diff --git a/content/actions/how-tos/write-workflows/choose-when-workflows-run/control-jobs-with-conditions.md b/content/actions/how-tos/write-workflows/choose-when-workflows-run/control-jobs-with-conditions.md
index cf474fc9cd40..01ef286c7bf4 100644
--- a/content/actions/how-tos/write-workflows/choose-when-workflows-run/control-jobs-with-conditions.md
+++ b/content/actions/how-tos/write-workflows/choose-when-workflows-run/control-jobs-with-conditions.md
@@ -15,7 +15,9 @@ category:
 contentType: how-tos
 ---
 
-You can use the `jobs.<job_id>.if` conditional to prevent a job from running unless a condition is met. {% data reusables.actions.if-supported-contexts %}
+You can use the `jobs.<job_id>.if` conditional to prevent a job from running unless a condition is met. {% data reusables.actions.if-supported-contexts %} 
+
+Note that conditions executed by a shell (for example `[[ $variable == "prefix"* ]]`) cannot be evaluated in `jobs.<job_id>.if`. Such conditions must be written inside `jobs.<job_id>.steps[*].run`.
 
 ### Example: Only run job for a specific repository
 
diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md
index e55131962f6c..7e25713ea3fe 100644
--- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md
+++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md
@@ -542,13 +542,15 @@ Change the limit on the maximum number of pull requests for version updates open
 * If five pull requests with version updates are open, no further pull requests are raised until some of those open requests are merged or closed.
 
 > [!NOTE]
-> _Security update_ pull requests are not subject to this limit and do not count toward it. There is no limit on the number of open pull requests for security updates.
+> _Security update_ pull requests are subject to a separate, fixed limit of 10 open pull requests, which cannot be configured using `open-pull-requests-limit`.
 
 When `open-pull-requests-limit` is defined:
 
 * {% data variables.product.prodname_dependabot %} opens pull requests up to the defined integer value. A large value can be set to effectively remove the open pull request limit.
 * You can temporarily disable version updates for a package manager by setting this option to zero, see [Disabling {% data variables.product.prodname_dependabot_version_updates %}](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-version-updates#disabling-dependabot-version-updates).
 
+When either limit is reached, {% data variables.product.prodname_dependabot %} reports an error and stops opening additional pull requests until some of the open pull requests are merged or closed. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors#pull-request-limit-reached).
+
 ## `package-ecosystem` {% octicon "versions" aria-label="Version updates only" height="24" %}
 
 <!--Note: When making updates to this section, please make sure any changes are also reflected in `data/reusables/dependabot/supported-package-managers.md`.-->
diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings.md
index 14ee09afbbd1..80348595b516 100644
--- a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings.md
+++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings.md
@@ -91,6 +91,14 @@ Place `{% data variables.copilot.managed_setting_file %}` in the following locat
 1. For {% data variables.copilot.copilot_cli_short %} on macOS and Linux, make the file a regular file owned by `root`, and ensure it is not group-writable or world-writable. Do not use a symbolic link. The CLI rejects files that do not meet these requirements.
 1. Ask users to restart supported clients so the updated policy is loaded at startup.
 
+## Requiring fresh server-managed settings on startup
+
+Use `forceRemoteSettingsRefresh` when a time-sensitive policy change must reach supported clients before {% data variables.product.prodname_copilot_short %} starts. The setting is supported in {% data variables.copilot.copilot_cli_short %}, the {% data variables.copilot.github_copilot_app %}, and {% data variables.product.prodname_vscode_shortname %}.
+
+MDM-managed and file-based delivery can apply this requirement before the client signs in for the first time. A server-managed value begins requiring refreshes on subsequent startups after the client has received it once.
+
+For client-specific behavior, value formats, and limitations, see [`forceRemoteSettingsRefresh`](/copilot/reference/enterprise-administrators/enterprise-managed-settings#forceremotesettingsrefresh) in the enterprise managed settings reference.
+
 ## Precedence of deployment methods
 
 When multiple settings sources are present, settings earlier in this list take precedence over settings later in the list:
diff --git a/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md b/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md
index 3decacba7eb7..d1501b328dfb 100644
--- a/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md
+++ b/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md
@@ -665,7 +665,7 @@ Only the following keys are supported in MDM managed settings.
 | `enabledPlugins` | Enable or disable specific plugins |
 | `extraKnownMarketplaces` | Add trusted plugin marketplaces |
 | `forceLoginOrgs` | Pin sign-in to an approved set of {% data variables.product.github %} organizations (an array of organization logins, matched case-insensitively). {% data variables.product.prodname_copilot_short %} only runs for an account belonging to at least one listed organization; a personal account, an account that belongs only to some other enterprise, or BYOK/API-key authentication is refused with an actionable error. Set an empty array to turn the pin off without deleting the key. Deploy this key through the device channel (MDM plist/registry, or `managed-settings.json`) since it must be able to redirect a developer's first sign-in—the server-managed channel only reaches accounts that have already authenticated into the organization. This key fails closed: an unusable value, or a managed policy that can't be read on a known-managed device, blocks all sign-in until fixed. |
-| `forceRemoteSettingsRefresh` | Require a fresh server-managed settings fetch on startup, even when a fresh cached policy exists. The cached entry is still kept as a fallback if the fetch fails. The device (MDM) value takes precedence over a cached server value. |
+| `forceRemoteSettingsRefresh` | Require a fresh server-managed settings fetch on startup, even when a fresh cached policy exists. Cached policy cannot satisfy the freshness requirement. If the fetch fails, affected operations remain restricted until current policy is confirmed. The device (MDM) value takes precedence over a cached server value. |
 | `model` | Set a default model for all users (overridden by the `--model` flag or a resumed-session model). `effortLevel` and `contextTier` set alongside `model` apply the same managed reasoning effort and context tier as the corresponding [repository settings](#repository-settings-githubcopilotsettingsjson) keys, but only when the managed model supports explicit effort/context options. |
 | `permissions` | Set managed permissions, including `disableBypassPermissionsMode`, `deny` / `ask` / `allow` rule arrays, and the `limitTo` domain boundary array. See [Managed permission rules](#managed-permission-rules) and [Domain boundary (`limitTo`)](#domain-boundary-limitto). |
 | `policyHelper` | Register an executable that supplies the lowest-priority managed-settings layer. Fields: `path` (required), plus optional `args`, `timeoutMs`, and `refreshIntervalMs`. If both a device (MDM) and a server policy register a `policyHelper`, the device registration wins. |
diff --git a/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md b/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
index 66e85a9a570c..ce80a422175f 100644
--- a/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
+++ b/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
@@ -32,9 +32,10 @@ For instructions on creating the file, see [AUTOTITLE](/copilot/how-tos/administ
 | `strictKnownMarketplaces` | Restricts plugin installation to explicitly listed marketplaces | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} |
 | `telemetry` | Configures OpenTelemetry export, routing {% data variables.product.prodname_copilot_short %} usage data to a collector of your choice | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} |
 | `remoteControl` | Restricts whether sessions hosted on this device can be remotely controlled, based on the controlling client's SSO authorization status for the listed organizations. Doesn't affect the user's ability to remotely control sessions hosted on other devices | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
+| `forceRemoteSettingsRefresh` | Requires a fresh server-managed settings fetch on client startup | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
 | `allowedMcpServers` | Defines an allowlist of MCP servers permitted to run. Any server not matched is blocked. Omit to allow all servers, subject to any deny rules | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} |
 | `deniedMcpServers` | Defines MCP servers that are unconditionally blocked, even if they also match an entry in `allowedMcpServers` | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} |
-| `sandbox` | Enforces minimum local sandbox restrictions for command execution, filesystem and network access, credentials, and local MCP and LSP servers | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} (Agent Host, 1.138.0+) | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
+| `sandbox` | Enforces minimum local sandbox restrictions for command execution, filesystem and network access, credentials, and local MCP and LSP servers. Subject to minimum client version requirements. | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} (Agent Host, 1.138.0+) | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
 
 {% endrowheaders %}
 
@@ -239,11 +240,11 @@ For example, a team settings file can set `"autoTier": "intelligence"`. If the t
 
 ## forceRemoteSettingsRefresh
 
-Requires a fresh download of server-managed settings at startup in {% data variables.copilot.copilot_cli_short %} and {% data variables.product.prodname_vscode_shortname %}. Set `forceRemoteSettingsRefresh` to `true` to enable this requirement.
+Requires a fresh download of server-managed settings at startup in {% data variables.copilot.copilot_cli_short %}, {% data variables.product.prodname_vscode_shortname %}, and the {% data variables.copilot.github_copilot_app %}. Set `forceRemoteSettingsRefresh` to `true` to enable this requirement.
 
-In {% data variables.copilot.copilot_cli_short %}, this skips the normal one-hour cache and prevents fallback to an older cached policy if the download fails. An unsuccessful refresh leaves the policy unconfirmed, so affected operations are restricted. In {% data variables.product.prodname_vscode_shortname %}, {% data variables.product.prodname_copilot_short %} features are blocked until the required refresh succeeds. Users therefore need a network connection when starting the client.
+In {% data variables.copilot.copilot_cli_short %} and the {% data variables.copilot.github_copilot_app %}, this skips the normal one-hour cache and prevents fallback to an older cached policy if the download fails. An unsuccessful refresh leaves the policy unconfirmed, so affected operations are restricted. In {% data variables.product.prodname_vscode_shortname %}, {% data variables.product.prodname_copilot_short %} features are blocked until the required refresh succeeds. Users therefore need a network connection when starting the client.
 
-For the requirement to apply from a device's first startup, deliver it through device management or `{% data variables.copilot.managed_setting_file %}`. A server-delivered value can require refreshes on subsequent startups after the client has received it. Policy helper scripts cannot set this key.
+For the requirement to apply from a device's first startup, deliver it through MDM-managed or file-based settings. A server-managed value can require refreshes on subsequent startups after the client has received it. Policy helper scripts cannot set this key.
 
 In `{% data variables.copilot.managed_setting_file %}`, use a JSON Boolean, for example `"forceRemoteSettingsRefresh": true`. When configuring {% data variables.copilot.copilot_cli_short %} through the Windows registry or macOS managed preferences, store this value as a string containing `true` or `false`. Do not use a DWORD or native Boolean.
 
@@ -458,3 +459,13 @@ In {% data variables.copilot.copilot_cli_short %}, host rules and upstream proxi
 Configures macOS-specific Seatbelt options.
 
 * `keychainAccess`: `false` prevents sandboxed processes from accessing the macOS Keychain.
+
+### Minimum client version enforcement for `sandbox`
+
+When you add the `sandbox` key to managed settings, {% data variables.product.prodname_copilot_short %} enforces a local sandbox for all users in scope. These users must use a {% data variables.product.prodname_copilot_short %} client version that supports local sandbox. Until a user updates their client to at least the minimum supported version, their connections to {% data variables.product.prodname_copilot_short %} are blocked.
+
+| Supported client | Minimum version |
+| --- | --- |
+| VS Code | [1.141.0](https://github.com/microsoft/vscode/releases/tag/1.141.0) |
+| Copilot CLI | [1.0.93](https://github.com/github/copilot-cli/releases/tag/v1.0.93) |
+| GitHub Copilot App | [1.1.26](https://github.com/github/app/releases#release-v1.1.26) |
diff --git a/data/reusables/actions/github-token-available-permissions.md b/data/reusables/actions/github-token-available-permissions.md
index 485026b2fc1c..668e91664afc 100644
--- a/data/reusables/actions/github-token-available-permissions.md
+++ b/data/reusables/actions/github-token-available-permissions.md
@@ -7,7 +7,8 @@ permissions:
   attestations: read|write|none{% endif %}
   checks: read|write|none{% ifversion code-quality %}
   code-quality: read|write|none{% endif %}
-  contents: read|write|none
+  contents: read|write|none{% ifversion copilot %}
+  copilot-requests: write|none{% endif %}
   deployments: read|write|none{% ifversion fpt or ghec %}
   id-token: write|none{% endif %}
   issues: read|write|none
diff --git a/data/reusables/actions/github-token-scope-descriptions.md b/data/reusables/actions/github-token-scope-descriptions.md
index e0fa148398ef..83ea8d470d11 100644
--- a/data/reusables/actions/github-token-scope-descriptions.md
+++ b/data/reusables/actions/github-token-scope-descriptions.md
@@ -16,6 +16,9 @@ Available permissions and details of what each allows an action to do:
 |  `code-quality` | Work with code quality. For example, `code-quality: write` permits an action to upload code coverage reports. For more information, see [AUTOTITLE](/code-security/concepts/code-quality/code-quality). |
 | {% endif %} |
 |  `contents` | Work with the contents of the repository. For example, `contents: read` permits an action to list the commits, and `contents: write` allows the action to create a release. For more information, see [AUTOTITLE](/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-contents). |
+| {% ifversion copilot %} |
+|  `copilot-requests` | Make {% data variables.product.prodname_copilot_short %} requests. For example, `copilot-requests: write` permits a workflow in an organization-owned repository to use {% data variables.copilot.copilot_cli_short %} with `GITHUB_TOKEN` when the organization's billing policy allows it. Only `write` and `none` are supported. See [AUTOTITLE](/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions). |
+| {% endif %} |
 |  `deployments` | Work with deployments. For example, `deployments: write` permits an action to create a new deployment. For more information, see [AUTOTITLE](/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-deployments). |
 |  `discussions` | Work with GitHub Discussions. For example, `discussions: write` permits an action to close or delete a discussion. For more information, see [AUTOTITLE](/graphql/guides/using-the-graphql-api-for-discussions). |
 | {% ifversion fpt or ghec %} |