diff --git a/.github/workflows/address-pr-review-feedback.yml b/.github/workflows/address-pr-review-feedback.yml
new file mode 100644
index 00000000..cd7531a9
--- /dev/null
+++ b/.github/workflows/address-pr-review-feedback.yml
@@ -0,0 +1,60 @@
+name: Address PR Review Feedback
+on:
+  pull_request_review:
+    types: [submitted]
+
+concurrency:
+  group: pr-address-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  actions: read
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  run:
+    if: >-
+      github.event.review.user.type == 'Bot' &&
+      github.event.pull_request.draft == false &&
+      !contains(github.event.pull_request.labels.*.name, 'no-address-pr-feedback')
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-pr-review-addresser.lock.yml@main
+    with:
+      allowed-bot-users: "coderabbitai[bot],github-actions[bot]"
+      additional-instructions: |
+        Focus on minor and straightforward fixes only. Address feedback that involves:
+        - Typos, naming, and formatting issues
+        - Missing or incorrect types
+        - Simple logic corrections with obvious fixes
+        - Import cleanup or unused variable removal
+        - Documentation or comment improvements
+        - Small refactors with clear intent (e.g. extract a constant, simplify a condition)
+
+        Do NOT attempt to fix feedback that involves:
+        - Architectural or design changes
+        - Complex logic rewrites or algorithm changes
+        - Subjective style preferences where reasonable people could disagree
+        - Changes requiring deep domain knowledge or broader context
+        - Performance optimizations that need benchmarking
+
+        When in doubt, reply to the review thread explaining why you're skipping
+        the change rather than making a potentially incorrect fix.
+
+        ## CI failures
+
+        After addressing review threads, also check the PR's CI status:
+
+        1. Look at the failing checks on the PR (use the GitHub API or gh CLI).
+        2. Read any bot comments on the PR — the PR Actions Detective agent posts
+           comments explaining what caused CI to fail and how to fix it. These
+           comments are your primary guide for fixing CI.
+        3. If CI is failing and the bot comment (or the check logs) point to a
+           clear, straightforward fix (e.g. a lint error, a type error, a failing
+           unit test, a missing import), apply the fix.
+        4. Apply the same scope rules as review feedback: fix simple, obvious CI
+           failures only. Do NOT attempt complex logic rewrites to make tests pass.
+        5. If you fix a CI failure, briefly describe what you changed and why in
+           your commit message.
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/breaking-change-detector.yml b/.github/workflows/breaking-change-detector.yml
new file mode 100644
index 00000000..c2925d27
--- /dev/null
+++ b/.github/workflows/breaking-change-detector.yml
@@ -0,0 +1,18 @@
+name: Breaking Change Detector
+on:
+  schedule:
+    - cron: "0 13 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-breaking-change-detector.lock.yml@main
+    with:
+      title-prefix: "[breaking-change]"
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/code-duplication-detector.yml b/.github/workflows/code-duplication-detector.yml
new file mode 100644
index 00000000..4a18e9d1
--- /dev/null
+++ b/.github/workflows/code-duplication-detector.yml
@@ -0,0 +1,19 @@
+name: Code Duplication Detector
+on:
+  schedule:
+    - cron: "0 12 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-code-duplication-detector.lock.yml@main
+    with:
+      title-prefix: "[code-duplication]"
+      languages: "python"
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/docs-patrol.yml b/.github/workflows/docs-patrol.yml
new file mode 100644
index 00000000..b0a340d0
--- /dev/null
+++ b/.github/workflows/docs-patrol.yml
@@ -0,0 +1,18 @@
+name: Docs Patrol
+on:
+  schedule:
+    - cron: "0 10 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-docs-patrol.lock.yml@main
+    with:
+      title-prefix: "[docs-patrol]"
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/duplicate-issue-detector.yml b/.github/workflows/duplicate-issue-detector.yml
new file mode 100644
index 00000000..39edfc92
--- /dev/null
+++ b/.github/workflows/duplicate-issue-detector.yml
@@ -0,0 +1,17 @@
+name: Duplicate Issue Detector
+on:
+  issues:
+    types: [opened]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  discussions: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-duplicate-issue-detector.lock.yml@main
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/minimize-resolved-reviews.yml b/.github/workflows/minimize-resolved-reviews.yml
index 9f49794c..989d15ff 100644
--- a/.github/workflows/minimize-resolved-reviews.yml
+++ b/.github/workflows/minimize-resolved-reviews.yml
@@ -1,11 +1,12 @@
-name: Minimize Resolved Reviews
+name: "Internal: Minimize Resolved Reviews"
+
 on:
   pull_request_review:
     types: [submitted]
-  pull_request_review_comment:
-    types: [created, edited]
-  issue_comment:
-    types: [created]
+
+concurrency:
+  group: minimize-reviews-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: true
 
 permissions:
   pull-requests: write
@@ -13,14 +14,8 @@ permissions:
 jobs:
   minimize:
     runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'issue_comment' || (
-        contains(github.event.comment.body, '/tidy') &&
-        github.event.issue.pull_request &&
-        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-      )
     steps:
-      - name: Minimize resolved review threads
+      - name: Minimize resolved review comments
         uses: strawgate/minimize-resolved-pr-reviews@v0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pr-actions-detective.yml b/.github/workflows/pr-actions-detective.yml
new file mode 100644
index 00000000..7afeb637
--- /dev/null
+++ b/.github/workflows/pr-actions-detective.yml
@@ -0,0 +1,41 @@
+name: PR Actions Detective
+on:
+  workflow_run:
+    workflows: ["Run Tests"]
+    types: [completed]
+
+permissions:
+  actions: read
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  gate:
+    if: >-
+      github.event.workflow_run.conclusion == 'failure' &&
+      toJSON(github.event.workflow_run.pull_requests) != '[]'
+    runs-on: ubuntu-latest
+    outputs:
+      enabled: ${{ steps.gate.outputs.enabled }}
+    steps:
+      - id: gate
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber = context.payload.workflow_run.pull_requests[0].number;
+            const pr = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+            const enabled = !(pr.data.labels || []).some((label) => label.name === "no-pr-actions-detective");
+            core.info(`PR #${prNumber} no-pr-actions-detective absent (enabled): ${enabled}`);
+            core.setOutput("enabled", enabled ? "true" : "false");
+
+  run:
+    needs: gate
+    if: needs.gate.outputs.enabled == 'true'
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-pr-actions-detective.lock.yml@main
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/refactor-opportunist.yml b/.github/workflows/refactor-opportunist.yml
new file mode 100644
index 00000000..7b9c308d
--- /dev/null
+++ b/.github/workflows/refactor-opportunist.yml
@@ -0,0 +1,19 @@
+name: Refactor Opportunist
+on:
+  schedule:
+    - cron: "0 14 * * 1"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-refactor-opportunist.lock.yml@main
+    with:
+      title-prefix: "[refactor-opportunist]"
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-bug-hunter.yml b/.github/workflows/trigger-bug-hunter.yml
index 21207602..9c0fdf57 100644
--- a/.github/workflows/trigger-bug-hunter.yml
+++ b/.github/workflows/trigger-bug-hunter.yml
@@ -5,19 +5,15 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  actions: read
+  contents: read
   issues: write
-  pull-requests: write
+  pull-requests: read
 
 jobs:
   run:
     uses: elastic/ai-github-actions/.github/workflows/gh-aw-bug-hunter.lock.yml@main
     with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
+      title-prefix: "[bug-hunter]"
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-code-simplifier.yml b/.github/workflows/trigger-code-simplifier.yml
deleted file mode 100644
index 9a7bc22e..00000000
--- a/.github/workflows/trigger-code-simplifier.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Code Simplifier
-on:
-  schedule:
-    - cron: "0 13 * * 1-5"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  run:
-    uses: elastic/ai-github-actions/.github/workflows/gh-aw-code-simplifier.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-docs-drift.yml b/.github/workflows/trigger-docs-drift.yml
deleted file mode 100644
index 24c534a2..00000000
--- a/.github/workflows/trigger-docs-drift.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Docs Drift
-on:
-  schedule:
-    - cron: "0 14 * * 1-5"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  run:
-    uses: elastic/ai-github-actions/.github/workflows/gh-aw-docs-patrol.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-issue-triage.yml b/.github/workflows/trigger-issue-triage.yml
index fe8ab84d..19279852 100644
--- a/.github/workflows/trigger-issue-triage.yml
+++ b/.github/workflows/trigger-issue-triage.yml
@@ -8,17 +8,10 @@ permissions:
   contents: read
   discussions: write
   issues: write
-  pull-requests: read
+  pull-requests: write
 
 jobs:
   run:
     uses: elastic/ai-github-actions/.github/workflows/gh-aw-issue-triage.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-mention-in-issue.yml b/.github/workflows/trigger-mention-in-issue.yml
index 10d576d6..7456c8f3 100644
--- a/.github/workflows/trigger-mention-in-issue.yml
+++ b/.github/workflows/trigger-mention-in-issue.yml
@@ -15,13 +15,6 @@ jobs:
     if: >-
       github.event.issue.pull_request == null &&
       startsWith(github.event.comment.body, '/ai')
-    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-issue.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-issue-no-sandbox.lock.yml@main
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-mention-in-pr.yml b/.github/workflows/trigger-mention-in-pr.yml
index 6012d815..e47b84e6 100644
--- a/.github/workflows/trigger-mention-in-pr.yml
+++ b/.github/workflows/trigger-mention-in-pr.yml
@@ -17,13 +17,6 @@ jobs:
     if: >-
       startsWith(github.event.comment.body, '/ai') &&
       (github.event.issue.pull_request != null || github.event_name == 'pull_request_review_comment')
-    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-pr.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-pr-no-sandbox.lock.yml@main
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-pr-actions-fixer.yml b/.github/workflows/trigger-pr-actions-fixer.yml
deleted file mode 100644
index 336f4535..00000000
--- a/.github/workflows/trigger-pr-actions-fixer.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-name: PR Actions Fixer
-on:
-  workflow_run:
-    workflows: ["Run Tests"]
-    types: [completed]
-
-permissions:
-  actions: read
-  contents: write
-  discussions: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  run:
-    if: >-
-      github.event.workflow_run.conclusion == 'failure' &&
-      toJSON(github.event.workflow_run.pull_requests) != '[]'
-    uses: elastic/ai-github-actions/.github/workflows/gh-aw-pr-actions-fixer.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-pr-review.yml b/.github/workflows/trigger-pr-review.yml
index bcc79a51..4c801b15 100644
--- a/.github/workflows/trigger-pr-review.yml
+++ b/.github/workflows/trigger-pr-review.yml
@@ -1,9 +1,10 @@
 name: PR Review
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
 
 permissions:
+  actions: read
   contents: read
   issues: write
   pull-requests: write
@@ -11,15 +12,13 @@ permissions:
 jobs:
   run:
     if: >-
+      (contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association) ||
+      contains(fromJSON('["Copilot","dependabot[bot]","github-actions[bot]"]'), github.event.pull_request.user.login)) &&
       github.event.pull_request.draft == false &&
-      !contains(github.event.pull_request.labels.*.name, 'skip-auto-pr-review')
+      !contains(github.event.pull_request.labels.*.name, 'no-pr-review')
     uses: elastic/ai-github-actions/.github/workflows/gh-aw-pr-review.lock.yml@main
     with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
+      intensity: aggressive
+      minimum_severity: nitpick
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-small-problem-fixer.yml b/.github/workflows/trigger-small-problem-fixer.yml
deleted file mode 100644
index bfb04596..00000000
--- a/.github/workflows/trigger-small-problem-fixer.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Small Problem Fixer
-on:
-  schedule:
-    - cron: "0 12 * * 1-5"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  run:
-    uses: elastic/ai-github-actions/.github/workflows/gh-aw-small-problem-fixer.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-stale-issues.yml b/.github/workflows/trigger-stale-issues.yml
index 8f1d46a6..bbac406d 100644
--- a/.github/workflows/trigger-stale-issues.yml
+++ b/.github/workflows/trigger-stale-issues.yml
@@ -7,17 +7,12 @@ on:
 permissions:
   contents: read
   issues: write
-  pull-requests: read
+  pull-requests: write
 
 jobs:
   run:
     uses: elastic/ai-github-actions/.github/workflows/gh-aw-stale-issues.lock.yml@main
     with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
+      title-prefix: "[stale-issues]"
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-test-improvement.yml b/.github/workflows/trigger-test-improvement.yml
deleted file mode 100644
index c02dcdd5..00000000
--- a/.github/workflows/trigger-test-improvement.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Test Improvement
-on:
-  schedule:
-    - cron: "0 9 * * 1"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  run:
-    uses: elastic/ai-github-actions/.github/workflows/gh-aw-test-improver.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}