diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 0709e319059..1ded6908a18 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-23975a577f6d405769e87726ba642ca7e3761230
+b98431224ef98fdd8186cc01c064708e4bceb419
diff --git a/app/assets/stylesheets/framework/typography.scss b/app/assets/stylesheets/framework/typography.scss
index 7e160fce1ce..1a6fb56e777 100644
--- a/app/assets/stylesheets/framework/typography.scss
+++ b/app/assets/stylesheets/framework/typography.scss
@@ -41,6 +41,9 @@
 
   img {
     max-width: 100%;
+  }
+
+  img[width][height] {
     object-fit: contain;
     object-position: top;
     height: auto;
diff --git a/app/controllers/groups/dependency_proxies_controller.rb b/app/controllers/groups/dependency_proxies_controller.rb
index 8e134529c34..7b174cd2053 100644
--- a/app/controllers/groups/dependency_proxies_controller.rb
+++ b/app/controllers/groups/dependency_proxies_controller.rb
@@ -6,7 +6,7 @@ module Groups
 
     before_action :verify_dependency_proxy_enabled!
 
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
     urgency :low
 
     private
diff --git a/app/controllers/groups/dependency_proxy_auth_controller.rb b/app/controllers/groups/dependency_proxy_auth_controller.rb
index 03579d62ba9..30d6508458e 100644
--- a/app/controllers/groups/dependency_proxy_auth_controller.rb
+++ b/app/controllers/groups/dependency_proxy_auth_controller.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class Groups::DependencyProxyAuthController < ::Groups::DependencyProxy::ApplicationController
-  feature_category :dependency_proxy
+  feature_category :virtual_registry
   urgency :low
 
   def authenticate
diff --git a/app/controllers/groups/dependency_proxy_for_containers_controller.rb b/app/controllers/groups/dependency_proxy_for_containers_controller.rb
index 4dc2802916b..48a1b9d3c54 100644
--- a/app/controllers/groups/dependency_proxy_for_containers_controller.rb
+++ b/app/controllers/groups/dependency_proxy_for_containers_controller.rb
@@ -15,7 +15,7 @@ class Groups::DependencyProxyForContainersController < ::Groups::DependencyProxy
 
   attr_reader :token
 
-  feature_category :dependency_proxy
+  feature_category :virtual_registry
   urgency :low
 
   def manifest
diff --git a/app/finders/concerns/finder_with_group_hierarchy.rb b/app/finders/concerns/finder_with_group_hierarchy.rb
index 99b58fa6954..96d3eca935e 100644
--- a/app/finders/concerns/finder_with_group_hierarchy.rb
+++ b/app/finders/concerns/finder_with_group_hierarchy.rb
@@ -75,6 +75,11 @@ module FinderWithGroupHierarchy
   end
 
   def preload_associations(groups)
+    ActiveRecord::Associations::Preloader.new(
+      records: groups,
+      associations: [:organization]
+    ).call
+
     Preloaders::UserMaxAccessLevelInGroupsPreloader.new(groups, current_user).execute
   end
 end
diff --git a/app/models/group.rb b/app/models/group.rb
index b3c408d3bea..43f2198561b 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -729,7 +729,7 @@ class Group < Namespace
 
     unless only_concrete_membership
       return GroupMember::OWNER if user.can_admin_all_resources?
-      return GroupMember::OWNER if user.can_admin_organization?(organization_id)
+      return GroupMember::OWNER if user.can_admin_organization?(organization)
     end
 
     max_member_access(user)
diff --git a/app/models/preloaders/group_policy_preloader.rb b/app/models/preloaders/group_policy_preloader.rb
index 23632a9b6c2..c52e49408c5 100644
--- a/app/models/preloaders/group_policy_preloader.rb
+++ b/app/models/preloaders/group_policy_preloader.rb
@@ -8,6 +8,11 @@ module Preloaders
     end
 
     def execute
+      ActiveRecord::Associations::Preloader.new(
+        records: groups,
+        associations: [:organization]
+      ).call
+
       Preloaders::UserMaxAccessLevelInGroupsPreloader.new(groups, current_user).execute
     end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index edb70215443..aef0a3af7c4 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -2145,7 +2145,7 @@ class User < MainClusterwide::ApplicationRecord
   end
 
   def can_admin_organization?(organization)
-    owns_organization?(organization)
+    can?(:admin_organization, organization)
   end
 
   def update_two_factor_requirement
diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb
index c9a7af3052a..5d626aaba35 100644
--- a/app/policies/group_policy.rb
+++ b/app/policies/group_policy.rb
@@ -34,13 +34,11 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
 
   desc "User owns the group's organization"
   condition(:organization_owner) do
-    if @user.is_a?(User)
-      @user.owns_organization?(@subject.organization_id)
-    else
-      false
-    end
+    owns_group_organization?
   end
 
+  rule { admin | organization_owner }.enable :admin_organization
+
   with_options scope: :subject, score: 0
   condition(:request_access_enabled) { @subject.request_access_enabled }
 
@@ -456,6 +454,21 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
   def valid_dependency_proxy_deploy_token
     @user.is_a?(DeployToken) && @user&.valid_for_dependency_proxy? && @user&.has_access_to_group?(@subject)
   end
+
+  # rubocop:disable Cop/UserAdmin -- specifically check the admin attribute
+  def owns_group_organization?
+    return false unless @user
+    return false unless user_is_user?
+    return false unless @subject.organization
+    # Ensure admins can't bypass admin mode.
+    return false if @user.admin? && !can?(:admin)
+
+    # Load the owners with a single query.
+    @subject.organization
+            .owner_user_ids
+            .include?(@user.id)
+  end
+  # rubocop:enable Cop/UserAdmin
 end
 
 GroupPolicy.prepend_mod_with('GroupPolicy')
diff --git a/app/workers/all_queues.yml b/app/workers/all_queues.yml
index 1963e60fd0c..50171d0834f 100644
--- a/app/workers/all_queues.yml
+++ b/app/workers/all_queues.yml
@@ -464,7 +464,7 @@
   :tags: []
 - :name: cronjob:dependency_proxy_cleanup_dependency_proxy
   :worker_name: DependencyProxy::CleanupDependencyProxyWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown
@@ -473,7 +473,7 @@
   :tags: []
 - :name: cronjob:dependency_proxy_image_ttl_group_policy
   :worker_name: DependencyProxy::ImageTtlGroupPolicyWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown
@@ -1004,7 +1004,7 @@
   :tags: []
 - :name: dependency_proxy:purge_dependency_proxy_cache
   :worker_name: PurgeDependencyProxyCacheWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown
@@ -1013,7 +1013,7 @@
   :tags: []
 - :name: dependency_proxy_blob:dependency_proxy_cleanup_blob
   :worker_name: DependencyProxy::CleanupBlobWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown
@@ -1022,7 +1022,7 @@
   :tags: []
 - :name: dependency_proxy_manifest:dependency_proxy_cleanup_manifest
   :worker_name: DependencyProxy::CleanupManifestWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown
diff --git a/app/workers/dependency_proxy/cleanup_blob_worker.rb b/app/workers/dependency_proxy/cleanup_blob_worker.rb
index eab536cd191..e88b6d8954e 100644
--- a/app/workers/dependency_proxy/cleanup_blob_worker.rb
+++ b/app/workers/dependency_proxy/cleanup_blob_worker.rb
@@ -11,7 +11,7 @@ module DependencyProxy
     sidekiq_options retry: 3
 
     queue_namespace :dependency_proxy_blob
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
     urgency :low
     worker_resource_boundary :unknown
     idempotent!
diff --git a/app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb b/app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb
index 6a958d6e9d7..e674fdf2bd4 100644
--- a/app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb
+++ b/app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb
@@ -8,7 +8,7 @@ module DependencyProxy
     data_consistency :always
     idempotent!
 
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
 
     def perform
       enqueue_blob_cleanup_job if DependencyProxy::Blob.pending_destruction.any?
diff --git a/app/workers/dependency_proxy/cleanup_manifest_worker.rb b/app/workers/dependency_proxy/cleanup_manifest_worker.rb
index 4445ee32e6d..33177d5b553 100644
--- a/app/workers/dependency_proxy/cleanup_manifest_worker.rb
+++ b/app/workers/dependency_proxy/cleanup_manifest_worker.rb
@@ -11,7 +11,7 @@ module DependencyProxy
     sidekiq_options retry: 3
 
     queue_namespace :dependency_proxy_manifest
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
     urgency :low
     worker_resource_boundary :unknown
     idempotent!
diff --git a/app/workers/dependency_proxy/image_ttl_group_policy_worker.rb b/app/workers/dependency_proxy/image_ttl_group_policy_worker.rb
index 89099ab6398..5a59c2d23c9 100644
--- a/app/workers/dependency_proxy/image_ttl_group_policy_worker.rb
+++ b/app/workers/dependency_proxy/image_ttl_group_policy_worker.rb
@@ -8,7 +8,7 @@ module DependencyProxy
 
     data_consistency :always
 
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
 
     def perform
       DependencyProxy::ImageTtlGroupPolicy.enabled.each do |policy|
diff --git a/app/workers/purge_dependency_proxy_cache_worker.rb b/app/workers/purge_dependency_proxy_cache_worker.rb
index c0ddf190210..31bacac65e0 100644
--- a/app/workers/purge_dependency_proxy_cache_worker.rb
+++ b/app/workers/purge_dependency_proxy_cache_worker.rb
@@ -11,7 +11,7 @@ class PurgeDependencyProxyCacheWorker
   idempotent!
 
   queue_namespace :dependency_proxy
-  feature_category :dependency_proxy
+  feature_category :virtual_registry
 
   def perform(current_user_id, group_id)
     @current_user = User.find_by_id(current_user_id)
diff --git a/config/bounded_contexts.yml b/config/bounded_contexts.yml
index e18212c4728..53b0baa14c6 100644
--- a/config/bounded_contexts.yml
+++ b/config/bounded_contexts.yml
@@ -112,7 +112,7 @@ domains:
   DependencyProxy:
     description:
     feature_categories:
-      - dependency_proxy
+      - virtual_registry
       - package_registry
 
   DesignManagement:
@@ -137,10 +137,8 @@ domains:
     description:
     feature_categories:
       - seat_cost_management
-      - saas_provisioning
-      - sm_provisioning
+      - plan_provisioning
       - subscription_management
-      - purchase
 
   Import:
     description:
diff --git a/config/feature_categories.yml b/config/feature_categories.yml
index c115dfb1aee..76288ce0498 100644
--- a/config/feature_categories.yml
+++ b/config/feature_categories.yml
@@ -9,6 +9,7 @@
 ---
 - acquisition
 - activation
+- add-on_provisioning
 - advisory_database
 - ai_abstraction_layer
 - ai_agents
@@ -33,7 +34,6 @@
 - code_search
 - code_suggestions
 - code_testing
-- commerce_integrations
 - compliance_management
 - consumables_cost_management
 - container_registry
@@ -41,14 +41,13 @@
 - continuous_delivery
 - continuous_integration
 - custom_models
-- customersdot_application
+- customersdot_and_quote_to_cash_integrations
 - database
 - dataops
 - dedicated
 - delivery
 - dependency_firewall
 - dependency_management
-- dependency_proxy
 - deployment_management
 - design_management
 - design_system
@@ -64,13 +63,12 @@
 - feature_flags
 - five_minute_production_app
 - fleet_visibility
-- fulfillment_admin_tooling
-- fulfillment_infrastructure
+- fulfillment_infradev
+- fulfillment_internal_admin_tooling
 - fuzz_testing
 - geo_replication
 - gitaly
 - gitlab_cli
-- gitlab_docs
 - global_search
 - groups_and_projects
 - helm_chart_registry
@@ -89,6 +87,7 @@
 - mlops
 - mobile_devops
 - navigation
+- notifications
 - okr_management
 - omnibus_package
 - on_call_schedule_management
@@ -98,11 +97,11 @@
 - pages
 - permissions
 - pipeline_composition
+- plan_provisioning
 - portfolio_management
 - product_analytics_data_management
 - product_analytics_visualization
 - pubsec_services
-- purchase
 - quality_management
 - rate_limiting
 - redis
@@ -112,7 +111,6 @@
 - requirements_management
 - review_apps
 - runner
-- saas_provisioning
 - sbom
 - scalability
 - seat_cost_management
@@ -121,7 +119,7 @@
 - security_policy_management
 - service_desk
 - service_ping
-- sm_provisioning
+- settings
 - software_composition_analysis
 - source_code_management
 - static_application_security_testing
@@ -133,6 +131,7 @@
 - user_management
 - user_profile
 - value_stream_management
+- virtual_registry
 - vulnerability_management
 - web_ide
 - webhooks
diff --git a/db/docs/ci_minutes_additional_packs.yml b/db/docs/ci_minutes_additional_packs.yml
index cffeb058eac..0c243aae35e 100644
--- a/db/docs/ci_minutes_additional_packs.yml
+++ b/db/docs/ci_minutes_additional_packs.yml
@@ -3,7 +3,6 @@ table_name: ci_minutes_additional_packs
 classes:
 - Ci::Minutes::AdditionalPack
 feature_categories:
-- purchase
 - consumables_cost_management
 description: Stores CI minutes purchases for a given namespace with fields for synchronizing
   and expiring available minutes between Customers Portal and GitLab.
diff --git a/db/docs/dependency_proxy_blobs.yml b/db/docs/dependency_proxy_blobs.yml
index d5ce9a9a8d5..fb02625759a 100644
--- a/db/docs/dependency_proxy_blobs.yml
+++ b/db/docs/dependency_proxy_blobs.yml
@@ -3,7 +3,7 @@ table_name: dependency_proxy_blobs
 classes:
 - DependencyProxy::Blob
 feature_categories:
-- dependency_proxy
+- virtual_registry
 description: Dependency proxy blob files
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/10676
 milestone: '11.11'
diff --git a/db/docs/dependency_proxy_group_settings.yml b/db/docs/dependency_proxy_group_settings.yml
index 62dbf02f39a..a79321aba22 100644
--- a/db/docs/dependency_proxy_group_settings.yml
+++ b/db/docs/dependency_proxy_group_settings.yml
@@ -3,7 +3,7 @@ table_name: dependency_proxy_group_settings
 classes:
 - DependencyProxy::GroupSetting
 feature_categories:
-- dependency_proxy
+- virtual_registry
 description: Group-level settings for the dependency proxy
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/10676
 milestone: '11.11'
diff --git a/db/docs/dependency_proxy_image_ttl_group_policies.yml b/db/docs/dependency_proxy_image_ttl_group_policies.yml
index eaaa69a06fe..d9fa67e66f4 100644
--- a/db/docs/dependency_proxy_image_ttl_group_policies.yml
+++ b/db/docs/dependency_proxy_image_ttl_group_policies.yml
@@ -3,7 +3,7 @@ table_name: dependency_proxy_image_ttl_group_policies
 classes:
 - DependencyProxy::ImageTtlGroupPolicy
 feature_categories:
-- dependency_proxy
+- virtual_registry
 description: Group-level settings for dependency proxy cleanup policies
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68809
 milestone: '14.3'
diff --git a/db/docs/dependency_proxy_manifests.yml b/db/docs/dependency_proxy_manifests.yml
index 4cbc7b17c45..d6588189a28 100644
--- a/db/docs/dependency_proxy_manifests.yml
+++ b/db/docs/dependency_proxy_manifests.yml
@@ -3,7 +3,7 @@ table_name: dependency_proxy_manifests
 classes:
 - DependencyProxy::Manifest
 feature_categories:
-- dependency_proxy
+- virtual_registry
 description: Dependency proxy manifest files
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/48535
 milestone: '13.7'
diff --git a/db/docs/gitlab_subscription_histories.yml b/db/docs/gitlab_subscription_histories.yml
index d6587ce25c8..c733837a0e9 100644
--- a/db/docs/gitlab_subscription_histories.yml
+++ b/db/docs/gitlab_subscription_histories.yml
@@ -3,7 +3,7 @@ table_name: gitlab_subscription_histories
 classes:
 - GitlabSubscriptionHistory
 feature_categories:
-- purchase
+- subscription_management
 description: History log for the gitlab_subscriptions table
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/19694
 milestone: '12.6'
diff --git a/db/docs/gitlab_subscriptions.yml b/db/docs/gitlab_subscriptions.yml
index 6907b8030f1..cfa034b4a13 100644
--- a/db/docs/gitlab_subscriptions.yml
+++ b/db/docs/gitlab_subscriptions.yml
@@ -3,7 +3,7 @@ table_name: gitlab_subscriptions
 classes:
 - GitlabSubscription
 feature_categories:
-- purchase
+- subscription_management
 description: Used to store information related to GitLab subscriptions
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/7885
 milestone: '11.6'
diff --git a/db/docs/historical_data.yml b/db/docs/historical_data.yml
index f67a6d81d42..00c07db2967 100644
--- a/db/docs/historical_data.yml
+++ b/db/docs/historical_data.yml
@@ -3,7 +3,7 @@ table_name: historical_data
 classes:
 - HistoricalData
 feature_categories:
-- sm_provisioning
+- plan_provisioning
 - seat_cost_management
 description: Stores seat usage data as active_user_count. Used in service ping analytics, cloud licensing, user limits, and renewal workflows.
 introduced_by_url: https://dev.gitlab.org/gitlab/gitlab-ee/-/merge_requests/390
diff --git a/db/docs/licenses.yml b/db/docs/licenses.yml
index 6309e7b3a9f..78831b61b87 100644
--- a/db/docs/licenses.yml
+++ b/db/docs/licenses.yml
@@ -3,7 +3,7 @@ table_name: licenses
 classes:
 - License
 feature_categories:
-- purchase
+- subscription_management
 description: Used to store information related to the instance's license
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/d1f2b09fadcfba210c5121bd214b910b9f9809fd
 milestone: '7.11'
diff --git a/db/docs/plan_limits.yml b/db/docs/plan_limits.yml
index 94bc986ab41..14b77205183 100644
--- a/db/docs/plan_limits.yml
+++ b/db/docs/plan_limits.yml
@@ -3,7 +3,7 @@ table_name: plan_limits
 classes:
 - PlanLimits
 feature_categories:
-- purchase
+- plan_provisioning
 description: Contains Plan specific limits (CI minute quantities for example)
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/19438
 milestone: '12.5'
diff --git a/db/docs/plans.yml b/db/docs/plans.yml
index bc763c37423..1ea3adae9f1 100644
--- a/db/docs/plans.yml
+++ b/db/docs/plans.yml
@@ -3,7 +3,7 @@ table_name: plans
 classes:
 - Plan
 feature_categories:
-- purchase
+- plan_provisioning
 description: Contains information about purchasable Plans for GitLab namespaces
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/39ca951a0f28d147d4689379bbe48a9c14d55d9f
 milestone: '9.5'
diff --git a/db/docs/upcoming_reconciliations.yml b/db/docs/upcoming_reconciliations.yml
index 59eaf8934fd..7b489cb31d0 100644
--- a/db/docs/upcoming_reconciliations.yml
+++ b/db/docs/upcoming_reconciliations.yml
@@ -3,7 +3,7 @@ table_name: upcoming_reconciliations
 classes:
 - GitlabSubscriptions::UpcomingReconciliation
 feature_categories:
-- purchase
+- subscription_management
 description: Stores the data needed to notify a user of an upcoming reconciliation
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63054
 milestone: '14.0'
diff --git a/db/docs/user_credit_card_validations.yml b/db/docs/user_credit_card_validations.yml
index 928d9ffc98d..a5966f8f80f 100644
--- a/db/docs/user_credit_card_validations.yml
+++ b/db/docs/user_credit_card_validations.yml
@@ -3,7 +3,7 @@ table_name: user_credit_card_validations
 classes:
 - Users::CreditCardValidation
 feature_categories:
-- purchase
+- subscription_management
 description: Stores whether the user has completed a first time validation to run CI pipelines
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/60626
 milestone: '13.12'
diff --git a/doc/user/project/integrations/webhooks.md b/doc/user/project/integrations/webhooks.md
index 7cd6d5e3192..ddcbd2cf806 100644
--- a/doc/user/project/integrations/webhooks.md
+++ b/doc/user/project/integrations/webhooks.md
@@ -136,6 +136,13 @@ with the data for the current event. The template must render as valid JSON.
 You can use any field from the [payload of any event](webhook_events.md), such as `{{build_name}}` for a job event and `{{deployable_url}}`
 for a deployment event. To access properties nested in objects, specify the path segments separated with `.`. For example:
 
+#### Known issue
+
+Custom webhook templates can't access properties in arrays. Support for accessing properties in arrays is proposed in
+[issue 463332](https://gitlab.com/gitlab-org/gitlab/-/issues/463332).
+
+#### Example
+
 Given this custom payload template:
 
 ```json
@@ -154,9 +161,6 @@ You'll have this request payload that combines the template with a `push` event:
 }
 ```
 
-Custom webhook templates do not support accessing properties that are in arrays. Support for this is proposed in
-[issue 463332](https://gitlab.com/gitlab-org/gitlab/-/issues/463332).
-
 ### Filter push events by branch
 
 You can filter push events by branch. Use one of the following options to filter which push events are sent to your webhook endpoint:
diff --git a/lib/api/dependency_proxy.rb b/lib/api/dependency_proxy.rb
index fcf18a2792a..9ab96d4463a 100644
--- a/lib/api/dependency_proxy.rb
+++ b/lib/api/dependency_proxy.rb
@@ -4,7 +4,7 @@ module API
   class DependencyProxy < ::API::Base
     helpers ::API::Helpers::PackagesHelpers
 
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
     urgency :low
 
     after_validation do
diff --git a/lib/api/users.rb b/lib/api/users.rb
index 7fca4878f88..0bf8c00232c 100644
--- a/lib/api/users.rb
+++ b/lib/api/users.rb
@@ -1249,7 +1249,7 @@ module API
 
         optional :zuora_payment_method_xid, type: String, desc: 'The Zuora payment method ID'
       end
-      put ":user_id/credit_card_validation", urgency: :low, feature_category: :purchase do
+      put ":user_id/credit_card_validation", urgency: :low, feature_category: :subscription_management do
         authenticated_as_admin!
 
         user = find_user(params[:user_id])
diff --git a/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb b/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb
index 34ca70e17fe..016214c20f0 100644
--- a/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb
+++ b/spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Groups::DependencyProxyForContainersController, feature_category: :dependency_proxy do
+RSpec.describe Groups::DependencyProxyForContainersController, feature_category: :virtual_registry do
   include HttpBasicAuthHelpers
   include DependencyProxyHelpers
   include WorkhorseHelpers
diff --git a/spec/controllers/groups_controller_spec.rb b/spec/controllers/groups_controller_spec.rb
index 4e83b348743..377c352b77b 100644
--- a/spec/controllers/groups_controller_spec.rb
+++ b/spec/controllers/groups_controller_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe GroupsController, factory_default: :keep, feature_category: :code
   let_it_be_with_refind(:project) { create(:project, namespace: group) }
   let_it_be(:user) { create(:user) }
   let_it_be(:admin_with_admin_mode) { create(:admin) }
-  let_it_be(:admin_without_admin_mode) { create(:admin, :without_default_org) }
+  let_it_be(:admin_without_admin_mode) { create(:admin) }
   let_it_be(:group_member) { create(:group_member, group: group, user: user) }
   let_it_be(:owner) { group.add_owner(create(:user)).user }
   let_it_be(:maintainer) { group.add_maintainer(create(:user)).user }
diff --git a/spec/features/groups/dependency_proxy_for_containers_spec.rb b/spec/features/groups/dependency_proxy_for_containers_spec.rb
index 1e15b97c5aa..3810976eeda 100644
--- a/spec/features/groups/dependency_proxy_for_containers_spec.rb
+++ b/spec/features/groups/dependency_proxy_for_containers_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Group Dependency Proxy for containers', :js, feature_category: :dependency_proxy do
+RSpec.describe 'Group Dependency Proxy for containers', :js, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   include_context 'file upload requests helpers'
diff --git a/spec/features/groups/dependency_proxy_spec.rb b/spec/features/groups/dependency_proxy_spec.rb
index 136c1ff0335..b1e75111fd5 100644
--- a/spec/features/groups/dependency_proxy_spec.rb
+++ b/spec/features/groups/dependency_proxy_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Group Dependency Proxy', feature_category: :dependency_proxy do
+RSpec.describe 'Group Dependency Proxy', feature_category: :virtual_registry do
   let(:owner) { create(:user) }
   let(:reporter) { create(:user) }
   let(:group) { create(:group) }
diff --git a/spec/features/groups_spec.rb b/spec/features/groups_spec.rb
index a3fa05242ef..ad187f04565 100644
--- a/spec/features/groups_spec.rb
+++ b/spec/features/groups_spec.rb
@@ -248,7 +248,7 @@ RSpec.describe 'Group', feature_category: :groups_and_projects do
     let_it_be(:group) { create(:group, path: 'foo') }
 
     context 'as admin' do
-      let(:user) { create(:admin, :without_default_org) }
+      let(:user) { create(:admin) }
 
       before do
         visit new_group_path(parent_id: group.id, anchor: 'create-group-pane')
diff --git a/spec/features/projects/new_project_spec.rb b/spec/features/projects/new_project_spec.rb
index cf9c0012e29..d6b27d8c618 100644
--- a/spec/features/projects/new_project_spec.rb
+++ b/spec/features/projects/new_project_spec.rb
@@ -92,7 +92,7 @@ RSpec.describe 'New project', :js, feature_category: :groups_and_projects do
   end
 
   context 'as an admin' do
-    let(:user) { create(:admin, :without_default_org) }
+    let(:user) { create(:admin) }
 
     it_behaves_like 'shows correct navigation'
 
diff --git a/spec/features/users/bizible_csp_spec.rb b/spec/features/users/bizible_csp_spec.rb
index 6c62cf9e0a2..6ed56af301d 100644
--- a/spec/features/users/bizible_csp_spec.rb
+++ b/spec/features/users/bizible_csp_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Bizible content security policy', feature_category: :purchase do
+RSpec.describe 'Bizible content security policy', feature_category: :subscription_management do
   before do
     stub_config(extra: { one_trust_id: SecureRandom.uuid })
   end
diff --git a/spec/graphql/mutations/dependency_proxy/group_settings/update_spec.rb b/spec/graphql/mutations/dependency_proxy/group_settings/update_spec.rb
index 4dddaf21181..8d3f0c80e6e 100644
--- a/spec/graphql/mutations/dependency_proxy/group_settings/update_spec.rb
+++ b/spec/graphql/mutations/dependency_proxy/group_settings/update_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Mutations::DependencyProxy::GroupSettings::Update, feature_category: :dependency_proxy do
+RSpec.describe Mutations::DependencyProxy::GroupSettings::Update, feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
 
   let_it_be_with_reload(:group) { create(:group) }
diff --git a/spec/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb b/spec/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb
index 0da12ab29f6..bf3231a420b 100644
--- a/spec/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb
+++ b/spec/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Mutations::DependencyProxy::ImageTtlGroupPolicy::Update, feature_category: :dependency_proxy do
+RSpec.describe Mutations::DependencyProxy::ImageTtlGroupPolicy::Update, feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
 
   let_it_be_with_reload(:group) { create(:group) }
diff --git a/spec/graphql/types/dependency_proxy/image_ttl_group_policy_type_spec.rb b/spec/graphql/types/dependency_proxy/image_ttl_group_policy_type_spec.rb
index 2a81e9508e7..47b1e5a79ca 100644
--- a/spec/graphql/types/dependency_proxy/image_ttl_group_policy_type_spec.rb
+++ b/spec/graphql/types/dependency_proxy/image_ttl_group_policy_type_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe GitlabSchema.types['DependencyProxyImageTtlGroupPolicy'], feature_category: :dependency_proxy do
+RSpec.describe GitlabSchema.types['DependencyProxyImageTtlGroupPolicy'], feature_category: :virtual_registry do
   it { expect(described_class.graphql_name).to eq('DependencyProxyImageTtlGroupPolicy') }
 
   it { expect(described_class.description).to eq('Group-level Dependency Proxy TTL policy settings') }
diff --git a/spec/lib/gitlab/import_export/project/relation_factory_spec.rb b/spec/lib/gitlab/import_export/project/relation_factory_spec.rb
index 3e731a75fe3..5421b0966b7 100644
--- a/spec/lib/gitlab/import_export/project/relation_factory_spec.rb
+++ b/spec/lib/gitlab/import_export/project/relation_factory_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe Gitlab::ImportExport::Project::RelationFactory, :use_clean_rails_
   let(:group) { create(:group, maintainers: importer_user) }
   let(:project) { create(:project, :repository, group: group) }
   let(:members_mapper) { double('members_mapper').as_null_object }
-  let(:admin) { create(:admin, :without_default_org) }
+  let(:admin) { create(:admin) }
   let(:importer_user) { admin }
   let(:excluded_keys) { [] }
   let(:additional_relation_attributes) { {} }
diff --git a/spec/lib/gitlab/import_export/project/tree_saver_spec.rb b/spec/lib/gitlab/import_export/project/tree_saver_spec.rb
index 6e5b9b7027e..5747194a7d0 100644
--- a/spec/lib/gitlab/import_export/project/tree_saver_spec.rb
+++ b/spec/lib/gitlab/import_export/project/tree_saver_spec.rb
@@ -393,7 +393,7 @@ RSpec.describe Gitlab::ImportExport::Project::TreeSaver, :with_license, feature_
         end
 
         context 'as admin' do
-          let(:user) { create(:admin, :without_default_org) }
+          let(:user) { create(:admin) }
 
           before do
             project_tree_saver.save # rubocop:disable Rails/SaveBang
diff --git a/spec/models/group_spec.rb b/spec/models/group_spec.rb
index 788201727bf..51be2051a36 100644
--- a/spec/models/group_spec.rb
+++ b/spec/models/group_spec.rb
@@ -1983,7 +1983,7 @@ RSpec.describe Group, feature_category: :groups_and_projects do
     end
 
     context 'evaluating admin access level' do
-      let_it_be(:admin) { create(:admin, :without_default_org) }
+      let_it_be(:admin) { create(:admin) }
 
       context 'when admin mode is enabled', :enable_admin_mode do
         it 'returns OWNER by default' do
@@ -2006,8 +2006,16 @@ RSpec.describe Group, feature_category: :groups_and_projects do
     context 'when organization owner' do
       let_it_be(:admin) { create(:admin) }
 
-      it 'returns OWNER by default' do
-        expect(group.max_member_access_for_user(admin)).to eq(Gitlab::Access::OWNER)
+      context 'when admin mode is enabled', :enable_admin_mode do
+        it 'returns OWNER by default' do
+          expect(group.max_member_access_for_user(admin)).to eq(Gitlab::Access::OWNER)
+        end
+      end
+
+      context 'when admin mode is disabled' do
+        it 'returns NO_ACCESS by default' do
+          expect(group.max_member_access_for_user(admin)).to eq(Gitlab::Access::NO_ACCESS)
+        end
       end
 
       context 'when only concrete members' do
diff --git a/spec/models/user_highest_role_spec.rb b/spec/models/user_highest_role_spec.rb
index d8cf09e7fd4..cf86a996ba5 100644
--- a/spec/models/user_highest_role_spec.rb
+++ b/spec/models/user_highest_role_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe UserHighestRole, feature_category: :sm_provisioning do
+RSpec.describe UserHighestRole, feature_category: :plan_provisioning do
   describe 'associations' do
     it { is_expected.to belong_to(:user).required }
   end
diff --git a/spec/policies/group_policy_spec.rb b/spec/policies/group_policy_spec.rb
index 0a546c44f6c..634e4c9c611 100644
--- a/spec/policies/group_policy_spec.rb
+++ b/spec/policies/group_policy_spec.rb
@@ -253,6 +253,18 @@ RSpec.describe GroupPolicy, feature_category: :system_access do
       expect_allowed(*owner_permissions)
       expect_allowed(*admin_permissions)
     end
+
+    context 'when user is also an admin' do
+      before do
+        organization_owner.update!(admin: true)
+      end
+
+      it { expect_disallowed(:admin_organization) }
+
+      context 'with admin mode', :enable_admin_mode do
+        it { expect_allowed(:admin_organization) }
+      end
+    end
   end
 
   context 'migration bot' do
diff --git a/spec/policies/upload_policy_spec.rb b/spec/policies/upload_policy_spec.rb
index 1dfc9885027..b08cc8a276b 100644
--- a/spec/policies/upload_policy_spec.rb
+++ b/spec/policies/upload_policy_spec.rb
@@ -9,7 +9,7 @@ RSpec.describe UploadPolicy do
   let_it_be(:developer) { create(:user, developer_of: group) }
   let_it_be(:maintainer) { create(:user, maintainer_of: group) }
   let_it_be(:owner) { create(:user, owner_of: group) }
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:non_member_user) { create(:user) }
 
   let(:upload_permissions) { [:read_upload, :destroy_upload] }
diff --git a/spec/presenters/projects/import_export/project_export_presenter_spec.rb b/spec/presenters/projects/import_export/project_export_presenter_spec.rb
index 277df5d4277..d5776ba2323 100644
--- a/spec/presenters/projects/import_export/project_export_presenter_spec.rb
+++ b/spec/presenters/projects/import_export/project_export_presenter_spec.rb
@@ -84,7 +84,7 @@ RSpec.describe Projects::ImportExport::ProjectExportPresenter do
     end
 
     context 'as admin' do
-      let(:user) { create(:admin, :without_default_org) }
+      let(:user) { create(:admin) }
 
       context 'when admin mode is enabled', :enable_admin_mode do
         it 'exports group members as admin' do
diff --git a/spec/requests/api/dependency_proxy_spec.rb b/spec/requests/api/dependency_proxy_spec.rb
index ef94cdbbe2b..791e52ea56c 100644
--- a/spec/requests/api/dependency_proxy_spec.rb
+++ b/spec/requests/api/dependency_proxy_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe API::DependencyProxy, api: true, feature_category: :dependency_proxy do
+RSpec.describe API::DependencyProxy, api: true, feature_category: :virtual_registry do
   let_it_be(:user) { create(:user) }
   let_it_be(:blob) { create(:dependency_proxy_blob) }
   let_it_be(:group, reload: true) { blob.group }
diff --git a/spec/requests/api/graphql/group/dependency_proxy_blobs_spec.rb b/spec/requests/api/graphql/group/dependency_proxy_blobs_spec.rb
index 869147f17b3..cf9acded132 100644
--- a/spec/requests/api/graphql/group/dependency_proxy_blobs_spec.rb
+++ b/spec/requests/api/graphql/group/dependency_proxy_blobs_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe 'getting dependency proxy blobs in a group', feature_category: :dependency_proxy do
+RSpec.describe 'getting dependency proxy blobs in a group', feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
   include GraphqlHelpers
 
diff --git a/spec/requests/api/graphql/group/dependency_proxy_group_setting_spec.rb b/spec/requests/api/graphql/group/dependency_proxy_group_setting_spec.rb
index b3752cbb6ca..3ec2d7633bb 100644
--- a/spec/requests/api/graphql/group/dependency_proxy_group_setting_spec.rb
+++ b/spec/requests/api/graphql/group/dependency_proxy_group_setting_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe 'getting dependency proxy settings for a group', feature_category: :dependency_proxy do
+RSpec.describe 'getting dependency proxy settings for a group', feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
   include GraphqlHelpers
 
diff --git a/spec/requests/api/graphql/group/dependency_proxy_image_ttl_policy_spec.rb b/spec/requests/api/graphql/group/dependency_proxy_image_ttl_policy_spec.rb
index de4433136b9..e178009d5ba 100644
--- a/spec/requests/api/graphql/group/dependency_proxy_image_ttl_policy_spec.rb
+++ b/spec/requests/api/graphql/group/dependency_proxy_image_ttl_policy_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe 'getting dependency proxy image ttl policy for a group', feature_category: :dependency_proxy do
+RSpec.describe 'getting dependency proxy image ttl policy for a group', feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
   include GraphqlHelpers
 
diff --git a/spec/requests/api/graphql/group/dependency_proxy_manifests_spec.rb b/spec/requests/api/graphql/group/dependency_proxy_manifests_spec.rb
index d2d686104ad..f7aa6008bbf 100644
--- a/spec/requests/api/graphql/group/dependency_proxy_manifests_spec.rb
+++ b/spec/requests/api/graphql/group/dependency_proxy_manifests_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe 'getting dependency proxy manifests in a group', feature_category: :dependency_proxy do
+RSpec.describe 'getting dependency proxy manifests in a group', feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
   include GraphqlHelpers
 
diff --git a/spec/requests/api/graphql/mutations/dependency_proxy/group_settings/update_spec.rb b/spec/requests/api/graphql/mutations/dependency_proxy/group_settings/update_spec.rb
index c752fa1d719..94ad5ac7a8b 100644
--- a/spec/requests/api/graphql/mutations/dependency_proxy/group_settings/update_spec.rb
+++ b/spec/requests/api/graphql/mutations/dependency_proxy/group_settings/update_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Updating the dependency proxy group settings', feature_category: :dependency_proxy do
+RSpec.describe 'Updating the dependency proxy group settings', feature_category: :virtual_registry do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb b/spec/requests/api/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb
index 89eb0c42bcd..5507f62d5c6 100644
--- a/spec/requests/api/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb
+++ b/spec/requests/api/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Updating the dependency proxy image ttl policy', feature_category: :dependency_proxy do
+RSpec.describe 'Updating the dependency proxy image ttl policy', feature_category: :virtual_registry do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }
diff --git a/spec/requests/api/user_runners_spec.rb b/spec/requests/api/user_runners_spec.rb
index 5a79f6c4e34..d889dc48fb9 100644
--- a/spec/requests/api/user_runners_spec.rb
+++ b/spec/requests/api/user_runners_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe API::UserRunners, :aggregate_failures, feature_category: :fleet_visibility do
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:user, reload: true) { create(:user, username: 'user.withdot') }
 
   describe 'POST /user/runners' do
diff --git a/spec/services/auth/dependency_proxy_authentication_service_spec.rb b/spec/services/auth/dependency_proxy_authentication_service_spec.rb
index 311bc2570c5..c979a59e7cc 100644
--- a/spec/services/auth/dependency_proxy_authentication_service_spec.rb
+++ b/spec/services/auth/dependency_proxy_authentication_service_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Auth::DependencyProxyAuthenticationService, feature_category: :dependency_proxy do
+RSpec.describe Auth::DependencyProxyAuthenticationService, feature_category: :virtual_registry do
   let_it_be(:user) { create(:user) }
   let_it_be(:params) { {} }
 
diff --git a/spec/services/ci/runners/create_runner_service_spec.rb b/spec/services/ci/runners/create_runner_service_spec.rb
index cab6266cc48..efab371482b 100644
--- a/spec/services/ci/runners/create_runner_service_spec.rb
+++ b/spec/services/ci/runners/create_runner_service_spec.rb
@@ -7,7 +7,7 @@ RSpec.describe ::Ci::Runners::CreateRunnerService, "#execute", feature_category:
 
   let(:runner) { execute.payload[:runner] }
 
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:non_admin_user) { create(:user) }
   let_it_be(:anonymous) { nil }
   let_it_be(:group_owner) { create(:user) }
diff --git a/spec/services/dependency_proxy/auth_token_service_spec.rb b/spec/services/dependency_proxy/auth_token_service_spec.rb
index 43a672032b9..01a42bde4d5 100644
--- a/spec/services/dependency_proxy/auth_token_service_spec.rb
+++ b/spec/services/dependency_proxy/auth_token_service_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::AuthTokenService, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::AuthTokenService, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   let_it_be(:user) { create(:user) }
diff --git a/spec/services/dependency_proxy/find_cached_manifest_service_spec.rb b/spec/services/dependency_proxy/find_cached_manifest_service_spec.rb
index 13620b3dfc1..3e18f01262b 100644
--- a/spec/services/dependency_proxy/find_cached_manifest_service_spec.rb
+++ b/spec/services/dependency_proxy/find_cached_manifest_service_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::FindCachedManifestService, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::FindCachedManifestService, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   let_it_be(:image) { 'alpine' }
diff --git a/spec/services/dependency_proxy/group_settings/update_service_spec.rb b/spec/services/dependency_proxy/group_settings/update_service_spec.rb
index 2cbd894c76e..0d83d2eaca1 100644
--- a/spec/services/dependency_proxy/group_settings/update_service_spec.rb
+++ b/spec/services/dependency_proxy/group_settings/update_service_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe ::DependencyProxy::GroupSettings::UpdateService, feature_category: :dependency_proxy do
+RSpec.describe ::DependencyProxy::GroupSettings::UpdateService, feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
 
   let_it_be_with_reload(:group) { create(:group) }
diff --git a/spec/services/dependency_proxy/head_manifest_service_spec.rb b/spec/services/dependency_proxy/head_manifest_service_spec.rb
index a9646a185bc..2f9cd6e6c49 100644
--- a/spec/services/dependency_proxy/head_manifest_service_spec.rb
+++ b/spec/services/dependency_proxy/head_manifest_service_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::HeadManifestService, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::HeadManifestService, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   let(:image) { 'alpine' }
diff --git a/spec/services/dependency_proxy/image_ttl_group_policies/update_service_spec.rb b/spec/services/dependency_proxy/image_ttl_group_policies/update_service_spec.rb
index fa05fabc070..3d8ab3bc92e 100644
--- a/spec/services/dependency_proxy/image_ttl_group_policies/update_service_spec.rb
+++ b/spec/services/dependency_proxy/image_ttl_group_policies/update_service_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe ::DependencyProxy::ImageTtlGroupPolicies::UpdateService, feature_category: :dependency_proxy do
+RSpec.describe ::DependencyProxy::ImageTtlGroupPolicies::UpdateService, feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
 
   let_it_be_with_reload(:group) { create(:group) }
diff --git a/spec/services/dependency_proxy/request_token_service_spec.rb b/spec/services/dependency_proxy/request_token_service_spec.rb
index 0cc3695f0b0..259e07841d2 100644
--- a/spec/services/dependency_proxy/request_token_service_spec.rb
+++ b/spec/services/dependency_proxy/request_token_service_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::RequestTokenService, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::RequestTokenService, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   let(:image) { 'alpine:3.9' }
diff --git a/spec/services/resource_access_tokens/create_service_spec.rb b/spec/services/resource_access_tokens/create_service_spec.rb
index 6810f2f0209..e0f3f9e6109 100644
--- a/spec/services/resource_access_tokens/create_service_spec.rb
+++ b/spec/services/resource_access_tokens/create_service_spec.rb
@@ -62,7 +62,7 @@ RSpec.describe ResourceAccessTokens::CreateService, feature_category: :system_ac
         end
 
         context 'when created by an admin' do
-          let(:user) { create(:admin, :without_default_org) }
+          let(:user) { create(:admin) }
 
           context 'when admin mode is enabled', :enable_admin_mode do
             it_behaves_like 'creates a user that has their email confirmed'
diff --git a/spec/support/matchers/access_matchers.rb b/spec/support/matchers/access_matchers.rb
index 741fed412c6..1b460fbdbf7 100644
--- a/spec/support/matchers/access_matchers.rb
+++ b/spec/support/matchers/access_matchers.rb
@@ -11,9 +11,7 @@ module AccessMatchers
 
   def emulate_user(user_type_or_trait, membership = nil)
     case user_type_or_trait
-    when :admin
-      login_as(create(user_type_or_trait, :without_default_org))
-    when :user
+    when :user, :admin
       login_as(create(user_type_or_trait))
     when :external, :auditor
       login_as(create(:user, user_type_or_trait))
diff --git a/spec/support/matchers/access_matchers_for_controller.rb b/spec/support/matchers/access_matchers_for_controller.rb
index 2188128d60f..401bf6c196e 100644
--- a/spec/support/matchers/access_matchers_for_controller.rb
+++ b/spec/support/matchers/access_matchers_for_controller.rb
@@ -13,7 +13,7 @@ module AccessMatchersForController
   def emulate_user(role, membership = nil)
     case role
     when :admin
-      user = create(:admin, :without_default_org)
+      user = create(:admin)
       sign_in(user)
     when :user
       user = create(:user)
diff --git a/spec/support/shared_contexts/graphql/resolvers/runners_resolver_shared_context.rb b/spec/support/shared_contexts/graphql/resolvers/runners_resolver_shared_context.rb
index b24ad8a535d..2dbb903a272 100644
--- a/spec/support/shared_contexts/graphql/resolvers/runners_resolver_shared_context.rb
+++ b/spec/support/shared_contexts/graphql/resolvers/runners_resolver_shared_context.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.shared_context 'runners resolver setup' do
-  let_it_be(:user) { create_default(:user, :admin, :without_default_org) }
+  let_it_be(:user) { create_default(:user, :admin) }
   let_it_be(:group) { create(:group, :public) }
   let_it_be(:subgroup) { create(:group, :public, parent: group) }
   let_it_be(:project) { create(:project, :public, group: group) }
diff --git a/spec/support/shared_contexts/policies/group_policy_shared_context.rb b/spec/support/shared_contexts/policies/group_policy_shared_context.rb
index 18fa8a89e29..bb8c36812b5 100644
--- a/spec/support/shared_contexts/policies/group_policy_shared_context.rb
+++ b/spec/support/shared_contexts/policies/group_policy_shared_context.rb
@@ -12,7 +12,7 @@ RSpec.shared_context 'GroupPolicy context' do
   let_it_be(:developer) { create(:user, developer_of: group) }
   let_it_be(:maintainer) { create(:user, maintainer_of: group) }
   let_it_be(:owner) { create(:user, owner_of: group) }
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:non_group_member) { create(:user) }
 
   let_it_be(:organization_owner) { create(:organization_user, :owner, organization: organization).user }
@@ -94,7 +94,7 @@ RSpec.shared_context 'GroupPolicy context' do
     ]
   end
 
-  let(:admin_permissions) { %i[read_confidential_issues read_internal_note] }
+  let(:admin_permissions) { %i[admin_organization read_confidential_issues read_internal_note] }
 
   subject { described_class.new(current_user, group) }
 end
diff --git a/spec/support/shared_examples/models/member_shared_examples.rb b/spec/support/shared_examples/models/member_shared_examples.rb
index 4b5d991e5ca..250791b1e60 100644
--- a/spec/support/shared_examples/models/member_shared_examples.rb
+++ b/spec/support/shared_examples/models/member_shared_examples.rb
@@ -112,7 +112,7 @@ RSpec.shared_examples '#valid_level_roles' do |entity_name|
 end
 
 RSpec.shared_examples_for "member creation" do
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
 
   it 'returns a Member object', :aggregate_failures do
     member = described_class.add_member(source, user, :maintainer)
@@ -385,7 +385,7 @@ RSpec.shared_examples_for "member creation" do
 end
 
 RSpec.shared_examples_for "bulk member creation" do
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:user1) { create(:user, email: 'bob@example.com') }
   let_it_be(:user2) { create(:user) }
 
diff --git a/spec/support/shared_examples/requests/admin_mode_shared_examples.rb b/spec/support/shared_examples/requests/admin_mode_shared_examples.rb
index 475e9bf6fe2..4f198dfb740 100644
--- a/spec/support/shared_examples/requests/admin_mode_shared_examples.rb
+++ b/spec/support/shared_examples/requests/admin_mode_shared_examples.rb
@@ -55,7 +55,7 @@ RSpec.shared_examples 'when user' do
 end
 
 RSpec.shared_examples 'when admin' do
-  let_it_be(:current_user) { create(:admin, :without_default_org) }
+  let_it_be(:current_user) { create(:admin) }
 
   it_behaves_like 'makes request' do
     let(:status) { success_status_code }
diff --git a/spec/support_specs/license_metadata_tags_spec.rb b/spec/support_specs/license_metadata_tags_spec.rb
index f89a32574c7..597d3de797b 100644
--- a/spec/support_specs/license_metadata_tags_spec.rb
+++ b/spec/support_specs/license_metadata_tags_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 
 # These specs only make sense if ee/spec/spec_helper is loaded
 # In FOSS_ONLY=1 mode, nothing should happen
-RSpec.describe 'license metadata tags', feature_category: :sm_provisioning, if: Gitlab.ee? do
+RSpec.describe 'license metadata tags', feature_category: :plan_provisioning, if: Gitlab.ee? do
   it 'applies the without_license metadata tag by default' do |example|
     expect(example.metadata[:without_license]).to eq(true)
   end
diff --git a/spec/workers/dependency_proxy/cleanup_blob_worker_spec.rb b/spec/workers/dependency_proxy/cleanup_blob_worker_spec.rb
index 9ef5fd9ec93..134daeb5344 100644
--- a/spec/workers/dependency_proxy/cleanup_blob_worker_spec.rb
+++ b/spec/workers/dependency_proxy/cleanup_blob_worker_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::CleanupBlobWorker, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::CleanupBlobWorker, feature_category: :virtual_registry do
   let_it_be(:factory_type) { :dependency_proxy_blob }
 
   it_behaves_like 'dependency_proxy_cleanup_worker'
diff --git a/spec/workers/dependency_proxy/cleanup_dependency_proxy_worker_spec.rb b/spec/workers/dependency_proxy/cleanup_dependency_proxy_worker_spec.rb
index 3040189d1c8..88b93d543e2 100644
--- a/spec/workers/dependency_proxy/cleanup_dependency_proxy_worker_spec.rb
+++ b/spec/workers/dependency_proxy/cleanup_dependency_proxy_worker_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::CleanupDependencyProxyWorker, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::CleanupDependencyProxyWorker, feature_category: :virtual_registry do
   describe '#perform' do
     subject { described_class.new.perform }
 
diff --git a/spec/workers/dependency_proxy/cleanup_manifest_worker_spec.rb b/spec/workers/dependency_proxy/cleanup_manifest_worker_spec.rb
index 730acc49110..2b8ccd5818c 100644
--- a/spec/workers/dependency_proxy/cleanup_manifest_worker_spec.rb
+++ b/spec/workers/dependency_proxy/cleanup_manifest_worker_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::CleanupManifestWorker, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::CleanupManifestWorker, feature_category: :virtual_registry do
   let_it_be(:factory_type) { :dependency_proxy_manifest }
 
   it_behaves_like 'dependency_proxy_cleanup_worker'
diff --git a/spec/workers/dependency_proxy/image_ttl_group_policy_worker_spec.rb b/spec/workers/dependency_proxy/image_ttl_group_policy_worker_spec.rb
index 44a21439ff8..ce5209f1d09 100644
--- a/spec/workers/dependency_proxy/image_ttl_group_policy_worker_spec.rb
+++ b/spec/workers/dependency_proxy/image_ttl_group_policy_worker_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::ImageTtlGroupPolicyWorker, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::ImageTtlGroupPolicyWorker, feature_category: :virtual_registry do
   let(:worker) { described_class.new }
 
   describe '#perform' do
diff --git a/spec/workers/purge_dependency_proxy_cache_worker_spec.rb b/spec/workers/purge_dependency_proxy_cache_worker_spec.rb
index d8be6cdd1a1..c5f95b5e540 100644
--- a/spec/workers/purge_dependency_proxy_cache_worker_spec.rb
+++ b/spec/workers/purge_dependency_proxy_cache_worker_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe PurgeDependencyProxyCacheWorker, feature_category: :dependency_proxy do
+RSpec.describe PurgeDependencyProxyCacheWorker, feature_category: :virtual_registry do
   let_it_be(:user) { create(:admin) }
   let_it_be_with_refind(:blob) { create(:dependency_proxy_blob ) }
   let_it_be_with_reload(:group) { blob.group }