diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index 377d6fc2aab8..0a890d52c7cd 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -190,7 +190,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
     env:
-      LOCAL_IMAGE: stackstate-cluster-agent:ci-${{ matrix.arch }}
+      LOCAL_IMAGE: quay.io/stackstate/stackstate-k8s-cluster-agent:ci-${{ matrix.arch }}
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -209,8 +209,6 @@ jobs:
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           set -eo pipefail
-          # Dockerfiles/cluster-agent pulls its ubuntu builder stage through the
-          # proxy; the BCI stages come from registry.suse.com and need no auth.
           printf '%s' "${REGISTRY_PASSWORD}" | docker login -u "${REGISTRY_USER}" --password-stdin "${REGISTRY_HOST}"
 
       - name: Build cluster-agent image
@@ -239,6 +237,120 @@ jobs:
             --entrypoint /opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent \
             "${LOCAL_IMAGE}" version
 
+      - name: Scan cluster-agent image (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets)
+        uses: StackVista/image-pipeline/.github/actions/scan-image@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: ${{ env.LOCAL_IMAGE }}
+          mode: gate
+          severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
+          with-grype: true
+          exceptions-path: exceptions
+          upload-sarif: false
+          sarif-category: stackstate-k8s-cluster-agent-${{ matrix.arch }}
+
+  publish-cluster-agent-image:
+    name: Publish and sign cluster-agent image (${{ matrix.arch }})
+    if: github.event_name == 'push'
+    needs: build-cluster-agent-image
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: docker-public
+          - arch: arm64
+            runner: arm64-xlarge-public
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      IMAGE: quay.io/stackstate/stackstate-k8s-cluster-agent
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Download cluster-agent binary
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: cluster-agent-binary-${{ matrix.arch }}
+
+      - name: Stage the cluster-agent binary in the image build context
+        run: |
+          set -eo pipefail
+          chmod +x bin/stackstate-cluster-agent/stackstate-cluster-agent
+          cp -r bin/stackstate-cluster-agent Dockerfiles/cluster-agent/
+
+      - name: Resolve image tag
+        id: image
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
+
+      - name: Resolve canonical OCI labels
+        id: oci
+        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image-name: stackstate-k8s-cluster-agent
+          tag: ${{ steps.image.outputs.tag }}
+          title: SUSE Observability Cluster Agent
+          description: Cluster-level agent collecting Kubernetes topology and cluster checks for SUSE Observability.
+          component: stackstate-k8s-cluster-agent
+          dockerfile: Dockerfiles/cluster-agent/Dockerfile
+          base-name: registry.suse.com/bci/bci-micro:latest
+          registry-credentials: |
+            [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
+
+      - name: Build, publish, and sign architecture image
+        uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: ${{ env.IMAGE }}
+          tag: ${{ steps.image.outputs.tag }}
+          arch: ${{ matrix.arch }}
+          docker-context: Dockerfiles/cluster-agent
+          dockerfile: Dockerfiles/cluster-agent/Dockerfile
+          labels: |
+            ${{ steps.oci.outputs.labels }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          source-registry-credentials: |
+            [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
+          target-registry: quay.io
+          target-registry-user: ${{ vars.QUAY_USER }}
+          target-registry-password: ${{ secrets.QUAY_PASSWORD }}
+
+  merge-cluster-agent-manifest:
+    name: Publish and sign multi-architecture cluster-agent image
+    if: github.event_name == 'push'
+    needs: publish-cluster-agent-image
+    runs-on: docker-public
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Resolve image tag
+        id: image
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
+
+      - name: Merge and sign multi-architecture manifest
+        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: quay.io/stackstate/stackstate-k8s-cluster-agent
+          tag: ${{ steps.image.outputs.tag }}
+          arches: amd64,arm64
+          target-registry: quay.io
+          target-registry-user: ${{ vars.QUAY_USER }}
+          target-registry-password: ${{ secrets.QUAY_PASSWORD }}
+
   cerberus-notify:
     name: Report failure to Slack (Cerberus)
     needs:
@@ -247,6 +359,8 @@ jobs:
       - build-agent
       - build-cluster-agent
       - build-cluster-agent-image
+      - publish-cluster-agent-image
+      - merge-cluster-agent-manifest
     if: >-
       always()
       && github.event_name == 'push'
diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 7c4b726c477c..ced8a5452144 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -236,7 +236,7 @@ jobs:
     timeout-minutes: 60
     env:
       ARCH: ${{ matrix.arch }}
-      LOCAL_IMAGE: stackstate-agent:ci-${{ matrix.arch }}
+      LOCAL_IMAGE: quay.io/stackstate/stackstate-k8s-agent:ci-${{ matrix.arch }}
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -255,8 +255,6 @@ jobs:
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           set -eo pipefail
-          # Dockerfiles/agent pulls its ubuntu extract stage through the proxy;
-          # the BCI stages come from registry.suse.com and need no auth.
           printf '%s' "${REGISTRY_PASSWORD}" | docker login -u "${REGISTRY_USER}" --password-stdin "${REGISTRY_HOST}"
 
       - name: Build agent image
@@ -278,6 +276,129 @@ jobs:
           set -eo pipefail
           docker run --rm --entrypoint /opt/stackstate-agent/bin/agent/agent "${LOCAL_IMAGE}" version
 
+      - name: Scan agent image (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets)
+        uses: StackVista/image-pipeline/.github/actions/scan-image@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: ${{ env.LOCAL_IMAGE }}
+          mode: gate
+          severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
+          with-grype: true
+          exceptions-path: exceptions
+          upload-sarif: false
+          sarif-category: stackstate-k8s-agent-${{ matrix.arch }}
+
+  publish-agent-image:
+    name: Publish and sign agent image (${{ matrix.arch }})
+    if: github.event_name == 'push'
+    needs:
+      - build-agent-image
+      - test-deb-renaming
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: docker-public
+          - arch: arm64
+            runner: arm64-xlarge-public
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      ARCH: ${{ matrix.arch }}
+      IMAGE: quay.io/stackstate/stackstate-k8s-agent
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Download DEB package
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: deb-package-${{ matrix.arch }}
+
+      - name: Stage the DEB in the image build context
+        run: |
+          set -eo pipefail
+          shopt -s nullglob
+          debs=(outcomes/pkg/stackstate-agent_*_"${ARCH}".deb)
+          if [ "${#debs[@]}" -ne 1 ]; then
+            echo "Expected exactly one stackstate-agent_*_${ARCH}.deb, found ${#debs[@]}: ${debs[*]}" >&2
+            exit 1
+          fi
+          cp "${debs[0]}" Dockerfiles/agent/
+
+      - name: Resolve image tag
+        id: image
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
+
+      - name: Resolve canonical OCI labels
+        id: oci
+        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image-name: stackstate-k8s-agent
+          tag: ${{ steps.image.outputs.tag }}
+          title: SUSE Observability Agent
+          description: Node agent collecting metrics, logs, traces and topology for SUSE Observability.
+          component: stackstate-k8s-agent
+          dockerfile: Dockerfiles/agent/Dockerfile
+          base-name: registry.suse.com/bci/bci-micro:latest
+          registry-credentials: |
+            [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
+
+      - name: Build, publish, and sign architecture image
+        uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: ${{ env.IMAGE }}
+          tag: ${{ steps.image.outputs.tag }}
+          arch: ${{ matrix.arch }}
+          docker-context: Dockerfiles/agent
+          dockerfile: Dockerfiles/agent/Dockerfile
+          build-args: ARCH=${{ matrix.arch }}
+          labels: |
+            ${{ steps.oci.outputs.labels }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          source-registry-credentials: |
+            [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
+          target-registry: quay.io
+          target-registry-user: ${{ vars.QUAY_USER }}
+          target-registry-password: ${{ secrets.QUAY_PASSWORD }}
+
+  merge-agent-manifest:
+    name: Publish and sign multi-architecture agent image
+    if: github.event_name == 'push'
+    needs: publish-agent-image
+    runs-on: docker-public
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Resolve image tag
+        id: image
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
+
+      - name: Merge and sign multi-architecture manifest
+        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        with:
+          image: quay.io/stackstate/stackstate-k8s-agent
+          tag: ${{ steps.image.outputs.tag }}
+          arches: amd64,arm64
+          target-registry: quay.io
+          target-registry-user: ${{ vars.QUAY_USER }}
+          target-registry-password: ${{ secrets.QUAY_PASSWORD }}
+
   cerberus-notify:
     name: Report failure to Slack (Cerberus)
     needs:
@@ -286,6 +407,8 @@ jobs:
       - build-deb
       - test-deb-renaming
       - build-agent-image
+      - publish-agent-image
+      - merge-agent-manifest
     if: >-
       always()
       && github.event_name == 'push'
diff --git a/Dockerfiles/agent/Dockerfile b/Dockerfiles/agent/Dockerfile
index 3e471e23f055..9ccde5ff4bd6 100644
--- a/Dockerfiles/agent/Dockerfile
+++ b/Dockerfiles/agent/Dockerfile
@@ -1,5 +1,6 @@
 ARG BASE_IMAGE_REGISTRY=registry.tooling.stackstate.io/docker/library
 ARG BASE_IMAGE_UBUNTU_VERSION=24.04
+ARG BCI_IMAGE_REGISTRY=registry.tooling.stackstate.io/suse/bci
 
 ##########################################
 # Preparation stage: extract and cleanup #
@@ -27,7 +28,7 @@ RUN dpkg -x /stackstate-agent*_${ARCH}.deb . \
 #   - copy default config files
 COPY stackstate*.yaml etc/stackstate-agent/
 
-FROM registry.suse.com/bci/bci-base:latest AS software
+FROM ${BCI_IMAGE_REGISTRY}/bci-base:latest AS software
 # as per comment here: https://github.com/rancher/rancher/blob/main/package/Dockerfile#L12
 # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm
 RUN :
@@ -35,7 +36,7 @@ RUN :
 # Actual docker image construction #
 ####################################
 
-FROM registry.suse.com/bci/bci-micro:latest
+FROM ${BCI_IMAGE_REGISTRY}/bci-micro:latest
 LABEL maintainer="StackState <info@stackstate.com>"
 # Install system packages using builder image that has zypper
 
diff --git a/Dockerfiles/cluster-agent/Dockerfile b/Dockerfiles/cluster-agent/Dockerfile
index bb252b5a996e..bc0777542028 100644
--- a/Dockerfiles/cluster-agent/Dockerfile
+++ b/Dockerfiles/cluster-agent/Dockerfile
@@ -1,8 +1,11 @@
+ARG BASE_IMAGE_REGISTRY=registry.tooling.stackstate.io/docker/library
+ARG BCI_IMAGE_REGISTRY=registry.tooling.stackstate.io/suse/bci
+
 ########################################
 # Preparation stage: layout and chmods #
 ########################################
 
-FROM registry.tooling.stackstate.io/docker/library/ubuntu:20.04 as builder
+FROM ${BASE_IMAGE_REGISTRY}/ubuntu:20.04 as builder
 
 WORKDIR /output
 
@@ -22,12 +25,12 @@ RUN chmod 755 entrypoint.sh \
 # Actual docker image construction #
 ####################################
 
-FROM registry.suse.com/bci/bci-base:latest AS software
+FROM ${BCI_IMAGE_REGISTRY}/bci-base:latest AS software
 # as per comment here: https://github.com/rancher/rancher/blob/main/package/Dockerfile#L12
 # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm
 RUN :
 
-FROM registry.suse.com/bci/bci-micro:latest AS final
+FROM ${BCI_IMAGE_REGISTRY}/bci-micro:latest AS final
 LABEL maintainer="StackState <info@stackstate.com>"
 
 ARG user="stackstate-agent"
diff --git a/exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml b/exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml
new file mode 100644
index 000000000000..4784c149340d
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2025-15366.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2025-15366
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2025-15366
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0a6, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml
new file mode 100644
index 000000000000..f9be944281b8
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2025-15367.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2025-15367
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2025-15367
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0a6, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml
new file mode 100644
index 000000000000..5080525c5523
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-0864.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-0864
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-0864
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0b4, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml
new file mode 100644
index 000000000000..f6d0d59faee4
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-11940.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-11940
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-11940
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0b4, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml
new file mode 100644
index 000000000000..44a30b317212
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-11972.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-11972
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-11972
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0b4, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml
new file mode 100644
index 000000000000..7466dfe8720f
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-12003.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-12003
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-12003
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0b3, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-1502.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-1502.yaml
new file mode 100644
index 000000000000..3b82193536ea
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-1502.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-1502
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-1502
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml
new file mode 100644
index 000000000000..690ecbdd9cd2
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-15308.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-15308
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_for_pinned_runtime_line
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-15308
+statement: |
+  No fix is published for the CPython 3.13 maintenance line. Upstream
+  currently carries the fix only in 3.15.0, a pre-release of a different
+  minor version, so there is no compatible patch we could apply without
+  moving the embedded interpreter to an unreleased runtime. Under the
+  remediation SLA this falls outside the patch commitment, so the date below
+  is a short review deadline rather than an acceptance: re-check upstream for
+  a 3.13 backport before renewing. Tracked with the rest of the
+  embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-3276.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-3276.yaml
new file mode 100644
index 000000000000..a7158e95bec1
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-3276.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-3276
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-3276
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-3298.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-3298.yaml
new file mode 100644
index 000000000000..0c8a60306626
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-3298.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-3298
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-3298
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml
new file mode 100644
index 000000000000..0079db8231f6
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-4360.yaml
@@ -0,0 +1,22 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-4360
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_published
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-4360
+statement: |
+  Upstream has published no fixed CPython version for this CVE in any release
+  line, so no patch exists to apply. The date below is a short review
+  deadline, not an acceptance -- re-check upstream before renewing. Tracked
+  with the rest of the embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-4786.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-4786.yaml
new file mode 100644
index 000000000000..ee7701d888ce
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-4786.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-4786
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-4786
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-6019.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-6019.yaml
new file mode 100644
index 000000000000..65a1f878a5f8
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-6019.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-6019
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-6019
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-6100.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-6100.yaml
new file mode 100644
index 000000000000..2cdcd61a3fb7
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-6100.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-6100
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-6100
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml
new file mode 100644
index 000000000000..5abe5fd4c54a
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-6879.yaml
@@ -0,0 +1,22 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-6879
+  severity: LOW
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_published
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-6879
+statement: |
+  Upstream has published no fixed CPython version for this CVE in any release
+  line, so no patch exists to apply. The date below is a short review
+  deadline, not an acceptance -- re-check upstream before renewing. Tracked
+  with the rest of the embedded-runtime work in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml
new file mode 100644
index 000000000000..65fedbbae7a0
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-69247.yaml
@@ -0,0 +1,24 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-69247
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:pypi/cryptography@48.0.1
+  paths:
+  - opt/stackstate-agent/embedded/lib/python3.13/site-packages/cryptography
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: pyca
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-69247
+statement: |
+  cryptography 50.0.0 fixes this, so a compatible patch exists and the
+  finding is inside the 14-day remediation window rather than being accepted.
+  The package is installed into the omnibus-embedded Python environment, so
+  the fix is a requirements bump in the omnibus build, tracked in STAC-25556.
+  Do not renew this exception without re-checking whether the bump has
+  landed.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml
new file mode 100644
index 000000000000..6f7d66fa1273
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-69248.yaml
@@ -0,0 +1,22 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-69248
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:pypi/cryptography@48.0.1
+  paths:
+  - opt/stackstate-agent/embedded/lib/python3.13/site-packages/cryptography
+status: accepted_pending_upstream_fix
+reason: no_upstream_fix_published
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: pyca
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-69248
+statement: |
+  Trivy reports no fixed version for this CVE, so there is no patch to apply.
+  It will most likely be resolved incidentally by the cryptography bump that
+  clears CVE-2026-69247 and CVE-2026-69249; until then the date below is a
+  short review deadline, not an acceptance. Tracked in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml
new file mode 100644
index 000000000000..4ca636daae4f
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-69249.yaml
@@ -0,0 +1,24 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-69249
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:pypi/cryptography@48.0.1
+  paths:
+  - opt/stackstate-agent/embedded/lib/python3.13/site-packages/cryptography
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: pyca
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-69249
+statement: |
+  cryptography 49.0.0 fixes this, so a compatible patch exists and the
+  finding is inside the 14-day remediation window rather than being accepted.
+  The package is installed into the omnibus-embedded Python environment, so
+  the fix is a requirements bump in the omnibus build, tracked in STAC-25556.
+  Do not renew this exception without re-checking whether the bump has
+  landed.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-7210.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-7210.yaml
new file mode 100644
index 000000000000..f4ae0c862dfb
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-7210.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-7210
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-7210
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-7774.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-7774.yaml
new file mode 100644
index 000000000000..4c19ae72e010
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-7774.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-7774
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-7774
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-8328.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-8328.yaml
new file mode 100644
index 000000000000..bf55aa30b620
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-8328.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-8328
+  severity: MEDIUM
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-8328
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-9669.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-9669.yaml
new file mode 100644
index 000000000000..592349d0a3ae
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/CVE-2026-9669.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: CVE-2026-9669
+  severity: HIGH
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:generic/python@3.13.13
+  paths:
+  - opt/stackstate-agent/embedded/bin/python3.13
+status: under_investigation
+reason: omnibus_runtime_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: python
+upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-9669
+statement: |
+  CPython 3.13.14 fixes this on the 3.13 maintenance line, so a compatible
+  patch exists and the finding is inside the 14-day remediation window rather
+  than being accepted. The interpreter is embedded by the omnibus build, so
+  the fix is an omnibus software-definition bump tracked in STAC-25556, not a
+  change any workflow in this repository can make. This exception exists only
+  so the newly added image gate can be enforced on everything else while that
+  bump lands; it must not be renewed without re-checking whether 3.13.14 has
+  been integrated.
diff --git a/exceptions/stackstate-k8s-agent/GO-2026-5841.yaml b/exceptions/stackstate-k8s-agent/GO-2026-5841.yaml
new file mode 100644
index 000000000000..71c2ab63538a
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/GO-2026-5841.yaml
@@ -0,0 +1,24 @@
+schema_version: '1'
+vulnerability:
+  id: GO-2026-5841
+  severity: UNKNOWN
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:golang/github.com/klauspost/compress@v1.18.5
+  paths:
+  - opt/stackstate-agent/bin/agent/agent
+  - opt/stackstate-agent/bin/installer/installer
+status: under_investigation
+reason: transitive_dependency_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: klauspost
+upstream_reference: https://pkg.go.dev/vuln/GO-2026-5841
+statement: |
+  github.com/klauspost/compress v1.18.7 fixes this, so a compatible patch
+  exists and the finding is inside the 14-day remediation window. It reaches
+  the binary transitively through the upstream Datadog agent dependency
+  graph, so the bump has to go through a go.mod update rather than a direct
+  version pin. Tracked in STAC-25556.
diff --git a/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml
new file mode 100644
index 000000000000..b10a861cd1f4
--- /dev/null
+++ b/exceptions/stackstate-k8s-agent/GO-2026-5932.yaml
@@ -0,0 +1,27 @@
+schema_version: '1'
+vulnerability:
+  id: GO-2026-5932
+  severity: UNKNOWN
+product:
+  consumer: stackstate-k8s-agent
+  image: quay.io/stackstate/stackstate-k8s-agent
+component:
+  purl: pkg:golang/golang.org/x/crypto@v0.53.0
+  paths:
+  - opt/stackstate-agent/bin/agent/agent
+  - opt/stackstate-agent/bin/installer/installer
+status: accepted_with_compensating_control
+reason: unpublished_image_vex_identity_bridge
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: golang
+upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932
+statement: |
+  The affected openpgp and openpgp/clearsign packages are absent from this
+  binary's command dependency graph. StackVista/vexhub carries the reviewed
+  image-scoped not_affected statement, but Grype and Trivy match VEX products
+  by exact image digest or tag, and this gate scans a freshly built commit
+  image whose identity cannot exist in the VEX hub in advance. The same
+  bridge is already in place for stackstate-process-agent. Keep it only until
+  the scan pipeline can apply reviewed statements to unpublished images
+  without broadening them to every consumer of golang.org/x/crypto.
diff --git a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml
new file mode 100644
index 000000000000..aa78469d9b58
--- /dev/null
+++ b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5841.yaml
@@ -0,0 +1,23 @@
+schema_version: '1'
+vulnerability:
+  id: GO-2026-5841
+  severity: UNKNOWN
+product:
+  consumer: stackstate-k8s-cluster-agent
+  image: quay.io/stackstate/stackstate-k8s-cluster-agent
+component:
+  purl: pkg:golang/github.com/klauspost/compress@v1.18.5
+  paths:
+  - opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent
+status: under_investigation
+reason: transitive_dependency_bump_in_progress
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: klauspost
+upstream_reference: https://pkg.go.dev/vuln/GO-2026-5841
+statement: |
+  github.com/klauspost/compress v1.18.7 fixes this, so a compatible patch
+  exists and the finding is inside the 14-day remediation window. It reaches
+  the binary transitively through the upstream Datadog agent dependency
+  graph, so the bump has to go through a go.mod update rather than a direct
+  version pin. Tracked in STAC-25556.
diff --git a/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml
new file mode 100644
index 000000000000..6025ad99e3da
--- /dev/null
+++ b/exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml
@@ -0,0 +1,26 @@
+schema_version: '1'
+vulnerability:
+  id: GO-2026-5932
+  severity: UNKNOWN
+product:
+  consumer: stackstate-k8s-cluster-agent
+  image: quay.io/stackstate/stackstate-k8s-cluster-agent
+component:
+  purl: pkg:golang/golang.org/x/crypto@v0.53.0
+  paths:
+  - opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent
+status: accepted_with_compensating_control
+reason: unpublished_image_vex_identity_bridge
+expires: '2026-08-20'
+owner: "@StackVista/observability-team"
+upstream_owner: golang
+upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932
+statement: |
+  The affected openpgp and openpgp/clearsign packages are absent from this
+  binary's command dependency graph. StackVista/vexhub carries the reviewed
+  image-scoped not_affected statement, but Grype and Trivy match VEX products
+  by exact image digest or tag, and this gate scans a freshly built commit
+  image whose identity cannot exist in the VEX hub in advance. The same
+  bridge is already in place for stackstate-process-agent. Keep it only until
+  the scan pipeline can apply reviewed statements to unpublished images
+  without broadening them to every consumer of golang.org/x/crypto.