := pkgsDir(t)
+		// directory name is "my_pkg_dir" but manifest says name: actual_name
+		writeManifest(t, filepath.Join(pkgs, "my_pkg_dir"), "actual_name")
+
+		result, err := DetectPackages([]string{
+			filepath.Join(pkgs, "my_pkg_dir", "manifest.yml"),
+		}, pkgs)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"actual_name"}, result)
+	})
+
+	t.Run("manifest.yml itself is detected as belonging to its package", func(t *testing.T) {
+		pkgs := pkgsDir(t)
+		writeManifest(t, filepath.Join(pkgs, "nginx"), "nginx")
+
+		result, err := DetectPackages([]string{
+			filepath.Join(pkgs, "nginx", "manifest.yml"),
+		}, pkgs)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"nginx"}, result)
+	})
+
+	t.Run("empty file list returns empty result", func(t *testing.T) {
+		pkgs := pkgsDir(t)
+		writeManifest(t, filepath.Join(pkgs, "nginx"), "nginx")
+
+		result, err := DetectPackages([]string{}, pkgs)
+		require.NoError(t, err)
+		assert.Empty(t, result)
+		assert.NotNil(t, result) // must be [] not null when JSON-marshalled
+	})
+
+	t.Run("mix of package and non-package files", func(t *testing.T) {
+		pkgs := pkgsDir(t)
+		writeManifest(t, filepath.Join(pkgs, "aws"), "aws")
+
+		result, err := DetectPackages([]string{
+			".github/workflows/test.yml",
+			filepath.Join(pkgs, "aws", "changelog.yml"),
+			"dev/backports/inventory.go",
+		}, pkgs)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"aws"}, result)
+	})
+
+	t.Run("nonexistent packagesDir returns error", func(t *testing.T) {
+		_, err := DetectPackages([]string{"packages/aws/foo.yml"}, "/no/such/packages")
+		require.Error(t, err)
+	})
+}
diff --git a/dev/citools/gomod.go b/dev/citools/gomod.go
index eb159749da0..3c1c7ef9538 100644
--- a/dev/citools/gomod.go
+++ b/dev/citools/gomod.go
@@ -34,7 +34,7 @@ func PackageVersionGoMod(path, modulePath string) (*semver.Version, error) {
 		epVersion = r.Mod.Version
 	}
 	if epVersion == "" {
-		return nil, fmt.Errorf("not found elastic-package dependency")
+		return nil, fmt.Errorf("elastic-package dependency not found")
 	}
 
 	foundVersion, err := semver.NewVersion(epVersion)
diff --git a/dev/citools/kibana.go b/dev/citools/kibana.go
index aef47205cb0..ae6a21d1113 100644
--- a/dev/citools/kibana.go
+++ b/dev/citools/kibana.go
@@ -12,7 +12,7 @@ import (
 )
 
 func KibanaConstraintPackage(path string) (*semver.Constraints, error) {
-	manifest, err := readPackageManifest(path)
+	manifest, err := ReadPackageManifest(path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read package manifest: %w", err)
 	}
diff --git a/dev/citools/logsdb.go b/dev/citools/logsdb.go
index 70829a82214..1ed90c8222d 100644
--- a/dev/citools/logsdb.go
+++ b/dev/citools/logsdb.go
@@ -21,7 +21,7 @@ func IsVersionLessThanLogsDBGA(version *semver.Version) bool {
 }
 
 func packageKibanaConstraint(path string) (*semver.Constraints, error) {
-	manifest, err := readPackageManifest(path)
+	manifest, err := ReadPackageManifest(path)
 	if err != nil {
 		return nil, err
 	}
@@ -42,7 +42,7 @@ func packageKibanaConstraint(path string) (*semver.Constraints, error) {
 func IsLogsDBSupportedInPackage(path string) (bool, error) {
 	constraint, err := packageKibanaConstraint(path)
 	if err != nil {
-		return false, fmt.Errorf("failed to read kibana.constraint fro mmanifest: %w", err)
+		return false, fmt.Errorf("failed to read kibana.constraint from manifest: %w", err)
 	}
 
 	if constraint == nil {
diff --git a/dev/citools/packagemanifest.go b/dev/citools/packagemanifest.go
index 7c2c61ca9e2..95e1a45c90d 100644
--- a/dev/citools/packagemanifest.go
+++ b/dev/citools/packagemanifest.go
@@ -6,6 +6,7 @@ package citools
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/elastic/go-ucfg"
 	"github.com/elastic/go-ucfg/yaml"
@@ -27,22 +28,65 @@ type conditions struct {
 	Elastic elasticConditions `config:"elastic" json:"elastic" yaml:"elastic"`
 }
 
+type requiresEntry struct {
+	Package string `config:"package" json:"package" yaml:"package"`
+	Version string `config:"version" json:"version" yaml:"version"`
+}
+
+type requiresBlock struct {
+	Input   []requiresEntry `config:"input"   json:"input"   yaml:"input"`
+	Content []requiresEntry `config:"content" json:"content" yaml:"content"`
+}
+
+// owner identifies the GitHub owner of a package, as recorded in its manifest.yml.
+type owner struct {
+	Github string `config:"github" json:"github" yaml:"github"`
+}
+
 type packageManifest struct {
-	Name       string     `config:"name" json:"name" yaml:"name"`
-	License    string     `config:"license" json:"license" yaml:"license"`
-	Conditions conditions `config:"conditions" json:"conditions" yaml:"conditions"`
+	FormatVersion string         `config:"format_version" json:"format_version"          yaml:"format_version"`
+	Name          string         `config:"name"           json:"name"                    yaml:"name"`
+	Type          string         `config:"type"           json:"type"                    yaml:"type"`
+	Version       string         `config:"version"        json:"version"                 yaml:"version"`
+	License       string         `config:"license"        json:"license"                 yaml:"license"`
+	Conditions    conditions     `config:"conditions"     json:"conditions"               yaml:"conditions"`
+	Requires      *requiresBlock `config:"requires"       json:"requires,omitempty"       yaml:"requires,omitempty"`
+	Owner         owner          `config:"owner" json:"owner" yaml:"owner"`
+}
+
+func (m *packageManifest) IsValid() bool {
+	return m.FormatVersion != "" && m.Name != "" && m.Type != "" && m.Version != ""
+}
+
+func (m *packageManifest) HasRequires() bool {
+	return m.Requires != nil && (len(m.Requires.Input) > 0 || len(m.Requires.Content) > 0)
 }
 
-func readPackageManifest(path string) (*packageManifest, error) {
-	cfg, err := yaml.NewConfigWithFile(path, ucfg.PathSep("."))
+// ParsePackageManifest parses manifest.yml content read from anywhere — a
+// worktree file, or content read from another git ref (e.g. via `git show
+// <ref>:packages/<pkg>/manifest.yml`).
+func ParsePackageManifest(content []byte) (*packageManifest, error) {
+	cfg, err := yaml.NewConfig(content, ucfg.PathSep("."))
 	if err != nil {
-		return nil, fmt.Errorf("reading file failed (path: %s): %w", path, err)
+		return nil, fmt.Errorf("failed to parse package manifest: %w", err)
 	}
 
 	var manifest packageManifest
-	err = cfg.Unpack(&manifest)
-	if err != nil {
-		return nil, fmt.Errorf("unpacking package manifest failed (path: %s): %w", path, err)
+	if err := cfg.Unpack(&manifest); err != nil {
+		return nil, fmt.Errorf("failed to unpack package manifest: %w", err)
 	}
 	return &manifest, nil
 }
+
+func ReadPackageManifest(path string) (*packageManifest, error) {
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("reading file failed (path: %s): %w", path, err)
+	}
+
+	manifest, err := ParsePackageManifest(content)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", path, err)
+	}
+	return manifest, nil
+}
diff --git a/dev/citools/packages.go b/dev/citools/packages.go
new file mode 100644
index 00000000000..ec5c4ac3759
--- /dev/null
+++ b/dev/citools/packages.go
@@ -0,0 +1,78 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package citools
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"slices"
+)
+
+const ManifestFileName = "manifest.yml"
+
+// PackageInfo holds the filesystem path and manifest fields of a discovered package.
+type PackageInfo struct {
+	Path        string
+	Name        string
+	Type        string
+	HasRequires bool
+}
+
+// ListPackagesWithNames returns the path and manifest name of every valid package
+// found under dir, in lexical path order. Each manifest is read exactly once.
+func ListPackagesWithNames(dir string) ([]PackageInfo, error) {
+	var pkgs []PackageInfo
+	err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if !d.IsDir() {
+			return nil
+		}
+		manifestPath := filepath.Join(path, ManifestFileName)
+		_, statErr := os.Stat(manifestPath)
+		if errors.Is(statErr, os.ErrNotExist) {
+			return nil
+		} else if statErr != nil {
+			return fmt.Errorf("error statting manifest %s: %w", manifestPath, statErr)
+		}
+		manifest, err := ReadPackageManifest(manifestPath)
+		if err != nil {
+			return fmt.Errorf("error reading manifest %s: %w", manifestPath, err)
+		}
+		if !manifest.IsValid() {
+			return nil
+		}
+		pkgs = append(pkgs, PackageInfo{
+			Path:        path,
+			Name:        manifest.Name,
+			Type:        manifest.Type,
+			HasRequires: manifest.HasRequires(),
+		})
+		// No need to look deeper once a package is found.
+		return filepath.SkipDir
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error listing packages in %s: %w", dir, err)
+	}
+	return pkgs, nil
+}
+
+// ListPackages returns the sorted paths of all packages found under dir.
+func ListPackages(dir string) ([]string, error) {
+	pkgs, err := ListPackagesWithNames(dir)
+	if err != nil {
+		return nil, err
+	}
+	paths := make([]string, len(pkgs))
+	for i, p := range pkgs {
+		paths[i] = p.Path
+	}
+	slices.Sort(paths)
+	return paths, nil
+}
diff --git a/dev/citools/subscription.go b/dev/citools/subscription.go
index a14169df68d..b611304f25c 100644
--- a/dev/citools/subscription.go
+++ b/dev/citools/subscription.go
@@ -9,7 +9,7 @@ import (
 )
 
 func packageSubscription(path string) (string, error) {
-	manifest, err := readPackageManifest(path)
+	manifest, err := ReadPackageManifest(path)
 	if err != nil {
 		return "", err
 	}
diff --git a/dev/codeowners/codeowners.go b/dev/codeowners/codeowners.go
index 4630abd54de..16e3d897dba 100644
--- a/dev/codeowners/codeowners.go
+++ b/dev/codeowners/codeowners.go
@@ -7,12 +7,15 @@ package codeowners
 import (
 	"bufio"
 	"fmt"
+	"io"
 	"os"
 	"path"
 	"path/filepath"
 	"strings"
 
 	"gopkg.in/yaml.v3"
+
+	"github.com/elastic/integrations/dev/citools"
 )
 
 const DefaultCodeownersPath = ".github/CODEOWNERS"
@@ -20,11 +23,11 @@ const DefaultCodeownersPath = ".github/CODEOWNERS"
 func Check() error {
 	codeowners, err := readGithubOwners(DefaultCodeownersPath)
 	if err != nil {
-		return err
+		return fmt.Errorf("error reading %s: %w", DefaultCodeownersPath, err)
 	}
 	const packagesDir = "packages"
 	if err := validatePackages(codeowners, packagesDir); err != nil {
-		return err
+		return fmt.Errorf("error validating packages in directory '%s': %w", packagesDir, err)
 	}
 
 	return nil
@@ -35,7 +38,25 @@ func PackageOwners(packageName, dataStream, codeownersPath string) ([]string, er
 	if err != nil {
 		return nil, fmt.Errorf("failed to read CODEOWNERS file: %w", err)
 	}
-	packagePath := fmt.Sprintf("/packages/%s", packageName)
+	// look for the path of the package taking into account nested directories
+	packagePath := ""
+	for path := range owners.owners {
+		if !strings.HasSuffix(path, "/"+packageName) {
+			continue
+		}
+		// Verify the path is a valid package path: /packages/<name> or /packages/<category>/<name>.
+		// This prevents matching data stream paths or other sub-paths that happen to end with the package name.
+		if path == "/packages/"+packageName {
+			packagePath = path
+			break
+		}
+		// Check for a nested package path: /packages/<category>/<name>, where <category> is a single path segment.
+		prefix := strings.TrimSuffix(path, "/"+packageName)
+		if strings.HasPrefix(prefix, "/packages/") && !strings.Contains(prefix[len("/packages/"):], "/") {
+			packagePath = path
+			break
+		}
+	}
 	packageTeams, found := owners.owners[packagePath]
 	if !found {
 		return nil, fmt.Errorf("no owner found for package %s", packageName)
@@ -53,6 +74,104 @@ func PackageOwners(packageName, dataStream, codeownersPath string) ([]string, er
 	return dataStreamTeams, nil
 }
 
+// Owners holds a parsed CODEOWNERS file for repeated lookups without re-reading disk.
+// Obtain one via LoadOwners; use PackageOwnersByPath to look up a package by its
+// filesystem path rather than its folder basename.
+type Owners struct {
+	inner *githubOwners
+}
+
+// LoadOwners parses the CODEOWNERS file at codeownersPath once. Use the returned
+// *Owners for repeated lookups across many packages instead of calling
+// PackageOwners (which re-reads the file on every call).
+func LoadOwners(codeownersPath string) (*Owners, error) {
+	inner, err := readGithubOwners(codeownersPath)
+	if err != nil {
+		return nil, err
+	}
+	return &Owners{inner: inner}, nil
+}
+
+// ParseOwners parses CODEOWNERS content from a string, applying the same
+// single-field exclusion-rule validation that readGithubOwners does when
+// reading from disk. A file that passes mage check never triggers this error.
+func ParseOwners(content string) (*Owners, error) {
+	o, err := scanGithubOwners(strings.NewReader(content), "<in-memory>")
+	if err != nil {
+		return nil, err
+	}
+	return &Owners{inner: o}, nil
+}
+
+// Resolve returns the owners that apply to p, walking up parent directories
+// until an explicit CODEOWNERS entry is found. p must be a CODEOWNERS-style
+// slash-prefixed path (e.g. "/packages/aws/data_stream/cloudtrail"). Returns
+// (nil, false) when no entry exists for p or any of its ancestors.
+func (o *Owners) Resolve(p string) ([]string, bool) {
+	p = strings.TrimSuffix(p, "/")
+	if p == "" {
+		p = "/"
+	}
+	for {
+		if owners, ok := o.inner.owners[p]; ok {
+			return owners, true
+		}
+		if p == "/" || p == "." {
+			return nil, false
+		}
+		p = path.Dir(p)
+	}
+}
+
+// EntriesUnder returns the full CODEOWNERS paths of every explicit entry
+// nested under prefix (e.g. "/packages/aws" returns
+// "/packages/aws/data_stream/cloudtrail" and "/packages/aws/kibana", but not
+// "/packages/aws" itself or the unrelated "/packages/awsome"). Order is
+// unspecified.
+func (o *Owners) EntriesUnder(prefix string) []string {
+	prefix = strings.TrimSuffix(prefix, "/") + "/"
+	var paths []string
+	for p := range o.inner.owners {
+		if strings.HasPrefix(p, prefix) {
+			paths = append(paths, p)
+		}
+	}
+	return paths
+}
+
+// ExplicitEntry returns the owners explicitly defined for exactly this
+// CODEOWNERS path — no walk-up/fallback resolution. Returns (nil, false) if
+// no explicit entry exists for this exact path.
+func (o *Owners) ExplicitEntry(p string) ([]string, bool) {
+	p = strings.TrimSuffix(p, "/")
+	owners, ok := o.inner.owners[p]
+	return owners, ok
+}
+
+// PackageOwnersByPath returns the owning team(s) for the package at pkgPath
+// (relative to the repo root, e.g. "packages/observability/nginx") and, when
+// dataStream is set, the more-specific data-stream-level owner if one is defined.
+//
+// Prefer this over PackageOwners when the full package path is available:
+// it handles arbitrary directory nesting by walking up the tree and avoids
+// the folder-basename ambiguity in PackageOwners. See
+// https://github.com/elastic/elastic-package/issues/3586.
+func (o *Owners) PackageOwnersByPath(pkgPath, dataStream string) ([]string, error) {
+	teams, found := o.inner.findOwnerForFile(filepath.Join(pkgPath, citools.ManifestFileName))
+	if !found {
+		return nil, fmt.Errorf("no owner found for package path %q", pkgPath)
+	}
+	if dataStream == "" {
+		return teams, nil
+	}
+	dataStreamDir := filepath.Join(pkgPath, "data_stream", dataStream)
+	dataStreamTeams, found := o.inner.owners["/"+filepath.ToSlash(dataStreamDir)]
+	if !found {
+		return teams, nil
+	}
+	return dataStreamTeams, nil
+}
+
 type githubOwners struct {
 	owners map[string][]string
 	path   string
@@ -63,34 +182,26 @@ type githubOwners struct {
 // data_streams, it checks that all data_streams are explicitly owned by a single owner. Such ownership
 // sharing packages are identified by having at least one data_stream with explicit ownership in codeowners.
 func validatePackages(codeowners *githubOwners, packagesDir string) error {
-	packageDirEntries, err := os.ReadDir(packagesDir)
+	paths, err := citools.ListPackages(packagesDir)
 	if err != nil {
-		return err
+		return fmt.Errorf("error listing packages in %s: %w", packagesDir, err)
 	}
-
-	if len(packageDirEntries) == 0 {
-		if len(codeowners.owners) == 0 {
-			return nil
-		}
-		return fmt.Errorf("no packages found in %q", packagesDir)
-	}
-
-	for _, packageDirEntry := range packageDirEntries {
-		packageName := packageDirEntry.Name()
-
-		packagePath := path.Join(packagesDir, packageName)
-
-		packageManifestPath := path.Join(packagePath, "manifest.yml")
-		err = codeowners.checkManifest(packageManifestPath)
+	for _, path := range paths {
+		err = codeowners.checkManifest(filepath.Join(path, citools.ManifestFileName))
 		if err != nil {
-			return err
+			return fmt.Errorf("error checking manifest '%s': %w", path, err)
 		}
-
-		err = codeowners.checkDataStreams(packagePath)
+		err = codeowners.checkDataStreams(path)
 		if err != nil {
-			return err
+			return fmt.Errorf("error checking data streams from '%s': %w", path, err)
 		}
+	}
 
+	if len(paths) == 0 {
+		if len(codeowners.owners) == 0 {
+			return nil
+		}
+		return fmt.Errorf("no packages found in %q", packagesDir)
 	}
 
 	return nil
@@ -102,13 +213,16 @@ func readGithubOwners(codeownersPath string) (*githubOwners, error) {
 		return nil, fmt.Errorf("failed to open %q: %w", codeownersPath, err)
 	}
 	defer f.Close()
+	return scanGithubOwners(f, codeownersPath)
+}
 
+func scanGithubOwners(r io.Reader, sourcePath string) (*githubOwners, error) {
 	codeowners := githubOwners{
 		owners: make(map[string][]string),
-		path:   codeownersPath,
+		path:   sourcePath,
 	}
 
-	scanner := bufio.NewScanner(f)
+	scanner := bufio.NewScanner(r)
 	lineNumber := 0
 	for scanner.Scan() {
 		lineNumber++
@@ -120,14 +234,15 @@ func readGithubOwners(codeownersPath string) (*githubOwners, error) {
 		if len(fields) == 1 {
 			err := codeowners.checkSingleField(fields[0])
 			if err != nil {
-				return nil, fmt.Errorf("invalid line %d in %q: %w", lineNumber, codeownersPath, err)
+				return nil, fmt.Errorf("invalid line %d in %q: %w", lineNumber, sourcePath, err)
 			}
 			continue
 		}
-		path, owners := fields[0], fields[1:]
+		ownerPath, owners := fields[0], fields[1:]
 
-		// It is ok to overwrite because latter lines have precedence in these files.
-		codeowners.owners[path] = owners
+		// remove trailing slash from path
+		ownerPath = strings.TrimSuffix(ownerPath, "/")
+		codeowners.owners[ownerPath] = owners
 	}
 	if err := scanner.Err(); err != nil {
 		return nil, fmt.Errorf("scanner error: %w", err)
@@ -170,10 +285,9 @@ func (codeowners *githubOwners) checkSingleField(field string) error {
 }
 
 func (codeowners *githubOwners) checkManifest(path string) error {
-	pkgDir := filepath.Dir(path)
-	owners, found := codeowners.owners["/"+pkgDir]
+	owners, found := codeowners.findOwnerForFile(path)
 	if !found {
-		return fmt.Errorf("there is no owner for %q in %q", pkgDir, codeowners.path)
+		return fmt.Errorf("there is no owner for %q in %q", filepath.Dir(path), codeowners.path)
 	}
 
 	content, err := os.ReadFile(path)
@@ -208,8 +322,32 @@ func (codeowners *githubOwners) checkManifest(path string) error {
 	return nil
 }
 
+func (codeowners *githubOwners) findOwnerForFile(path string) ([]string, bool) {
+	// Usually paths are related to the root of the repository. Examples:
+	// - "packages/package-name/manifest.yml"
+	// - "packages/technology/package-name/manifest.yml"
+	// Just in case, if an absolute path is provided, we remove the leading separator.
+	if filepath.IsAbs(path) {
+		path = strings.TrimPrefix(path, string(filepath.Separator))
+	}
+	ownerDir := filepath.Dir(path)
+	for {
+		owners, found := codeowners.owners["/"+filepath.ToSlash(ownerDir)]
+		if found {
+			return owners, found
+		}
+
+		ownerDir = filepath.Dir(ownerDir)
+		if ownerDir == "." {
+			break
+		}
+	}
+
+	return nil, false
+}
+
 func (codeowners *githubOwners) checkDataStreams(packagePath string) error {
-	packageDataStreamsPath := path.Join(packagePath, "data_stream")
+	packageDataStreamsPath := filepath.Join(packagePath, "data_stream")
 	if _, err := os.Stat(packageDataStreamsPath); os.IsNotExist(err) {
 		// package doesn't have data_streams
 		return nil
@@ -229,14 +367,14 @@ func (codeowners *githubOwners) checkDataStreams(packagePath string) error {
 	var dataStreamsWithoutOwner []string
 	for _, dataStreamDirEntry := range dataStreamDirEntries {
 		dataStreamName := dataStreamDirEntry.Name()
-		dataStreamDir := path.Join(packageDataStreamsPath, dataStreamName)
-		dataStreamOwners, found := codeowners.owners["/"+dataStreamDir]
+		dataStreamDir := filepath.Join(packageDataStreamsPath, dataStreamName)
+		dataStreamOwners, found := codeowners.owners["/"+filepath.ToSlash(dataStreamDir)]
 		if !found {
 			dataStreamsWithoutOwner = append(dataStreamsWithoutOwner, dataStreamDir)
 			continue
 		}
 		if len(dataStreamOwners) > 1 {
-			return fmt.Errorf("data stream \"%s\" of package \"%s\" has more than one owners [%s]", dataStreamDir,
+			return fmt.Errorf("data stream \"%s\" of package \"%s\" has more than one owner [%s]", dataStreamDir,
 				packagePath, strings.Join(dataStreamOwners, ", "))
 		}
 	}
diff --git a/dev/codeowners/codeowners_test.go b/dev/codeowners/codeowners_test.go
index e84f218352d..e2b728eb34f 100644
--- a/dev/codeowners/codeowners_test.go
+++ b/dev/codeowners/codeowners_test.go
@@ -11,6 +11,143 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// Tests for the exported Owners API (ParseOwners, LoadOwners, Resolve,
+// EntriesUnder, ExplicitEntry, PackageOwnersByPath). These mirror the
+// behaviours the dev/backports/owners package relies on, ensuring the shared
+// implementation stays consistent.
+
+func TestParseOwners(t *testing.T) {
+	t.Run("valid content parses successfully", func(t *testing.T) {
+		const content = `/packages/aws @elastic/obs-infraobs-integrations
+/packages/aws/data_stream/cloudtrail @elastic/security-service-integrations
+# a comment line is skipped
+`
+		o, err := ParseOwners(content)
+		require.NoError(t, err)
+		owners, ok := o.ExplicitEntry("/packages/aws")
+		require.True(t, ok)
+		assert.Equal(t, []string{"@elastic/obs-infraobs-integrations"}, owners)
+	})
+
+	t.Run("single-field exclusion rule that removes owners from a defined path is rejected", func(t *testing.T) {
+		// checkSingleField must reject any exclusion-only line that would strip
+		// ownership from a path already covered by an explicit entry — same
+		// validation readGithubOwners performs when reading from disk.
+		const content = `/packages/aws @elastic/obs-infraobs-integrations
+/packages/aws/data_stream/cloudtrail
+`
+		_, err := ParseOwners(content)
+		assert.Error(t, err)
+	})
+
+	t.Run("trailing slash on path is stripped", func(t *testing.T) {
+		const content = "/packages/aws/ @elastic/obs-infraobs-integrations\n"
+		o, err := ParseOwners(content)
+		require.NoError(t, err)
+		_, ok := o.ExplicitEntry("/packages/aws")
+		assert.True(t, ok)
+	})
+}
+
+func TestResolve(t *testing.T) {
+	const content = `
+/packages/aws @elastic/obs-infraobs-integrations
+/packages/aws/data_stream/cloudtrail @elastic/security-service-integrations
+/packages/nested/foo @elastic/ecosystem
+`
+	o, err := ParseOwners(content)
+	require.NoError(t, err)
+
+	cases := []struct {
+		name     string
+		path     string
+		expected []string
+		found    bool
+	}{
+		{
+			name:     "explicit package root",
+			path:     "/packages/aws",
+			expected: []string{"@elastic/obs-infraobs-integrations"},
+			found:    true,
+		},
+		{
+			name:     "explicit data stream override",
+			path:     "/packages/aws/data_stream/cloudtrail",
+			expected: []string{"@elastic/security-service-integrations"},
+			found:    true,
+		},
+		{
+			name:     "data stream without override falls back to package owner",
+			path:     "/packages/aws/data_stream/vpcflow",
+			expected: []string{"@elastic/obs-infraobs-integrations"},
+			found:    true,
+		},
+		{
+			name:     "nested category package",
+			path:     "/packages/nested/foo",
+			expected: []string{"@elastic/ecosystem"},
+			found:    true,
+		},
+		{
+			name:  "unknown path with no ancestor entry",
+			path:  "/packages/does-not-exist",
+			found: false,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got, found := o.Resolve(c.path)
+			assert.Equal(t, c.found, found)
+			if c.found {
+				assert.Equal(t, c.expected, got)
+			}
+		})
+	}
+}
+
+func TestEntriesUnder(t *testing.T) {
+	const content = `
+/packages/aws @elastic/obs-infraobs-integrations
+/packages/aws/data_stream/cloudtrail @elastic/security-service-integrations
+/packages/aws/kibana @elastic/obs-infraobs-integrations
+/packages/awsome @elastic/unrelated-team
+`
+	o, err := ParseOwners(content)
+	require.NoError(t, err)
+
+	got := o.EntriesUnder("/packages/aws")
+	assert.ElementsMatch(t, []string{
+		"/packages/aws/data_stream/cloudtrail",
+		"/packages/aws/kibana",
+	}, got)
+}
+
+func TestExplicitEntry(t *testing.T) {
+	const content = `
+/packages/aws @elastic/obs-infraobs-integrations
+/packages/aws/data_stream/cloudtrail @elastic/security-service-integrations
+`
+	o, err := ParseOwners(content)
+	require.NoError(t, err)
+
+	t.Run("returns entry for an explicitly defined path", func(t *testing.T) {
+		got, ok := o.ExplicitEntry("/packages/aws/data_stream/cloudtrail")
+		require.True(t, ok)
+		assert.Equal(t, []string{"@elastic/security-service-integrations"}, got)
+	})
+
+	t.Run("returns false for a path that only resolves via walk-up", func(t *testing.T) {
+		_, ok := o.ExplicitEntry("/packages/aws/data_stream/vpcflow")
+		assert.False(t, ok)
+	})
+
+	t.Run("returns false for an unknown path", func(t *testing.T) {
+		_, ok := o.ExplicitEntry("/packages/other")
+		assert.False(t, ok)
+	})
+}
+
 func TestCheckManifest(t *testing.T) {
 	cases := []struct {
 		codeownersPath string
@@ -95,6 +232,31 @@ func TestValidatePackages(t *testing.T) {
 			packageDir:     "testdata/test_packages",
 			valid:          true,
 		},
+		{
+			codeownersPath: "testdata/CODEOWNERS-nested-valid",
+			packageDir:     "testdata/nested_packages",
+			valid:          true,
+		},
+		{
+			codeownersPath: "testdata/CODEOWNERS-nested-missing-owner",
+			packageDir:     "testdata/nested_packages",
+			valid:          false,
+		},
+		{
+			codeownersPath: "testdata/CODEOWNERS-nested-category-owner",
+			packageDir:     "testdata/nested_packages",
+			valid:          true,
+		},
+		{
+			codeownersPath: "testdata/CODEOWNERS-nested-streams-valid",
+			packageDir:     "testdata/nested_packages",
+			valid:          true,
+		},
+		{
+			codeownersPath: "testdata/CODEOWNERS-nested-streams-missing-owners",
+			packageDir:     "testdata/nested_packages",
+			valid:          false,
+		},
 	}
 
 	for _, c := range cases {
@@ -141,6 +303,10 @@ func TestReadGithubOwners(t *testing.T) {
 			codeownersPath: "testdata/CODEOWNERS-invalid-override-wildcard",
 			valid:          false,
 		},
+		{
+			codeownersPath: "testdata/CODEOWNERS-owners-trailing-slash",
+			valid:          true,
+		},
 	}
 
 	for _, c := range cases {
@@ -172,6 +338,30 @@ func TestReturnPackageOwners(t *testing.T) {
 			expected:       []string{"@elastic/obs-infraobs-integrations", "@elastic/obs-ds-hosted-services", "@elastic/security-service-integrations"},
 			expectedError:  false,
 		},
+		{
+			title:          "package with trailing slash",
+			codeownersPath: "testdata/CODEOWNERS-owners-trailing-slash",
+			packageName:    "content",
+			datastream:     "",
+			expected:       []string{"@elastic/integrations"},
+			expectedError:  false,
+		},
+		{
+			title:          "data stream with trailing slash",
+			codeownersPath: "testdata/CODEOWNERS-owners-trailing-slash",
+			packageName:    "aws",
+			datastream:     "apigateway_logs",
+			expected:       []string{"@elastic/obs-infraobs-integrations"},
+			expectedError:  false,
+		},
+		{
+			title:          "nested package with trailing slash",
+			codeownersPath: "testdata/CODEOWNERS-owners-trailing-slash",
+			packageName:    "elastic_package_registry",
+			datastream:     "",
+			expected:       []string{"@elastic/integrations"},
+			expectedError:  false,
+		},
 		{
 			title:          "package and datastream",
 			codeownersPath: "testdata/CODEOWNERS-owners-packages-datastreams",
@@ -218,3 +408,78 @@ func TestReturnPackageOwners(t *testing.T) {
 		})
 	}
 }
+
+func TestPackageOwnersByPath(t *testing.T) {
+	cases := []struct {
+		title          string
+		codeownersPath string
+		pkgPath        string
+		datastream     string
+		expected       []string
+		expectedError  bool
+	}{
+		{
+			title:          "nested package",
+			codeownersPath: "testdata/CODEOWNERS-nested-valid",
+			pkgPath:        "testdata/nested_packages/category/package_nested_1",
+			datastream:     "",
+			expected:       []string{"@elastic/integrations-developer-experience"},
+			expectedError:  false,
+		},
+		{
+			title:          "nested package inherits category owner",
+			codeownersPath: "testdata/CODEOWNERS-nested-category-owner",
+			pkgPath:        "testdata/nested_packages/category/package_nested_2",
+			datastream:     "",
+			expected:       []string{"@elastic/integrations-developer-experience"},
+			expectedError:  false,
+		},
+		{
+			title:          "nested package data stream",
+			codeownersPath: "testdata/CODEOWNERS-nested-streams-valid",
+			pkgPath:        "testdata/nested_packages/category/package_nested_1",
+			datastream:     "stream_1",
+			expected:       []string{"@pkoutsovasilis"},
+			expectedError:  false,
+		},
+		{
+			title:          "top-level package",
+			codeownersPath: "testdata/CODEOWNERS-nested-valid",
+			pkgPath:        "testdata/nested_packages/package_top",
+			datastream:     "",
+			expected:       []string{"@elastic/integrations-developer-experience"},
+			expectedError:  false,
+		},
+		{
+			title:          "data stream not in CODEOWNERS falls back to package owner",
+			codeownersPath: "testdata/CODEOWNERS-nested-streams-valid",
+			pkgPath:        "testdata/nested_packages/category/package_nested_1",
+			datastream:     "stream_unknown",
+			expected:       []string{"@elastic/integrations-developer-experience"},
+			expectedError:  false,
+		},
+		{
+			title:          "package path not found",
+			codeownersPath: "testdata/CODEOWNERS-owners-packages-datastreams",
+			pkgPath:        "packages/other",
+			datastream:     "",
+			expected:       []string{},
+			expectedError:  true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.title, func(t *testing.T) {
+			owners, err := LoadOwners(c.codeownersPath)
+			require.NoError(t, err)
+
+			got, err := owners.PackageOwnersByPath(c.pkgPath, c.datastream)
+			if c.expectedError {
+				assert.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, c.expected, got)
+		})
+	}
+}
diff --git a/dev/codeowners/testdata/CODEOWNERS-nested-category-owner b/dev/codeowners/testdata/CODEOWNERS-nested-category-owner
new file mode 100644
index 00000000000..db3cc9189cd
--- /dev/null
+++ b/dev/codeowners/testdata/CODEOWNERS-nested-category-owner
@@ -0,0 +1,2 @@
+/testdata/nested_packages/package_top @elastic/integrations-developer-experience
+/testdata/nested_packages/category @elastic/integrations-developer-experience
diff --git a/dev/codeowners/testdata/CODEOWNERS-nested-missing-owner b/dev/codeowners/testdata/CODEOWNERS-nested-missing-owner
new file mode 100644
index 00000000000..3ef5d7ca2f7
--- /dev/null
+++ b/dev/codeowners/testdata/CODEOWNERS-nested-missing-owner
@@ -0,0 +1,2 @@
+/testdata/nested_packages/package_top @elastic/integrations-developer-experience
+/testdata/nested_packages/category/package_nested_1 @elastic/integrations-developer-experience
diff --git a/dev/codeowners/testdata/CODEOWNERS-nested-streams-missing-owners b/dev/codeowners/testdata/CODEOWNERS-nested-streams-missing-owners
new file mode 100644
index 00000000000..d70c2f93b82
--- /dev/null
+++ b/dev/codeowners/testdata/CODEOWNERS-nested-streams-missing-owners
@@ -0,0 +1,4 @@
+/testdata/nested_packages/package_top @elastic/integrations-developer-experience
+/testdata/nested_packages/category/package_nested_1 @elastic/integrations-developer-experience
+/testdata/nested_packages/category/package_nested_1/data_stream/stream_1 @pkoutsovasilis
+/testdata/nested_packages/category/package_nested_2 @elastic/integrations-developer-experience
diff --git a/dev/codeowners/testdata/CODEOWNERS-nested-streams-valid b/dev/codeowners/testdata/CODEOWNERS-nested-streams-valid
new file mode 100644
index 00000000000..168f5b26054
--- /dev/null
+++ b/dev/codeowners/testdata/CODEOWNERS-nested-streams-valid
@@ -0,0 +1,5 @@
+/testdata/nested_packages/package_top @elastic/integrations-developer-experience
+/testdata/nested_packages/category/package_nested_1 @elastic/integrations-developer-experience
+/testdata/nested_packages/category/package_nested_1/data_stream/stream_1 @pkoutsovasilis
+/testdata/nested_packages/category/package_nested_1/data_stream/stream_2 @pkoutsovasilis
+/testdata/nested_packages/category/package_nested_2 @elastic/integrations-developer-experience
diff --git a/dev/codeowners/testdata/CODEOWNERS-nested-valid b/dev/codeowners/testdata/CODEOWNERS-nested-valid
new file mode 100644
index 00000000000..3674da6be52
--- /dev/null
+++ b/dev/codeowners/testdata/CODEOWNERS-nested-valid
@@ -0,0 +1,3 @@
+/testdata/nested_packages/package_top @elastic/integrations-developer-experience
+/testdata/nested_packages/category/package_nested_1 @elastic/integrations-developer-experience
+/testdata/nested_packages/category/package_nested_2 @elastic/integrations-developer-experience
diff --git a/dev/codeowners/testdata/CODEOWNERS-owners-trailing-slash b/dev/codeowners/testdata/CODEOWNERS-owners-trailing-slash
new file mode 100644
index 00000000000..e6eb10d58a6
--- /dev/null
+++ b/dev/codeowners/testdata/CODEOWNERS-owners-trailing-slash
@@ -0,0 +1,7 @@
+# This is a valid test file
+* @elastic/ecosystem
+
+/packages/aws @elastic/obs-infraobs-integrations @elastic/obs-ds-hosted-services @elastic/security-service-integrations
+/packages/aws/data_stream/apigateway_logs/ @elastic/obs-infraobs-integrations
+/packages/content/ @elastic/integrations
+/packages/technology/elastic_package_registry/ @elastic/integrations
diff --git a/dev/codeowners/testdata/devexp/manifest.yml b/dev/codeowners/testdata/devexp/manifest.yml
index 6e10c80be6e..f74ae81b82c 100644
--- a/dev/codeowners/testdata/devexp/manifest.yml
+++ b/dev/codeowners/testdata/devexp/manifest.yml
@@ -1,2 +1,6 @@
+format_version: 1.0.0
+name: devexp
+type: integration
+version: 1.0.0
 owner:
   github: elastic/integrations-developer-experience
diff --git a/dev/codeowners/testdata/nested_packages/category/package_nested_1/data_stream/stream_1/.keep b/dev/codeowners/testdata/nested_packages/category/package_nested_1/data_stream/stream_1/.keep
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/dev/codeowners/testdata/nested_packages/category/package_nested_1/data_stream/stream_2/.keep b/dev/codeowners/testdata/nested_packages/category/package_nested_1/data_stream/stream_2/.keep
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/dev/codeowners/testdata/nested_packages/category/package_nested_1/manifest.yml b/dev/codeowners/testdata/nested_packages/category/package_nested_1/manifest.yml
new file mode 100644
index 00000000000..1e37f754abc
--- /dev/null
+++ b/dev/codeowners/testdata/nested_packages/category/package_nested_1/manifest.yml
@@ -0,0 +1,6 @@
+format_version: 1.0.0
+name: package_nested_1
+type: integration
+version: 1.0.0
+owner:
+  github: elastic/integrations-developer-experience
diff --git a/dev/codeowners/testdata/nested_packages/category/package_nested_2/manifest.yml b/dev/codeowners/testdata/nested_packages/category/package_nested_2/manifest.yml
new file mode 100644
index 00000000000..9f875919e7a
--- /dev/null
+++ b/dev/codeowners/testdata/nested_packages/category/package_nested_2/manifest.yml
@@ -0,0 +1,6 @@
+format_version: 1.0.0
+name: package_nested_2
+type: integration
+version: 1.0.0
+owner:
+  github: elastic/integrations-developer-experience
diff --git a/dev/codeowners/testdata/nested_packages/package_top/manifest.yml b/dev/codeowners/testdata/nested_packages/package_top/manifest.yml
new file mode 100644
index 00000000000..b963185633e
--- /dev/null
+++ b/dev/codeowners/testdata/nested_packages/package_top/manifest.yml
@@ -0,0 +1,6 @@
+format_version: 1.0.0
+name: package_top
+type: integration
+version: 1.0.0
+owner:
+  github: elastic/integrations-developer-experience
diff --git a/dev/codeowners/testdata/test_packages/package_1/manifest.yml b/dev/codeowners/testdata/test_packages/package_1/manifest.yml
index 6e10c80be6e..1af7799981b 100644
--- a/dev/codeowners/testdata/test_packages/package_1/manifest.yml
+++ b/dev/codeowners/testdata/test_packages/package_1/manifest.yml
@@ -1,2 +1,6 @@
+format_version: 1.0.0
+name: package_1
+type: integration
+version: 1.0.0
 owner:
   github: elastic/integrations-developer-experience
diff --git a/dev/gitutil/git.go b/dev/gitutil/git.go
new file mode 100644
index 00000000000..a394315558e
--- /dev/null
+++ b/dev/gitutil/git.go
@@ -0,0 +1,52 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package gitutil
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// Git runs git commands in Dir. An empty Dir means the current working directory.
+type Git struct{ Dir string }
+
+// Run runs a git command forwarding stdout and stderr to the terminal.
+func (g Git) Run(args ...string) error {
+	cmd := exec.Command("git", args...)
+	cmd.Dir = g.Dir
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+
+// RunToStderr runs a git command sending both stdout and stderr to os.Stderr.
+// Use this instead of Run when the process stdout must stay clean for
+// structured output — for example when the caller is invoked inside a shell
+// $() capture where only JSON must appear on stdout (git commit summaries,
+// fetch progress, etc. would otherwise contaminate the captured result).
+func (g Git) RunToStderr(args ...string) error {
+	cmd := exec.Command("git", args...)
+	cmd.Dir = g.Dir
+	cmd.Stdout = os.Stderr
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+
+// Output runs a git command and returns its stdout as a string.
+// On failure the returned error includes git's stderr output.
+func (g Git) Output(args ...string) (string, error) {
+	var stderr bytes.Buffer
+	cmd := exec.Command("git", args...)
+	cmd.Dir = g.Dir
+	cmd.Stderr = &stderr
+	out, err := cmd.Output()
+	if err != nil {
+		return "", fmt.Errorf("%w: %s", err, strings.TrimSpace(stderr.String()))
+	}
+	return string(out), nil
+}
diff --git a/dev/import-beats/README.md b/dev/import-beats/README.md
index aa2bb754b10..e70ef7a762e 100644
--- a/dev/import-beats/README.md
+++ b/dev/import-beats/README.md
@@ -98,7 +98,7 @@ and package fields.
 
 ##### Integration title
 
-The correct spelling makes better impression on users, so the scripts uses `title` property in the module fields
+The correct spelling makes better impression on users, so the scripts use `title` property in the module fields
 as the proper form. Remember to adjust this value if working on the migration from Beats.
 
 ##### Release type
diff --git a/dev/packagenames/packagenames.go b/dev/packagenames/packagenames.go
new file mode 100644
index 00000000000..2b6bed1c2e4
--- /dev/null
+++ b/dev/packagenames/packagenames.go
@@ -0,0 +1,56 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package packagenames
+
+import (
+	"fmt"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/elastic/integrations/dev/citools"
+)
+
+const packagesDir = "packages"
+
+// Check validates that no two packages share the same name under the default packages directory.
+func Check() error {
+	if err := checkPackageNames(packagesDir); err != nil {
+		return fmt.Errorf("error validating package names in directory '%s': %w", packagesDir, err)
+	}
+	return nil
+}
+
+func checkPackageNames(dir string) error {
+	paths, err := citools.ListPackages(dir)
+	if err != nil {
+		return fmt.Errorf("error finding packages: %w", err)
+	}
+	return checkDuplicateNames(paths)
+}
+
+func checkDuplicateNames(paths []string) error {
+	seen := make(map[string][]string)
+	for _, path := range paths {
+		manifest, err := citools.ReadPackageManifest(filepath.Join(path, citools.ManifestFileName))
+		if err != nil {
+			return fmt.Errorf("error reading manifest in %s: %w", path, err)
+		}
+		seen[manifest.Name] = append(seen[manifest.Name], path)
+	}
+
+	var duplicates []string
+	for name, dirs := range seen {
+		if len(dirs) > 1 {
+			duplicates = append(duplicates, fmt.Sprintf("duplicate package name %q found in: %s", name, strings.Join(dirs, ", ")))
+		}
+	}
+
+	if len(duplicates) > 0 {
+		slices.Sort(duplicates)
+		return fmt.Errorf("found duplicate package names:\n%s", strings.Join(duplicates, "\n"))
+	}
+	return nil
+}
diff --git a/dev/packagenames/packagenames_test.go b/dev/packagenames/packagenames_test.go
new file mode 100644
index 00000000000..1c8312f3d8d
--- /dev/null
+++ b/dev/packagenames/packagenames_test.go
@@ -0,0 +1,63 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package packagenames
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/elastic/integrations/dev/citools"
+)
+
+func TestNoDuplicates(t *testing.T) {
+	paths, err := citools.ListPackages("testdata/no_duplicates")
+	require.NoError(t, err)
+	assert.Len(t, paths, 2)
+
+	t.Logf("paths: %v", paths)
+	err = checkDuplicateNames(paths)
+	assert.NoError(t, err)
+}
+
+func TestDuplicates(t *testing.T) {
+	paths, err := citools.ListPackages("testdata/duplicates")
+	require.NoError(t, err)
+	assert.Len(t, paths, 2)
+
+	err = checkDuplicateNames(paths)
+	assert.EqualError(t, err, "found duplicate package names:\nduplicate package name \"pkg_a\" found in: testdata/duplicates/p1, testdata/duplicates/p2")
+}
+
+func TestInvalidManifestsIgnored(t *testing.T) {
+	paths, err := citools.ListPackages("testdata/invalid_manifests")
+	require.NoError(t, err)
+	// p2 has no type field and must be ignored
+	assert.Len(t, paths, 1)
+
+	err = checkDuplicateNames(paths)
+	assert.NoError(t, err)
+}
+
+func TestNestedNoDuplicates(t *testing.T) {
+	paths, err := citools.ListPackages("testdata/nested/no_duplicates")
+	require.NoError(t, err)
+	// p3 at first level + technology/p1 and technology/p2 at second level
+	assert.Len(t, paths, 3)
+
+	err = checkDuplicateNames(paths)
+	assert.NoError(t, err)
+}
+
+func TestNestedDuplicates(t *testing.T) {
+	paths, err := citools.ListPackages("testdata/nested/duplicates")
+	require.NoError(t, err)
+	// p3 at first level + technology/p1 and technology/p2 at second level
+	assert.Len(t, paths, 3)
+
+	err = checkDuplicateNames(paths)
+	assert.EqualError(t, err, "found duplicate package names:\nduplicate package name \"pkg_e\" found in: testdata/nested/duplicates/p3, testdata/nested/duplicates/technology/p1, testdata/nested/duplicates/technology/p2")
+}
diff --git a/dev/packagenames/testdata/duplicates/p1/manifest.yml b/dev/packagenames/testdata/duplicates/p1/manifest.yml
new file mode 100644
index 00000000000..4ef80244397
--- /dev/null
+++ b/dev/packagenames/testdata/duplicates/p1/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_a
+type: integration
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/duplicates/p2/manifest.yml b/dev/packagenames/testdata/duplicates/p2/manifest.yml
new file mode 100644
index 00000000000..4ef80244397
--- /dev/null
+++ b/dev/packagenames/testdata/duplicates/p2/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_a
+type: integration
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/invalid_manifests/p1/manifest.yml b/dev/packagenames/testdata/invalid_manifests/p1/manifest.yml
new file mode 100644
index 00000000000..4ef80244397
--- /dev/null
+++ b/dev/packagenames/testdata/invalid_manifests/p1/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_a
+type: integration
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/invalid_manifests/p2/manifest.yml b/dev/packagenames/testdata/invalid_manifests/p2/manifest.yml
new file mode 100644
index 00000000000..f1ea7ab5f2d
--- /dev/null
+++ b/dev/packagenames/testdata/invalid_manifests/p2/manifest.yml
@@ -0,0 +1,3 @@
+format_version: "3.0.0"
+name: pkg_b
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/nested/duplicates/p3/manifest.yml b/dev/packagenames/testdata/nested/duplicates/p3/manifest.yml
new file mode 100644
index 00000000000..acebbd6c6db
--- /dev/null
+++ b/dev/packagenames/testdata/nested/duplicates/p3/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_e
+type: integration
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/nested/duplicates/technology/p1/manifest.yml b/dev/packagenames/testdata/nested/duplicates/technology/p1/manifest.yml
new file mode 100644
index 00000000000..acebbd6c6db
--- /dev/null
+++ b/dev/packagenames/testdata/nested/duplicates/technology/p1/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_e
+type: integration
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/nested/duplicates/technology/p2/manifest.yml b/dev/packagenames/testdata/nested/duplicates/technology/p2/manifest.yml
new file mode 100644
index 00000000000..acebbd6c6db
--- /dev/null
+++ b/dev/packagenames/testdata/nested/duplicates/technology/p2/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_e
+type: integration
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/nested/no_duplicates/p3/manifest.yml b/dev/packagenames/testdata/nested/no_duplicates/p3/manifest.yml
new file mode 100644
index 00000000000..3707aa1f9f6
--- /dev/null
+++ b/dev/packagenames/testdata/nested/no_duplicates/p3/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_f
+type: integration
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/nested/no_duplicates/technology/p1/manifest.yml b/dev/packagenames/testdata/nested/no_duplicates/technology/p1/manifest.yml
new file mode 100644
index 00000000000..6a7bc8a7edd
--- /dev/null
+++ b/dev/packagenames/testdata/nested/no_duplicates/technology/p1/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_c
+type: input
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/nested/no_duplicates/technology/p2/manifest.yml b/dev/packagenames/testdata/nested/no_duplicates/technology/p2/manifest.yml
new file mode 100644
index 00000000000..a9dabb93d00
--- /dev/null
+++ b/dev/packagenames/testdata/nested/no_duplicates/technology/p2/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_d
+type: content
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/no_duplicates/p1/manifest.yml b/dev/packagenames/testdata/no_duplicates/p1/manifest.yml
new file mode 100644
index 00000000000..4ef80244397
--- /dev/null
+++ b/dev/packagenames/testdata/no_duplicates/p1/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_a
+type: integration
+version: "1.0.0"
diff --git a/dev/packagenames/testdata/no_duplicates/p2/manifest.yml b/dev/packagenames/testdata/no_duplicates/p2/manifest.yml
new file mode 100644
index 00000000000..b0fcac77c15
--- /dev/null
+++ b/dev/packagenames/testdata/no_duplicates/p2/manifest.yml
@@ -0,0 +1,4 @@
+format_version: "3.0.0"
+name: pkg_b
+type: integration
+version: "1.0.0"
diff --git a/dev/requiresupdate/publish.go b/dev/requiresupdate/publish.go
new file mode 100644
index 00000000000..adb6c1bd738
--- /dev/null
+++ b/dev/requiresupdate/publish.go
@@ -0,0 +1,319 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package requiresupdate
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"sort"
+	"strings"
+
+	"github.com/cli/go-gh/v2"
+
+	"github.com/elastic/integrations/dev/gitutil"
+)
+
+// ghExec runs the gh CLI and folds stderr into the result: on failure it's
+// appended to the returned error, since gh's exit error alone typically
+// doesn't carry the human-readable reason; on success a non-empty stderr is
+// printed as a warning, since gh can report partial problems (e.g. a
+// reviewer it couldn't request) without a non-zero exit.
+func ghExec(args ...string) (bytes.Buffer, error) {
+	stdout, stderr, err := gh.Exec(args...)
+	if err != nil {
+		if msg := strings.TrimSpace(stderr.String()); msg != "" {
+			return stdout, fmt.Errorf("%w: %s", err, msg)
+		}
+		return stdout, err
+	}
+	if msg := strings.TrimSpace(stderr.String()); msg != "" {
+		fmt.Printf("gh %s warning: %s\n", strings.Join(args, " "), msg)
+	}
+	return stdout, nil
+}
+
+// publish opens one PR per package with applied changes — creating or
+// updating a stable per-package branch — and one GitHub issue per package
+// whose proposals were entirely skipped. Deliberately kept simple while
+// adoption of `requires:` is low; revisit batching by codeowner once weekly
+// volume per team justifies the added complexity.
+//
+// In preview mode nothing is written to git or GitHub; actions are only
+// printed.
+func publish(summaries []packageSummary, preview bool) error {
+	sort.Slice(summaries, func(i, j int) bool { return summaries[i].name < summaries[j].name })
+
+	for _, s := range summaries {
+		if len(s.files) == 0 {
+			if err := publishIssue(s, preview); err != nil {
+				return fmt.Errorf("%s: %w", s.name, err)
+			}
+			continue
+		}
+		if err := publishPR(s, preview); err != nil {
+			return fmt.Errorf("%s: %w", s.name, err)
+		}
+	}
+	return nil
+}
+
+func publishIssue(s packageSummary, preview bool) error {
+	title := fmt.Sprintf("[automation] Package version updates blocked for `%s`", s.name)
+	body := issueBody(s)
+
+	if preview {
+		fmt.Printf("======================================== ISSUE\n"+
+			"Package: %s\nOwners:  %s\n\nIssue title: %s\n\nIssue body:\n%s"+
+			"========================================\n\n",
+			s.name, mentions(s.codeowners), title, body)
+		return nil
+	}
+
+	number, err := findOpenIssue(title)
+	if err != nil {
+		return fmt.Errorf("listing existing issues: %w", err)
+	}
+	if number != "" {
+		if _, err := ghExec("issue", "edit", number, "--body", body); err != nil {
+			return fmt.Errorf("updating issue #%s: %w", number, err)
+		}
+		fmt.Printf("Updated existing issue #%s for %s.\n", number, s.name)
+		return nil
+	}
+	if _, err := ghExec("issue", "create", "--title", title, "--label", "automation", "--body", body); err != nil {
+		return fmt.Errorf("creating issue: %w", err)
+	}
+	fmt.Printf("Created issue for %s.\n", s.name)
+	return nil
+}
+
+func publishPR(s packageSummary, preview bool) error {
+	branch := "automated/requires-update-" + s.name
+	title := fmt.Sprintf("[automation] Update required package versions for `%s`", s.name)
+	body := prBody(s)
+
+	if preview {
+		fmt.Printf("======================================== PR\n"+
+			"Package: %s\nOwners:  %s\nBranch:  %s\nFiles:\n  %s\n\nPR title: %s\n\nPR body:\n%s"+
+			"========================================\n\n",
+			s.name, mentions(s.codeowners), branch, strings.Join(s.files, "\n  "), title, body)
+		return nil
+	}
+
+	git := gitutil.Git{}
+
+	// Reset HEAD to main without discarding the dirty working tree.
+	// "checkout -B" moves HEAD but does not touch untracked/modified files,
+	// so other packages' pending changes survive subsequent calls.
+	if err := git.Run("checkout", "-B", branch, "origin/main"); err != nil {
+		return fmt.Errorf("creating branch failed: %w", err)
+	}
+	if err := git.Run(append([]string{"add", "--"}, s.files...)...); err != nil {
+		return fmt.Errorf("staging files failed: %w", err)
+	}
+	staged, err := git.Output("diff", "--cached", "--name-only")
+	if err != nil {
+		return fmt.Errorf("checking staged files failed: %w", err)
+	}
+	if strings.TrimSpace(staged) == "" {
+		return fmt.Errorf("nothing staged for %s: files may already be committed or elastic-package produced no changes", s.name)
+	}
+	if err := git.Run("commit", "-m", fmt.Sprintf("[automation] Update required package versions for %s", s.name)); err != nil {
+		return fmt.Errorf("committing failed: %w", err)
+	}
+	// Force push: each run resets the branch to origin/main and commits fresh
+	// changes, so the new commit intentionally diverges from any previous run's
+	// commit on the same branch — not a fast-forward.
+	if err := git.Run("push", "--force", "origin", branch); err != nil {
+		return fmt.Errorf("pushing failed: %w", err)
+	}
+
+	prNumber, err := createOrUpdatePR(branch, title, body)
+	if err != nil {
+		return fmt.Errorf("creating/updating PR failed: %w", err)
+	}
+
+	return fixupChangelogLinks(s, branch, prNumber)
+}
+
+// createOrUpdatePR opens a PR for branch, or updates the body of an existing
+// open one, and returns the PR number for changelog link fixup. Reviewers are
+// left to GitHub's automatic CODEOWNERS review request rather than requested
+// explicitly here.
+func createOrUpdatePR(branch, title, body string) (string, error) {
+	stdout, err := ghExec("pr", "list", "--head", branch, "--state", "open", "--json", "number,url")
+	if err != nil {
+		return "", err
+	}
+	var prs []struct {
+		Number int    `json:"number"`
+		URL    string `json:"url"`
+	}
+	if err := json.Unmarshal(stdout.Bytes(), &prs); err != nil {
+		return "", fmt.Errorf("parsing PR list: %w", err)
+	}
+	if len(prs) > 0 {
+		if _, err := ghExec("pr", "edit", prs[0].URL, "--body", body); err != nil {
+			return "", fmt.Errorf("updating PR: %w", err)
+		}
+		return fmt.Sprintf("%d", prs[0].Number), nil
+	}
+
+	args := []string{
+		"pr", "create",
+		"--base", "main",
+		"--head", branch,
+		"--title", title,
+		"--label", "automation",
+		"--body", body,
+	}
+	if _, err := ghExec(args...); err != nil {
+		return "", fmt.Errorf("creating PR: %w", err)
+	}
+	// gh pr create --json is not available on GitHub-hosted runners yet; pr list
+	// supports --json and is already used above for the update path.
+	return openPRNumber(branch)
+}
+
+func openPRNumber(branch string) (string, error) {
+	stdout, err := ghExec("pr", "list", "--head", branch, "--state", "open", "--json", "number")
+	if err != nil {
+		return "", err
+	}
+	var prs []struct {
+		Number int `json:"number"`
+	}
+	if err := json.Unmarshal(stdout.Bytes(), &prs); err != nil {
+		return "", fmt.Errorf("parsing PR list: %w", err)
+	}
+	if len(prs) == 0 {
+		return "", fmt.Errorf("no open PR found for branch %q after create", branch)
+	}
+	return fmt.Sprintf("%d", prs[0].Number), nil
+}
+
+// fixupChangelogLinks replaces the pull/REPLACE_ME placeholder in this
+// package's changelog file with the real PR number, in a follow-up commit,
+// once the PR number is known. s.files is only populated (and this function
+// only called) when a changelog.yml was written, so a missing file or a
+// missing placeholder both indicate elastic-package produced unexpected
+// output rather than a normal no-op.
+func fixupChangelogLinks(s packageSummary, branch, prNumber string) error {
+	if prNumber == "" {
+		return nil
+	}
+	changedPath, err := replaceChangelogPlaceholder(s.files, prNumber)
+	if err != nil {
+		return err
+	}
+	git := gitutil.Git{}
+	if err := git.Run("add", "--", changedPath); err != nil {
+		return err
+	}
+	if err := git.Run("commit", "-m", "Fix changelog PR links"); err != nil {
+		return fmt.Errorf("committing changelog fixup: %w", err)
+	}
+	return git.Run("push", "origin", branch)
+}
+
+// replaceChangelogPlaceholder replaces the pull/REPLACE_ME placeholder in the
+// first changelog.yml found in files with the real PR number, preserving file
+// permissions. Returns the path of the modified file.
+func replaceChangelogPlaceholder(files []string, prNumber string) (string, error) {
+	for _, f := range files {
+		if !strings.HasSuffix(f, "changelog.yml") {
+			continue
+		}
+		info, err := os.Stat(f)
+		if err != nil {
+			return "", fmt.Errorf("stat %s: %w", f, err)
+		}
+		data, err := os.ReadFile(f)
+		if err != nil {
+			return "", fmt.Errorf("reading %s: %w", f, err)
+		}
+		fixed := strings.ReplaceAll(string(data), "pull/REPLACE_ME", "pull/"+prNumber)
+		if fixed == string(data) {
+			return "", fmt.Errorf("pull/REPLACE_ME placeholder not found in %s: elastic-package may have changed its changelog output format", f)
+		}
+		if err := os.WriteFile(f, []byte(fixed), info.Mode()); err != nil {
+			return "", fmt.Errorf("writing %s: %w", f, err)
+		}
+		return f, nil
+	}
+	return "", fmt.Errorf("no changelog.yml found among written files to fix up PR links")
+}
+
+func findOpenIssue(title string) (string, error) {
+	stdout, err := ghExec("issue", "list",
+		"--state", "open",
+		"--search", fmt.Sprintf("%s in:title", title),
+		"--json", "number,title",
+	)
+	if err != nil {
+		return "", err
+	}
+	var issues []struct {
+		Number int    `json:"number"`
+		Title  string `json:"title"`
+	}
+	if err := json.Unmarshal(stdout.Bytes(), &issues); err != nil {
+		return "", fmt.Errorf("parsing issue list: %w", err)
+	}
+	for _, i := range issues {
+		if i.Title == title {
+			return fmt.Sprintf("%d", i.Number), nil
+		}
+	}
+	return "", nil
+}
+
+func issueBody(s packageSummary) string {
+	var b strings.Builder
+	b.WriteString("The following dependency updates are available but could not be applied automatically.\n\n")
+	for _, p := range s.skipped {
+		fmt.Fprintf(&b, "- **%s**: %s\n", p.Package, p.Warning)
+	}
+	if s.ownerMismatch != "" {
+		fmt.Fprintf(&b, "\n> **Note:** codeowner mismatch — %s\n", s.ownerMismatch)
+	}
+	fmt.Fprintf(&b, "\n/cc %s\n", mentions(s.codeowners))
+	return b.String()
+}
+
+// mentions formats owners (bare "org/team" entries) as space-separated
+// GitHub @mentions, e.g. "@elastic/team-a @elastic/team-b".
+func mentions(owners []string) string {
+	mentioned := make([]string, len(owners))
+	for i, o := range owners {
+		mentioned[i] = "@" + o
+	}
+	return strings.Join(mentioned, " ")
+}
+
+func prBody(s packageSummary) string {
+	var b strings.Builder
+	if len(s.applied) > 0 {
+		b.WriteString("## Applied\n\n")
+		for _, p := range s.applied {
+			fmt.Fprintf(&b, "- **%s** (`%s`): `%s` → `%s`\n", p.Package, p.Kind, p.Current, p.Proposed)
+		}
+	}
+	if len(s.skipped) > 0 {
+		if b.Len() > 0 {
+			b.WriteString("\n")
+		}
+		b.WriteString("## Skipped\n\n")
+		for _, p := range s.skipped {
+			fmt.Fprintf(&b, "- ⚠️ **%s**: %s\n", p.Package, p.Warning)
+		}
+	}
+	if s.ownerMismatch != "" {
+		fmt.Fprintf(&b, "\n> **Note:** codeowner mismatch — %s\n", s.ownerMismatch)
+	}
+	return b.String()
+}
diff --git a/dev/requiresupdate/publish_test.go b/dev/requiresupdate/publish_test.go
new file mode 100644
index 00000000000..2290a6eed3b
--- /dev/null
+++ b/dev/requiresupdate/publish_test.go
@@ -0,0 +1,173 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package requiresupdate
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPRBody(t *testing.T) {
+	cases := []struct {
+		title        string
+		summary      packageSummary
+		wantContains []string
+		wantExcludes []string
+	}{
+		{
+			title: "applied only",
+			summary: packageSummary{
+				applied: []proposal{
+					{Kind: "input", Package: "apache", Current: "1.2.0", Proposed: "1.3.0"},
+				},
+			},
+			wantContains: []string{"## Applied", "**apache** (`input`): `1.2.0` → `1.3.0`"},
+			wantExcludes: []string{"## Skipped"},
+		},
+		{
+			title: "skipped only",
+			summary: packageSummary{
+				skipped: []proposal{
+					{Package: "foo", Warning: "requires kibana >=9.0.0"},
+				},
+			},
+			wantContains: []string{"## Skipped", "⚠️ **foo**: requires kibana >=9.0.0"},
+			wantExcludes: []string{"## Applied"},
+		},
+		{
+			title: "applied and skipped",
+			summary: packageSummary{
+				applied: []proposal{
+					{Kind: "input", Package: "apache", Current: "1.2.0", Proposed: "1.3.0"},
+				},
+				skipped: []proposal{
+					{Package: "foo", Warning: "requires kibana >=9.0.0"},
+				},
+			},
+			wantContains: []string{"## Applied", "## Skipped"},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.title, func(t *testing.T) {
+			body := prBody(tc.summary)
+			for _, want := range tc.wantContains {
+				assert.Contains(t, body, want)
+			}
+			for _, exclude := range tc.wantExcludes {
+				assert.NotContains(t, body, exclude)
+			}
+		})
+	}
+}
+
+func TestIssueBody(t *testing.T) {
+	body := issueBody(packageSummary{
+		codeowners: []string{"elastic/some-team"},
+		skipped: []proposal{
+			{Package: "foo", Warning: "requires kibana >=9.0.0"},
+		},
+	})
+
+	assert.Contains(t, body, "**foo**: requires kibana >=9.0.0")
+	assert.Contains(t, body, "/cc @elastic/some-team")
+}
+
+func TestIssueBodyMultipleOwners(t *testing.T) {
+	body := issueBody(packageSummary{
+		codeowners: []string{"elastic/team-a", "elastic/team-b"},
+		skipped: []proposal{
+			{Package: "foo", Warning: "requires kibana >=9.0.0"},
+		},
+	})
+
+	assert.Contains(t, body, "/cc @elastic/team-a @elastic/team-b")
+}
+
+func TestIssueBodyOwnerMismatch(t *testing.T) {
+	body := issueBody(packageSummary{
+		codeowners: []string{"elastic/some-team"},
+		ownerMismatch: "CODEOWNERS=elastic/some-team manifest owner.github=elastic/other-team " +
+			"(using CODEOWNERS)",
+		skipped: []proposal{
+			{Package: "foo", Warning: "requires kibana >=9.0.0"},
+		},
+	})
+
+	assert.Contains(t, body, "codeowner mismatch")
+	assert.Contains(t, body, "elastic/other-team")
+	assert.Contains(t, body, "/cc @elastic/some-team")
+}
+
+func TestReplaceChangelogPlaceholder(t *testing.T) {
+	t.Run("replaces placeholder with PR number", func(t *testing.T) {
+		dir := t.TempDir()
+		cl := filepath.Join(dir, "changelog.yml")
+		require.NoError(t, os.WriteFile(cl, []byte("- link: pull/REPLACE_ME\n"), 0644))
+
+		got, err := replaceChangelogPlaceholder([]string{cl}, "42")
+		require.NoError(t, err)
+		assert.Equal(t, cl, got)
+
+		data, err := os.ReadFile(cl)
+		require.NoError(t, err)
+		assert.Equal(t, "- link: pull/42\n", string(data))
+
+		info, err := os.Stat(cl)
+		require.NoError(t, err)
+		assert.Equal(t, os.FileMode(0644), info.Mode())
+	})
+
+	t.Run("error when placeholder missing", func(t *testing.T) {
+		dir := t.TempDir()
+		cl := filepath.Join(dir, "changelog.yml")
+		require.NoError(t, os.WriteFile(cl, []byte("- link: pull/12345\n"), 0644))
+
+		_, err := replaceChangelogPlaceholder([]string{cl}, "42")
+		assert.ErrorContains(t, err, "placeholder not found")
+	})
+
+	t.Run("error when no changelog.yml in list", func(t *testing.T) {
+		_, err := replaceChangelogPlaceholder([]string{"manifest.yml", "data_stream/foo/manifest.yml"}, "42")
+		assert.ErrorContains(t, err, "no changelog.yml")
+	})
+
+	t.Run("only changelog.yml is modified", func(t *testing.T) {
+		dir := t.TempDir()
+		cl := filepath.Join(dir, "changelog.yml")
+		manifest := filepath.Join(dir, "manifest.yml")
+		require.NoError(t, os.WriteFile(cl, []byte("- link: pull/REPLACE_ME\n"), 0644))
+		require.NoError(t, os.WriteFile(manifest, []byte("name: mypackage\n"), 0644))
+
+		got, err := replaceChangelogPlaceholder([]string{manifest, cl}, "99")
+		require.NoError(t, err)
+		assert.Equal(t, cl, got)
+
+		manifestData, err := os.ReadFile(manifest)
+		require.NoError(t, err)
+		assert.Equal(t, "name: mypackage\n", string(manifestData))
+
+		clData, err := os.ReadFile(cl)
+		require.NoError(t, err)
+		assert.Contains(t, string(clData), "pull/99")
+	})
+}
+
+func TestPRBodyOwnerMismatch(t *testing.T) {
+	body := prBody(packageSummary{
+		applied: []proposal{
+			{Kind: "input", Package: "apache", Current: "1.2.0", Proposed: "1.3.0"},
+		},
+		ownerMismatch: "CODEOWNERS=elastic/some-team manifest owner.github=elastic/other-team " +
+			"(using CODEOWNERS)",
+	})
+
+	assert.Contains(t, body, "codeowner mismatch")
+	assert.Contains(t, body, "elastic/other-team")
+}
diff --git a/dev/requiresupdate/requiresupdate.go b/dev/requiresupdate/requiresupdate.go
new file mode 100644
index 00000000000..80e046d7742
--- /dev/null
+++ b/dev/requiresupdate/requiresupdate.go
@@ -0,0 +1,275 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package requiresupdate
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"sort"
+	"strings"
+
+	"github.com/elastic/integrations/dev/citools"
+	"github.com/elastic/integrations/dev/codeowners"
+)
+
+const packagesDir = "packages"
+
+// elasticPackageBin returns the elastic-package binary to use.
+// Override with ELASTIC_PACKAGE_BIN for local builds that carry new commands.
+func elasticPackageBin() string {
+	if bin := os.Getenv("ELASTIC_PACKAGE_BIN"); bin != "" {
+		return bin
+	}
+	return "elastic-package"
+}
+
+type proposal struct {
+	Kind             string `json:"kind"`
+	Package          string `json:"package"`
+	Current          string `json:"current"`
+	Proposed         string `json:"proposed"`
+	KibanaConstraint string `json:"kibana_constraint"`
+	Warning          string `json:"warning"`
+}
+
+type updateResult struct {
+	Package    string     `json:"package"`
+	Codeowner  string     `json:"codeowner"`
+	Proposals  []proposal `json:"proposals"`
+	NewVersion string     `json:"new_version,omitempty"`
+}
+
+// defaultOwner is the catch-all team used when a package has no resolvable
+// codeowner (neither CODEOWNERS nor the manifest's owner.github field), so a
+// proposal never gets dropped for lack of somewhere to send it.
+const defaultOwner = "elastic/ecosystem"
+
+type packageSummary struct {
+	path          string
+	name          string
+	applied       []proposal
+	skipped       []proposal
+	codeowners    []string // bare "org/team" entries, no leading '@'; every team owning this package
+	ownerMismatch string   // non-empty if CODEOWNERS and the manifest fallback disagreed; describes both values
+	files         []string // paths written to disk, relative to repo root; empty on dry-run
+}
+
+// Run walks all integration packages, runs elastic-package requires update,
+// adds changelog entries for packages with actual updates, opens one PR (or,
+// if every proposal was skipped, one issue) per package via Publish, and
+// prints a summary grouped by codeowner.
+//
+// Set dryRun to see proposals without applying (this also skips publishing,
+// since no files were written). Set preview to print what publish would do
+// without touching git or GitHub.
+func Run(dryRun, preview bool) error {
+	pkgs, err := citools.ListPackagesWithNames(packagesDir)
+	if err != nil {
+		return fmt.Errorf("listing packages: %w", err)
+	}
+
+	owners, err := codeowners.LoadOwners(codeowners.DefaultCodeownersPath)
+	if err != nil {
+		return fmt.Errorf("loading codeowners: %w", err)
+	}
+
+	var summaries []packageSummary
+	var errs []string
+	eligible := 0
+
+	for _, pkg := range pkgs {
+		if pkg.Type != "integration" || !pkg.HasRequires {
+			continue
+		}
+		eligible++
+
+		summary, err := processPackage(pkg.Path, pkg.Name, dryRun, owners)
+		if err != nil {
+			errs = append(errs, fmt.Sprintf("%s: %v", pkg.Name, err))
+			continue
+		}
+		if summary != nil {
+			summaries = append(summaries, *summary)
+		}
+	}
+
+	printSummary(summaries, dryRun)
+	printScanStats(len(pkgs), eligible, len(summaries), len(errs))
+
+	if dryRun {
+		fmt.Println("dry run — skipping PR/issue creation.")
+	} else if err := publish(summaries, preview); err != nil {
+		errs = append(errs, fmt.Sprintf("publishing: %v", err))
+	}
+
+	if len(errs) > 0 {
+		return fmt.Errorf("errors in %d package(s):\n  %s", len(errs), strings.Join(errs, "\n  "))
+	}
+	return nil
+}
+
+func processPackage(pkgPath, pkgName string, dryRun bool, owners *codeowners.Owners) (*packageSummary, error) {
+	args := []string{"requires", "update", "--changelog", "--format", "json"}
+	if dryRun {
+		args = append(args, "--dry-run")
+	}
+	var stdout, stderr bytes.Buffer
+	cmd := exec.Command(elasticPackageBin(), args...)
+	cmd.Dir = pkgPath
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	if err := cmd.Run(); err != nil {
+		return nil, fmt.Errorf("elastic-package requires update: %w\nstderr: %s", err, stderr.String())
+	}
+
+	if stdout.Len() == 0 {
+		return nil, nil
+	}
+
+	var result updateResult
+	if err := json.Unmarshal(stdout.Bytes(), &result); err != nil {
+		return nil, fmt.Errorf("parsing JSON output: %w\noutput: %s", err, stdout.String())
+	}
+
+	var applied, skipped []proposal
+	for _, p := range result.Proposals {
+		if p.Proposed != "" {
+			applied = append(applied, p)
+		} else if p.Warning != "" {
+			skipped = append(skipped, p)
+		} else {
+			fmt.Printf("warning: unrecognised proposal for %s (package=%s kind=%s) — neither proposed nor warning set; skipping\n",
+				pkgName, p.Package, p.Kind)
+		}
+	}
+
+	if len(applied) == 0 && len(skipped) == 0 {
+		return nil, nil
+	}
+
+	res := resolveOwner(owners, pkgPath, result.Codeowner)
+
+	var writtenFiles []string
+	// written files are only populated when proposals are applied, not on dry-run
+	if len(applied) > 0 && !dryRun {
+		writtenFiles = []string{
+			filepath.Join(pkgPath, citools.ManifestFileName),
+			filepath.Join(pkgPath, "changelog.yml"),
+		}
+	}
+
+	return &packageSummary{
+		path:          pkgPath,
+		name:          pkgName,
+		applied:       applied,
+		skipped:       skipped,
+		codeowners:    res.owners,
+		ownerMismatch: res.mismatch,
+		files:         writtenFiles,
+	}, nil
+}
+
+// ownerResolution is the result of reconciling CODEOWNERS against the
+// package manifest's own owner.github fallback field.
+type ownerResolution struct {
+	owners   []string // bare "org/team" entries, no leading '@'; never empty
+	mismatch string   // non-empty if CODEOWNERS and the fallback disagreed; describes both values
+}
+
+// resolveOwner reconciles the package's codeowner(s), preferring CODEOWNERS
+// (which may list more than one owning team) over the JSON fallback field
+// (sourced from the package manifest's owner.github, which only ever names
+// one team). Falls back to defaultOwner when neither source resolves one, so
+// a proposal never gets dropped for lack of somewhere to send it.
+func resolveOwner(owners *codeowners.Owners, pkgPath, fallback string) ownerResolution {
+	teams, err := owners.PackageOwnersByPath(pkgPath, "")
+	if err != nil {
+		owner := fallback
+		if owner == "" {
+			owner = defaultOwner
+		}
+		return ownerResolution{owners: []string{owner}}
+	}
+	// CODEOWNERS entries carry a '@' prefix; the JSON fallback field does
+	// not — normalize to the bare form so callers get a consistent value
+	// regardless of which path resolved it.
+	bare := make([]string, len(teams))
+	for i, t := range teams {
+		bare[i] = strings.TrimPrefix(t, "@")
+	}
+	res := ownerResolution{owners: bare}
+	if fallback != "" && !slices.Contains(bare, fallback) {
+		res.mismatch = fmt.Sprintf("CODEOWNERS=%s manifest owner.github=%s (using CODEOWNERS)",
+			strings.Join(bare, ","), fallback)
+	}
+	return res
+}
+
+// printScanStats prints a one-line scan summary distinguishing "nothing to do
+// because adoption of requires: is low" from "the walk found nothing due to a
+// bug" — both currently produce zero proposals. Also appended to
+// $GITHUB_STEP_SUMMARY when set, so it's visible without opening the job log.
+func printScanStats(total, eligible, withProposals, errored int) {
+	line := fmt.Sprintf("Scanned %d packages, %d eligible (requires: present), %d with proposals, %d errored.\n",
+		total, eligible, withProposals, errored)
+	fmt.Print(line)
+
+	if summaryPath := os.Getenv("GITHUB_STEP_SUMMARY"); summaryPath != "" {
+		f, err := os.OpenFile(summaryPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+		if err != nil {
+			return
+		}
+		defer f.Close()
+		fmt.Fprint(f, line)
+	}
+}
+
+func printSummary(summaries []packageSummary, dryRun bool) {
+	groups := make(map[string][]packageSummary)
+	for _, s := range summaries {
+		key := strings.Join(s.codeowners, ", ")
+		groups[key] = append(groups[key], s)
+	}
+
+	teams := make([]string, 0, len(groups))
+	for t := range groups {
+		teams = append(teams, t)
+	}
+	sort.Strings(teams)
+
+	mode := "applied"
+	if dryRun {
+		mode = "proposed (dry run)"
+	}
+
+	fmt.Printf("\n=== Requires Update Summary (%s) ===\n\n", mode)
+
+	for _, team := range teams {
+		fmt.Printf("## %s\n", team)
+		for _, s := range groups[team] {
+			printPackageSummary(s)
+		}
+		fmt.Println()
+	}
+}
+
+func printPackageSummary(s packageSummary) {
+	fmt.Printf("  %s\n", s.name)
+	if s.ownerMismatch != "" {
+		fmt.Printf("    [OWNER MISMATCH] %s\n", s.ownerMismatch)
+	}
+	for _, p := range s.applied {
+		fmt.Printf("    [%s] %s: %s → %s\n", p.Kind, p.Package, p.Current, p.Proposed)
+	}
+	for _, p := range s.skipped {
+		fmt.Printf("    [SKIPPED] %s (kibana constraint): %s\n", p.Package, p.Warning)
+	}
+}
diff --git a/dev/requiresupdate/requiresupdate_test.go b/dev/requiresupdate/requiresupdate_test.go
new file mode 100644
index 00000000000..60e1d63f3a2
--- /dev/null
+++ b/dev/requiresupdate/requiresupdate_test.go
@@ -0,0 +1,97 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package requiresupdate
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/elastic/integrations/dev/codeowners"
+)
+
+func TestResolveOwner(t *testing.T) {
+	owners, err := codeowners.LoadOwners("testdata/CODEOWNERS")
+	require.NoError(t, err)
+
+	cases := []struct {
+		title        string
+		pkgPath      string
+		fallback     string
+		wantOwners   []string
+		wantMismatch bool
+	}{
+		{
+			title:      "CODEOWNERS only",
+			pkgPath:    "packages/aws",
+			fallback:   "",
+			wantOwners: []string{"elastic/obs-infraobs-integrations"},
+		},
+		{
+			title:      "CODEOWNERS agrees with manifest fallback",
+			pkgPath:    "packages/aws",
+			fallback:   "elastic/obs-infraobs-integrations",
+			wantOwners: []string{"elastic/obs-infraobs-integrations"},
+		},
+		{
+			title:        "CODEOWNERS disagrees with manifest fallback",
+			pkgPath:      "packages/aws",
+			fallback:     "elastic/other-team",
+			wantOwners:   []string{"elastic/obs-infraobs-integrations"},
+			wantMismatch: true,
+		},
+		{
+			title:      "no CODEOWNERS entry, manifest fallback used",
+			pkgPath:    "packages/unknown-package",
+			fallback:   "elastic/fallback-team",
+			wantOwners: []string{"elastic/fallback-team"},
+		},
+		{
+			title:      "no CODEOWNERS entry and no fallback falls back to the default owner",
+			pkgPath:    "packages/unknown-package",
+			fallback:   "",
+			wantOwners: []string{defaultOwner},
+		},
+		{
+			title:      "CODEOWNERS lists multiple teams, all are kept",
+			pkgPath:    "packages/multi_owner",
+			fallback:   "",
+			wantOwners: []string{"elastic/team-a", "elastic/team-b"},
+		},
+		{
+			title:      "CODEOWNERS lists multiple teams, fallback matches one of them",
+			pkgPath:    "packages/multi_owner",
+			fallback:   "elastic/team-b",
+			wantOwners: []string{"elastic/team-a", "elastic/team-b"},
+		},
+		{
+			title:        "CODEOWNERS lists multiple teams, fallback matches none of them",
+			pkgPath:      "packages/multi_owner",
+			fallback:     "elastic/other-team",
+			wantOwners:   []string{"elastic/team-a", "elastic/team-b"},
+			wantMismatch: true,
+		},
+		{
+			title:      "nested package path where folder name differs from manifest name",
+			pkgPath:    "testdata/nested_packages/technology/p1",
+			fallback:   "",
+			wantOwners: []string{"elastic/nested-team"},
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.title, func(t *testing.T) {
+			res := resolveOwner(owners, c.pkgPath, c.fallback)
+			assert.Equal(t, c.wantOwners, res.owners)
+			if c.wantMismatch {
+				assert.NotEmpty(t, res.mismatch)
+				assert.Contains(t, res.mismatch, c.fallback)
+			} else {
+				assert.Empty(t, res.mismatch)
+			}
+		})
+	}
+}
diff --git a/dev/requiresupdate/testdata/CODEOWNERS b/dev/requiresupdate/testdata/CODEOWNERS
new file mode 100644
index 00000000000..ca0f651b3d2
--- /dev/null
+++ b/dev/requiresupdate/testdata/CODEOWNERS
@@ -0,0 +1,4 @@
+# Minimal CODEOWNERS fixture for resolveOwner tests.
+/packages/aws @elastic/obs-infraobs-integrations
+/packages/multi_owner @elastic/team-a @elastic/team-b
+/testdata/nested_packages/technology/p1 @elastic/nested-team
diff --git a/dev/scripts/README.md b/dev/scripts/README.md
new file mode 100644
index 00000000000..09292ed2e97
--- /dev/null
+++ b/dev/scripts/README.md
@@ -0,0 +1,12 @@
+# dev/scripts
+
+Developer and maintenance scripts that are **not** involved in package testing.
+
+Because none of these scripts affect package behaviour, the entire `dev/scripts/`
+directory is listed as a `non_package_pattern` in
+`.buildkite/scripts/common.sh`. This means changes here do not trigger the
+package test matrix in CI.
+
+If a script is ever added here that does affect package testing, the
+`non_package_patterns` entry for `dev/scripts/` must be narrowed or removed
+accordingly so that the relevant packages are still tested.
diff --git a/dev/scripts/backport_apply.sh b/dev/scripts/backport_apply.sh
new file mode 100755
index 00000000000..86c063a14a3
--- /dev/null
+++ b/dev/scripts/backport_apply.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# backport_apply.sh — thin CLI wrapper around `mage ApplyBackport`.
+#
+# Usage:
+#   dev/scripts/backport_apply.sh --sha <sha> --package <pkg> --target <target> \
+#     [--open-pr] [--json] [--dry-run] \
+#     [--repository <org/repo>] [--packages-dir <path>]
+#
+# Required:
+#   --sha        Commit SHA to cherry-pick (min 8 chars).
+#   --package    Package name as it appears in manifest.yml.
+#   --target     Version series ("6.14") or full branch name ("backport-aws-6.14").
+#
+# Optional flags passed as mage *bool params:
+#   --open-pr    Create a GitHub PR after pushing the working branch.
+#   --json       Emit JSON output (success/conflict schemas per issue spec).
+#   --dry-run    Commit locally but skip push and PR creation for local review.
+#
+# Optional strings passed as mage *string params:
+#   --remote       Git remote to fetch from and push to (default: origin).
+#   --repository   GitHub repository (org/repo) used in PR body and links.
+#   --packages-dir Path to packages directory (default: packages).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(git -C "${SCRIPT_DIR}" rev-parse --show-toplevel)"
+
+sha=""
+pkg=""
+target=""
+open_pr="false"
+as_json="false"
+dry_run="false"
+remote=""
+repository=""
+packages_dir=""
+
+usage() {
+    grep '^#' "$0" | grep -v '#!/' | sed 's/^# \?//' >&2
+    exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --sha)           sha="$2";           shift 2 ;;
+        --package)       pkg="$2";           shift 2 ;;
+        --target)        target="$2";        shift 2 ;;
+        --open-pr)       open_pr="true";     shift   ;;
+        --json)          as_json="true";     shift   ;;
+        --dry-run)       dry_run="true";     shift   ;;
+        --remote)        remote="$2";        shift 2 ;;
+        --repository)    repository="$2";    shift 2 ;;
+        --packages-dir)  packages_dir="$2";  shift 2 ;;
+        -h|--help)       usage ;;
+        *) echo "Unknown option: $1" >&2; usage ;;
+    esac
+done
+
+if [[ -z "$sha" || -z "$pkg" || -z "$target" ]]; then
+    echo "error: --sha, --package, and --target are required" >&2
+    usage
+fi
+
+cd "${REPO_ROOT}"
+
+# *bool and *string params are all passed as -flagname [value]; omitting a
+# flag leaves the param nil in mage, which Apply() treats as "use default".
+flags=()
+[[ "$open_pr"     == "true" ]] && flags+=("-openPR")
+[[ "$as_json"     == "true" ]] && flags+=("-asJSON")
+[[ "$dry_run"     == "true" ]] && flags+=("-dryRun")
+[[ -n "$remote"       ]] && flags+=("-remote=$remote")
+[[ -n "$repository"   ]] && flags+=("-repository=$repository")
+[[ -n "$packages_dir" ]] && flags+=("-packagesDir=$packages_dir")
+
+exec mage ApplyBackport \
+    "$sha" "$pkg" "$target" \
+    "${flags[@]+"${flags[@]}"}"
diff --git a/dev/scripts/backport_bootstrap_inventory.sh b/dev/scripts/backport_bootstrap_inventory.sh
new file mode 100755
index 00000000000..4bde5000ff5
--- /dev/null
+++ b/dev/scripts/backport_bootstrap_inventory.sh
@@ -0,0 +1,337 @@
+#!/usr/bin/env bash
+# backport_bootstrap_inventory.sh
+#
+# IMPORTANT: One-time bootstrap script kept for auditability.
+# Run once to seed .backports.yml from existing backport-* branches.
+# Do NOT use this script to maintain the inventory after the initial seed —
+# update .backports.yml directly from that point on.
+#
+# See issue #19210 for context.
+#
+# After running, perform a manual review pass to:
+#   - Fill in known maintained_until dates (e.g. stack EOL dates).
+#   - Verify base_version entries marked with a WARN comment.
+#
+# Usage: ./dev/scripts/backport_bootstrap_inventory.sh [-r REMOTE] [-o OUTPUT] [-n]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(git -C "${SCRIPT_DIR}" rev-parse --show-toplevel)"
+
+REMOTE="upstream"
+OUTPUT="${REPO_ROOT}/.backports.yml"
+FETCH="true"
+
+usage() {
+    cat >&2 <<'EOF'
+Usage: backport_bootstrap_inventory.sh [-r REMOTE] [-o OUTPUT] [-n]
+
+Seed .backports.yml from existing backport-* branches on a remote.
+
+Options:
+  -r REMOTE    Git remote name (default: upstream)
+  -o OUTPUT    Output file path (default: <repo-root>/.backports.yml)
+  -n           No-fetch: skip fetching remote refs (branches must already
+               be locally cached as refs/remotes/<REMOTE>/backport-*)
+  -h           Show this help
+
+After running, manually review the output and fill in maintained_until dates.
+EOF
+    exit 1
+}
+
+while getopts ":r:o:nh" opt; do
+    case "${opt}" in
+        r) REMOTE="${OPTARG}" ;;
+        o) OUTPUT="${OPTARG}" ;;
+        n) FETCH="false" ;;
+        h) usage; exit 0 ;;
+        \?)
+            echo "Invalid option: -${OPTARG}" >&2
+            usage
+            ;;
+        :)
+            echo "Missing argument for -${OPTARG}" >&2
+            usage
+            ;;
+    esac
+done
+
+if [[ "${FETCH}" == "true" ]]; then
+    echo "Fetching backport-* branches from ${REMOTE}..." >&2
+    git fetch "${REMOTE}" \
+        "refs/heads/backport-*:refs/remotes/${REMOTE}/backport-*" \
+        --no-tags 2>&1 >&2
+fi
+
+ONE_YEAR_SECS=$(( 365 * 24 * 60 * 60 ))
+NOW="$(date +%s)"
+
+# Resolve the package name to a manifest.yml path at a given git object ref.
+# Tries flat layout (packages/<pkg>/manifest.yml) first, then one level of nesting
+# (packages/<folder>/<pkg>/manifest.yml), then falls back to scanning all manifests.
+# Prints the path on success, nothing on failure.
+find_manifest_path() {
+    local ref="${1}"
+    local pkg="${2}"
+
+    # 1. Flat layout: packages/<pkg>/manifest.yml
+    if git cat-file -e "${ref}:packages/${pkg}/manifest.yml" 2>/dev/null; then
+        echo "packages/${pkg}/manifest.yml"
+        return 0
+    fi
+
+    # 2. One-level nesting: packages/<folder>/<pkg>/manifest.yml
+    local nested
+    nested="$(git ls-tree --name-only "${ref}" packages/ 2>/dev/null | while IFS= read -r folder; do
+        candidate="packages/${folder}/${pkg}/manifest.yml"
+        if git cat-file -e "${ref}:${candidate}" 2>/dev/null; then
+            echo "${candidate}"
+            break
+        fi
+    done)"
+    if [[ -n "${nested}" ]]; then
+        echo "${nested}"
+        return 0
+    fi
+
+    # 3. Full scan: match by name field (handles deeper or unusual layouts)
+    while IFS= read -r candidate; do
+        local name
+        name="$(git show "${ref}:${candidate}" 2>/dev/null \
+            | grep -m1 "^name:" \
+            | sed "s/^name:[[:space:]]*//" \
+            | tr -d "\"'")"
+        if [[ "${name}" == "${pkg}" ]]; then
+            echo "${candidate}"
+            return 0
+        fi
+    done < <(git ls-tree -r --name-only "${ref}" packages/ 2>/dev/null \
+        | grep '/manifest.yml$' \
+        | grep -v '/data_stream/')
+
+    return 1
+}
+
+# Read the version field from a manifest at a given git object ref + path.
+get_version_at() {
+    local ref="${1}"
+    local manifest_path="${2}"
+    git show "${ref}:${manifest_path}" 2>/dev/null \
+        | grep -m1 "^version:" \
+        | sed "s/^version:[[:space:]]*//" \
+        | tr -d "\"'"
+}
+
+echo "Generating ${OUTPUT} from refs/remotes/${REMOTE}/backport-* ..." >&2
+
+{
+    cat <<'HEADER'
+# Backport branch inventory — single source of truth.
+# See issue #19210 for schema documentation.
+#
+# Active branch logic:
+#   inactive if:  archived == true
+#             OR  (maintained_until != null AND maintained_until < today)
+#
+# Fill in maintained_until for branches with known EOL dates (YYYY-MM-DD).
+# Example: security_detection_engine-8.19 -> "2027-01-15" (8.19 EOL)
+#
+# This file was seeded by dev/scripts/backport_bootstrap_inventory.sh.
+# Do not re-run the bootstrap — update this file directly.
+HEADER
+
+    echo "backports:"
+
+    while IFS= read -r shortref; do
+        branch="${shortref#"${REMOTE}/"}"
+        ref="refs/remotes/${shortref}"
+
+        # --- Parse package name and version suffix from branch name ---
+        # Branch format: backport-<package>-<major>.<minor>[.<patch>]
+        stripped="${branch#backport-}"
+
+        pkg=""
+        ver_suffix=""
+        if echo "${stripped}" | grep -qE '^.+-[0-9]+\.[0-9]+(\.[0-9]+)?$'; then
+            pkg="$(echo "${stripped}" | sed -E 's/-([0-9]+\.[0-9]+(\.[0-9]+)?)$//')"
+            ver_suffix="$(echo "${stripped}" | sed -E 's/^.*-([0-9]+\.[0-9]+(\.[0-9]+)?)$/\1/')"
+        fi
+
+        if [[ -z "${pkg}" || -z "${ver_suffix}" ]]; then
+            echo "  # WARNING: skipped — could not parse branch name: ${branch}" >&2
+            printf '  # SKIPPED (unparseable): %s\n\n' "${branch}"
+            continue
+        fi
+
+        echo "  Processing ${branch} ..." >&2
+
+        # Major.minor from branch name (used to verify version family).
+        ver_major_minor="$(echo "${ver_suffix}" | cut -d. -f1-2)"
+        # Regex-safe major.minor for grep/sed matching.
+        ver_family_regex="^${ver_major_minor//./\\.}(\.|\$)"
+
+        # --- base_commit resolution ---
+        #
+        # The BASE_COMMIT is the commit on main from which the backport branch was
+        # created.  Three fast strategies produce candidates; we then pick the
+        # OLDEST (by commit timestamp) whose package version matches the branch's
+        # major.minor family.  This correctly handles:
+        #
+        #   • Recent branches: merge-base is still in main (strategy A).
+        #   • Old branches with CI-sync at creation time: parent of OLDEST CI-sync
+        #     commit is the BASE_COMMIT (strategy C).
+        #   • Old branches where CI-sync was RE-DONE after cherry-picks: the
+        #     CI-sync parent is a cherry-pick, not the base.  Walking from HEAD
+        #     skipping automation/backport commits finds the first "normal" commit
+        #     (strategy B), and "oldest wins" picks the right one.
+        #
+        # If no candidate matches the version family, fall back to branch-tip version.
+
+        base_commit=""
+        base_version=""
+        version_warn=""
+
+        # Helper: check version family match.
+        matches_family() { echo "${1}" | grep -qE "${ver_family_regex}"; }
+
+        # Helper: get commit timestamp (unix seconds).
+        commit_ts() { git log -1 --format="%ct" "${1}" 2>/dev/null; }
+
+        # Collect candidate SHAs.
+        cand_merge_base=""
+        cand_walk=""
+        cand_ci_parent=""
+
+        # Strategy A: git merge-base
+        cand_merge_base="$(git merge-base "refs/remotes/${REMOTE}/main" "${ref}" 2>/dev/null)" || true
+
+        # Strategy B: walk from HEAD, skip CI-automation and explicit backport commits,
+        # take the first "normal" commit (within the top 30).
+        walk_count=0
+        while IFS= read -r sha; do
+            (( walk_count++ )) || true
+            [[ "${walk_count}" -gt 30 ]] && break
+            msg="$(git log -1 --format="%s" "${sha}" 2>/dev/null)"
+            # Skip CI automation commits.
+            echo "${msg}" | grep -qiE \
+                "Update .buildkite (folder )?from main|Copy .buildkite from main|Add .buildkite.*to backport branch" \
+                && continue
+            # Skip explicit backport cherry-picks and double-PR cherry-picks.
+            # Double-PR pattern "(#NNNNN) (#MMMMM)" at end of message is the standard
+            # format for backport cherry-picks in this repo (first PR = original on main,
+            # second PR = the backport PR targeting this branch).
+            echo "${msg}" | grep -qiE "\[backport\]|\(backport\)|backporting |\(#[0-9]+\) \(#[0-9]+\)$" && continue
+            cand_walk="${sha}"
+            break
+        done < <(git log "${ref}" --format="%H" 2>/dev/null)
+
+        # Strategy C: parent of oldest (first) CI-sync commit.
+        first_ci="$(git log "${ref}" --format="%H %s" 2>/dev/null \
+            | grep -iE "Update .buildkite (folder )?from main|Copy .buildkite from main|Add .buildkite.*to backport branch" \
+            | tail -1 | awk '{print $1}')" || true
+        if [[ -n "${first_ci}" ]]; then
+            cand_ci_parent="$(git rev-parse "${first_ci}^" 2>/dev/null)" || true
+        fi
+
+        # Among all candidates, pick the OLDEST whose version matches the version family.
+        best_commit=""
+        best_version=""
+        best_ts=9999999999
+
+        for candidate in "${cand_merge_base}" "${cand_walk}" "${cand_ci_parent}"; do
+            [[ -z "${candidate}" ]] && continue
+            m="$(find_manifest_path "${candidate}" "${pkg}" 2>/dev/null)" || true
+            [[ -z "${m}" ]] && continue
+            ver="$(get_version_at "${candidate}" "${m}")"
+            matches_family "${ver}" || continue
+            ts="$(commit_ts "${candidate}")"
+            [[ -z "${ts}" ]] && continue
+            if [[ -z "${best_commit}" || "${ts}" -lt "${best_ts}" ]]; then
+                best_ts="${ts}"
+                best_commit="${candidate}"
+                best_version="${ver}"
+            fi
+        done
+
+        if [[ -n "${best_commit}" ]]; then
+            base_commit="${best_commit}"
+            base_version="${best_version}"
+            echo "    base_commit: ${base_commit:0:10} (version ${base_version})" >&2
+        else
+            # Fallback: use stale merge-base as commit, branch tip for version.
+            base_commit="${cand_merge_base}"
+            tip_manifest="$(find_manifest_path "${ref}" "${pkg}" 2>/dev/null)" || true
+            if [[ -n "${tip_manifest}" ]]; then
+                base_version="$(get_version_at "${ref}" "${tip_manifest}")"
+                echo "    NOTE: using branch-tip version '${base_version}' — verify base_commit manually" >&2
+            fi
+        fi
+
+        if [[ -z "${base_version}" ]]; then
+            base_version="unknown"
+            version_warn="  # WARN: could not determine base_version — fill in manually"
+            echo "    WARNING: could not determine base_version for ${branch}" >&2
+        fi
+
+        base_commit_short="${base_commit:0:10}"
+
+        # --- Check if base_commit is reachable from upstream/main ---
+        # Old branches whose entire history diverged from main before a force-push
+        # (or was never on main) produce a base_commit that is a valid branch ancestor
+        # but not reachable from the current main lineage.
+        base_commit_in_main="false"
+        if [[ -n "${base_commit}" ]]; then
+            if git merge-base --is-ancestor "${base_commit}" \
+                    "refs/remotes/${REMOTE}/main" 2>/dev/null; then
+                base_commit_in_main="true"
+            else
+                echo "    NOTE: base_commit ${base_commit_short} not reachable from ${REMOTE}/main" >&2
+            fi
+        fi
+
+        # --- archived: true if last commit is older than one year ---
+        archived="false"
+        last_ts="$(git log -1 --format="%ct" "${ref}" 2>/dev/null)" || last_ts=0
+        if (( NOW - last_ts > ONE_YEAR_SECS )); then
+            archived="true"
+        fi
+
+        # --- Emit YAML entry ---
+        if [[ -n "${version_warn}" ]]; then
+            printf '%s\n' "${version_warn}"
+        fi
+        printf '  - package: %s\n'         "${pkg}"
+        printf '    branch: %s\n'          "${branch}"
+        printf '    base_version: "%s"\n'  "${base_version}"
+        if [[ -n "${base_commit_short}" ]]; then
+            if [[ "${base_commit_in_main}" == "false" ]]; then
+                printf '    base_commit: "%s"  # not in upstream/main; next commit is branch-exclusive\n' \
+                    "${base_commit_short}"
+            else
+                printf '    base_commit: "%s"\n'  "${base_commit_short}"
+            fi
+        else
+            printf '    base_commit: null  # WARN: could not determine\n'
+        fi
+        printf '    maintained_until: null\n'
+        printf '    archived: %s\n'        "${archived}"
+        printf '\n'
+
+    done < <(git for-each-ref --format='%(refname:short)' \
+        "refs/remotes/${REMOTE}/backport-*" \
+        | sed -E 's|^[^/]+/backport-([a-z_]+)-([0-9]+\.[0-9]+(\.[0-9]+)?)$|\1 \2 &|' \
+        | sort -k1,1 -k2,2Vr \
+        | awk '{print $NF}')
+
+} > "${OUTPUT}"
+
+echo "" >&2
+echo "Done. Written to ${OUTPUT}" >&2
+echo "" >&2
+echo "NEXT STEPS:" >&2
+echo "  1. Review ${OUTPUT} for WARN entries and fix them." >&2
+echo "  2. Fill in maintained_until for branches with known EOL dates." >&2
+echo "     Format: \"YYYY-MM-DD\"  (e.g. Elastic 8.19 EOL = 2027-01-15)" >&2
+echo "  3. Commit .backports.yml and this bootstrap script together." >&2
diff --git a/dev/scripts/get_release_commit.sh b/dev/scripts/get_release_commit.sh
new file mode 100755
index 00000000000..ac1c275ac71
--- /dev/null
+++ b/dev/scripts/get_release_commit.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Finds the commit on main where a package version was released.
+# Usage: ./get_release_commit.sh <package_name> <version>
+
+set -euo pipefail
+
+usage() {
+    echo "Usage: $0 -p <package_name> -v <version>" >&2
+    exit 1
+}
+
+PACKAGE_NAME=""
+VERSION=""
+
+while getopts ":p:v:h" opt; do
+    case "${opt}" in
+        p) PACKAGE_NAME="${OPTARG}" ;;
+        v) VERSION="${OPTARG}" ;;
+        h)
+            usage
+            exit 0
+            ;;
+        \?)
+            echo "Invalid option ${OPTARG}"
+            usage
+            exit 1
+            ;;
+        :)
+            echo "Missing argument for -${OPTARG}"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+if [[ -z "${PACKAGE_NAME}" || -z "${VERSION}" ]]; then
+    usage
+fi
+
+# Find the manifest.yml that declares the given package name.
+# Packages live at packages/<p>/ or packages/<folder>/<p>/ (one level of nesting).
+MANIFEST=""
+while IFS= read -r candidate; do
+    # name field must match exactly (allow optional quotes and trailing whitespace)
+    if grep -E "^name: ['\"]?${PACKAGE_NAME}['\"]?[[:space:]]*$" "$candidate" > /dev/null; then
+        MANIFEST="$candidate"
+        break
+    fi
+done < <(find packages -mindepth 2 -maxdepth 3 -name "manifest.yml")
+
+if [[ -z "$MANIFEST" ]]; then
+    echo "Error: package '${PACKAGE_NAME}' not found." >&2
+    exit 1
+fi
+
+# Use -G with an anchored regex so that versions like "9.3.8" are not confused
+# with "9.3.8-beta.2" (which -S would treat as the same string occurrence count).
+ESCAPED_VERSION="${VERSION//./\\.}"
+# mapfile requires bash 4+; macOS ships bash 3.2, so use a while-read loop instead.
+COMMITS=()
+while IFS= read -r line; do
+    [[ -n "$line" ]] && COMMITS+=("$line")
+done < <(
+    git log --oneline \
+        -G "^version: ['\"]?${ESCAPED_VERSION}['\"]?[[:space:]]*$" \
+        -- "$MANIFEST" \
+        | awk 'NF {print $1}' | sort -u
+)
+
+# Among matching commits, keep only those that *added* (not removed) the version.
+FOUND=""
+for COMMIT in "${COMMITS[@]}"; do
+    if git show "$COMMIT" -- "$MANIFEST" \
+            | grep -E "^\+version: ['\"]?${VERSION}['\"]?[[:space:]]*$" > /dev/null; then
+        FOUND="$COMMIT"
+        break
+    fi
+done
+
+if [[ -z "$FOUND" ]]; then
+    echo "Error: no commit found that released version '${VERSION}' of package '${PACKAGE_NAME}'." >&2
+    exit 1
+fi
+
+echo "$FOUND"
diff --git a/dev/scripts/test_get_release_commit.sh b/dev/scripts/test_get_release_commit.sh
new file mode 100755
index 00000000000..d9872114948
--- /dev/null
+++ b/dev/scripts/test_get_release_commit.sh
@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# Unit tests for get_release_commit.sh.
+# Run directly or via .buildkite/scripts/run_dev_scripts_tests.sh.
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+SCRIPT="${REPO_ROOT}/dev/scripts/get_release_commit.sh"
+
+source "${REPO_ROOT}/.buildkite/scripts/test_helpers.sh"
+
+pass=0
+fail=0
+
+# ---------------------------------------------------------------------------
+# Helpers: set up / tear down a minimal git repo with two package layouts.
+#
+# Creates:
+#   packages/flat_pkg/manifest.yml            (flat:   packages/<pkg>/, unquoted version)
+#   packages/group/nested_pkg/manifest.yml    (nested: packages/<group>/<pkg>/)
+#   packages/quoted_pkg/manifest.yml          (flat, version string in quotes)
+#   packages/beta_pkg/manifest.yml            (flat, version promoted from beta)
+# Each package gets multiple commits so tests can verify the script finds the
+# right commit, not just the latest. Commit hashes are stored in .state/.
+# ---------------------------------------------------------------------------
+
+DUMMY_REPO=""
+
+cleanup() {
+    [[ -n "${DUMMY_REPO}" ]] && rm -rf "${DUMMY_REPO}"
+}
+trap cleanup EXIT
+
+setup_dummy_repo() {
+    local tmpdir
+    tmpdir="$(mktemp -d)"
+    git -C "${tmpdir}" init -q
+    git -C "${tmpdir}" config user.email "test@test.com"
+    git -C "${tmpdir}" config user.name "Test"
+
+    mkdir -p "${tmpdir}/packages/flat_pkg"
+    printf 'name: flat_pkg\nversion: 1.0.0\n' > "${tmpdir}/packages/flat_pkg/manifest.yml"
+    git -C "${tmpdir}" add .
+    git -C "${tmpdir}" commit -q -m "Release flat_pkg 1.0.0"
+    mkdir -p "${tmpdir}/.state"
+    git -C "${tmpdir}" rev-parse --short HEAD > "${tmpdir}/.state/flat_pkg_1.0.0"
+
+    printf 'name: flat_pkg\nversion: 1.1.0\n' > "${tmpdir}/packages/flat_pkg/manifest.yml"
+    git -C "${tmpdir}" add .
+    git -C "${tmpdir}" commit -q -m "Release flat_pkg 1.1.0"
+
+    mkdir -p "${tmpdir}/packages/group/nested_pkg"
+    printf 'name: nested_pkg\nversion: 2.0.0\n' > "${tmpdir}/packages/group/nested_pkg/manifest.yml"
+    git -C "${tmpdir}" add .
+    git -C "${tmpdir}" commit -q -m "Release nested_pkg 2.0.0"
+    git -C "${tmpdir}" rev-parse --short HEAD > "${tmpdir}/.state/nested_pkg_2.0.0"
+
+    printf 'name: nested_pkg\nversion: 2.1.0\n' > "${tmpdir}/packages/group/nested_pkg/manifest.yml"
+    git -C "${tmpdir}" add .
+    git -C "${tmpdir}" commit -q -m "Release nested_pkg 2.1.0"
+
+    mkdir -p "${tmpdir}/packages/quoted_pkg"
+    printf 'name: quoted_pkg\nversion: "1.0.0"\n' > "${tmpdir}/packages/quoted_pkg/manifest.yml"
+    git -C "${tmpdir}" add .
+    git -C "${tmpdir}" commit -q -m "Release quoted_pkg 1.0.0"
+    git -C "${tmpdir}" rev-parse --short HEAD > "${tmpdir}/.state/quoted_pkg_1.0.0"
+
+    printf 'name: quoted_pkg\nversion: "1.1.0"\n' > "${tmpdir}/packages/quoted_pkg/manifest.yml"
+    git -C "${tmpdir}" add .
+    git -C "${tmpdir}" commit -q -m "Release quoted_pkg 1.1.0"
+
+    mkdir -p "${tmpdir}/packages/beta_pkg"
+    printf 'name: beta_pkg\nversion: 3.0.0-beta.1\n' > "${tmpdir}/packages/beta_pkg/manifest.yml"
+    git -C "${tmpdir}" add .
+    git -C "${tmpdir}" commit -q -m "Release beta_pkg 3.0.0-beta.1"
+
+    printf 'name: beta_pkg\nversion: 3.0.0\n' > "${tmpdir}/packages/beta_pkg/manifest.yml"
+    git -C "${tmpdir}" add .
+    git -C "${tmpdir}" commit -q -m "Release beta_pkg 3.0.0"
+    git -C "${tmpdir}" rev-parse --short HEAD > "${tmpdir}/.state/beta_pkg_3.0.0"
+
+    echo "${tmpdir}"
+}
+
+# ---------------------------------------------------------------------------
+# Tests: flag validation (no package lookup; agnostic of packages on disk)
+# ---------------------------------------------------------------------------
+echo "--- get_release_commit.sh tests"
+
+# Missing -p flag
+exit_code=0
+"${SCRIPT}" -v 1.0.0 > /dev/null 2>&1 || exit_code=$?
+assert_exit_code "exits non-zero when -p is missing" "1" "${exit_code}"
+
+# Missing -v flag
+exit_code=0
+"${SCRIPT}" -p any_pkg > /dev/null 2>&1 || exit_code=$?
+assert_exit_code "exits non-zero when -v is missing" "1" "${exit_code}"
+
+# Invalid flag
+exit_code=0
+"${SCRIPT}" -z > /dev/null 2>&1 || exit_code=$?
+assert_exit_code "exits non-zero for invalid flag" "1" "${exit_code}"
+
+# ---------------------------------------------------------------------------
+# Tests: against dummy repo (isolated from real history)
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- get_release_commit.sh tests (dummy repo)"
+
+DUMMY_REPO="$(setup_dummy_repo)"
+DUMMY_FLAT_COMMIT="$(cat "${DUMMY_REPO}/.state/flat_pkg_1.0.0")"
+DUMMY_NESTED_COMMIT="$(cat "${DUMMY_REPO}/.state/nested_pkg_2.0.0")"
+DUMMY_QUOTED_COMMIT="$(cat "${DUMMY_REPO}/.state/quoted_pkg_1.0.0")"
+DUMMY_BETA_COMMIT="$(cat "${DUMMY_REPO}/.state/beta_pkg_3.0.0")"
+
+# Flat layout: packages/<pkg>/ — queries v1.0.0, not the latest v1.1.0
+result="$(cd "${DUMMY_REPO}" && "${SCRIPT}" -p flat_pkg -v 1.0.0)"
+assert_equals "finds correct commit for packages/<p>/ (not the latest)" "${DUMMY_FLAT_COMMIT}" "${result}"
+
+# Nested layout: packages/<group>/<pkg>/ — queries v2.0.0, not the latest v2.1.0
+result="$(cd "${DUMMY_REPO}" && "${SCRIPT}" -p nested_pkg -v 2.0.0)"
+assert_equals "finds correct commit for packages/<group>/<p>/ (not the latest)" "${DUMMY_NESTED_COMMIT}" "${result}"
+
+# Quoted version in manifest (version: "1.0.0") — queries v1.0.0, not the latest v1.1.0
+result="$(cd "${DUMMY_REPO}" && "${SCRIPT}" -p quoted_pkg -v 1.0.0)"
+assert_equals "finds correct commit for package with quoted version in manifest" "${DUMMY_QUOTED_COMMIT}" "${result}"
+
+# Version promoted from beta (3.0.0-beta.1 → 3.0.0)
+result="$(cd "${DUMMY_REPO}" && "${SCRIPT}" -p beta_pkg -v 3.0.0)"
+assert_equals "finds commit for version promoted from beta" "${DUMMY_BETA_COMMIT}" "${result}"
+
+# Unknown package
+exit_code=0
+(cd "${DUMMY_REPO}" && "${SCRIPT}" -p no_such_package -v 1.0.0) > /dev/null 2>&1 || exit_code=$?
+assert_exit_code "exits non-zero for unknown package" "1" "${exit_code}"
+
+# Unknown version
+exit_code=0
+(cd "${DUMMY_REPO}" && "${SCRIPT}" -p flat_pkg -v 9.99.99) > /dev/null 2>&1 || exit_code=$?
+assert_exit_code "exits non-zero for unknown version" "1" "${exit_code}"
+
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Results: ${pass} passed, ${fail} failed"
+if [[ "${fail}" -gt 0 ]]; then
+    exit 1
+fi
diff --git a/dev/testsreporter/github.go b/dev/testsreporter/github.go
index ca548104adb..dfa11d274db 100644
--- a/dev/testsreporter/github.go
+++ b/dev/testsreporter/github.go
@@ -35,7 +35,7 @@ func (g *ghRunner) Exec(ctx context.Context, args ...string) (stdout, stdErr byt
 	log.Printf("Running command: %s", strings.Join(args[:4], " "))
 	if g.DryRun {
 		if args[0] != "issue" || args[1] != "list" {
-			log.Printf("DRY-RUN> not run command")
+			log.Printf("DRY-RUN> command not run")
 			return bytes.Buffer{}, bytes.Buffer{}, nil
 		}
 	}
diff --git a/dev/testsreporter/testsreporter.go b/dev/testsreporter/testsreporter.go
index aec29d7b52b..58e744c8acd 100644
--- a/dev/testsreporter/testsreporter.go
+++ b/dev/testsreporter/testsreporter.go
@@ -58,7 +58,7 @@ func Check(ctx context.Context, resultsPath string, options CheckOptions) error
 	})
 
 	if len(packageErrors) > options.MaxTestsReported {
-		fmt.Printf("Skip creating GitHub issues, hit the maximum number (%d) of tests to be reported. Total failing tests: %d.\n", options.MaxTestsReported, len(packageErrors))
+		fmt.Printf("Skip creating GitHub issues, hit the maximum number (%d) of tests to report. Total failing tests: %d.\n", options.MaxTestsReported, len(packageErrors))
 		packages, err := packagesFromTests(resultsPath)
 		if err != nil {
 			return fmt.Errorf("failed to get packages from results files: %w", err)
diff --git a/magefile.go b/magefile.go
index eee66a585d1..46f9d3a77cb 100644
--- a/magefile.go
+++ b/magefile.go
@@ -8,20 +8,32 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
+	"time"
 
 	"github.com/Masterminds/semver/v3"
 	"github.com/magefile/mage/mg"
 	"github.com/magefile/mage/sh"
 	"github.com/pkg/errors"
 
+	"github.com/elastic/integrations/dev/backports"
+	"github.com/elastic/integrations/dev/backports/apply"
+	"github.com/elastic/integrations/dev/backports/changelog"
+	bpchecklist "github.com/elastic/integrations/dev/backports/checklist"
+	bpowners "github.com/elastic/integrations/dev/backports/owners"
+	bppackages "github.com/elastic/integrations/dev/backports/packages"
 	"github.com/elastic/integrations/dev/citools"
 	"github.com/elastic/integrations/dev/codeowners"
 	"github.com/elastic/integrations/dev/coverage"
+	"github.com/elastic/integrations/dev/gitutil"
+	"github.com/elastic/integrations/dev/packagenames"
+	"github.com/elastic/integrations/dev/requiresupdate"
 	"github.com/elastic/integrations/dev/testsreporter"
 )
 
@@ -48,6 +60,7 @@ func Check() error {
 	mg.Deps(ModTidy)
 	mg.Deps(goTest)
 	mg.Deps(codeowners.Check)
+	mg.Deps(packagenames.Check)
 	return nil
 }
 
@@ -164,7 +177,7 @@ func ReportFailedTests(ctx context.Context, testResultsFolder string) error {
 	if serverlessEnv != "" {
 		var err error
 		serverless, err = strconv.ParseBool(serverlessEnv)
-		if err != err {
+		if err != nil {
 			return fmt.Errorf("failed to parse SERVERLESS value: %w", err)
 		}
 		if serverlessProjectEnv == "" {
@@ -188,7 +201,7 @@ func ReportFailedTests(ctx context.Context, testResultsFolder string) error {
 		var err error
 		maxIssues, err = strconv.Atoi(maxIssuesString)
 		if err != nil {
-			return fmt.Errorf("failed to convert to int env. variable CI_MAX_TESTS_REPORTED %s: %w", maxIssuesString, err)
+			return fmt.Errorf("failed to convert env. variable CI_MAX_TESTS_REPORTED to int (%s): %w", maxIssuesString, err)
 		}
 	}
 
@@ -196,7 +209,7 @@ func ReportFailedTests(ctx context.Context, testResultsFolder string) error {
 	if dryRunEnv != "" {
 		var err error
 		dryRun, err = strconv.ParseBool(dryRunEnv)
-		if err != err {
+		if err != nil {
 			return fmt.Errorf("failed to parse DRY_RUN value: %w", err)
 		}
 	}
@@ -216,6 +229,34 @@ func ReportFailedTests(ctx context.Context, testResultsFolder string) error {
 	return testsreporter.Check(ctx, testResultsFolder, options)
 }
 
+// ValidateBackportsInventory validates the schema of .backports.yml at the repo root.
+func ValidateBackportsInventory() error {
+	return backports.ValidateInventory(".backports.yml", "packages")
+}
+
+// ValidateBackportBranchName checks that the given branch name is valid for the given package.
+// The branch must match backport-<package>-<suffix> and start with "backport-<packageName>-".
+func ValidateBackportBranchName(packageName, branch string) error {
+	if err := backports.ValidateBranchName(packageName, branch); err != nil {
+		return err
+	}
+	fmt.Printf("Branch name %q is valid for package %q.\n", branch, packageName)
+	return nil
+}
+
+// ListPackages lists all packages found under the packages directory.
+func ListPackages() error {
+	const packagesDir = "packages"
+	packages, err := citools.ListPackages(packagesDir)
+	if err != nil {
+		return fmt.Errorf("failed to list packages: %w", err)
+	}
+	for _, p := range packages {
+		fmt.Println(p)
+	}
+	return nil
+}
+
 // IsSubscriptionCompatible checks whether or not the package in the current directory allows to run with the given subscription (ELASTIC_SUBSCRIPTION env var).
 func IsSubscriptionCompatible() error {
 	subscription := os.Getenv("ELASTIC_SUBSCRIPTION")
@@ -240,7 +281,7 @@ func IsSubscriptionCompatible() error {
 func KibanaConstraintPackage() error {
 	constraint, err := citools.KibanaConstraintPackage("manifest.yml")
 	if err != nil {
-		return fmt.Errorf("faile")
+		return fmt.Errorf("failed to get Kibana constraint: %w", err)
 	}
 	if constraint == nil {
 		fmt.Println("null")
@@ -299,6 +340,240 @@ func IsVersionLessThanLogsDBGA(version string) error {
 	return nil
 }
 
+// AddBackportEntry adds a new entry to .backports.yml for the given package and
+// base version. The branch name is derived as backport-<package>-<major>.<minor>,
+// archived is set to false, and maintained_until to null. The base commit is
+// resolved via dev/scripts/get_release_commit.sh. The entry is inserted in
+// sorted order (by package name ascending, then by version descending — newest first).
+func AddBackportEntry(packageName, baseVersion string) error {
+	baseCommit, err := sh.Output("bash", "dev/scripts/get_release_commit.sh", "-p", packageName, "-v", baseVersion)
+	if err != nil {
+		return fmt.Errorf("resolving base commit for %s@%s: %w", packageName, baseVersion, err)
+	}
+	commit := strings.TrimSpace(baseCommit)
+	branch, err := backports.AddEntry(".backports.yml", packageName, baseVersion, commit, "packages")
+	if err != nil {
+		return err
+	}
+	fmt.Printf("Added: branch=%s base_commit=%s\n", branch, commit)
+	fmt.Printf("Tip: if you need a custom branch name, edit the 'branch' field in .backports.yml before opening the PR (must start with \"backport-%s-\").\n", packageName)
+	return nil
+}
+
+// CheckBackportBranchActive reports whether a backport branch is active per .backports.yml.
+// Prints "<branch>: active" or "<branch>: inactive (<reason>)".
+// Pass -json for JSON output: mage CheckBackportBranchActive <branch> -json
+// Exit codes: 0 = active, 1 = inactive, 2 = error (branch not found, parse error, etc.).
+func CheckBackportBranchActive(branch string, asJSON *bool) error {
+	result, err := backports.CheckActive(".backports.yml", branch, time.Now().UTC())
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(2)
+	}
+
+	if asJSON != nil && *asJSON {
+		data, _ := json.Marshal(result)
+		fmt.Println(string(data))
+	} else {
+		if result.Active {
+			fmt.Printf("%s: active\n", branch)
+		} else {
+			reason := "archived"
+			if !result.Archived && result.MaintainedUntil != nil {
+				reason = fmt.Sprintf("maintained_until=%s is past", *result.MaintainedUntil)
+			}
+			fmt.Printf("%s: inactive (%s)\n", branch, reason)
+		}
+	}
+
+	if !result.Active {
+		os.Exit(1)
+	}
+	return nil
+}
+
+// diffPackages runs git diff --name-only before..after and maps the changed
+// files to package names. Shared by DetectBackportPackages and
+// CheckBackportOwners so the diff-to-package logic lives in one place.
+func diffPackages(before, after string) ([]string, error) {
+	out, err := sh.Output("git", "diff", "--name-only", before+".."+after)
+	if err != nil {
+		return nil, fmt.Errorf("running git diff: %w", err)
+	}
+	var files []string
+	for _, line := range strings.Split(out, "\n") {
+		if line = strings.TrimSpace(line); line != "" {
+			files = append(files, line)
+		}
+	}
+	return bppackages.DetectPackages(files, "packages")
+}
+
+// DetectBackportPackages lists the packages touched by commits between before and after.
+// Runs git diff --name-only before..after and maps the changed files to package names
+// using the packages/ directory as the root.
+// Plain output: one package name per line. Pass -asJSON for a JSON array.
+func DetectBackportPackages(before, after string, asJSON *bool) error {
+	pkgs, err := diffPackages(before, after)
+	if err != nil {
+		return err
+	}
+
+	if asJSON != nil && *asJSON {
+		data, err := json.Marshal(pkgs)
+		if err != nil {
+			return fmt.Errorf("marshalling packages: %w", err)
+		}
+		fmt.Println(string(data))
+	} else {
+		for _, p := range pkgs {
+			fmt.Println(p)
+		}
+	}
+	return nil
+}
+
+// CheckBackportOwners reports package owner mismatches between the current
+// worktree and remote/sourceBranch (the ownership source of truth, normally
+// "main"), for every package changed between before and after — before..after,
+// following DetectBackportPackages's convention: before is normally the PR's
+// merge-base with sourceBranch, after is the PR's own commit.
+// Prints a JSON array to stdout; see check_backport_owners.sh's
+// build_owner_check_comment for the exact shape it expects. A package fully
+// in sync, or no longer present on sourceBranch, is omitted entirely.
+func CheckBackportOwners(remote, sourceBranch, before, after string) error {
+	if err := sh.Run("git", "fetch", remote, sourceBranch); err != nil {
+		return fmt.Errorf("fetching %s: %w", sourceBranch, err)
+	}
+	remoteRef := remote + "/" + sourceBranch
+
+	pkgs, err := diffPackages(before, after)
+	if err != nil {
+		return fmt.Errorf("detecting packages: %w", err)
+	}
+
+	pkgIndex, err := changelog.BuildPackageIndex("packages")
+	if err != nil {
+		return fmt.Errorf("building package index: %w", err)
+	}
+
+	mismatches := bpowners.CheckPackages(gitutil.Git{}, "", remoteRef, pkgs, pkgIndex)
+
+	type mismatchJSON struct {
+		Package string   `json:"package"`
+		Teams   []string `json:"teams,omitempty"`
+		Error   string   `json:"error,omitempty"`
+	}
+	results := make([]mismatchJSON, 0, len(mismatches))
+	for _, m := range mismatches {
+		entry := mismatchJSON{Package: m.Package, Teams: m.Teams}
+		if m.Err != nil {
+			entry.Error = m.Err.Error()
+		}
+		results = append(results, entry)
+	}
+
+	data, err := json.Marshal(results)
+	if err != nil {
+		return fmt.Errorf("marshalling results: %w", err)
+	}
+	fmt.Println(string(data))
+	return nil
+}
+
+// RenderBackportChecklist prints the backport-checklist comment body for a PR.
+// It reads the list of packages from artifactPath (a JSON file with shape
+// {"pr_number": N, "packages": [...]}) and the existing comment body (if any) from
+// stdin. Active branches for each package are looked up in .backports.yml using the
+// current UTC time. Previously checked boxes are preserved: any branch that appeared
+// as "- [x] `branch`" in the existing body is rendered ticked in the new body.
+// Prints nothing when no package has any active branch; callers should skip posting.
+func RenderBackportChecklist(artifactPath string) error {
+	data, err := os.ReadFile(artifactPath)
+	if err != nil {
+		return fmt.Errorf("reading artifact: %w", err)
+	}
+
+	var artifact struct {
+		Packages []string `json:"packages"`
+	}
+	if err := json.Unmarshal(data, &artifact); err != nil {
+		return fmt.Errorf("parsing artifact: %w", err)
+	}
+
+	existingBody, err := io.ReadAll(os.Stdin)
+	if err != nil {
+		return fmt.Errorf("reading stdin: %w", err)
+	}
+
+	checked := bpchecklist.ParseCheckedBranches(string(existingBody))
+
+	skipPkgs, err := backports.ListSkipChecklistPackages(".backports.yml")
+	if err != nil {
+		return fmt.Errorf("loading skip checklist packages: %w", err)
+	}
+	skipSet := make(map[string]struct{}, len(skipPkgs))
+	for _, p := range skipPkgs {
+		skipSet[p] = struct{}{}
+	}
+
+	checklistPkgs := make([]string, 0, len(artifact.Packages))
+	for _, pkg := range artifact.Packages {
+		if _, skip := skipSet[pkg]; !skip {
+			checklistPkgs = append(checklistPkgs, pkg)
+		}
+	}
+
+	branchesByPkg, err := backports.ListAllActiveBackportBranches(".backports.yml", checklistPkgs, time.Now().UTC())
+	if err != nil {
+		return fmt.Errorf("listing active backport branches: %w", err)
+	}
+
+	pkgs := make([]bpchecklist.PackageBranches, 0, len(checklistPkgs))
+	for _, pkg := range checklistPkgs {
+		pkgs = append(pkgs, bpchecklist.PackageBranches{
+			Package:  pkg,
+			Branches: branchesByPkg[pkg],
+		})
+	}
+
+	body := bpchecklist.BuildComment(pkgs, checked)
+	if body != "" {
+		fmt.Print(body)
+	}
+	return nil
+}
+
+// ParseBackportChecklist reads a checklist comment body from bodyFile and prints
+// a JSON array of ChecklistItem to stdout. Used by auto-backport.yml to enumerate
+// which branches need backport PRs created.
+func ParseBackportChecklist(bodyFile string) error {
+	data, err := os.ReadFile(bodyFile)
+	if err != nil {
+		return fmt.Errorf("reading body file: %w", err)
+	}
+	items := bpchecklist.ParseChecklistItems(string(data))
+	out, err := json.Marshal(items)
+	if err != nil {
+		return fmt.Errorf("marshalling checklist items: %w", err)
+	}
+	fmt.Println(string(out))
+	return nil
+}
+
+// UpdateChecklistBranchStatus reads a checklist comment body from bodyFile, appends
+// the given status to the line for branch, and prints the updated body to stdout.
+// If the line already carries a ✅ or ⚠️ suffix the body is printed unchanged.
+// Used by auto-backport.yml to mark each branch after its PR is processed.
+func UpdateChecklistBranchStatus(bodyFile, branch, status string) error {
+	data, err := os.ReadFile(bodyFile)
+	if err != nil {
+		return fmt.Errorf("reading body file: %w", err)
+	}
+	fmt.Print(bpchecklist.UpdateBranchStatus(string(data), branch, status))
+	return nil
+}
+
 // IsElasticPackageDependencyLessThan checks whether or not the elastic-package version set in go.mod is less than the given version
 func IsElasticPackageDependencyLessThan(version string) error {
 	foundVersion, err := citools.PackageVersionGoMod("go.mod", elasticPackageModulePath)
@@ -320,3 +595,205 @@ func IsElasticPackageDependencyLessThan(version string) error {
 	fmt.Println(value)
 	return nil
 }
+
+// SyncBackportChangelog collects changelog entries introduced by a backport push
+// and creates a sync PR targeting main. Outputs are written to $GITHUB_OUTPUT for
+// use by the PostBackportComment step.
+//
+// Required env vars: BEFORE, AFTER, REPOSITORY, BACKPORT_BRANCH.
+// Optional env vars: PACKAGES_DIR (defaults to "packages").
+// CheckChangelogVersionsInMain verifies that changelog versions introduced in the
+// current PR do not already exist in origin/main. It exits non-zero when any
+// conflict is found. Intended to run on PRs targeting backport-* branches.
+//
+// baseBranch is the PR's target branch (e.g. "backport-aws-1.x"); only changes
+// relative to that branch are examined, not the full backport history.
+func CheckChangelogVersionsInMain(baseBranch string) error {
+	if baseBranch == "" {
+		return fmt.Errorf("baseBranch is required")
+	}
+	before := "origin/" + baseBranch
+
+	git := gitutil.Git{}
+	conflicts, err := changelog.CheckVersionsAgainstMain(git, before, "HEAD")
+	if err != nil {
+		return err
+	}
+	if len(conflicts) > 0 {
+		fmt.Fprintln(os.Stderr, "ERROR: the following changelog versions are already present in main:")
+		for _, c := range conflicts {
+			fmt.Fprintf(os.Stderr, "  - %s\n", c)
+		}
+		return fmt.Errorf("found %d changelog version(s) already in main", len(conflicts))
+	}
+	fmt.Println("All changelog versions are new — no conflicts with main.")
+	return nil
+}
+
+func SyncBackportChangelog() error {
+	before := os.Getenv("BEFORE")
+	after := os.Getenv("AFTER")
+	repository := os.Getenv("REPOSITORY")
+	backportBranch := os.Getenv("BACKPORT_BRANCH")
+	if before == "" || after == "" || repository == "" || backportBranch == "" {
+		return fmt.Errorf("BEFORE, AFTER, REPOSITORY, and BACKPORT_BRANCH must be set")
+	}
+	packagesDir := os.Getenv("PACKAGES_DIR")
+	if packagesDir == "" {
+		packagesDir = "packages"
+	}
+
+	collectResult, err := changelog.Collect(before, after, repository)
+	if err != nil {
+		return err
+	}
+
+	if !collectResult.HasChanges {
+		return writeGitHubOutputs(map[string]string{
+			"backport_pr_number": collectResult.BackportPRNumber,
+			"working_branch":     collectResult.WorkingBranch,
+			"not_found_packages": "",
+			"create_outcome":     "skipped",
+		})
+	}
+
+	syncResult, err := changelog.CreateSyncPR(
+		"",
+		collectResult.EntriesTSV,
+		collectResult.WorkingBranch,
+		collectResult.BackportPRNumber,
+		backportBranch,
+		packagesDir,
+		repository,
+	)
+	if err != nil {
+		return err
+	}
+	return writeGitHubOutputs(map[string]string{
+		"backport_pr_number": collectResult.BackportPRNumber,
+		"working_branch":     collectResult.WorkingBranch,
+		"not_found_packages": strings.Join(syncResult.NotFoundPackages, ","),
+		"create_outcome":     syncResult.Outcome,
+	})
+}
+
+// PostBackportComment posts a result comment on the originating backport PR.
+//
+// Required env vars: BACKPORT_PR_NUMBER, WORKING_BRANCH, REPOSITORY.
+// Optional env vars: NOT_FOUND_PACKAGES, CREATE_OUTCOME, RUN_ID.
+func PostBackportComment() error {
+	backportPRNumber := os.Getenv("BACKPORT_PR_NUMBER")
+	workingBranch := os.Getenv("WORKING_BRANCH")
+	repository := os.Getenv("REPOSITORY")
+	if repository == "" {
+		return fmt.Errorf("REPOSITORY must be set")
+	}
+	return changelog.PostComment(
+		backportPRNumber,
+		workingBranch,
+		os.Getenv("NOT_FOUND_PACKAGES"),
+		os.Getenv("CREATE_OUTCOME"),
+		os.Getenv("RUN_ID"),
+		repository,
+	)
+}
+
+// ApplyBackport cherry-picks a fix commit onto a backport branch, bumps the patch
+// version, writes a correct changelog entry, and optionally opens a PR.
+//
+// Usage: mage ApplyBackport <sha> <package> <target> [-openPR] [-asJSON] [-dryRun] \
+//
+//	[-remote=<remote>] [-repository=<org/repo>] [-packagesDir=<path>]
+//
+// sha, pkg, target are required. All remaining parameters are optional (nil = unset).
+// All optional flags use -name=value format on the command line.
+func ApplyBackport(sha, pkg, target string, openPR, asJSON, dryRun *bool, remote, repository, packagesDir *string) error {
+	opts := apply.Options{
+		SHA:         sha,
+		Package:     pkg,
+		Target:      target,
+		OpenPR:      openPR != nil && *openPR,
+		AsJSON:      asJSON != nil && *asJSON,
+		DryRun:      dryRun != nil && *dryRun,
+		Remote:      deref(remote),
+		Repository:  deref(repository),
+		PackagesDir: deref(packagesDir),
+	}
+
+	result, err := apply.Apply(opts)
+	if err != nil {
+		return err
+	}
+
+	if opts.AsJSON {
+		data, err := json.Marshal(result)
+		if err != nil {
+			return fmt.Errorf("marshalling result: %w", err)
+		}
+		fmt.Println(string(data))
+		if result.Status == "conflict" {
+			return fmt.Errorf("cherry-pick conflict on %s", strings.Join(result.ConflictingFiles, ", "))
+		}
+	} else if result.Status == "conflict" {
+		fmt.Fprintf(os.Stderr, "conflict: cherry-pick of %s onto %s failed\n", result.SHA, result.TargetBranch)
+		fmt.Fprintf(os.Stderr, "conflicting files:\n")
+		for _, f := range result.ConflictingFiles {
+			fmt.Fprintf(os.Stderr, "  %s\n", f)
+		}
+		fmt.Fprintf(os.Stderr, "suggested command: %s\n", result.SuggestedCommand)
+		return fmt.Errorf("cherry-pick conflict on %s", strings.Join(result.ConflictingFiles, ", "))
+	} else if result.WorkingBranch != "" {
+		fmt.Printf("dry run: branch %q created locally with version %s — review with: git checkout %s\n",
+			result.WorkingBranch, result.NewVersion, result.WorkingBranch)
+	} else {
+		fmt.Printf("backport success: %s %s", result.TargetBranch, result.NewVersion)
+		if result.PRURL != "" {
+			fmt.Printf(", PR: %s", result.PRURL)
+		}
+		fmt.Println()
+	}
+	return nil
+}
+
+// deref returns the string pointed to by s, or "" if s is nil.
+func deref(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
+
+// writeGitHubOutputs appends key=value pairs to the file named by $GITHUB_OUTPUT.
+func writeGitHubOutputs(outputs map[string]string) error {
+	outputFile := os.Getenv("GITHUB_OUTPUT")
+	if outputFile == "" {
+		for k, v := range outputs {
+			fmt.Printf("%s=%s\n", k, v)
+		}
+		return nil
+	}
+	f, err := os.OpenFile(outputFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
+	if err != nil {
+		return fmt.Errorf("opening GITHUB_OUTPUT: %w", err)
+	}
+	defer f.Close()
+	for k, v := range outputs {
+		if _, err := fmt.Fprintf(f, "%s=%s\n", k, v); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// RequiresUpdate updates required package versions for all integration packages,
+// adds a changelog entry per modified package, and opens one PR (or issue) per
+// package.
+//
+// Usage: mage RequiresUpdate [-dryRun] [-preview]
+//
+// Pass -dryRun to preview proposals without applying changes (also skips
+// publishing, since no files would be written); pass -preview to print what
+// would be published without touching git or GitHub.
+func RequiresUpdate(dryRun, preview *bool) error {
+	return requiresupdate.Run(dryRun != nil && *dryRun, preview != nil && *preview)
+}