diff --git a/app/assets/javascripts/issuable/popover/components/issue_popover.vue b/app/assets/javascripts/issuable/popover/components/issue_popover.vue
index cb2299316b0..6f99446004c 100644
--- a/app/assets/javascripts/issuable/popover/components/issue_popover.vue
+++ b/app/assets/javascripts/issuable/popover/components/issue_popover.vue
@@ -104,9 +104,7 @@ export default {
 
 <template>
   <gl-popover :target="target" boundary="viewport" placement="top" :show="show">
-    <gl-skeleton-loader v-if="$apollo.queries.workItem.loading" :height="15">
-      <rect width="250" height="15" rx="4" />
-    </gl-skeleton-loader>
+    <gl-skeleton-loader v-if="$apollo.queries.workItem.loading" :width="150" />
     <template v-else>
       <div class="gl-flex gl-items-center gl-gap-2">
         <status-badge :state="workItem.state" />
diff --git a/app/assets/javascripts/notes/components/note_body.vue b/app/assets/javascripts/notes/components/note_body.vue
index 2f77eb3dd51..1c39806d111 100644
--- a/app/assets/javascripts/notes/components/note_body.vue
+++ b/app/assets/javascripts/notes/components/note_body.vue
@@ -115,8 +115,7 @@ export default {
       return escape(suggestion);
     },
     isDuoFirstReviewComment() {
-      // Must be a Duo bot comment of type DiffNote
-      if (this.note.author.user_type !== 'duo_code_review_bot' || this.note.type !== 'DiffNote') {
+      if (this.note.author.user_type !== 'duo_code_review_bot') {
         return false;
       }
       // Get the discussion
@@ -124,8 +123,11 @@ export default {
       // If can't get discussion or this is not the first note, don't show feedback
       return discussion?.notes?.length > 0 && discussion.notes[0].id === this.note.id;
     },
+    isDiffNote() {
+      return this.note.type === 'DiffNote';
+    },
     defaultAwardsList() {
-      return this.isDuoFirstReviewComment ? ['thumbsup', 'thumbsdown'] : [];
+      return this.isDuoFirstReviewComment && this.isDiffNote ? ['thumbsup', 'thumbsdown'] : [];
     },
     duoFeedbackText() {
       return sprintf(
@@ -223,7 +225,7 @@ export default {
     />
     <div v-else v-safe-html:[$options.safeHtmlConfig]="note.note_html" class="note-text md"></div>
     <duo-code-review-feedback
-      v-if="note.author.user_type === 'duo_code_review_bot' && note.type !== 'DiffNote'"
+      v-if="isDuoFirstReviewComment && !isDiffNote"
       class="gl-mt-3"
       data-testid="code-review-feedback"
     />
@@ -261,12 +263,12 @@ export default {
       class="note_edited_ago"
     />
     <div
-      v-if="isDuoFirstReviewComment"
+      v-if="isDuoFirstReviewComment && isDiffNote"
       v-safe-html:[$options.safeHtmlConfig]="duoFeedbackText"
       class="gl-text-md gl-mt-4 gl-text-gray-500"
     ></div>
     <note-awards-list
-      v-if="isDuoFirstReviewComment || (note.award_emoji && note.award_emoji.length)"
+      v-if="defaultAwardsList.length || (note.award_emoji && note.award_emoji.length)"
       :note-id="note.id"
       :note-author-id="note.author.id"
       :awards="note.award_emoji"
diff --git a/app/assets/javascripts/projects/new/components/new_project_url_select.vue b/app/assets/javascripts/projects/new/components/new_project_url_select.vue
index 236d9288631..4a70377792a 100644
--- a/app/assets/javascripts/projects/new/components/new_project_url_select.vue
+++ b/app/assets/javascripts/projects/new/components/new_project_url_select.vue
@@ -234,6 +234,7 @@ export default {
     <input
       :id="inputId"
       type="hidden"
+      :data-testid="inputName"
       :name="inputName"
       :value="selectedNamespace.id || userNamespaceUniqueId"
     />
diff --git a/app/assets/javascripts/work_items/components/work_item_assignees.vue b/app/assets/javascripts/work_items/components/work_item_assignees.vue
index 0fc901d15bd..96c2d05bb31 100644
--- a/app/assets/javascripts/work_items/components/work_item_assignees.vue
+++ b/app/assets/javascripts/work_items/components/work_item_assignees.vue
@@ -1,6 +1,7 @@
 <script>
 import { GlButton } from '@gitlab/ui';
 import { unionBy } from 'lodash';
+import fuzzaldrinPlus from 'fuzzaldrin-plus';
 import { sortNameAlphabetically, newWorkItemId } from '~/work_items/utils';
 import currentUserQuery from '~/graphql_shared/queries/current_user.query.graphql';
 import usersSearchQuery from '~/graphql_shared/queries/workspace_autocomplete_users.query.graphql';
@@ -163,8 +164,18 @@ export default {
           { options: unselectedUsers, text: __('All users'), textSrOnly: true },
         ];
       }
+      const filteredParticipants = fuzzaldrinPlus.filter(
+        // We're storing `name` and `username` as a combined string in
+        // a new key `matcher` as fuzzaldrin-plus doesn't support searching
+        // using multiple keys.
+        this.participants.map((p) => ({ ...p, matcher: `${p.name} ${p.username}` })),
+        this.searchKey,
+        {
+          key: ['matcher'],
+        },
+      );
 
-      return this.users.map((user) => ({
+      return unionBy([...filteredParticipants, ...this.users], 'id').map((user) => ({
         ...user,
         value: user?.id,
         text: user?.name,
diff --git a/app/assets/javascripts/work_items/graphql/work_item_bulk_update.mutation.graphql b/app/assets/javascripts/work_items/graphql/list/work_item_bulk_update.mutation.graphql
similarity index 100%
rename from app/assets/javascripts/work_items/graphql/work_item_bulk_update.mutation.graphql
rename to app/assets/javascripts/work_items/graphql/list/work_item_bulk_update.mutation.graphql
diff --git a/app/assets/javascripts/work_items/graphql/list/work_item_parent.query.graphql b/app/assets/javascripts/work_items/graphql/list/work_item_parent.query.graphql
new file mode 100644
index 00000000000..e3022fa586d
--- /dev/null
+++ b/app/assets/javascripts/work_items/graphql/list/work_item_parent.query.graphql
@@ -0,0 +1,5 @@
+query workItemParent($fullPath: ID!) {
+  namespace(fullPath: $fullPath) {
+    id
+  }
+}
diff --git a/app/assets/javascripts/work_items/index.js b/app/assets/javascripts/work_items/index.js
index bb3de8bb61c..34d41525bc1 100644
--- a/app/assets/javascripts/work_items/index.js
+++ b/app/assets/javascripts/work_items/index.js
@@ -27,6 +27,7 @@ export const initWorkItemsRoot = ({ workItemType, workspaceType, withTabs } = {}
 
   const {
     canAdminLabel,
+    canBulkUpdate,
     fullPath,
     groupPath,
     groupId,
@@ -36,6 +37,7 @@ export const initWorkItemsRoot = ({ workItemType, workspaceType, withTabs } = {}
     labelsManagePath,
     registerPath,
     signInPath,
+    hasGroupBulkEditFeature,
     hasIterationsFeature,
     hasOkrsFeature,
     hasSubepicsFeature,
@@ -47,7 +49,7 @@ export const initWorkItemsRoot = ({ workItemType, workspaceType, withTabs } = {}
     isSignedIn,
     workItemType: listWorkItemType,
     hasEpicsFeature,
-    showNewIssueLink,
+    showNewWorkItem,
     canCreateEpic,
     autocompleteAwardEmojisPath,
     hasScopedLabelsFeature,
@@ -115,10 +117,12 @@ export const initWorkItemsRoot = ({ workItemType, workspaceType, withTabs } = {}
     router,
     apolloProvider,
     provide: {
-      canAdminLabel,
+      canAdminLabel: parseBoolean(canAdminLabel),
+      canBulkUpdate: parseBoolean(canBulkUpdate),
       fullPath,
       isGroup,
       isProject: !isGroup,
+      hasGroupBulkEditFeature: parseBoolean(hasGroupBulkEditFeature),
       hasIssueWeightsFeature: parseBoolean(hasIssueWeightsFeature),
       hasOkrsFeature: parseBoolean(hasOkrsFeature),
       hasSubepicsFeature: parseBoolean(hasSubepicsFeature),
@@ -136,7 +140,7 @@ export const initWorkItemsRoot = ({ workItemType, workspaceType, withTabs } = {}
       isSignedIn: parseBoolean(isSignedIn),
       workItemType: listWorkItemType,
       hasEpicsFeature: parseBoolean(hasEpicsFeature),
-      showNewIssueLink: parseBoolean(showNewIssueLink),
+      showNewWorkItem: parseBoolean(showNewWorkItem),
       canCreateEpic: parseBoolean(canCreateEpic),
       autocompleteAwardEmojisPath,
       hasQualityManagementFeature: parseBoolean(hasQualityManagementFeature),
diff --git a/app/assets/javascripts/work_items/pages/work_items_list_app.vue b/app/assets/javascripts/work_items/pages/work_items_list_app.vue
index 872911b071c..fbc5c237b73 100644
--- a/app/assets/javascripts/work_items/pages/work_items_list_app.vue
+++ b/app/assets/javascripts/work_items/pages/work_items_list_app.vue
@@ -1,12 +1,10 @@
 <script>
 import { GlButton, GlFilteredSearchToken, GlLoadingIcon } from '@gitlab/ui';
 import { isEmpty } from 'lodash';
+import { createAlert } from '~/alert';
 import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import IssueCardStatistics from 'ee_else_ce/issues/list/components/issue_card_statistics.vue';
 import IssueCardTimeInfo from 'ee_else_ce/issues/list/components/issue_card_time_info.vue';
-import WorkItemHealthStatus from '~/work_items/components/work_item_health_status.vue';
-import CreateWorkItemModal from '~/work_items/components/create_work_item_modal.vue';
-import EmptyStateWithoutAnyIssues from '~/issues/list/components/empty_state_without_any_issues.vue';
 import {
   convertToApiParams,
   convertToSearchQuery,
@@ -27,6 +25,7 @@ import {
   WORKSPACE_PROJECT,
 } from '~/issues/constants';
 import { AutocompleteCache } from '~/issues/dashboard/utils';
+import EmptyStateWithoutAnyIssues from '~/issues/list/components/empty_state_without_any_issues.vue';
 import {
   CREATED_DESC,
   PARAM_FIRST_PAGE_SIZE,
@@ -39,8 +38,9 @@ import {
 import searchLabelsQuery from '~/issues/list/queries/search_labels.query.graphql';
 import setSortPreferenceMutation from '~/issues/list/queries/set_sort_preference.mutation.graphql';
 import { fetchPolicies } from '~/lib/graphql';
-import { scrollUp } from '~/lib/utils/scroll_utils';
 import { isPositiveInteger } from '~/lib/utils/number_utils';
+import { scrollUp } from '~/lib/utils/scroll_utils';
+import { getParameterByName, removeParams, updateHistory } from '~/lib/utils/url_utility';
 import { __, s__ } from '~/locale';
 import {
   OPERATOR_IS,
@@ -78,13 +78,16 @@ import {
   TOKEN_TYPE_TYPE,
   TOKEN_TYPE_UPDATED,
 } from '~/vue_shared/components/filtered_search_bar/constants';
+import DateToken from '~/vue_shared/components/filtered_search_bar/tokens/date_token.vue';
 import IssuableList from '~/vue_shared/issuable/list/components/issuable_list_root.vue';
-import WorkItemDrawer from '~/work_items/components/work_item_drawer.vue';
 import { DEFAULT_PAGE_SIZE, issuableListTabs } from '~/vue_shared/issuable/list/constants';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
-import DateToken from '~/vue_shared/components/filtered_search_bar/tokens/date_token.vue';
-import { getParameterByName, removeParams, updateHistory } from '~/lib/utils/url_utility';
+import CreateWorkItemModal from '../components/create_work_item_modal.vue';
+import WorkItemBulkEditSidebar from '../components/work_item_bulk_edit/work_item_bulk_edit_sidebar.vue';
+import WorkItemHealthStatus from '../components/work_item_health_status.vue';
+import WorkItemDrawer from '../components/work_item_drawer.vue';
 import {
+  BASE_ALLOWED_CREATE_TYPES,
   DETAIL_VIEW_QUERY_PARAM_NAME,
   NAME_TO_ENUM_MAP,
   STATE_CLOSED,
@@ -92,9 +95,13 @@ import {
   WORK_ITEM_TYPE_ENUM_EPIC,
   WORK_ITEM_TYPE_ENUM_ISSUE,
   WORK_ITEM_TYPE_NAME_EPIC,
+  WORK_ITEM_TYPE_NAME_KEY_RESULT,
+  WORK_ITEM_TYPE_NAME_OBJECTIVE,
 } from '../constants';
-import getWorkItemsQuery from '../graphql/list/get_work_items.query.graphql';
 import getWorkItemStateCountsQuery from '../graphql/list/get_work_item_state_counts.query.graphql';
+import getWorkItemsQuery from '../graphql/list/get_work_items.query.graphql';
+import workItemBulkUpdateMutation from '../graphql/list/work_item_bulk_update.mutation.graphql';
+import workItemParent from '../graphql/list/work_item_parent.query.graphql';
 import { sortOptions, urlSortParams } from './list/constants';
 
 const EmojiToken = () =>
@@ -122,6 +129,7 @@ export default {
     IssuableList,
     IssueCardStatistics,
     IssueCardTimeInfo,
+    WorkItemBulkEditSidebar,
     WorkItemDrawer,
     WorkItemHealthStatus,
     EmptyStateWithoutAnyIssues,
@@ -131,15 +139,19 @@ export default {
   mixins: [glFeatureFlagMixin()],
   inject: [
     'autocompleteAwardEmojisPath',
+    'canBulkUpdate',
+    'canBulkEditEpics',
     'fullPath',
     'hasEpicsFeature',
+    'hasGroupBulkEditFeature',
+    'hasIssueDateFilterFeature',
     'hasOkrsFeature',
     'hasQualityManagementFeature',
     'initialSort',
     'isGroup',
     'isSignedIn',
+    'showNewWorkItem',
     'workItemType',
-    'hasIssueDateFilterFeature',
   ],
   props: {
     eeWorkItemUpdateCount: {
@@ -147,11 +159,6 @@ export default {
       required: false,
       default: 0,
     },
-    showBulkEditSidebar: {
-      type: Boolean,
-      required: false,
-      default: false,
-    },
     withTabs: {
       type: Boolean,
       required: false,
@@ -171,12 +178,15 @@ export default {
   data() {
     return {
       error: undefined,
+      bulkEditInProgress: false,
       filterTokens: [],
       hasAnyIssues: false,
       isInitialLoadComplete: false,
       pageInfo: {},
       pageParams: {},
       pageSize: DEFAULT_PAGE_SIZE,
+      parentId: undefined,
+      showBulkEditSidebar: false,
       sortKey: CREATED_DESC,
       state: STATUS_OPEN,
       workItems: [],
@@ -244,11 +254,49 @@ export default {
         Sentry.captureException(error);
       },
     },
+    parentId: {
+      query: workItemParent,
+      variables() {
+        return {
+          fullPath: this.fullPath,
+        };
+      },
+      update(data) {
+        return data.namespace.id;
+      },
+      skip() {
+        return !this.showBulkEditSidebar;
+      },
+    },
   },
   computed: {
     isItemSelected() {
       return !isEmpty(this.activeItem);
     },
+    allowBulkEditing() {
+      if (this.isEpicsList) {
+        return this.canBulkEditEpics;
+      }
+      if (this.isGroup) {
+        return this.canBulkUpdate && this.hasGroupBulkEditFeature;
+      }
+      return this.canBulkUpdate;
+    },
+    // TODO: delete once https://gitlab.com/gitlab-org/gitlab/-/merge_requests/185081 is merged
+    allowedWorkItemTypes() {
+      if (this.isGroup) {
+        return [];
+      }
+
+      if (this.glFeatures.okrsMvc && this.hasOkrsFeature) {
+        return BASE_ALLOWED_CREATE_TYPES.concat(
+          WORK_ITEM_TYPE_NAME_KEY_RESULT,
+          WORK_ITEM_TYPE_NAME_OBJECTIVE,
+        );
+      }
+
+      return BASE_ALLOWED_CREATE_TYPES;
+    },
     apiFilterParams() {
       return convertToApiParams(this.filterTokens);
     },
@@ -700,6 +748,36 @@ export default {
 
       this.$router.push({ query: this.urlParams });
     },
+    async handleWorkItemBulkEdit({ ids, addLabelIds, removeLabelIds }) {
+      this.bulkEditInProgress = true;
+
+      try {
+        await this.$apollo.mutate({
+          mutation: workItemBulkUpdateMutation,
+          variables: {
+            input: {
+              parentId: this.parentId,
+              ids,
+              labelsWidget: {
+                addLabelIds,
+                removeLabelIds,
+              },
+            },
+          },
+        });
+
+        await this.refetchItems();
+      } catch (error) {
+        createAlert({
+          message: s__('WorkItem|Something went wrong while bulk editing.'),
+          captureError: true,
+          error,
+        });
+      } finally {
+        this.bulkEditInProgress = false;
+        this.showBulkEditSidebar = false;
+      }
+    },
     saveSortPreference(sortKey) {
       this.$apollo
         .mutate({
@@ -870,13 +948,31 @@ export default {
         @select-issuable="handleToggle"
       >
         <template #nav-actions>
-          <gl-button
-            v-if="enableClientSideBoardsExperiment"
-            data-testid="show-local-board-button"
-            @click="showLocalBoard = true"
-            >{{ __('Launch board') }}</gl-button
-          >
-          <slot name="nav-actions"> </slot>
+          <div class="gl-flex gl-gap-3">
+            <gl-button
+              v-if="enableClientSideBoardsExperiment"
+              data-testid="show-local-board-button"
+              @click="showLocalBoard = true"
+            >
+              {{ __('Launch board') }}
+            </gl-button>
+            <gl-button
+              v-if="allowBulkEditing"
+              :disabled="showBulkEditSidebar"
+              data-testid="bulk-edit-start-button"
+              @click="showBulkEditSidebar = true"
+            >
+              {{ __('Bulk edit') }}
+            </gl-button>
+            <create-work-item-modal
+              v-if="showNewWorkItem"
+              :allowed-work-item-types="allowedWorkItemTypes"
+              :always-show-work-item-type-select="!isEpicsList"
+              :is-group="isGroup"
+              :preselected-work-item-type="preselectedWorkItemType"
+              @workItemCreated="refetchItems"
+            />
+          </div>
         </template>
 
         <template #timeframe="{ issuable = {} }">
@@ -900,11 +996,27 @@ export default {
         </template>
 
         <template #bulk-edit-actions="{ checkedIssuables }">
-          <slot name="bulk-edit-actions" :checked-issuables="checkedIssuables"></slot>
+          <gl-button
+            :disabled="!checkedIssuables.length || bulkEditInProgress"
+            form="work-item-list-bulk-edit"
+            :loading="bulkEditInProgress"
+            type="submit"
+            variant="confirm"
+          >
+            {{ __('Update selected') }}
+          </gl-button>
+          <gl-button class="gl-float-right" @click="showBulkEditSidebar = false">
+            {{ __('Cancel') }}
+          </gl-button>
         </template>
 
         <template #sidebar-items="{ checkedIssuables }">
-          <slot name="sidebar-items" :checked-issuables="checkedIssuables"></slot>
+          <work-item-bulk-edit-sidebar
+            :checked-items="checkedIssuables"
+            :full-path="fullPath"
+            :is-group="isGroup"
+            @bulk-update="handleWorkItemBulkEdit"
+          />
         </template>
 
         <template #health-status="{ issuable = {} }">
diff --git a/app/helpers/work_items_helper.rb b/app/helpers/work_items_helper.rb
index b613ee0e8bb..1bc370c81ff 100644
--- a/app/helpers/work_items_helper.rb
+++ b/app/helpers/work_items_helper.rb
@@ -9,6 +9,7 @@ module WorkItemsHelper
     {
       autocomplete_award_emojis_path: autocomplete_award_emojis_path,
       can_admin_label: can?(current_user, :admin_label, resource_parent).to_s,
+      can_bulk_update: can?(current_user, :admin_issue, resource_parent).to_s,
       full_path: resource_parent.full_path,
       group_path: group&.full_path,
       issues_list_path:
@@ -22,7 +23,7 @@ module WorkItemsHelper
       default_branch: resource_parent.is_a?(Project) ? resource_parent.default_branch_or_main : nil,
       initial_sort: current_user&.user_preference&.issues_sort,
       is_signed_in: current_user.present?.to_s,
-      show_new_issue_link: can?(current_user, :create_work_item, group).to_s,
+      show_new_work_item: can?(current_user, :create_work_item, group).to_s,
       can_create_projects: can?(current_user, :create_projects, group).to_s,
       new_project_path: new_project_path(namespace_id: group&.id),
       group_id: group&.id,
diff --git a/app/models/protected_branch/push_access_level.rb b/app/models/protected_branch/push_access_level.rb
index c65723871b0..6998f6c7403 100644
--- a/app/models/protected_branch/push_access_level.rb
+++ b/app/models/protected_branch/push_access_level.rb
@@ -5,4 +5,10 @@ class ProtectedBranch::PushAccessLevel < ApplicationRecord
   include ProtectedRefDeployKeyAccess
   # default value for the access_level column
   GITLAB_DEFAULT_ACCESS_LEVEL = Gitlab::Access::MAINTAINER
+
+  ignore_column :id_convert_to_bigint, remove_with: '18.3', remove_after: '2025-07-06'
+  ignore_column :protected_branch_id_convert_to_bigint, remove_with: '18.3', remove_after: '2025-07-06'
+  ignore_column :user_id_convert_to_bigint, remove_with: '18.3', remove_after: '2025-07-06'
+  ignore_column :group_id_convert_to_bigint, remove_with: '18.3', remove_after: '2025-07-06'
+  ignore_column :deploy_key_id_convert_to_bigint, remove_with: '18.3', remove_after: '2025-07-06'
 end
diff --git a/app/views/shared/issuable/_sidebar.html.haml b/app/views/shared/issuable/_sidebar.html.haml
index daf6e223259..49cbf086948 100644
--- a/app/views/shared/issuable/_sidebar.html.haml
+++ b/app/views/shared/issuable/_sidebar.html.haml
@@ -74,14 +74,6 @@
         -# haml-lint:disable InlineJavaScript
         %script#js-confidential-issue-data{ type: "application/json" }= { is_confidential: issuable_sidebar[:confidential], is_editable: can_edit_issuable }.to_json.html_safe
 
-        -# REMOVE BLOCK - cf. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172577
-        .block
-          .hide-collapsed.gl-flex.gl-items-center.gl-font-bold.gl-leading-20.gl-text-default
-            = _('Confidentiality')
-          .hide-collapsed.gl-text-subtle
-            = _("Confidentiality controls have moved to the issue actions menu (%{icon}) at the top of the page.").html_safe % { icon: sprite_icon('ellipsis_v', size: 12, css_class: 'gl-align-middle') }
-        -# END REMOVE BLOCK
-
         = render_if_exists 'shared/issuable/sidebar_cve_id_request', issuable_sidebar: issuable_sidebar
 
       .js-sidebar-participants-widget-root
diff --git a/config/feature_flags/gitlab_com_derisk/load_balancer_replace_hosts.yml b/config/feature_flags/gitlab_com_derisk/load_balancer_replace_hosts.yml
new file mode 100644
index 00000000000..0ca184c4105
--- /dev/null
+++ b/config/feature_flags/gitlab_com_derisk/load_balancer_replace_hosts.yml
@@ -0,0 +1,8 @@
+name: load_balancer_replace_hosts
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/497226
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170129
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/534523
+milestone: '18.0'
+group: group::database frameworks
+type: gitlab_com_derisk
+default_enabled: false
diff --git a/db/docs/batched_background_migrations/backfill_protected_branch_push_access_levels_fields.yml b/db/docs/batched_background_migrations/backfill_protected_branch_push_access_levels_fields.yml
new file mode 100644
index 00000000000..ba591c40922
--- /dev/null
+++ b/db/docs/batched_background_migrations/backfill_protected_branch_push_access_levels_fields.yml
@@ -0,0 +1,10 @@
+---
+migration_job_name: BackfillProtectedBranchPushAccessLevelsFields
+description: Backfills sharding key `protected_branch_push_access_levels.protected_branch_project_id`,
+  `protected_branch_push_access_levels.protected_branch_namespace_id` from `protected_branches` and
+  convert int columns to bigint.
+feature_category: source_code_management
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/175714
+milestone: '18.0'
+queued_migration_version: 20250414090268
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/batched_background_migrations/fix_string_config_hashes_group_streaming_destinations.yml b/db/docs/batched_background_migrations/fix_string_config_hashes_group_streaming_destinations.yml
new file mode 100644
index 00000000000..ecdb1ee62f8
--- /dev/null
+++ b/db/docs/batched_background_migrations/fix_string_config_hashes_group_streaming_destinations.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: FixStringConfigHashesGroupStreamingDestinations
+description: Fixes any string config hashes to jsonb
+feature_category: audit_events
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/187558
+milestone: '18.0'
+queued_migration_version: 20250409141444
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/batched_background_migrations/fix_string_config_hashes_instance_streaming_destinations.yml b/db/docs/batched_background_migrations/fix_string_config_hashes_instance_streaming_destinations.yml
new file mode 100644
index 00000000000..9f28775f8ee
--- /dev/null
+++ b/db/docs/batched_background_migrations/fix_string_config_hashes_instance_streaming_destinations.yml
@@ -0,0 +1,8 @@
+---
+migration_job_name: FixStringConfigHashesInstanceStreamingDestinations
+description: Fixes any string config hashes to jsonb
+feature_category: audit_events
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/187558
+milestone: '18.0'
+queued_migration_version: 20250409141503
+finalized_by: # version of the migration that finalized this BBM
diff --git a/db/docs/protected_branch_push_access_levels.yml b/db/docs/protected_branch_push_access_levels.yml
index f78880ca3f9..fed7f5e4a9f 100644
--- a/db/docs/protected_branch_push_access_levels.yml
+++ b/db/docs/protected_branch_push_access_levels.yml
@@ -26,3 +26,5 @@ desired_sharding_key:
         sharding_key: namespace_id
         belongs_to: protected_branch
 table_size: small
+desired_sharding_key_migration_job_name:
+- BackfillProtectedBranchPushAccessLevelsFields
diff --git a/db/migrate/20250414090241_add_protected_branch_project_id_to_protected_branch_push_access_levels.rb b/db/migrate/20250414090241_add_protected_branch_project_id_to_protected_branch_push_access_levels.rb
new file mode 100644
index 00000000000..ca5ae78197e
--- /dev/null
+++ b/db/migrate/20250414090241_add_protected_branch_project_id_to_protected_branch_push_access_levels.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddProtectedBranchProjectIdToProtectedBranchPushAccessLevels < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  def change
+    add_column :protected_branch_push_access_levels, :protected_branch_project_id, :bigint
+  end
+end
diff --git a/db/migrate/20250414090252_add_protected_branch_namespace_id_to_protected_branch_push_access_levels.rb b/db/migrate/20250414090252_add_protected_branch_namespace_id_to_protected_branch_push_access_levels.rb
new file mode 100644
index 00000000000..fab0c42ca2a
--- /dev/null
+++ b/db/migrate/20250414090252_add_protected_branch_namespace_id_to_protected_branch_push_access_levels.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddProtectedBranchNamespaceIdToProtectedBranchPushAccessLevels < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  def change
+    add_column :protected_branch_push_access_levels, :protected_branch_namespace_id, :bigint
+  end
+end
diff --git a/db/migrate/20250415101548_drop_not_null_constraint_from_merge_request_diff_commits.rb b/db/migrate/20250415101548_drop_not_null_constraint_from_merge_request_diff_commits.rb
index 427aaaa458a..a36a77f5ae1 100644
--- a/db/migrate/20250415101548_drop_not_null_constraint_from_merge_request_diff_commits.rb
+++ b/db/migrate/20250415101548_drop_not_null_constraint_from_merge_request_diff_commits.rb
@@ -3,12 +3,10 @@
 class DropNotNullConstraintFromMergeRequestDiffCommits < Gitlab::Database::Migration[2.2]
   milestone '18.0'
 
-  # rubocop:disable Migration/ChangeColumnNullOnHighTrafficTable -- We're making them nullable and there is no constraint
   def up
     change_column_null :merge_request_diff_commits, :sha, true
     change_column_null :merge_request_diff_commits, :trailers, true
   end
-  # rubocop:enable Migration/ChangeColumnNullOnHighTrafficTable
 
   def down
     # no-op
diff --git a/db/post_migrate/20240318130900_remove_not_null_constraint_from_traversal_ids_if_exists.rb b/db/post_migrate/20240318130900_remove_not_null_constraint_from_traversal_ids_if_exists.rb
index bef417a0c8f..e09eef37f02 100644
--- a/db/post_migrate/20240318130900_remove_not_null_constraint_from_traversal_ids_if_exists.rb
+++ b/db/post_migrate/20240318130900_remove_not_null_constraint_from_traversal_ids_if_exists.rb
@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-# rubocop:disable Migration/ChangeColumnNullOnHighTrafficTable -- The cop is introduced after this migration.
 class RemoveNotNullConstraintFromTraversalIdsIfExists < Gitlab::Database::Migration[2.2]
   disable_ddl_transaction!
   milestone '16.11'
@@ -27,4 +26,3 @@ class RemoveNotNullConstraintFromTraversalIdsIfExists < Gitlab::Database::Migrat
     # no-op
   end
 end
-# rubocop:enable Migration/ChangeColumnNullOnHighTrafficTable
diff --git a/db/post_migrate/20250409141444_queue_fix_string_config_hashes_group_streaming_destinations.rb b/db/post_migrate/20250409141444_queue_fix_string_config_hashes_group_streaming_destinations.rb
new file mode 100644
index 00000000000..5b29b00fa76
--- /dev/null
+++ b/db/post_migrate/20250409141444_queue_fix_string_config_hashes_group_streaming_destinations.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class QueueFixStringConfigHashesGroupStreamingDestinations < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  MIGRATION = "FixStringConfigHashesGroupStreamingDestinations"
+  BATCH_SIZE = 100
+  SUB_BATCH_SIZE = 10
+
+  def up
+    queue_batched_background_migration(
+      MIGRATION,
+      :audit_events_group_external_streaming_destinations,
+      :id,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :audit_events_group_external_streaming_destinations, :id, [])
+  end
+end
diff --git a/db/post_migrate/20250409141503_queue_fix_string_config_hashes_instance_streaming_destinations.rb b/db/post_migrate/20250409141503_queue_fix_string_config_hashes_instance_streaming_destinations.rb
new file mode 100644
index 00000000000..afe7005b65f
--- /dev/null
+++ b/db/post_migrate/20250409141503_queue_fix_string_config_hashes_instance_streaming_destinations.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class QueueFixStringConfigHashesInstanceStreamingDestinations < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main
+
+  MIGRATION = "FixStringConfigHashesInstanceStreamingDestinations"
+  BATCH_SIZE = 100
+  SUB_BATCH_SIZE = 10
+
+  def up
+    queue_batched_background_migration(
+      MIGRATION,
+      :audit_events_instance_external_streaming_destinations,
+      :id,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(MIGRATION, :audit_events_instance_external_streaming_destinations, :id, [])
+  end
+end
diff --git a/db/post_migrate/20250414090246_index_protected_branch_push_access_levels_on_protected_branch_project_id.rb b/db/post_migrate/20250414090246_index_protected_branch_push_access_levels_on_protected_branch_project_id.rb
new file mode 100644
index 00000000000..ec62ef85a56
--- /dev/null
+++ b/db/post_migrate/20250414090246_index_protected_branch_push_access_levels_on_protected_branch_project_id.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class IndexProtectedBranchPushAccessLevelsOnProtectedBranchProjectId < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+  disable_ddl_transaction!
+
+  INDEX_NAME = 'index_protected_branch_push_access_levels_on_protected_branch_p'
+
+  def up
+    add_concurrent_index :protected_branch_push_access_levels, :protected_branch_project_id, name: INDEX_NAME
+  end
+
+  def down
+    remove_concurrent_index_by_name :protected_branch_push_access_levels, INDEX_NAME
+  end
+end
diff --git a/db/post_migrate/20250414090248_add_protected_branch_push_access_levels_protected_branch_project_id_fk.rb b/db/post_migrate/20250414090248_add_protected_branch_push_access_levels_protected_branch_project_id_fk.rb
new file mode 100644
index 00000000000..94c4a1d6f07
--- /dev/null
+++ b/db/post_migrate/20250414090248_add_protected_branch_push_access_levels_protected_branch_project_id_fk.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddProtectedBranchPushAccessLevelsProtectedBranchProjectIdFk < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_foreign_key :protected_branch_push_access_levels, :projects, column: :protected_branch_project_id,
+      on_delete: :cascade
+  end
+
+  def down
+    with_lock_retries do
+      remove_foreign_key :protected_branch_push_access_levels, column: :protected_branch_project_id
+    end
+  end
+end
diff --git a/db/post_migrate/20250414090250_add_protected_branch_push_access_levels_protected_branch_project_id_trigger.rb b/db/post_migrate/20250414090250_add_protected_branch_push_access_levels_protected_branch_project_id_trigger.rb
new file mode 100644
index 00000000000..b6f60a1cd82
--- /dev/null
+++ b/db/post_migrate/20250414090250_add_protected_branch_push_access_levels_protected_branch_project_id_trigger.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class AddProtectedBranchPushAccessLevelsProtectedBranchProjectIdTrigger < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  def up
+    install_sharding_key_assignment_trigger(
+      table: :protected_branch_push_access_levels,
+      sharding_key: :protected_branch_project_id,
+      parent_table: :protected_branches,
+      parent_sharding_key: :project_id,
+      foreign_key: :protected_branch_id
+    )
+  end
+
+  def down
+    remove_sharding_key_assignment_trigger(
+      table: :protected_branch_push_access_levels,
+      sharding_key: :protected_branch_project_id,
+      parent_table: :protected_branches,
+      parent_sharding_key: :project_id,
+      foreign_key: :protected_branch_id
+    )
+  end
+end
diff --git a/db/post_migrate/20250414090255_index_protected_branch_push_access_levels_on_protected_branch_namespace_id.rb b/db/post_migrate/20250414090255_index_protected_branch_push_access_levels_on_protected_branch_namespace_id.rb
new file mode 100644
index 00000000000..cbef7a67c5d
--- /dev/null
+++ b/db/post_migrate/20250414090255_index_protected_branch_push_access_levels_on_protected_branch_namespace_id.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class IndexProtectedBranchPushAccessLevelsOnProtectedBranchNamespaceId < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+  disable_ddl_transaction!
+
+  INDEX_NAME = 'index_protected_branch_push_access_levels_on_protected_branch_n'
+
+  def up
+    add_concurrent_index :protected_branch_push_access_levels, :protected_branch_namespace_id, name: INDEX_NAME
+  end
+
+  def down
+    remove_concurrent_index_by_name :protected_branch_push_access_levels, INDEX_NAME
+  end
+end
diff --git a/db/post_migrate/20250414090258_add_protected_branch_push_access_levels_protected_branch_namespace_id_fk.rb b/db/post_migrate/20250414090258_add_protected_branch_push_access_levels_protected_branch_namespace_id_fk.rb
new file mode 100644
index 00000000000..d86450388bd
--- /dev/null
+++ b/db/post_migrate/20250414090258_add_protected_branch_push_access_levels_protected_branch_namespace_id_fk.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddProtectedBranchPushAccessLevelsProtectedBranchNamespaceIdFk < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_foreign_key :protected_branch_push_access_levels, :namespaces,
+      column: :protected_branch_namespace_id, on_delete: :cascade
+  end
+
+  def down
+    with_lock_retries do
+      remove_foreign_key :protected_branch_push_access_levels, column: :protected_branch_namespace_id
+    end
+  end
+end
diff --git a/db/post_migrate/20250414090260_add_protected_branch_push_access_levels_protected_branch_namespace_id_trigger.rb b/db/post_migrate/20250414090260_add_protected_branch_push_access_levels_protected_branch_namespace_id_trigger.rb
new file mode 100644
index 00000000000..d770ddb58ae
--- /dev/null
+++ b/db/post_migrate/20250414090260_add_protected_branch_push_access_levels_protected_branch_namespace_id_trigger.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class AddProtectedBranchPushAccessLevelsProtectedBranchNamespaceIdTrigger < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+
+  def up
+    install_sharding_key_assignment_trigger(
+      table: :protected_branch_push_access_levels,
+      sharding_key: :protected_branch_namespace_id,
+      parent_table: :protected_branches,
+      parent_sharding_key: :namespace_id,
+      foreign_key: :protected_branch_id
+    )
+  end
+
+  def down
+    remove_sharding_key_assignment_trigger(
+      table: :protected_branch_push_access_levels,
+      sharding_key: :protected_branch_namespace_id,
+      parent_table: :protected_branches,
+      parent_sharding_key: :namespace_id,
+      foreign_key: :protected_branch_id
+    )
+  end
+end
diff --git a/db/post_migrate/20250414090264_int_conversion_for_protected_branch_push_access_levels_fields.rb b/db/post_migrate/20250414090264_int_conversion_for_protected_branch_push_access_levels_fields.rb
new file mode 100644
index 00000000000..597694d32eb
--- /dev/null
+++ b/db/post_migrate/20250414090264_int_conversion_for_protected_branch_push_access_levels_fields.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class IntConversionForProtectedBranchPushAccessLevelsFields < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+  milestone '18.0'
+
+  TABLE = :protected_branch_push_access_levels
+  COLUMNS = %i[id protected_branch_id user_id group_id deploy_key_id]
+
+  def up
+    initialize_conversion_of_integer_to_bigint(TABLE, COLUMNS)
+  end
+
+  def down
+    revert_initialize_conversion_of_integer_to_bigint(TABLE, COLUMNS)
+  end
+end
diff --git a/db/post_migrate/20250414090268_queue_backfill_protected_branch_push_access_levels_fields.rb b/db/post_migrate/20250414090268_queue_backfill_protected_branch_push_access_levels_fields.rb
new file mode 100644
index 00000000000..74c14ab5204
--- /dev/null
+++ b/db/post_migrate/20250414090268_queue_backfill_protected_branch_push_access_levels_fields.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class QueueBackfillProtectedBranchPushAccessLevelsFields < Gitlab::Database::Migration[2.2]
+  milestone '18.0'
+  restrict_gitlab_migration gitlab_schema: :gitlab_main_cell
+
+  MIGRATION = "BackfillProtectedBranchPushAccessLevelsFields"
+  DELAY_INTERVAL = 2.minutes
+  BATCH_SIZE = 1000
+  SUB_BATCH_SIZE = 100
+
+  def up
+    queue_batched_background_migration(
+      MIGRATION,
+      :protected_branch_push_access_levels,
+      :id,
+      job_interval: DELAY_INTERVAL,
+      batch_size: BATCH_SIZE,
+      sub_batch_size: SUB_BATCH_SIZE
+    )
+  end
+
+  def down
+    delete_batched_background_migration(
+      MIGRATION,
+      :protected_branch_push_access_levels,
+      :id,
+      []
+    )
+  end
+end
diff --git a/db/schema_migrations/20250409141444 b/db/schema_migrations/20250409141444
new file mode 100644
index 00000000000..ab130de135c
--- /dev/null
+++ b/db/schema_migrations/20250409141444
@@ -0,0 +1 @@
+fc74ee7659582047ff80b7ae0f82a6cca6c44178bdf25f6785cb296e2368f10a
\ No newline at end of file
diff --git a/db/schema_migrations/20250409141503 b/db/schema_migrations/20250409141503
new file mode 100644
index 00000000000..971bf647b7c
--- /dev/null
+++ b/db/schema_migrations/20250409141503
@@ -0,0 +1 @@
+4331890af7c3f3160228795ff472073812024bce537af87453d53717f82b8c0e
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090241 b/db/schema_migrations/20250414090241
new file mode 100644
index 00000000000..580cd1123c1
--- /dev/null
+++ b/db/schema_migrations/20250414090241
@@ -0,0 +1 @@
+1d983d3b65c64b6fd515e27dcb03aecd240770c111379fe3fa17d0879de31965
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090246 b/db/schema_migrations/20250414090246
new file mode 100644
index 00000000000..7879ddb811b
--- /dev/null
+++ b/db/schema_migrations/20250414090246
@@ -0,0 +1 @@
+f2120497fb547da5c515da8355ed40af915f9afc0fb77bd2cc384185c602cabe
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090248 b/db/schema_migrations/20250414090248
new file mode 100644
index 00000000000..55e298339de
--- /dev/null
+++ b/db/schema_migrations/20250414090248
@@ -0,0 +1 @@
+f638bd9948347d38f8439d3755a2e89d297de07debe6573bfebff0c4a7dbe475
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090250 b/db/schema_migrations/20250414090250
new file mode 100644
index 00000000000..da7839b4ec2
--- /dev/null
+++ b/db/schema_migrations/20250414090250
@@ -0,0 +1 @@
+1c74e2ec07e4424f5b736ef9f764b2e0941b56bb84ab10bebd0c1b7171f67984
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090252 b/db/schema_migrations/20250414090252
new file mode 100644
index 00000000000..40ec7cdd5cd
--- /dev/null
+++ b/db/schema_migrations/20250414090252
@@ -0,0 +1 @@
+5b9b6439940b575b7e3ff88411d15469d5645f75082a5c5ee682c62a05d4ecc5
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090255 b/db/schema_migrations/20250414090255
new file mode 100644
index 00000000000..ad79f3d6b6e
--- /dev/null
+++ b/db/schema_migrations/20250414090255
@@ -0,0 +1 @@
+ab0deb7ce441a02283208bf5253498fe33bf6ecf6a34623ed6beb3a27c059b33
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090258 b/db/schema_migrations/20250414090258
new file mode 100644
index 00000000000..3480775f879
--- /dev/null
+++ b/db/schema_migrations/20250414090258
@@ -0,0 +1 @@
+ccdba2146deda114c1ab90b0a0e2f26383497a823fd63ea66abbb0426ec6fa38
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090260 b/db/schema_migrations/20250414090260
new file mode 100644
index 00000000000..081c1854909
--- /dev/null
+++ b/db/schema_migrations/20250414090260
@@ -0,0 +1 @@
+67a7a5942983782bbe1b3633a1e2999b09b81b8733b0a1d29023724e579c2473
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090264 b/db/schema_migrations/20250414090264
new file mode 100644
index 00000000000..488f36b032c
--- /dev/null
+++ b/db/schema_migrations/20250414090264
@@ -0,0 +1 @@
+e77791a135a195582aca639397fb2e198109ce9a157bd43d8368ff2738df23c2
\ No newline at end of file
diff --git a/db/schema_migrations/20250414090268 b/db/schema_migrations/20250414090268
new file mode 100644
index 00000000000..89df7e97c33
--- /dev/null
+++ b/db/schema_migrations/20250414090268
@@ -0,0 +1 @@
+b1692892e1bc9684cd824b0190d7090fab917a5ef14e749a7e865a78d69441fe
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index cc589f635e3..4348f9bd9a3 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -1168,6 +1168,22 @@ BEGIN
 END;
 $$;
 
+CREATE FUNCTION trigger_009314eae986() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+IF NEW."protected_branch_project_id" IS NULL THEN
+  SELECT "project_id"
+  INTO NEW."protected_branch_project_id"
+  FROM "protected_branches"
+  WHERE "protected_branches"."id" = NEW."protected_branch_id";
+END IF;
+
+RETURN NEW;
+
+END
+$$;
+
 CREATE FUNCTION trigger_01b3fc052119() RETURNS trigger
     LANGUAGE plpgsql
     AS $$
@@ -2690,6 +2706,22 @@ RETURN NEW;
 END
 $$;
 
+CREATE FUNCTION trigger_744ab45ee5ac() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+IF NEW."protected_branch_namespace_id" IS NULL THEN
+  SELECT "namespace_id"
+  INTO NEW."protected_branch_namespace_id"
+  FROM "protected_branches"
+  WHERE "protected_branches"."id" = NEW."protected_branch_id";
+END IF;
+
+RETURN NEW;
+
+END
+$$;
+
 CREATE FUNCTION trigger_7495f5e0efcb() RETURNS trigger
     LANGUAGE plpgsql
     AS $$
@@ -21793,7 +21825,9 @@ CREATE TABLE protected_branch_push_access_levels (
     updated_at timestamp without time zone NOT NULL,
     user_id bigint,
     group_id bigint,
-    deploy_key_id bigint
+    deploy_key_id bigint,
+    protected_branch_project_id bigint,
+    protected_branch_namespace_id bigint
 );
 
 CREATE SEQUENCE protected_branch_push_access_levels_id_seq
@@ -37130,6 +37164,10 @@ CREATE INDEX index_protected_branch_push_access ON protected_branch_push_access_
 
 CREATE INDEX index_protected_branch_push_access_levels_on_group_id ON protected_branch_push_access_levels USING btree (group_id);
 
+CREATE INDEX index_protected_branch_push_access_levels_on_protected_branch_n ON protected_branch_push_access_levels USING btree (protected_branch_namespace_id);
+
+CREATE INDEX index_protected_branch_push_access_levels_on_protected_branch_p ON protected_branch_push_access_levels USING btree (protected_branch_project_id);
+
 CREATE INDEX index_protected_branch_push_access_levels_on_user_id ON protected_branch_push_access_levels USING btree (user_id);
 
 CREATE INDEX index_protected_branch_unprotect_access ON protected_branch_unprotect_access_levels USING btree (protected_branch_id);
@@ -41468,6 +41506,8 @@ CREATE TRIGGER tags_loose_fk_trigger AFTER DELETE ON tags REFERENCING OLD TABLE
 
 CREATE TRIGGER terraform_state_versions_loose_fk_trigger AFTER DELETE ON terraform_state_versions REFERENCING OLD TABLE AS old_table FOR EACH STATEMENT EXECUTE FUNCTION insert_into_loose_foreign_keys_deleted_records();
 
+CREATE TRIGGER trigger_009314eae986 BEFORE INSERT OR UPDATE ON protected_branch_push_access_levels FOR EACH ROW EXECUTE FUNCTION trigger_009314eae986();
+
 CREATE TRIGGER trigger_01b3fc052119 BEFORE INSERT OR UPDATE ON approval_merge_request_rules FOR EACH ROW EXECUTE FUNCTION trigger_01b3fc052119();
 
 CREATE TRIGGER trigger_02450faab875 BEFORE INSERT OR UPDATE ON vulnerability_occurrence_identifiers FOR EACH ROW EXECUTE FUNCTION trigger_02450faab875();
@@ -41658,6 +41698,8 @@ CREATE TRIGGER trigger_738125833856 BEFORE INSERT OR UPDATE ON bulk_import_confi
 
 CREATE TRIGGER trigger_740afa9807b8 BEFORE INSERT OR UPDATE ON subscription_user_add_on_assignments FOR EACH ROW EXECUTE FUNCTION trigger_740afa9807b8();
 
+CREATE TRIGGER trigger_744ab45ee5ac BEFORE INSERT OR UPDATE ON protected_branch_push_access_levels FOR EACH ROW EXECUTE FUNCTION trigger_744ab45ee5ac();
+
 CREATE TRIGGER trigger_7495f5e0efcb BEFORE INSERT OR UPDATE ON snippet_user_mentions FOR EACH ROW EXECUTE FUNCTION trigger_7495f5e0efcb();
 
 CREATE TRIGGER trigger_765cae42cd77 BEFORE INSERT OR UPDATE ON bulk_import_trackers FOR EACH ROW EXECUTE FUNCTION trigger_765cae42cd77();
@@ -42877,6 +42919,9 @@ ALTER TABLE ONLY deploy_tokens
 ALTER TABLE ONLY oauth_openid_requests
     ADD CONSTRAINT fk_7092424b77 FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY protected_branch_push_access_levels
+    ADD CONSTRAINT fk_70dc11e706 FOREIGN KEY (protected_branch_namespace_id) REFERENCES namespaces(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY bulk_import_failures
     ADD CONSTRAINT fk_70f30b02fd FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
@@ -43861,6 +43906,9 @@ ALTER TABLE ONLY ci_sources_pipelines
 ALTER TABLE p_ci_builds_metadata
     ADD CONSTRAINT fk_e20479742e_p FOREIGN KEY (partition_id, build_id) REFERENCES p_ci_builds(partition_id, id) ON UPDATE CASCADE ON DELETE CASCADE;
 
+ALTER TABLE ONLY protected_branch_push_access_levels
+    ADD CONSTRAINT fk_e23067f9e1 FOREIGN KEY (protected_branch_project_id) REFERENCES projects(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY gitlab_subscriptions
     ADD CONSTRAINT fk_e2595d00a1 FOREIGN KEY (namespace_id) REFERENCES namespaces(id) ON DELETE CASCADE;
 
diff --git a/doc/user/group/import/migrated_items.md b/doc/user/group/import/migrated_items.md
index 22e64573b70..2c22d1b0430 100644
--- a/doc/user/group/import/migrated_items.md
+++ b/doc/user/group/import/migrated_items.md
@@ -74,9 +74,9 @@ Some group items are excluded from migration because they:
   - Deploy tokens
   - Webhooks
 - Are not supported:
-  - Push rules
   - Iteration cadence settings
   - Pending member invitations
+  - Push rules
 
 ## Migrated project items
 
@@ -220,8 +220,8 @@ Setting-related project items that are migrated to the destination GitLab instan
 Some project items are excluded from migration because they:
 
 - Might contain sensitive information:
-  - CI/CD variables
   - CI/CD job logs
+  - CI/CD variables
   - Container registry images
   - Deploy keys
   - Deploy tokens
@@ -232,6 +232,11 @@ Some project items are excluded from migration because they:
   - Webhooks
 - Are not supported:
   - Agents
+  - Container registry
+  - Environments
+  - Feature flags
+  - Infrastructure registry
+  - Linked issues
   - Merge request approval rules
 
     {{< alert type="note" >}}
@@ -240,11 +245,8 @@ Some project items are excluded from migration because they:
 
     {{< /alert >}}
 
-  - Container registry
-  - Environments
-  - Feature flags
-  - Infrastructure registry
+  - Merge request dependencies
   - Package registry
   - Pages domains
-  - Remote mirrors
   - Pending member invitations
+  - Remote mirrors
diff --git a/lib/authn/tokens/personal_access_token.rb b/lib/authn/tokens/personal_access_token.rb
index 7d6f98ebc8a..1b044758e70 100644
--- a/lib/authn/tokens/personal_access_token.rb
+++ b/lib/authn/tokens/personal_access_token.rb
@@ -4,10 +4,12 @@ module Authn
   module Tokens
     class PersonalAccessToken
       def self.prefix?(plaintext)
-        plaintext.start_with?(
+        token_prefixes = [
           ::PersonalAccessToken.token_prefix,
           ApplicationSetting.defaults[:personal_access_token_prefix]
-        )
+        ].uniq.compact.reject(&:empty?)
+
+        plaintext.start_with?(*token_prefixes)
       end
 
       attr_reader :revocable, :source
diff --git a/lib/gitlab/background_migration/backfill_protected_branch_push_access_levels_fields.rb b/lib/gitlab/background_migration/backfill_protected_branch_push_access_levels_fields.rb
new file mode 100644
index 00000000000..b7a6dc77789
--- /dev/null
+++ b/lib/gitlab/background_migration/backfill_protected_branch_push_access_levels_fields.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class BackfillProtectedBranchPushAccessLevelsFields < BatchedMigrationJob
+      operation_name :backfill_protected_branch_push_access_levels_fields
+      feature_category :source_code_management
+
+      COLUMNS_CONVERT_TO_BIGINT = %w[
+        id_convert_to_bigint
+        protected_branch_id_convert_to_bigint
+        user_id_convert_to_bigint
+        group_id_convert_to_bigint
+        deploy_key_id_convert_to_bigint
+      ].freeze
+
+      delegate :quote_column_name, :quote_table_name, to: :connection
+
+      def perform
+        each_sub_batch do |sub_batch|
+          connection.execute(
+            <<~SQL
+              WITH filtered_relation AS MATERIALIZED (#{sub_batch.limit(100).to_sql})
+              UPDATE protected_branch_push_access_levels
+              SET protected_branch_namespace_id = protected_branches.namespace_id,
+                protected_branch_project_id = protected_branches.project_id
+                #{bigint_column_assignments}
+              FROM filtered_relation INNER JOIN protected_branches
+              ON protected_branches.id = filtered_relation.protected_branch_id
+              WHERE protected_branch_push_access_levels.id = filtered_relation.id
+            SQL
+          )
+        end
+      end
+
+      private
+
+      def bigint_column_assignments
+        @bigint_assignments ||=
+          COLUMNS_CONVERT_TO_BIGINT.filter_map do |bigint_column|
+            next unless all_column_names.include?(bigint_column)
+
+            source_column = bigint_column.sub('_convert_to_bigint', '')
+
+            ",\n#{quote_column_name(bigint_column)} = filtered_relation.#{quote_column_name(source_column)}"
+          end.join('')
+      end
+
+      def all_column_names
+        @all_column_names ||= connection.columns(:protected_branch_push_access_levels).map(&:name)
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/background_migration/fix_string_config_hashes_group_streaming_destinations.rb b/lib/gitlab/background_migration/fix_string_config_hashes_group_streaming_destinations.rb
new file mode 100644
index 00000000000..86149fecca6
--- /dev/null
+++ b/lib/gitlab/background_migration/fix_string_config_hashes_group_streaming_destinations.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class FixStringConfigHashesGroupStreamingDestinations < BatchedMigrationJob
+      # This batched background migration is EE-only
+      # Migration file: ee/lib/ee/gitlab/background_migration/fix_string_config_hashes_group_streaming_destinations.rb
+
+      feature_category :audit_events
+
+      def perform; end
+    end
+  end
+end
+
+Gitlab::BackgroundMigration::FixStringConfigHashesGroupStreamingDestinations.prepend_mod
diff --git a/lib/gitlab/background_migration/fix_string_config_hashes_instance_streaming_destinations.rb b/lib/gitlab/background_migration/fix_string_config_hashes_instance_streaming_destinations.rb
new file mode 100644
index 00000000000..a50a74649bc
--- /dev/null
+++ b/lib/gitlab/background_migration/fix_string_config_hashes_instance_streaming_destinations.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module BackgroundMigration
+    class FixStringConfigHashesInstanceStreamingDestinations < BatchedMigrationJob
+      # This batched background migration is EE-only
+      # Migration file:
+      # ee/lib/ee/gitlab/background_migration/fix_string_config_hashes_instance_streaming_destinations.rb
+      feature_category :audit_events
+
+      def perform; end
+    end
+  end
+end
+
+Gitlab::BackgroundMigration::FixStringConfigHashesInstanceStreamingDestinations.prepend_mod
diff --git a/lib/gitlab/database/load_balancing/service_discovery.rb b/lib/gitlab/database/load_balancing/service_discovery.rb
index 890dde3c843..24351da3e1f 100644
--- a/lib/gitlab/database/load_balancing/service_discovery.rb
+++ b/lib/gitlab/database/load_balancing/service_discovery.rb
@@ -31,7 +31,7 @@ module Gitlab
           'SRV' => Net::DNS::SRV
         }.freeze
 
-        Address = Struct.new(:hostname, :port) do
+        Address = Data.define(:hostname, :port) do
           def to_s
             port ? "#{hostname}:#{port}" : hostname
           end
@@ -136,11 +136,19 @@ module Gitlab
           wait_time
         end
 
+        def replace_hosts(addresses)
+          if replace_hosts_enabled?
+            new_replace_hosts(addresses)
+          else
+            old_replace_hosts(addresses)
+          end
+        end
+
         # Replaces all the hosts in the load balancer with the new ones,
         # disconnecting the old connections.
         #
-        # addresses - An Array of Address structs to use for the new hosts.
-        def replace_hosts(addresses)
+        # addresses - An Array of Address Data types to use for the new hosts
+        def old_replace_hosts(addresses)
           old_hosts = load_balancer.host_list.hosts
 
           load_balancer.host_list.hosts = addresses.map do |addr|
@@ -155,6 +163,56 @@ module Gitlab
           disconnect_old_hosts(old_hosts)
         end
 
+        # Replace the hosts in the load balancer with the new ones from the addresses provided.
+        # Reuse existing hosts where the hostname and port remain unchanged.
+        # Disconnect the old connections.
+        #
+        # addresses - An Array of Address Data types to use for the new hosts
+        def new_replace_hosts(addresses)
+          old_hosts = load_balancer.host_list.hosts
+
+          # Example:
+          # old_hosts_lookup = {
+          #     Address.new("10.0.1.30", 5432) => [host1, host2],
+          #     Address.new("10.0.1.31", 5432) => [host3]
+          # }
+          old_hosts_lookup = old_hosts.each_with_object({}) do |host, hash|
+            key = Address.new(host.host.to_s, host.port)
+            (hash[key] ||= []) << host
+          end
+
+          # Find addresses that exist in both the addresses
+          # and old_hosts_lookup collections
+          hosts_to_keep = addresses & old_hosts_lookup.keys
+
+          # Create new hosts with current kept hosts
+          new_hosts = addresses.map do |addr|
+            if hosts_to_keep.include?(addr)
+              old_hosts_lookup[addr]
+            else
+              Host.new(addr.hostname, load_balancer, port: addr.port)
+            end
+          end
+
+          # Update load balancer's host list
+          load_balancer.host_list.hosts = new_hosts
+
+          # return the elements that are in the old_host_lookup, but not in addresses.
+          addresses_to_disconnect = old_hosts_lookup.keys - addresses
+
+          # Convert addresses to disconnect back to Host objects before disconnecting them
+          hosts_to_disconnect = addresses_to_disconnect.flat_map do |addr|
+            old_hosts_lookup[addr] || []
+          end
+
+          # We must explicitly disconnect the old connections, otherwise we may
+          # leak database connections over time. For example, if a request
+          # started just before we added the new hosts it will use an old
+          # host/connection. While this connection will be checked in and out,
+          # it won't be explicitly disconnected.
+          disconnect_old_hosts(hosts_to_disconnect)
+        end
+
         # Returns an Array containing:
         #
         # 1. The time to wait for the next check.
@@ -224,6 +282,10 @@ module Gitlab
 
         private
 
+        def replace_hosts_enabled?
+          Feature.enabled?(:load_balancer_replace_hosts, Feature.current_pod)
+        end
+
         def record_type_for(type)
           RECORD_TYPES.fetch(type) do
             raise(ArgumentError, "Unsupported record type: #{type}")
@@ -242,7 +304,7 @@ module Gitlab
         end
 
         def addresses_from_a_record(resources)
-          resources.map { |r| Address.new(r.address.to_s) }
+          resources.map { |r| Address.new(r.address.to_s, nil) }
         end
 
         def sampler
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 00b26e1ce5b..d6999af2f2b 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -16569,9 +16569,6 @@ msgstr ""
 msgid "Confidentiality"
 msgstr ""
 
-msgid "Confidentiality controls have moved to the issue actions menu (%{icon}) at the top of the page."
-msgstr ""
-
 msgid "Configuration help"
 msgstr ""
 
@@ -68935,6 +68932,9 @@ msgstr ""
 msgid "WorkItem|Something went wrong when trying to link a item. Please try again."
 msgstr ""
 
+msgid "WorkItem|Something went wrong while bulk editing."
+msgstr ""
+
 msgid "WorkItem|Something went wrong while copying the %{workItemType} email address. Please try again."
 msgstr ""
 
diff --git a/rubocop/cop/migration/change_column_null_on_high_traffic_table.rb b/rubocop/cop/migration/change_column_null_on_high_traffic_table.rb
index 88b6b8ac4e1..0df3ef57237 100644
--- a/rubocop/cop/migration/change_column_null_on_high_traffic_table.rb
+++ b/rubocop/cop/migration/change_column_null_on_high_traffic_table.rb
@@ -26,6 +26,16 @@ module RuboCop
 
           return unless table_name
 
+          nullable = node.arguments.third
+
+          # constraint validation only needs to be performed when _adding_ a constraint,
+          # not when removing a constraint.
+          #
+          # rubocop:disable Lint/BooleanSymbol -- Node#type? takes the name of the primitive as a symbol
+          return unless nullable&.type?(:false)
+
+          # rubocop:enable Lint/BooleanSymbol
+
           high_traffic_tables.include?(table_name.to_sym)
         end
       end
diff --git a/scripts/frontend/quarantined_vue3_specs.txt b/scripts/frontend/quarantined_vue3_specs.txt
index 8fc04fcf69b..89d4659f38e 100644
--- a/scripts/frontend/quarantined_vue3_specs.txt
+++ b/scripts/frontend/quarantined_vue3_specs.txt
@@ -154,7 +154,6 @@ spec/frontend/pipeline_wizard/components/step_spec.js
 spec/frontend/profile/preferences/components/profile_preferences_spec.js
 spec/frontend/projects/commit/components/form_modal_spec.js
 spec/frontend/projects/commits/components/author_select_spec.js
-spec/frontend/projects/new/components/new_project_url_select_spec.js
 spec/frontend/projects/report_abuse/components/report_abuse_dropdown_item_spec.js
 spec/frontend/projects/settings/components/branch_rule_modal_spec.js
 spec/frontend/projects/settings/topics/components/topics_token_selector_spec.js
diff --git a/spec/frontend/notes/components/note_body_spec.js b/spec/frontend/notes/components/note_body_spec.js
index 531ffa09c36..b84919845d0 100644
--- a/spec/frontend/notes/components/note_body_spec.js
+++ b/spec/frontend/notes/components/note_body_spec.js
@@ -159,6 +159,19 @@ describe('issue_note_body component', () => {
   });
 
   describe('duo code review feedback', () => {
+    const createMockStoreWithDiscussion = (discussionId, discussionNotes) => {
+      return new Vuex.Store({
+        getters: {
+          getDiscussion: () => (id) => {
+            if (id === discussionId) {
+              return { notes: discussionNotes };
+            }
+            return {};
+          },
+        },
+      });
+    };
+
     it.each`
       userType                 | type                | exists   | existsText
       ${'duo_code_review_bot'} | ${null}             | ${true}  | ${'renders'}
@@ -168,13 +181,47 @@ describe('issue_note_body component', () => {
     `(
       '$existsText code review feedback component when author type is "$userType" and note type is "$type"',
       ({ userType, type, exists }) => {
+        const duoNote = {
+          ...note,
+          id: '1',
+          type,
+          discussion_id: 'discussion1',
+          author: {
+            ...note.author,
+            user_type: userType,
+          },
+        };
+        const mockStore = createMockStoreWithDiscussion('discussion1', [duoNote]);
+
         createComponent({
-          props: { note: { ...note, type, author: { ...note.author, user_type: userType } } },
+          props: { note: duoNote },
+          store: mockStore,
         });
 
         expect(wrapper.findByTestId('code-review-feedback').exists()).toBe(exists);
       },
     );
+
+    it('does not render if not first note in discussion', () => {
+      const duoNote = {
+        ...note,
+        id: '9',
+        type: 'DiscussionNote',
+        discussion_id: 'discussion1',
+        author: {
+          ...note.author,
+          user_type: 'duo_code_review_bot',
+        },
+      };
+      const mockStore = createMockStoreWithDiscussion('discussion1', [note, duoNote]);
+
+      createComponent({
+        props: { note: duoNote },
+        store: mockStore,
+      });
+
+      expect(wrapper.findByTestId('code-review-feedback').exists()).toBe(false);
+    });
   });
 
   describe('duo code review feedback text', () => {
diff --git a/spec/frontend/projects/new/components/new_project_url_select_spec.js b/spec/frontend/projects/new/components/new_project_url_select_spec.js
index cba52298f10..0d5a36dacde 100644
--- a/spec/frontend/projects/new/components/new_project_url_select_spec.js
+++ b/spec/frontend/projects/new/components/new_project_url_select_spec.js
@@ -5,13 +5,13 @@ import {
   GlTruncate,
   GlSearchBoxByType,
 } from '@gitlab/ui';
-import { mount, shallowMount } from '@vue/test-utils';
 import Vue from 'vue';
 import VueApollo from 'vue-apollo';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
 import { mockTracking, unmockTracking } from 'helpers/tracking_helper';
 import { stubComponent } from 'helpers/stub_component';
+import { shallowMountExtended, mountExtended } from 'helpers/vue_test_utils_helper';
 import { getIdFromGraphQLId } from '~/graphql_shared/utils';
 import eventHub from '~/projects/new/event_hub';
 import NewProjectUrlSelect from '~/projects/new/components/new_project_url_select.vue';
@@ -76,7 +76,7 @@ describe('NewProjectUrlSelect component', () => {
     search = '',
     queryResponse = data,
     provide = defaultProvide,
-    mountFn = shallowMount,
+    mountFn = shallowMountExtended,
   } = {}) => {
     mockQueryResponse = jest.fn().mockResolvedValue({ data: queryResponse });
     const requestHandlers = [[searchQuery, mockQueryResponse]];
@@ -102,7 +102,7 @@ describe('NewProjectUrlSelect component', () => {
   const findButtonLabel = () => wrapper.findComponent(GlButton);
   const findDropdown = () => wrapper.findComponent(GlCollapsibleListbox);
   const findSelectedPath = () => wrapper.findComponent(GlTruncate);
-  const findHiddenNamespaceInput = () => wrapper.find(`[name="${defaultProvide.inputName}`);
+  const findHiddenNamespaceInput = () => wrapper.findByTestId(defaultProvide.inputName);
   const findAllListboxItems = () => wrapper.findAllComponents(GlListboxItem);
   const findToggleButton = () => findDropdown().findComponent(GlButton);
 
@@ -129,7 +129,7 @@ describe('NewProjectUrlSelect component', () => {
 
   describe('when namespaceId is provided', () => {
     beforeEach(() => {
-      wrapper = mountComponent({ mountFn: mount });
+      wrapper = mountComponent({ mountFn: mountExtended });
     });
 
     it('renders a dropdown with the given namespace full path as the text', () => {
@@ -159,7 +159,7 @@ describe('NewProjectUrlSelect component', () => {
     };
 
     beforeEach(() => {
-      wrapper = mountComponent({ provide, mountFn: mount });
+      wrapper = mountComponent({ provide, mountFn: mountExtended });
     });
 
     it("renders a dropdown with the user's namespace full path as the text", () => {
@@ -177,12 +177,12 @@ describe('NewProjectUrlSelect component', () => {
     });
 
     it('renders a hidden input with the selected namespace id', () => {
-      expect(findHiddenSelectedNamespaceInput().attributes('value')).toBe(undefined);
+      expect(Boolean(findHiddenSelectedNamespaceInput().attributes('value'))).toBe(false);
     });
   });
 
   it('renders expected dropdown items', async () => {
-    wrapper = mountComponent({ mountFn: mount });
+    wrapper = mountComponent({ mountFn: mountExtended });
 
     await showDropdown();
 
@@ -201,7 +201,7 @@ describe('NewProjectUrlSelect component', () => {
 
   it('does not render users section when user namespace id is not provided', async () => {
     wrapper = mountComponent({
-      mountFn: mount,
+      mountFn: mountExtended,
       provide: { ...defaultProvide, userNamespaceId: null },
     });
 
@@ -218,7 +218,7 @@ describe('NewProjectUrlSelect component', () => {
   describe('query fetching', () => {
     describe('on component mount', () => {
       it('does not fetch query', () => {
-        wrapper = mountComponent({ mountFn: mount });
+        wrapper = mountComponent({ mountFn: mountExtended });
 
         expect(mockQueryResponse).not.toHaveBeenCalled();
       });
@@ -226,7 +226,7 @@ describe('NewProjectUrlSelect component', () => {
 
     describe('on dropdown shown', () => {
       it('fetches query', async () => {
-        wrapper = mountComponent({ mountFn: mount });
+        wrapper = mountComponent({ mountFn: mountExtended });
 
         await showDropdown();
 
@@ -239,7 +239,7 @@ describe('NewProjectUrlSelect component', () => {
     const { fullPath, id } = data.currentUser.groups.nodes[1];
 
     beforeEach(async () => {
-      wrapper = mountComponent({ mountFn: mount });
+      wrapper = mountComponent({ mountFn: mountExtended });
 
       // Show dropdown to fetch projects
       await showDropdown();
@@ -278,14 +278,14 @@ describe('NewProjectUrlSelect component', () => {
       },
     };
 
-    wrapper = mountComponent({ search: 'no matches', queryResponse, mountFn: mount });
+    wrapper = mountComponent({ search: 'no matches', queryResponse, mountFn: mountExtended });
     await waitForPromises();
 
     expect(wrapper.find('[data-testid="listbox-no-results-text"]').text()).toBe('No matches found');
   });
 
   it('emits `update-visibility` event to update the visibility radio options', async () => {
-    wrapper = mountComponent({ mountFn: mount });
+    wrapper = mountComponent({ mountFn: mountExtended });
 
     const spy = jest.spyOn(eventHub, '$emit');
 
@@ -305,7 +305,7 @@ describe('NewProjectUrlSelect component', () => {
   });
 
   it('updates hidden input with selected namespace', async () => {
-    wrapper = mountComponent({ mountFn: mount });
+    wrapper = mountComponent({ mountFn: mountExtended });
 
     // Show dropdown to fetch projects
     await showDropdown();
diff --git a/spec/frontend/work_items/components/work_item_assignees_spec.js b/spec/frontend/work_items/components/work_item_assignees_spec.js
index 9b2a8d1cc56..14a7765a0c0 100644
--- a/spec/frontend/work_items/components/work_item_assignees_spec.js
+++ b/spec/frontend/work_items/components/work_item_assignees_spec.js
@@ -21,6 +21,7 @@ import {
   workItemResponseFactory,
   projectMembersAutocompleteResponseWithCurrentUser,
   mockAssignees,
+  mockParticipants,
   currentUserResponse,
   currentUserNullResponse,
   projectMembersAutocompleteResponseWithNoMatchingUsers,
@@ -76,6 +77,7 @@ describe('WorkItemAssignees component', () => {
     workItemId = 'gid://gitlab/WorkItem/1',
     mountFn = shallowMountExtended,
     assignees = mockAssignees,
+    participants = [],
     searchQueryHandler = successSearchQueryHandler,
     currentUserQueryHandler = successCurrentUserQueryHandler,
     allowsMultipleAssignees = false,
@@ -109,6 +111,7 @@ describe('WorkItemAssignees component', () => {
     wrapper = mountFn(WorkItemAssignees, {
       propsData: {
         assignees,
+        participants,
         fullPath,
         workItemId,
         allowsMultipleAssignees,
@@ -134,6 +137,30 @@ describe('WorkItemAssignees component', () => {
   });
 
   describe('Dropdown search', () => {
+    it('includes participants in the results when there are matching results', async () => {
+      const expectedParticipant = {
+        ...mockParticipants[0],
+        text: mockParticipants[0].name,
+        value: mockParticipants[0].id,
+        matcher: `${mockParticipants[0].name} ${mockParticipants[0].username}`,
+      };
+
+      createComponent({
+        participants: mockParticipants,
+        searchQueryHandler: successSearchWithNoMatchingUsers,
+      });
+
+      showDropdown();
+
+      await waitForPromises();
+
+      findSidebarDropdownWidget().vm.$emit('searchStarted', expectedParticipant.username);
+
+      await nextTick();
+
+      expect(findSidebarDropdownWidget().props('listItems')).toEqual([expectedParticipant]);
+    });
+
     it('shows no items in the dropdown when no results matching', async () => {
       createComponent({ searchQueryHandler: successSearchWithNoMatchingUsers });
       showDropdown();
diff --git a/spec/frontend/work_items/list/components/work_items_list_app_spec.js b/spec/frontend/work_items/list/components/work_items_list_app_spec.js
index bf4ccd8c9bd..da0ffac1d9d 100644
--- a/spec/frontend/work_items/list/components/work_items_list_app_spec.js
+++ b/spec/frontend/work_items/list/components/work_items_list_app_spec.js
@@ -7,6 +7,7 @@ import VueRouter from 'vue-router';
 import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import IssueCardStatistics from 'ee_else_ce/issues/list/components/issue_card_statistics.vue';
 import IssueCardTimeInfo from 'ee_else_ce/issues/list/components/issue_card_time_info.vue';
+import WorkItemBulkEditSidebar from '~/work_items/components/work_item_bulk_edit/work_item_bulk_edit_sidebar.vue';
 import WorkItemHealthStatus from '~/work_items/components/work_item_health_status.vue';
 import EmptyStateWithoutAnyIssues from '~/issues/list/components/empty_state_without_any_issues.vue';
 import createMockApollo from 'helpers/mock_apollo_helper';
@@ -43,22 +44,31 @@ import {
   TOKEN_TYPE_UPDATED,
 } from '~/vue_shared/components/filtered_search_bar/constants';
 import IssuableList from '~/vue_shared/issuable/list/components/issuable_list_root.vue';
+import CreateWorkItemModal from '~/work_items/components/create_work_item_modal.vue';
 import WorkItemsListApp from '~/work_items/pages/work_items_list_app.vue';
 import { sortOptions, urlSortParams } from '~/work_items/pages/list/constants';
 import getWorkItemStateCountsQuery from '~/work_items/graphql/list/get_work_item_state_counts.query.graphql';
 import getWorkItemsQuery from '~/work_items/graphql/list/get_work_items.query.graphql';
+import workItemBulkUpdateMutation from '~/work_items/graphql/list/work_item_bulk_update.mutation.graphql';
+import workItemParentQuery from '~/work_items/graphql/list//work_item_parent.query.graphql';
 import WorkItemDrawer from '~/work_items/components/work_item_drawer.vue';
 import {
   DETAIL_VIEW_QUERY_PARAM_NAME,
   STATE_CLOSED,
   WORK_ITEM_TYPE_ENUM_EPIC,
+  WORK_ITEM_TYPE_ENUM_ISSUE,
   WORK_ITEM_TYPE_NAME_EPIC,
+  WORK_ITEM_TYPE_NAME_INCIDENT,
   WORK_ITEM_TYPE_NAME_ISSUE,
+  WORK_ITEM_TYPE_NAME_KEY_RESULT,
+  WORK_ITEM_TYPE_NAME_OBJECTIVE,
+  WORK_ITEM_TYPE_NAME_TASK,
 } from '~/work_items/constants';
 import { createRouter } from '~/work_items/router';
 import {
   groupWorkItemsQueryResponse,
   groupWorkItemStateCountsQueryResponse,
+  workItemParentQueryResponse,
 } from '../../mock_data';
 
 jest.mock('~/lib/utils/scroll_utils', () => ({ scrollUp: jest.fn() }));
@@ -83,6 +93,8 @@ describeSkipVue3(skipReason, () => {
     .fn()
     .mockResolvedValue(groupWorkItemStateCountsQueryResponse);
   const mutationHandler = jest.fn().mockResolvedValue(setSortPreferenceMutationResponse);
+  const workItemParentQueryHandler = jest.fn().mockResolvedValue(workItemParentQueryResponse);
+  const workItemBulkUpdateHandler = jest.fn();
 
   const findIssuableList = () => wrapper.findComponent(IssuableList);
   const findIssueCardStatistics = () => wrapper.findComponent(IssueCardStatistics);
@@ -90,6 +102,9 @@ describeSkipVue3(skipReason, () => {
   const findWorkItemHealthStatus = () => wrapper.findComponent(WorkItemHealthStatus);
   const findDrawer = () => wrapper.findComponent(WorkItemDrawer);
   const findEmptyStateWithoutAnyIssues = () => wrapper.findComponent(EmptyStateWithoutAnyIssues);
+  const findCreateWorkItemModal = () => wrapper.findComponent(CreateWorkItemModal);
+  const findBulkEditStartButton = () => wrapper.find('[data-testid="bulk-edit-start-button"]');
+  const findBulkEditSidebar = () => wrapper.findComponent(WorkItemBulkEditSidebar);
 
   const mountComponent = ({
     provide = {},
@@ -113,17 +128,26 @@ describeSkipVue3(skipReason, () => {
       apolloProvider: createMockApollo([
         [getWorkItemsQuery, queryHandler],
         [getWorkItemStateCountsQuery, countsQueryHandler],
+        [workItemParentQuery, workItemParentQueryHandler],
         [setSortPreferenceMutation, sortPreferenceMutationResponse],
+        [workItemBulkUpdateMutation, workItemBulkUpdateHandler],
       ]),
       provide: {
+        glFeatures: {
+          okrsMvc: true,
+        },
         autocompleteAwardEmojisPath: 'autocomplete/award/emojis/path',
+        canBulkUpdate: true,
+        canBulkEditEpics: true,
         fullPath: 'full/path',
         hasEpicsFeature: false,
+        hasGroupBulkEditFeature: true,
         hasOkrsFeature: false,
         hasQualityManagementFeature: false,
         initialSort: CREATED_DESC,
         isGroup: true,
         isSignedIn: true,
+        showNewWorkItem: true,
         workItemType: null,
         hasIssueDateFilterFeature: false,
         timeTrackingLimitToHours: false,
@@ -875,4 +899,148 @@ describeSkipVue3(skipReason, () => {
       expect(tokenTypes).toEqual(expect.arrayContaining([TOKEN_TYPE_CLOSED, TOKEN_TYPE_CREATED]));
     });
   });
+
+  describe('CreateWorkItem modal', () => {
+    it.each([true, false])('renders depending on showNewWorkItem=%s', async (showNewWorkItem) => {
+      mountComponent({ provide: { showNewWorkItem } });
+      await waitForPromises();
+
+      expect(findCreateWorkItemModal().exists()).toBe(showNewWorkItem);
+    });
+
+    describe('allowedWorkItemTypes', () => {
+      it('returns empty array when group', async () => {
+        mountComponent({ provide: { isGroup: true } });
+        await waitForPromises();
+
+        expect(findCreateWorkItemModal().props('allowedWorkItemTypes')).toEqual([]);
+      });
+
+      it('returns project-level types when project', async () => {
+        mountComponent({ provide: { isGroup: false } });
+        await waitForPromises();
+
+        expect(findCreateWorkItemModal().props('allowedWorkItemTypes')).toEqual([
+          WORK_ITEM_TYPE_NAME_INCIDENT,
+          WORK_ITEM_TYPE_NAME_ISSUE,
+          WORK_ITEM_TYPE_NAME_TASK,
+        ]);
+      });
+
+      it('returns project-level types including okr types when project and when okrs is enabled', async () => {
+        mountComponent({ provide: { isGroup: false, hasOkrsFeature: true } });
+        await waitForPromises();
+
+        expect(findCreateWorkItemModal().props('allowedWorkItemTypes')).toEqual([
+          WORK_ITEM_TYPE_NAME_INCIDENT,
+          WORK_ITEM_TYPE_NAME_ISSUE,
+          WORK_ITEM_TYPE_NAME_TASK,
+          WORK_ITEM_TYPE_NAME_KEY_RESULT,
+          WORK_ITEM_TYPE_NAME_OBJECTIVE,
+        ]);
+      });
+    });
+
+    describe('alwaysShowWorkItemTypeSelect', () => {
+      it.each`
+        workItemType                 | value
+        ${WORK_ITEM_TYPE_NAME_ISSUE} | ${true}
+        ${WORK_ITEM_TYPE_NAME_EPIC}  | ${false}
+      `('renders=$value when workItemType=$workItemType', async ({ workItemType, value }) => {
+        mountComponent({ provide: { workItemType } });
+        await waitForPromises();
+
+        expect(findCreateWorkItemModal().props('alwaysShowWorkItemTypeSelect')).toBe(value);
+      });
+    });
+
+    describe('preselectedWorkItemType', () => {
+      it.each`
+        workItemType                 | value
+        ${WORK_ITEM_TYPE_NAME_ISSUE} | ${WORK_ITEM_TYPE_ENUM_ISSUE}
+        ${WORK_ITEM_TYPE_NAME_EPIC}  | ${WORK_ITEM_TYPE_ENUM_EPIC}
+      `('renders=$value when workItemType=$workItemType', async ({ workItemType, value }) => {
+        mountComponent({ provide: { workItemType } });
+        await waitForPromises();
+
+        expect(findCreateWorkItemModal().props('preselectedWorkItemType')).toBe(value);
+      });
+    });
+  });
+
+  describe('when bulk editing', () => {
+    describe('when workItemType=Epic', () => {
+      it.each([true, false])('renders=$s when canBulkEditEpics=%s', async (canBulkEditEpics) => {
+        mountComponent({ provide: { canBulkEditEpics, workItemType: WORK_ITEM_TYPE_NAME_EPIC } });
+        await waitForPromises();
+
+        expect(findBulkEditStartButton().exists()).toBe(canBulkEditEpics);
+      });
+    });
+
+    describe('when group', () => {
+      it.each`
+        canBulkUpdate | hasGroupBulkEditFeature | renders
+        ${true}       | ${true}                 | ${true}
+        ${true}       | ${false}                | ${false}
+        ${false}      | ${true}                 | ${false}
+        ${false}      | ${false}                | ${false}
+      `(
+        'renders=$renders when canBulkUpdate=$canBulkUpdate and hasGroupBulkEditFeature=$hasGroupBulkEditFeature',
+        async ({ canBulkUpdate, hasGroupBulkEditFeature, renders }) => {
+          mountComponent({ provide: { isGroup: true, canBulkUpdate, hasGroupBulkEditFeature } });
+          await waitForPromises();
+
+          expect(findBulkEditStartButton().exists()).toBe(renders);
+        },
+      );
+    });
+
+    describe('when project', () => {
+      it.each([true, false])('renders depending on canBulkUpdate=%s', async (canBulkUpdate) => {
+        mountComponent({ provide: { isGroup: false, canBulkUpdate } });
+        await waitForPromises();
+
+        expect(findBulkEditStartButton().exists()).toBe(canBulkUpdate);
+      });
+    });
+
+    it('opens the bulk update sidebar when the toggle is clicked', async () => {
+      mountComponent({ provide: { isGroup: false, canBulkUpdate: true } });
+      await waitForPromises();
+
+      findBulkEditStartButton().vm.$emit('click');
+      await nextTick();
+
+      expect(findIssuableList().props('showBulkEditSidebar')).toBe(true);
+    });
+
+    it('triggers the bulk edit mutation when bulk edit is submitted', async () => {
+      mountComponent({ provide: { isGroup: false, canBulkUpdate: true } });
+      await waitForPromises();
+
+      const ids = ['gid://gitlab/WorkItem/1', 'gid://gitlab/WorkItem/2'];
+      const addLabelIds = ['gid://gitlab/Label/1', 'gid://gitlab/Label/2', 'gid://gitlab/Label/3'];
+      const removeLabelIds = [
+        'gid://gitlab/Label/4',
+        'gid://gitlab/Label/5',
+        'gid://gitlab/Label/6',
+      ];
+
+      findBulkEditStartButton().vm.$emit('click');
+      await waitForPromises();
+      findBulkEditSidebar().vm.$emit('bulk-update', { ids, addLabelIds, removeLabelIds });
+
+      expect(workItemBulkUpdateHandler).toHaveBeenCalledWith({
+        input: {
+          parentId: workItemParentQueryResponse.data.namespace.id,
+          ids,
+          labelsWidget: {
+            addLabelIds,
+            removeLabelIds,
+          },
+        },
+      });
+    });
+  });
 });
diff --git a/spec/frontend/work_items/mock_data.js b/spec/frontend/work_items/mock_data.js
index 45e4e0779a8..94dc82c9d03 100644
--- a/spec/frontend/work_items/mock_data.js
+++ b/spec/frontend/work_items/mock_data.js
@@ -32,6 +32,27 @@ export const mockAssignees = [
   },
 ];
 
+export const mockParticipants = [
+  {
+    __typename: 'UserCore',
+    id: 'gid://gitlab/User/3',
+    avatarUrl: '',
+    webUrl: '',
+    webPath: '/l_zadeh',
+    name: 'Lotfi Zadeh',
+    username: 'l_zadeh',
+  },
+  {
+    __typename: 'UserCore',
+    id: 'gid://gitlab/User/4',
+    avatarUrl: '',
+    webUrl: '',
+    webPath: '/fbar',
+    name: 'Foo Bar',
+    username: 'fbar',
+  },
+];
+
 export const mockLabels = [
   {
     __typename: 'Label',
@@ -6459,3 +6480,11 @@ export const errorTrackingQueryResponseWithStackTrace = getErrorTrackingQueryRes
 });
 
 export const mockRolledUpHealthStatus = [];
+
+export const workItemParentQueryResponse = {
+  data: {
+    namespace: {
+      id: 'gid://gitlab/Group/1',
+    },
+  },
+};
diff --git a/spec/helpers/boards_helper_spec.rb b/spec/helpers/boards_helper_spec.rb
index 134a42c22ca..c1edef447aa 100644
--- a/spec/helpers/boards_helper_spec.rb
+++ b/spec/helpers/boards_helper_spec.rb
@@ -108,6 +108,7 @@ RSpec.describe BoardsHelper do
         allow(helper).to receive(:can?).with(user, :create_saved_replies, project).and_return(false)
         allow(helper).to receive(:can?).with(user, :create_work_item, project.group).and_return(false)
         allow(helper).to receive(:can?).with(user, :bulk_admin_epic, project).and_return(false)
+        allow(helper).to receive(:can?).with(user, :admin_issue, project).and_return(false)
         allow(helper).to receive(:can?).with(user, :create_projects, project.group).and_return(false)
       end
 
@@ -167,6 +168,7 @@ RSpec.describe BoardsHelper do
         allow(helper).to receive(:can?).with(user, :create_saved_replies, base_group).and_return(false)
         allow(helper).to receive(:can?).with(user, :create_work_item, base_group).and_return(false)
         allow(helper).to receive(:can?).with(user, :bulk_admin_epic, base_group).and_return(false)
+        allow(helper).to receive(:can?).with(user, :admin_issue, base_group).and_return(false)
         allow(helper).to receive(:can?).with(user, :create_projects, base_group).and_return(false)
       end
 
diff --git a/spec/helpers/work_items_helper_spec.rb b/spec/helpers/work_items_helper_spec.rb
index d99e42ce23e..4c2d6c5cf52 100644
--- a/spec/helpers/work_items_helper_spec.rb
+++ b/spec/helpers/work_items_helper_spec.rb
@@ -19,6 +19,7 @@ RSpec.describe WorkItemsHelper, feature_category: :team_planning do
           {
             autocomplete_award_emojis_path: autocomplete_award_emojis_path,
             can_admin_label: 'true',
+            can_bulk_update: 'true',
             full_path: project.full_path,
             group_path: nil,
             issues_list_path: project_issues_path(project),
@@ -44,7 +45,7 @@ RSpec.describe WorkItemsHelper, feature_category: :team_planning do
           expect(helper.work_items_data(group_project, current_user)).to include(
             {
               group_path: group_project.group.full_path,
-              show_new_issue_link: 'true'
+              show_new_work_item: 'true'
             }
           )
         end
diff --git a/spec/lib/authn/tokens/personal_access_token_spec.rb b/spec/lib/authn/tokens/personal_access_token_spec.rb
index 8c508059975..559494feb96 100644
--- a/spec/lib/authn/tokens/personal_access_token_spec.rb
+++ b/spec/lib/authn/tokens/personal_access_token_spec.rb
@@ -9,6 +9,27 @@ RSpec.describe Authn::Tokens::PersonalAccessToken, feature_category: :system_acc
 
   subject(:token) { described_class.new(plaintext, :group_token_revocation_service) }
 
+  describe '.prefix?' do
+    let_it_be(:token_lookalike) { 'glpat-1234abcd' }
+
+    it 'returns true if token starts with a prefix' do
+      expect(described_class.prefix?(token_lookalike)).to be_truthy
+    end
+
+    it 'is true and falls back to the default token prefix if token setting is nil' do
+      stub_application_setting(personal_access_token_prefix: nil)
+
+      expect(described_class.prefix?(token_lookalike)).to be_truthy
+    end
+
+    # An empty string sent to `start_with?` would cause every value to be true
+    it 'is false if token setting is an empty string' do
+      stub_application_setting(personal_access_token_prefix: '')
+
+      expect(described_class.prefix?('non-token')).to be_falsey
+    end
+  end
+
   context 'with valid personal access token' do
     let(:plaintext) { personal_access_token.token }
     let(:valid_revocable) { personal_access_token }
diff --git a/spec/lib/gitlab/background_migration/backfill_protected_branch_push_access_levels_fields_spec.rb b/spec/lib/gitlab/background_migration/backfill_protected_branch_push_access_levels_fields_spec.rb
new file mode 100644
index 00000000000..225c01a8b93
--- /dev/null
+++ b/spec/lib/gitlab/background_migration/backfill_protected_branch_push_access_levels_fields_spec.rb
@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::BackgroundMigration::BackfillProtectedBranchPushAccessLevelsFields, feature_category: :source_code_management do
+  let(:connection) { ApplicationRecord.connection }
+
+  let(:migration) do
+    described_class.new(
+      batch_table: :protected_branch_push_access_levels,
+      batch_column: :id,
+      sub_batch_size: 2,
+      pause_ms: 0,
+      connection: connection
+    )
+  end
+
+  shared_context 'for database tables' do
+    let(:namespaces) { table(:namespaces) }
+    let(:organizations) { table(:organizations) }
+    let(:projects) { table(:projects) }
+    let(:users) { table(:users) }
+    let(:groups) { table(:namespaces) }
+    let(:protected_branches) { table(:protected_branches) { |t| t.primary_key = :id } }
+    let(:protected_branch_push_access_levels) do
+      table(:protected_branch_push_access_levels) do |t|
+        t.primary_key = :id
+      end
+    end
+  end
+
+  shared_context 'for organization' do
+    let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  end
+
+  shared_context 'for namespaces' do
+    let(:namespace1) { namespaces.create!(name: 'namespace 1', path: 'namespace1', organization_id: organization.id) }
+    let(:namespace2) { namespaces.create!(name: 'namespace 2', path: 'namespace2', organization_id: organization.id) }
+  end
+
+  shared_context 'for projects' do
+    let(:project1) do
+      projects.create!(
+        name: 'project 1',
+        path: 'project1',
+        namespace_id: namespace1.id,
+        project_namespace_id: namespace1.id,
+        organization_id: organization.id
+      )
+    end
+
+    let(:project2) do
+      projects.create!(
+        name: 'project 2',
+        path: 'project2',
+        namespace_id: namespace2.id,
+        project_namespace_id: namespace2.id,
+        organization_id: organization.id
+      )
+    end
+  end
+
+  shared_context 'for users and groups' do
+    let(:user) do
+      users.create!(
+        email: 'test@example.com',
+        username: 'test_user',
+        projects_limit: 10
+      )
+    end
+
+    let(:group) do
+      groups.create!(
+        name: 'test-group',
+        path: 'test-group',
+        type: 'Group',
+        organization_id: organization.id
+      )
+    end
+  end
+
+  shared_context 'for protected branches' do
+    let!(:protected_branch1) do
+      protected_branches.create!(
+        name: 'master',
+        namespace_id: namespace1.id
+      )
+    end
+
+    let!(:protected_branch2) do
+      protected_branches.create!(
+        name: 'main',
+        namespace_id: namespace2.id
+      )
+    end
+  end
+
+  shared_context 'for protected branch push access levels' do
+    let!(:protected_branch_push_access_level_1) do
+      protected_branch_push_access_levels.create!(
+        protected_branch_id: protected_branch1.id,
+        access_level: 0,
+        user_id: user.id,
+        protected_branch_namespace_id: nil,
+        protected_branch_project_id: nil
+      )
+    end
+  end
+
+  include_context 'for database tables'
+  include_context 'for organization'
+  include_context 'for namespaces'
+  include_context 'for projects'
+  include_context 'for users and groups'
+  include_context 'for protected branches'
+  include_context 'for protected branch push access levels'
+
+  describe '#perform' do
+    context 'when backfilling all fields' do
+      it 'backfills the bigint and association fields correctly' do
+        migration.perform
+
+        expect(protected_branch_push_access_level_1.reload.protected_branch_project_id)
+          .to eq(protected_branch1.project_id)
+        expect(protected_branch_push_access_level_1.reload.protected_branch_namespace_id)
+          .to eq(protected_branch1.namespace_id)
+      end
+    end
+
+    context 'when doing filtering' do
+      it 'includes the sub-batch filter in the update SQL' do
+        expect(connection).to receive(:execute) do |sql|
+          expect(sql).to include("WHERE protected_branch_push_access_levels.id = filtered_relation.id")
+        end
+
+        migration.perform
+      end
+    end
+  end
+
+  describe "#bigint_column_assignments" do
+    subject(:assignment_string) { migration.send(:bigint_column_assignments) }
+
+    context "when some expected bigint columns are present" do
+      before do
+        allow(migration).to receive(:all_column_names).and_return(
+          %w[id_convert_to_bigint protected_branch_id_convert_to_bigint]
+        )
+      end
+
+      it "returns the expected assignment string" do
+        expected = <<~EXPECTED.strip
+          ,\n"id_convert_to_bigint" = filtered_relation."id",\n"protected_branch_id_convert_to_bigint" = filtered_relation."protected_branch_id"
+        EXPECTED
+
+        expect(assignment_string).to eq(expected)
+      end
+    end
+
+    context "when none of the expected bigint columns are present" do
+      before do
+        allow(migration).to receive(:all_column_names).and_return([])
+      end
+
+      it "returns an empty string" do
+        expect(assignment_string).to eq('')
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/database/load_balancing/service_discovery_spec.rb b/spec/lib/gitlab/database/load_balancing/service_discovery_spec.rb
index 4d35e16a865..dc9b5a851bd 100644
--- a/spec/lib/gitlab/database/load_balancing/service_discovery_spec.rb
+++ b/spec/lib/gitlab/database/load_balancing/service_discovery_spec.rb
@@ -149,8 +149,8 @@ RSpec.describe Gitlab::Database::LoadBalancing::ServiceDiscovery, feature_catego
   end
 
   describe '#refresh_if_necessary' do
-    let(:address_foo) { described_class::Address.new('foo') }
-    let(:address_bar) { described_class::Address.new('bar') }
+    let(:address_foo) { described_class::Address.new('foo', nil) }
+    let(:address_bar) { described_class::Address.new('bar', nil) }
 
     context 'when a refresh is necessary' do
       before do
@@ -199,20 +199,34 @@ RSpec.describe Gitlab::Database::LoadBalancing::ServiceDiscovery, feature_catego
               .and_return(load_balancer)
     end
 
-    let(:address_foo) { described_class::Address.new('foo') }
-    let(:address_bar) { described_class::Address.new('bar') }
+    let(:address_foo) { described_class::Address.new('foo', nil) }
+    let(:address_bar) { described_class::Address.new('bar', nil) }
 
     let(:load_balancer) do
       Gitlab::Database::LoadBalancing::LoadBalancer.new(
         Gitlab::Database::LoadBalancing::Configuration
-          .new(ActiveRecord::Base, [address_foo])
+          .new(ActiveRecord::Base, [address_foo.hostname])
       )
     end
 
     it 'replaces the hosts of the load balancer' do
       service.replace_hosts([address_bar])
 
-      expect(load_balancer.host_list.host_names_and_ports).to eq([['bar', nil]])
+      expect(load_balancer.host_list.host_names_and_ports).to match_array([['bar', nil]])
+    end
+
+    it 'reuses existing hosts when hostname and port are unchanged' do
+      old_host1 = Gitlab::Database::LoadBalancing::Host.new(address_foo.hostname, load_balancer, port: address_foo.port)
+      old_host2 = Gitlab::Database::LoadBalancing::Host.new(address_bar.hostname, load_balancer, port: address_bar.port)
+
+      allow(load_balancer.host_list)
+      .to receive(:hosts)
+            .and_return([old_host1, old_host2])
+
+      expect(service).to receive(:disconnect_old_hosts).with([old_host2])
+      service.replace_hosts([address_foo])
+
+      expect(load_balancer.host_list.hosts.size).to eq(2)
     end
 
     it 'disconnects the old connections gracefully if possible' do
@@ -256,6 +270,32 @@ RSpec.describe Gitlab::Database::LoadBalancing::ServiceDiscovery, feature_catego
         service.replace_hosts([address_foo, address_bar])
       end
     end
+
+    context "when replace_hosts_enabled? is true" do
+      before do
+        allow(service).to receive(:replace_hosts_enabled?).and_return(true)
+        allow(service).to receive(:new_replace_hosts).and_call_original
+      end
+
+      it 'calls new_replace_hosts' do
+        expect(service).to receive(:new_replace_hosts).with([address_bar])
+
+        service.replace_hosts([address_bar])
+      end
+    end
+
+    context "when replace_hosts_enabled? is false" do
+      before do
+        allow(service).to receive(:replace_hosts_enabled?).and_return(false)
+        allow(service).to receive(:old_replace_hosts).and_call_original
+      end
+
+      it 'calls old_replace_hosts' do
+        expect(service).to receive(:old_replace_hosts).with([address_bar])
+
+        service.replace_hosts([address_bar])
+      end
+    end
   end
 
   describe '#addresses_from_dns' do
@@ -289,8 +329,8 @@ RSpec.describe Gitlab::Database::LoadBalancing::ServiceDiscovery, feature_catego
 
       it 'returns a TTL and ordered list of IP addresses' do
         addresses = [
-          described_class::Address.new('127.0.0.1'),
-          described_class::Address.new('255.255.255.0')
+          described_class::Address.new('127.0.0.1', nil),
+          described_class::Address.new('255.255.255.0', nil)
         ]
 
         expect(service.addresses_from_dns).to eq([90, addresses])
@@ -389,8 +429,8 @@ RSpec.describe Gitlab::Database::LoadBalancing::ServiceDiscovery, feature_catego
 
     it 'returns the ordered host names of the load balancer' do
       addresses = [
-        described_class::Address.new('a'),
-        described_class::Address.new('b')
+        described_class::Address.new('a', nil),
+        described_class::Address.new('b', nil)
       ]
 
       expect(service.addresses_from_load_balancer).to eq(addresses)
diff --git a/spec/migrations/20250319104254_queue_backfill_protected_branch_push_access_levels_fields_spec.rb b/spec/migrations/20250319104254_queue_backfill_protected_branch_push_access_levels_fields_spec.rb
new file mode 100644
index 00000000000..447fe3c4cb4
--- /dev/null
+++ b/spec/migrations/20250319104254_queue_backfill_protected_branch_push_access_levels_fields_spec.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueBackfillProtectedBranchPushAccessLevelsFields, feature_category: :source_code_management do
+  let!(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          table_name: :protected_branch_push_access_levels,
+          column_name: :id,
+          interval: described_class::DELAY_INTERVAL,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE,
+          gitlab_schema: :gitlab_main_cell,
+          job_arguments: []
+        )
+      }
+    end
+  end
+end
diff --git a/spec/migrations/20250409141444_queue_fix_string_config_hashes_group_streaming_destinations_spec.rb b/spec/migrations/20250409141444_queue_fix_string_config_hashes_group_streaming_destinations_spec.rb
new file mode 100644
index 00000000000..133aab625a9
--- /dev/null
+++ b/spec/migrations/20250409141444_queue_fix_string_config_hashes_group_streaming_destinations_spec.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueFixStringConfigHashesGroupStreamingDestinations, migration: :gitlab_main, feature_category: :audit_events do
+  let!(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          gitlab_schema: :gitlab_main,
+          table_name: :audit_events_group_external_streaming_destinations,
+          column_name: :id,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE
+        )
+      }
+    end
+  end
+end
diff --git a/spec/migrations/20250409141503_queue_fix_string_config_hashes_instance_streaming_destinations_spec.rb b/spec/migrations/20250409141503_queue_fix_string_config_hashes_instance_streaming_destinations_spec.rb
new file mode 100644
index 00000000000..b9430776b53
--- /dev/null
+++ b/spec/migrations/20250409141503_queue_fix_string_config_hashes_instance_streaming_destinations_spec.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe QueueFixStringConfigHashesInstanceStreamingDestinations, migration: :gitlab_main, feature_category: :audit_events do
+  let!(:batched_migration) { described_class::MIGRATION }
+
+  it 'schedules a new batched migration' do
+    reversible_migration do |migration|
+      migration.before -> {
+        expect(batched_migration).not_to have_scheduled_batched_migration
+      }
+
+      migration.after -> {
+        expect(batched_migration).to have_scheduled_batched_migration(
+          gitlab_schema: :gitlab_main,
+          table_name: :audit_events_instance_external_streaming_destinations,
+          column_name: :id,
+          batch_size: described_class::BATCH_SIZE,
+          sub_batch_size: described_class::SUB_BATCH_SIZE
+        )
+      }
+    end
+  end
+end
diff --git a/spec/rubocop/cop/migration/change_column_null_on_high_traffic_table_spec.rb b/spec/rubocop/cop/migration/change_column_null_on_high_traffic_table_spec.rb
index 9bf2e88091b..b371a1b4d12 100644
--- a/spec/rubocop/cop/migration/change_column_null_on_high_traffic_table_spec.rb
+++ b/spec/rubocop/cop/migration/change_column_null_on_high_traffic_table_spec.rb
@@ -50,11 +50,19 @@ RSpec.describe RuboCop::Cop::Migration::ChangeColumnNullOnHighTrafficTable, feat
             'For more details check https://docs.gitlab.com/ee/development/database/not_null_constraints.html#not-null-constraints-on-large-tables'
         end
 
-        it 'registers an offense' do
+        it 'registers an offense when setting NOT NULL' do
           expect_offense(<<~RUBY)
             def up
-              change_column_null :vulnerabilities, :name
-              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ #{offense}
+              change_column_null :vulnerabilities, :name, false
+              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ #{offense}
+            end
+          RUBY
+        end
+
+        it 'does not register an offense when removing NOT NULL' do
+          expect_no_offenses(<<~RUBY)
+            def up
+              change_column_null :vulnerabilities, :name, true
             end
           RUBY
         end