diff --git a/amazon_app_mesh/README.md b/amazon_app_mesh/README.md
index b70929abab2a2..9ed0d249feb1d 100644
--- a/amazon_app_mesh/README.md
+++ b/amazon_app_mesh/README.md
@@ -67,7 +67,7 @@ Log collection is not supported for this site.
 partial -->
 
 <!-- partial
-{{< site-region region="us,eu,gov" >}}
+{{< site-region region="us,eu,gov,gov2" >}}
 
 To enable log collection, update the Agent's DaemonSet with the dedicated [Kubernetes log collection instructions][1].
 
@@ -127,7 +127,7 @@ Log collection is not supported for this site.
 partial -->
 
 <!-- partial
-{{< site-region region="us,eu,gov" >}}
+{{< site-region region="us,eu,gov,gov2" >}}
 
 Enable log collection with the instructions in the [ECS Fargate integration documentation][1].
 
@@ -178,7 +178,7 @@ Log collection is not supported for this site.
 partial -->
 
 <!-- partial
-{{< site-region region="us,eu,gov" >}}
+{{< site-region region="us,eu,gov,gov2" >}}
 
 Enable log collection with the instructions in the [ECS integration documentation][1].
 
diff --git a/ddev/changelog.d/23703.added b/ddev/changelog.d/23703.added
new file mode 100644
index 0000000000000..5d4c276c6afe7
--- /dev/null
+++ b/ddev/changelog.d/23703.added
@@ -0,0 +1 @@
+Accept a PR number, ``PR-<number>`` token, or GitHub PR URL as input to ``port-commit``, and fetch the target commit from origin when it is not in the local object database.
diff --git a/ddev/src/ddev/cli/application.py b/ddev/src/ddev/cli/application.py
index 767a21b916f46..2dd56f4efc332 100644
--- a/ddev/src/ddev/cli/application.py
+++ b/ddev/src/ddev/cli/application.py
@@ -6,7 +6,7 @@
 import logging
 import os
 from functools import cached_property
-from typing import cast
+from typing import TYPE_CHECKING, cast
 
 from ddev.cli.terminal import Terminal
 from ddev.config.constants import AppEnvVars, ConfigEnvVars, VerbosityLevels
@@ -16,6 +16,9 @@
 from ddev.utils.github import GitHubManager
 from ddev.utils.platform import Platform
 
+if TYPE_CHECKING:
+    from typing import Any, Callable, NoReturn
+
 
 class AppLoggingHandler(logging.Handler):
     """Routes Python logging through the Application display methods."""
@@ -35,7 +38,7 @@ def emit(self, record: logging.LogRecord) -> None:
 
 
 class Application(Terminal):
-    def __init__(self, exit_func, *args, **kwargs):
+    def __init__(self, exit_func: Callable[[int], NoReturn], *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.platform = Platform(self.escaped_output)
         self.__exit_func = exit_func
@@ -49,7 +52,7 @@ def __init__(self, exit_func, *args, **kwargs):
         self.__github = cast(GitHubManager, None)
 
         # TODO: remove this when the old CLI is gone
-        self.__config = {}
+        self.__config: dict[str, Any] = {}
 
     @property
     def config(self) -> RootConfig:
@@ -105,7 +108,7 @@ def set_repo(self, core: bool, extras: bool, marketplace: bool, agent: bool, her
             self.repo, user=self.config.github.user, token=self.config.github.token, status=self.status
         )
 
-    def abort(self, text='', code=1, **kwargs):
+    def abort(self, text: str = '', code: int = 1, **kwargs: Any) -> NoReturn:
         if text:
             self.display_error(text, **kwargs)
         self.__exit_func(code)
diff --git a/ddev/src/ddev/cli/meta/scripts/serve_openmetrics_payload.py b/ddev/src/ddev/cli/meta/scripts/serve_openmetrics_payload.py
index 33a8c50c70375..d5bc8a0cad284 100644
--- a/ddev/src/ddev/cli/meta/scripts/serve_openmetrics_payload.py
+++ b/ddev/src/ddev/cli/meta/scripts/serve_openmetrics_payload.py
@@ -91,7 +91,7 @@ def serve_openmetrics_payload(
     env_data.write_config(check_config)
     env_data.write_metadata(metadata)
 
-    agent = DockerAgent(app.platform, intg, ENVIRONMENT_NAME, metadata, env_data.config_file)
+    agent = DockerAgent(app, intg, ENVIRONMENT_NAME, metadata, env_data.config_file)
     agent_env_vars = _get_agent_env_vars(app.config.org.config, {}, {}, False)
 
     try:
diff --git a/ddev/src/ddev/cli/release/port_commit.py b/ddev/src/ddev/cli/release/port_commit.py
index 43292dbb85ed3..c21f011ea828f 100644
--- a/ddev/src/ddev/cli/release/port_commit.py
+++ b/ddev/src/ddev/cli/release/port_commit.py
@@ -13,7 +13,7 @@
 
 @click.command(name='port-commit', short_help='Backport a commit onto a target branch')
 @click.pass_obj
-@click.argument('commit_hash', required=False)
+@click.argument('commit_hash', required=False, metavar='COMMIT_OR_PR')
 @click.option('-t', '--target-branch', default='master', show_default=True, help='Target branch to port to.')
 @click.option('-p', '--branch-prefix', default='port', show_default=True, help='Branch name prefix.')
 @click.option('-s', '--branch-suffix', default=None, help='Branch name suffix. Defaults to `to-<target-branch>`.')
@@ -43,16 +43,21 @@ def port_commit(
     """
     Backport a commit onto a target branch.
 
-    Cherry-picks COMMIT_HASH onto `--target-branch` (default `master`) on a new branch named
+    Cherry-picks COMMIT_OR_PR onto `--target-branch` (default `master`) on a new branch named
     `<github-user>/<prefix>-<sha[:10]>-<suffix>`, preserving `.in-toto` files from the target
     branch so package signatures stay intact. Pushes the branch and, unless `--no-pr` is set,
     opens a pull request titled `[Backport] <subject>` and labeled with `--pr-labels`.
 
-    If COMMIT_HASH is omitted, the current HEAD commit is used after confirmation.
+    COMMIT_OR_PR accepts: a full 40-character commit SHA, a PR number (e.g. `23703`), an
+    explicit `PR-<number>` token, or a GitHub PR URL. Pure-digit inputs are tried as a PR
+    first when a GitHub token is configured, and fall back to commit resolution on 404. If
+    omitted, the current HEAD commit is used after confirmation.
 
     The GitHub user for the branch prefix is taken from `ddev config` (`github.user`) or the
     `DD_GITHUB_USER` / `GITHUB_USER` / `GITHUB_ACTOR` environment variables.
     """
+    import logging
+
     from ddev.cli.release.port_commit_workflow import (
         PortStepError,
         build_port_steps,
@@ -60,6 +65,10 @@ def port_commit(
         resolve_port_plan,
     )
 
+    # httpx logs every request at INFO and clutters the workflow output. The PR-resolution and
+    # PR-creation steps already print their own status lines; the underlying HTTP traffic is noise.
+    logging.getLogger('httpx').setLevel(logging.WARNING)
+
     plan = resolve_port_plan(
         app,
         commit_hash=commit_hash,
diff --git a/ddev/src/ddev/cli/release/port_commit_workflow.py b/ddev/src/ddev/cli/release/port_commit_workflow.py
index bb1bc90d850a7..472f1692ecc17 100644
--- a/ddev/src/ddev/cli/release/port_commit_workflow.py
+++ b/ddev/src/ddev/cli/release/port_commit_workflow.py
@@ -14,6 +14,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import re
 from dataclasses import dataclass
 from typing import TYPE_CHECKING
@@ -27,6 +28,7 @@
 
 if TYPE_CHECKING:
     from ddev.cli.application import Application
+    from ddev.utils.github_async.models import PullRequest
 
 
 PR_NUMBER_SUFFIX_PATTERN = re.compile(r'\s*\(#(\d+)\)\s*$')
@@ -34,12 +36,25 @@
 PR_TEMPLATE_HEADING = '### What does this PR do?'
 IN_TOTO_SUFFIX = '.in-toto'
 WORKTREE_BASE = '.worktrees/port-commit'
+FULL_SHA_PATTERN = re.compile(r'^[0-9a-fA-F]{40}$')
+HEX_PATTERN = re.compile(r'^[0-9a-fA-F]+$')
+DIGITS_PATTERN = re.compile(r'^\d+$')
+PR_PREFIX_PATTERN = re.compile(r'^PR-(\d+)$', re.IGNORECASE)
+PR_URL_PATTERN = re.compile(r'^https?://github\.com/[^/]+/[^/]+/pull/(\d+)(?:[/?#].*)?$', re.IGNORECASE)
 
 
 class PortStepError(Exception):
     """Raised by a PortStep to signal a clean abort with a user-facing message."""
 
 
+class _CommitNotResolvable(Exception):
+    """Raised when a commit input cannot be resolved locally or via a SHA-targeted fetch."""
+
+
+class _PRNotFound(Exception):
+    """Raised when a PR lookup returns 404 so the caller can fall back to commit resolution."""
+
+
 class PortStep:
     """Single step of the port-commit workflow."""
 
@@ -342,6 +357,164 @@ async def _create_pr(self) -> None:
                 )
 
 
+def _resolve_input(app: Application, raw: str, *, dry_run: bool) -> str:
+    """Resolve the raw user input to a full commit SHA.
+
+    Handles three input shapes:
+    - Explicit PR form (`PR-12345` or a GitHub PR URL) -> looks up the PR.
+    - All-digits (e.g. `12345`) with a GitHub token configured -> tries as a PR; on 404 falls
+      back to commit resolution. Without a token the PR step is skipped.
+    - Anything else -> commit resolution.
+
+    Raises `_CommitNotResolvable` when nothing matches so the caller can decide how to abort.
+    """
+    raw = raw.strip()
+    pr_number = _extract_explicit_pr_number(raw)
+    if pr_number is not None:
+        return _resolve_pr_to_commit(app, pr_number, dry_run=dry_run)
+
+    is_digits = DIGITS_PATTERN.fullmatch(raw) is not None
+    if is_digits and app.config.github.token:
+        with contextlib.suppress(_PRNotFound):
+            return _resolve_pr_to_commit(app, int(raw), dry_run=dry_run)
+
+    try:
+        return _resolve_commit_or_fetch(app, raw, dry_run=dry_run)
+    except _CommitNotResolvable as exc:
+        if is_digits:
+            raise _CommitNotResolvable(
+                f'Could not resolve `{raw}` as a PR or a commit. '
+                'Pass the full 40-character SHA, or `PR-xxxxx` / a PR URL to disambiguate.'
+            ) from exc
+        raise
+
+
+def _extract_explicit_pr_number(raw: str) -> int | None:
+    """Return the PR number when `raw` is a `PR-12345` token or a GitHub PR URL, else None."""
+    for pattern in (PR_PREFIX_PATTERN, PR_URL_PATTERN):
+        match = pattern.fullmatch(raw)
+        if match:
+            return int(match.group(1))
+    return None
+
+
+def _resolve_pr_to_commit(app: Application, pr_number: int, *, dry_run: bool) -> str:
+    """Resolve a PR number to the SHA of its merge commit, validating squash-merge.
+
+    Raises `_PRNotFound` when GitHub returns 404. Raises `_CommitNotResolvable` (wrapped with PR
+    context) when the merge commit can't be resolved locally. Aborts on other auth / network /
+    validation errors so the user gets a clear, contextual message rather than a stack trace.
+    """
+    import asyncio
+
+    import httpx
+    from pydantic import ValidationError
+
+    if not app.config.github.token:
+        app.abort(
+            'GitHub token required to resolve a PR reference. Set `github.token`, or pass the '
+            'full commit SHA directly (--no-pr does not skip this lookup).'
+        )
+
+    owner, repo = resolve_owner_repo(app)
+    app.display_info(f'Resolving PR #{pr_number} via GitHub...')
+    try:
+        pr = asyncio.run(_fetch_pr(app.config.github.token, owner, repo, pr_number))
+    except httpx.HTTPStatusError as exc:
+        status = exc.response.status_code
+        if status == 404:
+            raise _PRNotFound(str(pr_number)) from exc
+        if status in (401, 403):
+            app.abort(
+                f'GitHub denied the request for PR #{pr_number} (HTTP {status}). '
+                'Check that `github.token` is set and has `repo` scope.'
+            )
+        app.abort(f'Failed to fetch PR #{pr_number} from GitHub: {exc}.')
+    except (httpx.HTTPError, ValidationError) as exc:
+        app.abort(f'Failed to fetch PR #{pr_number} from GitHub: {exc}.')
+
+    if not pr.merged:
+        app.abort(f'PR #{pr_number} is not merged; nothing to backport.')
+
+    if not pr.merge_commit_sha:
+        app.abort(f'PR #{pr_number} has no merge commit SHA available.')
+
+    try:
+        full_sha = _resolve_commit_or_fetch(app, pr.merge_commit_sha, dry_run=dry_run)
+    except _CommitNotResolvable as exc:
+        raise _CommitNotResolvable(
+            f'PR #{pr_number} was found but its merge commit `{pr.merge_commit_sha}` could not be resolved: {exc}'
+        ) from exc
+    _abort_if_merge_commit(app, pr_number, full_sha)
+    return full_sha
+
+
+async def _fetch_pr(token: str, owner: str, repo: str, pr_number: int) -> PullRequest:
+    from ddev.utils.github_async import async_github_client
+
+    async with async_github_client(token=token) as client:
+        response = await client.get_pull_request(owner=owner, repo=repo, pull_number=pr_number)
+        return response.data
+
+
+def _abort_if_merge_commit(app: Application, pr_number: int, full_sha: str) -> None:
+    """Abort when `full_sha` is a merge commit (>= 2 parents), which can't be backported as a single commit."""
+    try:
+        raw = app.repo.git.capture('rev-list', '--parents', '-n1', full_sha)
+    except OSError as exc:
+        app.abort(f'Could not inspect merge parents of `{full_sha}`: {exc}.')
+    else:
+        parent_count = max(len(raw.strip().split()) - 1, 0)
+        if parent_count >= 2:
+            app.abort(
+                f"PR #{pr_number} was not squash-merged, so there isn't a single commit to backport "
+                'the full PR. Run again with the specific commit you want to backport.'
+            )
+
+
+def _resolve_commit_or_fetch(app: Application, commit_hash: str, *, dry_run: bool) -> str:
+    """Return the full SHA for `commit_hash`, fetching from origin when the commit is not local.
+
+    Raises `_CommitNotResolvable` when the commit is neither available locally nor reachable on
+    origin. Falling back to a SHA-targeted fetch lets the command port commits that live on remote
+    branches the local repo does not track (the `remote.origin.fetch` refspec is often narrowed in
+    this repo to avoid pulling thousands of branches).
+
+    When `dry_run` is true, the fetch fallback is skipped to preserve the dry-run contract: a
+    non-local commit raises instead of mutating local state.
+    """
+    git = app.repo.git
+    with contextlib.suppress(OSError):
+        return git.capture('rev-parse', '--verify', f'{commit_hash}^{{commit}}').strip()
+
+    # Abbreviated SHAs cannot be fetched (GitHub's allowReachableSHA1InWant only honours full
+    # SHAs), so this is the real diagnosis regardless of dry-run mode. Surface it first.
+    if HEX_PATTERN.fullmatch(commit_hash) and not FULL_SHA_PATTERN.fullmatch(commit_hash):
+        raise _CommitNotResolvable(
+            f'Commit `{commit_hash}` is not in the local repository. '
+            'Pass the full 40-character SHA so it can be fetched from origin '
+            '(GitHub does not support SHA-targeted fetches for abbreviated SHAs).'
+        )
+
+    if dry_run:
+        raise _CommitNotResolvable(
+            f'Commit `{commit_hash}` is not in the local repository. '
+            'Re-run without `--dry-run` to fetch it from origin, or pre-fetch the commit manually.'
+        )
+
+    app.display_info(f'Commit `{commit_hash}` not found locally; fetching from origin.')
+    fetched = False
+    with contextlib.suppress(OSError):
+        git.run('fetch', 'origin', commit_hash)
+        fetched = True
+
+    if fetched:
+        with contextlib.suppress(OSError):
+            return git.capture('rev-parse', '--verify', f'{commit_hash}^{{commit}}').strip()
+
+    raise _CommitNotResolvable(f'Commit `{commit_hash}` does not exist locally or on origin.')
+
+
 def _path_exists_in_head(git: GitRepository, path: str) -> bool:
     try:
         git.capture('cat-file', '-e', f'HEAD:{path}')
@@ -355,7 +528,10 @@ def _resolve_in_toto_conflict(git: GitRepository, path: str) -> None:
         git.run('rm', '--force', path)
         return
     git.run('checkout', '--ours', path)
-    git.run('add', path)
+    # `.in-toto/` is gitignored in this repo, so `git add` refuses without `--force` even though
+    # the path is already tracked in HEAD. The force is safe: we only get here for paths that
+    # came out of `git diff --diff-filter=U`, i.e. files git itself flagged as needing resolution.
+    git.run('add', '--force', path)
 
 
 def _restore_path_from_head(git: GitRepository, path: str) -> None:
@@ -471,9 +647,9 @@ def resolve_port_plan(
         commit_hash = head_commit.sha
 
     try:
-        full_sha = app.repo.git.capture('rev-parse', '--verify', f'{commit_hash}^{{commit}}').strip()
-    except OSError:
-        app.abort(f'Commit `{commit_hash}` does not exist.')
+        full_sha = _resolve_input(app, commit_hash, dry_run=dry_run)
+    except _CommitNotResolvable as exc:
+        app.abort(str(exc))
 
     log_entries = app.repo.git.log(['hash:%H', 'subject:%s'], n=1, source=full_sha)
     if not log_entries:
diff --git a/ddev/src/ddev/utils/github_async/client.py b/ddev/src/ddev/utils/github_async/client.py
index 0297f70da44f0..67a66ab44047a 100644
--- a/ddev/src/ddev/utils/github_async/client.py
+++ b/ddev/src/ddev/utils/github_async/client.py
@@ -275,6 +275,31 @@ async def create_issue_comment(
         )
         return self._parse_response(response, IssueComment)
 
+    async def get_pull_request(
+        self,
+        owner: str,
+        repo: str,
+        pull_number: int,
+        timeout: float | None = None,
+    ) -> GitHubResponse[PullRequest]:
+        """
+        Calls the GitHub API to get a single pull request.
+
+        GitHub API Documentation:
+        https://docs.github.com/en/rest/pulls/pulls#get-a-pull-request
+
+        Args:
+            owner: Repository owner (user or organisation).
+            repo: Repository name.
+            pull_number: Pull request number.
+            timeout: Optional timeout for this specific request. Defaults to the client's default_timeout.
+
+        Returns:
+            GitHubResponse[PullRequest]: The validated pull request data and headers.
+        """
+        response = await self._request("GET", f"/repos/{owner}/{repo}/pulls/{pull_number}", timeout=timeout)
+        return self._parse_response(response, PullRequest)
+
     async def create_pull_request(
         self,
         owner: str,
diff --git a/ddev/tests/cli/release/test_port_commit.py b/ddev/tests/cli/release/test_port_commit.py
index 9a64e344cc5bf..85b5d77dec276 100644
--- a/ddev/tests/cli/release/test_port_commit.py
+++ b/ddev/tests/cli/release/test_port_commit.py
@@ -27,6 +27,8 @@
 from tests.helpers.github_async import FakeAsyncGitHubClient
 from tests.helpers.runner import CliRunner
 
+FULL_SHA_FOR_TESTS = '1234567890abcdef001234567890abcdef00abcd'
+
 
 @pytest.fixture
 def app_mock(mocker: MockerFixture) -> MagicMock:
@@ -219,7 +221,7 @@ def test_cherry_pick_only_in_toto_conflict_is_resolved(app_mock, git_mock):
     assert git_mock.run.call_args_list == [
         call('cherry-pick', '--no-commit', '1234567890'),
         call('checkout', '--ours', 'path/file.in-toto.link'),
-        call('add', 'path/file.in-toto.link'),
+        call('add', '--force', 'path/file.in-toto.link'),
     ]
 
 
@@ -363,12 +365,22 @@ def test_create_pull_request_step_skips_label_call_when_no_labels(
     fake_async_github.assert_not_called('add_labels_to_issue')
 
 
-def _setup_command_mocks(mocker, *, commit_sha='1234567890abcdef00', subject='Fix bug (#100)', in_toto=''):
+def _setup_command_mocks(
+    mocker,
+    *,
+    commit_sha='1234567890abcdef00',
+    subject='Fix bug (#100)',
+    in_toto='',
+    parents=('parent_sha',),
+):
+    """Patch git so the workflow sees a resolvable commit. `parents` controls the merge-parent check."""
     run_mock = mocker.patch('ddev.utils.git.GitRepository.run')
     capture_mock = mocker.patch('ddev.utils.git.GitRepository.capture')
+    rev_list_output = ' '.join([commit_sha, *parents]) + '\n'
     capture_mock.side_effect = lambda *args: {
         ('rev-parse', '--verify', f'{commit_sha}^{{commit}}'): commit_sha + '\n',
         ('diff-tree', '--no-commit-id', '--name-only', '-r', commit_sha): in_toto,
+        ('rev-list', '--parents', '-n1', commit_sha): rev_list_output,
     }.get(args, '')
     mocker.patch(
         'ddev.utils.git.GitRepository.log',
@@ -381,6 +393,16 @@ def _setup_command_mocks(mocker, *, commit_sha='1234567890abcdef00', subject='Fi
     return run_mock
 
 
+def _merged_pr(number=23703, merge_commit_sha=None):
+    """Build a PullRequest model for a squash-merged PR."""
+    return PullRequest(
+        number=number,
+        html_url=f'https://github.com/DataDog/integrations-core/pull/{number}',
+        merged=True,
+        merge_commit_sha=merge_commit_sha or FULL_SHA_FOR_TESTS,
+    )
+
+
 def test_command_happy_path(ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient) -> None:
     run_mock = _setup_command_mocks(mocker)
     fake_async_github.mock_response(
@@ -601,20 +623,273 @@ def test_command_token_guard(
     fake_async_github.assert_not_called('create_pull_request')
 
 
-def test_command_aborts_when_commit_does_not_exist(
+def test_command_aborts_when_commit_missing_after_fetch(
     ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
 ) -> None:
-    mocker.patch('ddev.utils.git.GitRepository.run')
+    """Fetch succeeds but rev-parse still cannot resolve the commit (edge case)."""
+    run_mock = mocker.patch('ddev.utils.git.GitRepository.run')
     mocker.patch('ddev.utils.git.GitRepository.capture', side_effect=OSError('bad object'))
     mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
 
-    result = ddev('release', 'port-commit', '1234567890abcdef00')
+    result = ddev('release', 'port-commit', FULL_SHA_FOR_TESTS)
+
+    assert result.exit_code == 1, result.output
+    assert 'does not exist locally or on origin' in result.output
+    assert ('fetch', 'origin', FULL_SHA_FOR_TESTS) in [c.args for c in run_mock.call_args_list]
+    fake_async_github.assert_not_called('create_pull_request')
+
+
+def test_command_aborts_when_fetch_fails(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    def run_side_effect(*args):
+        if args[:2] == ('fetch', 'origin'):
+            raise OSError("couldn't find remote ref")
+        return None
+
+    mocker.patch('ddev.utils.git.GitRepository.run', side_effect=run_side_effect)
+    mocker.patch('ddev.utils.git.GitRepository.capture', side_effect=OSError('bad object'))
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', FULL_SHA_FOR_TESTS)
+
+    assert result.exit_code == 1, result.output
+    assert 'does not exist locally or on origin' in result.output
+    fake_async_github.assert_not_called('create_pull_request')
+
+
+def test_command_aborts_in_dry_run_when_commit_not_local(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    """Dry-run must not mutate local state, so don't fetch when the commit is missing."""
+    run_mock = mocker.patch('ddev.utils.git.GitRepository.run')
+    mocker.patch('ddev.utils.git.GitRepository.capture', side_effect=OSError('bad object'))
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', '--dry-run', FULL_SHA_FOR_TESTS)
+
+    assert result.exit_code == 1, result.output
+    assert 'is not in the local repository' in result.output
+    assert 'Re-run without `--dry-run`' in result.output
+    assert not any(c.args[:2] == ('fetch', 'origin') for c in run_mock.call_args_list)
+    fake_async_github.assert_not_called('create_pull_request')
+
+
+def test_command_aborts_on_abbreviated_sha_not_local(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    """Abbreviated SHAs cannot be fetched from origin, so abort early with a clear hint."""
+    run_mock = mocker.patch('ddev.utils.git.GitRepository.run')
+    mocker.patch('ddev.utils.git.GitRepository.capture', side_effect=OSError('bad object'))
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', '1234567890')
 
     assert result.exit_code == 1, result.output
-    assert 'does not exist' in result.output
+    assert 'full 40-character SHA' in result.output
+    assert not any(c.args[:2] == ('fetch', 'origin') for c in run_mock.call_args_list)
     fake_async_github.assert_not_called('create_pull_request')
 
 
+def test_command_fetches_commit_when_not_local(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    commit_sha = FULL_SHA_FOR_TESTS
+    subject = 'Fix bug (#100)'
+    rev_parse_calls = {'count': 0}
+
+    def capture_side_effect(*args):
+        if args == ('rev-parse', '--verify', f'{commit_sha}^{{commit}}'):
+            rev_parse_calls['count'] += 1
+            if rev_parse_calls['count'] == 1:
+                raise OSError('bad object')
+            return commit_sha + '\n'
+        if args == ('diff-tree', '--no-commit-id', '--name-only', '-r', commit_sha):
+            return ''
+        return ''
+
+    run_mock = mocker.patch('ddev.utils.git.GitRepository.run')
+    mocker.patch('ddev.utils.git.GitRepository.capture', side_effect=capture_side_effect)
+    mocker.patch(
+        'ddev.utils.git.GitRepository.log',
+        return_value=[{'hash': commit_sha, 'subject': subject}],
+    )
+    fake_async_github.mock_response(
+        'create_pull_request',
+        PullRequest(number=1, html_url='https://github.com/x/pr/1'),
+    )
+    mocker.patch('click.confirm', return_value=True)
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', commit_sha)
+
+    assert result.exit_code == 0, result.output
+    assert 'not found locally; fetching from origin' in result.output
+    assert rev_parse_calls['count'] == 2
+    git_calls = [c.args for c in run_mock.call_args_list]
+    assert ('fetch', 'origin', commit_sha) in git_calls
+    fake_async_github.assert_called_once_with(
+        'create_pull_request',
+        owner='DataDog',
+        repo='integrations-core',
+        title='[Backport] Fix bug',
+        head=f'alice/port-{commit_sha[:10]}-to-master',
+        base='master',
+        body=mocker.ANY,
+        draft=False,
+        timeout=None,
+    )
+
+
+@pytest.mark.parametrize(
+    'input_arg',
+    [
+        pytest.param('PR-23703', id='PR-prefix'),
+        pytest.param('pr-23703', id='PR-prefix-lowercase'),
+        pytest.param('PR-23703 ', id='PR-prefix-trailing-whitespace'),
+        pytest.param('https://github.com/DataDog/integrations-core/pull/23703', id='URL-https'),
+        pytest.param('http://github.com/DataDog/integrations-core/pull/23703', id='URL-http'),
+        pytest.param('https://github.com/DataDog/integrations-core/pull/23703#discussion_r1', id='URL-with-fragment'),
+        pytest.param('23703', id='pure-digit-auto-detect'),
+        pytest.param(' 23703 ', id='pure-digit-with-whitespace'),
+    ],
+)
+def test_command_resolves_pr_input(
+    input_arg: str,
+    ddev: CliRunner,
+    mocker: MockerFixture,
+    fake_async_github: FakeAsyncGitHubClient,
+) -> None:
+    _setup_command_mocks(mocker, commit_sha=FULL_SHA_FOR_TESTS)
+    fake_async_github.mock_response('get_pull_request', _merged_pr(number=23703))
+    fake_async_github.mock_response(
+        'create_pull_request',
+        PullRequest(number=1, html_url='https://github.com/x/pr/1'),
+    )
+    mocker.patch('click.confirm', return_value=True)
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', input_arg)
+
+    assert result.exit_code == 0, result.output
+    pr_call = fake_async_github.last_call('get_pull_request')
+    assert pr_call.kwargs['owner'] == 'DataDog'
+    assert pr_call.kwargs['repo'] == 'integrations-core'
+    assert pr_call.kwargs['pull_number'] == 23703
+
+
+def test_command_aborts_when_pr_not_merged(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    _setup_command_mocks(mocker, commit_sha=FULL_SHA_FOR_TESTS)
+    fake_async_github.mock_response(
+        'get_pull_request',
+        PullRequest(
+            number=23703,
+            html_url='https://github.com/DataDog/integrations-core/pull/23703',
+            merged=False,
+            merge_commit_sha=None,
+        ),
+    )
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', 'PR-23703')
+
+    assert result.exit_code == 1, result.output
+    assert 'PR #23703 is not merged' in result.output
+
+
+def test_command_aborts_when_pr_is_merge_commit(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    _setup_command_mocks(mocker, commit_sha=FULL_SHA_FOR_TESTS, parents=('parent1', 'parent2'))
+    fake_async_github.mock_response('get_pull_request', _merged_pr(number=23703))
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', 'PR-23703')
+
+    assert result.exit_code == 1, result.output
+    assert 'not squash-merged' in result.output
+    assert 'specific commit' in result.output.lower()
+
+
+def test_command_emits_pr_context_when_pure_digit_pr_merge_commit_missing(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    """Pure-digit PR input + PR found + non-resolvable merge commit -> abort names the PR, not the SHA."""
+    fake_async_github.mock_response('get_pull_request', _merged_pr(number=23703))
+    mocker.patch('ddev.utils.git.GitRepository.run')
+    mocker.patch('ddev.utils.git.GitRepository.capture', side_effect=OSError('bad object'))
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', '--dry-run', '23703')
+
+    assert result.exit_code == 1, result.output
+    assert 'PR #23703 was found but its merge commit' in result.output
+    assert FULL_SHA_FOR_TESTS in result.output
+
+
+def test_command_aborts_when_pr_input_has_no_token(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    """Explicit PR form requires a GitHub token even with --no-pr."""
+    mocker.patch.dict(
+        'os.environ',
+        {'DD_GITHUB_USER': 'alice', 'DD_GITHUB_TOKEN': '', 'GH_TOKEN': '', 'GITHUB_TOKEN': ''},
+    )
+
+    result = ddev('release', 'port-commit', '--no-pr', 'PR-23703')
+
+    assert result.exit_code == 1, result.output
+    assert 'GitHub token required to resolve a PR reference' in result.output
+    assert '--no-pr does not skip this lookup' in result.output
+    fake_async_github.assert_not_called('get_pull_request')
+
+
+def test_command_falls_back_to_commit_on_pr_not_found(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    """Pure-digit input that isn't a PR resolves as a commit when it's local (PR 404 from default mock)."""
+    short_input = '1234'
+    full_sha = FULL_SHA_FOR_TESTS
+    run_mock = mocker.patch('ddev.utils.git.GitRepository.run')
+    capture_mock = mocker.patch('ddev.utils.git.GitRepository.capture')
+    capture_mock.side_effect = lambda *args: {
+        ('rev-parse', '--verify', f'{short_input}^{{commit}}'): full_sha + '\n',
+        ('diff-tree', '--no-commit-id', '--name-only', '-r', full_sha): '',
+    }.get(args, '')
+    mocker.patch('ddev.utils.git.GitRepository.log', return_value=[{'hash': full_sha, 'subject': 'Fix bug'}])
+    fake_async_github.mock_response(
+        'create_pull_request',
+        PullRequest(number=1, html_url='https://github.com/x/pr/1'),
+    )
+    mocker.patch('click.confirm', return_value=True)
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', short_input)
+
+    assert result.exit_code == 0, result.output
+    assert fake_async_github.last_call('get_pull_request').kwargs['pull_number'] == int(short_input)
+    git_calls = [c.args for c in run_mock.call_args_list]
+    # No SHA-targeted fetch (3 args): commit was resolvable locally.
+    assert not any(len(args) == 3 and args[:2] == ('fetch', 'origin') for args in git_calls)
+
+
+def test_command_aborts_with_unified_message_when_pr_and_commit_both_fail(
+    ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
+) -> None:
+    """Pure-digit input: PR 404 (default mock) + commit unresolvable -> unified message."""
+    mocker.patch('ddev.utils.git.GitRepository.run')
+    mocker.patch('ddev.utils.git.GitRepository.capture', side_effect=OSError('bad object'))
+    mocker.patch.dict('os.environ', {'DD_GITHUB_USER': 'alice'})
+
+    result = ddev('release', 'port-commit', '1234567')
+
+    assert result.exit_code == 1, result.output
+    assert 'Could not resolve `1234567` as a PR or a commit' in result.output
+    assert '`PR-xxxxx`' in result.output
+
+
 def test_command_aborts_when_commit_log_is_empty(
     ddev: CliRunner, mocker: MockerFixture, fake_async_github: FakeAsyncGitHubClient
 ) -> None:
diff --git a/ddev/tests/helpers/__init__.py b/ddev/tests/helpers/__init__.py
index 2e5d0433a3807..4daef506fa638 100644
--- a/ddev/tests/helpers/__init__.py
+++ b/ddev/tests/helpers/__init__.py
@@ -1,9 +1,18 @@
 # (C) Datadog, Inc. 2022-present
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
+import sys
+from typing import NoReturn
+
 from ddev.cli.application import Application
 from ddev.utils.platform import Platform
 
+
+def _exit(code: int) -> NoReturn:
+    print(f"Application exited with code: {code}")
+    sys.exit(code)
+
+
 PLATFORM = Platform()
-APPLICATION = Application(lambda code: print(f"Applicatione exited with code: {code}"), 1, False, False)
+APPLICATION = Application(_exit, 1, False, False)
 LOCAL_REPO_BRANCH = "ddev-testing"
diff --git a/ddev/tests/helpers/github_async.py b/ddev/tests/helpers/github_async.py
index 093401795262a..4114a8b794b44 100644
--- a/ddev/tests/helpers/github_async.py
+++ b/ddev/tests/helpers/github_async.py
@@ -39,6 +39,8 @@ def test_thing(fake_async_github):
 from dataclasses import dataclass, field
 from typing import Any
 
+import httpx
+
 from ddev.utils.github_async import GitHubResponse
 from ddev.utils.github_async.models import Label, PullRequest
 
@@ -69,6 +71,13 @@ def _default_response_factories() -> dict[str, Callable[[], Any]]:
             headers={},
         ),
         'add_labels_to_issue': lambda: GitHubResponse.model_validate({'data': [], 'headers': {}}),
+        # Default to "PR not found" so tests that don't care about PR lookup auto-fall-through
+        # to commit resolution. Tests that need a specific PR register their own mock_response.
+        'get_pull_request': lambda: httpx.HTTPStatusError(
+            'Not Found',
+            request=httpx.Request('GET', 'https://api.github.com/'),
+            response=httpx.Response(404),
+        ),
     }
 
 
@@ -130,6 +139,21 @@ def mock_response(
     # Mirrored API surface
     # ------------------------------------------------------------------
 
+    async def get_pull_request(
+        self,
+        owner: str,
+        repo: str,
+        pull_number: int,
+        timeout: float | None = None,
+    ) -> GitHubResponse[PullRequest]:
+        return self._call(
+            'get_pull_request',
+            owner=owner,
+            repo=repo,
+            pull_number=pull_number,
+            timeout=timeout,
+        )
+
     async def create_pull_request(
         self,
         owner: str,
diff --git a/flink/README.md b/flink/README.md
index 6e9bca3300799..0f5bb170484d4 100644
--- a/flink/README.md
+++ b/flink/README.md
@@ -19,7 +19,7 @@ No additional installation is needed on your server.
 #### Metric collection
 
 <!-- partial
-{{< site-region region="gov" >}}
+{{< site-region region="gov,gov2" >}}
 1. Configure the [StatsD reporter][14] in Flink.
    In your `<FLINK_HOME>/conf/flink-conf.yaml`, add these lines:
    ```yaml
diff --git a/openai/README.md b/openai/README.md
index ceb20ddbcab81..152e165fb46d6 100644
--- a/openai/README.md
+++ b/openai/README.md
@@ -211,7 +211,7 @@ This will display detailed information about any errors or issues with tracing.
 **Notes**:
 
 <!-- partial
-{{% site-region region="us3,us5,eu,gov,ap1" %}}
+{{% site-region region="us3,us5,eu,gov,gov2,ap1" %}}
 - Non-US1 customers must set `DD_SITE` on the application command to the correct Datadog site parameter as specified in the table in the <a href="https://docs.datadoghq.com/getting_started/site/#access-the-datadog-site">Datadog Site</a> page (for example, `datadoghq.eu` for EU1 customers).{{% /site-region %}}
 partial -->
 
@@ -453,7 +453,7 @@ Validate that the APM Node.js library can communicate with your Agent by examini
 **Notes**:
 
 <!-- partial
-{{% site-region region="us3,us5,eu,gov,ap1" %}}
+{{% site-region region="us3,us5,eu,gov,gov2,ap1" %}}
 - Non-US1 customers must set `DD_SITE` on the application command to the correct Datadog site parameter as specified in the table in the <a href="https://docs.datadoghq.com/getting_started/site/#access-the-datadog-site">Datadog Site</a> page (for example, `datadoghq.eu` for EU1 customers).{{% /site-region %}}
 partial -->