diff --git a/.github/workflows/cla_draft_gate.yml b/.github/workflows/cla_draft_gate.yml
new file mode 100644
index 00000000000..a58bf645004
--- /dev/null
+++ b/.github/workflows/cla_draft_gate.yml
@@ -0,0 +1,286 @@
+name: CLA draft gate
+
+# Reduce reviewer load from first-time contributor PRs without a signed CLA:
+#  - Scheduled sweep: if a first-time contributor's PR is older than 1 hour and
+#    the `license/cla` status is not green, convert the PR to draft, remove the
+#    requested reviewers (remembering them in a hidden comment marker), label it
+#    `cla-pending`, and explain why in a comment.
+#  - When the CLA is signed (the `license/cla` commit status turns green), mark
+#    the PR ready for review again and re-request the same reviewers. The
+#    scheduled sweep doubles as a backstop in case a status event is missed.
+#  - While a PR stays gated, escalate: remind the contributor 5 days after the
+#    PR was opened, post a final warning after 10 days, and close the PR after
+#    14 days. Each step waits for the previous comment to be a few days old, so
+#    PRs that are already old when first gated still get the full sequence
+#    instead of being closed right away.
+# Maintainers can opt a PR out by adding the `skip-cla-reminder` label.
+
+on:
+  status:
+  schedule:
+    - cron: "17,47 * * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+concurrency:
+  group: cla-draft-gate
+  cancel-in-progress: false
+
+jobs:
+  gate:
+    runs-on: ubuntu-slim
+    # For status events, only react to the CLA check turning green.
+    if: >
+      github.event_name != 'status' ||
+      (github.event.context == 'license/cla' && github.event.state == 'success')
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          # GITHUB_TOKEN can normally convert PRs to draft and back. If those
+          # GraphQL mutations ever fail with "Resource not accessible by
+          # integration", add a classic PAT with `repo` scope as CLA_GATE_PAT.
+          github-token: ${{ secrets.CLA_GATE_PAT || github.token }}
+          script: |
+            const CLA_CONTEXT = "license/cla";
+            const LABEL = "cla-pending";
+            const EXEMPT_LABEL = "skip-cla-reminder";
+            const GRACE_MS = 60 * 60 * 1000; // 1 hour
+            const DAY_MS = 24 * 60 * 60 * 1000;
+            const MARKER = "<!-- cla-draft-gate ";
+            const REMINDER_MARKER = "<!-- cla-reminder-5d -->";
+            const WARNING_MARKER = "<!-- cla-warning-10d -->";
+            const FIRST_TIMER = new Set(["FIRST_TIME_CONTRIBUTOR", "FIRST_TIMER", "NONE"]);
+            const { owner, repo } = context.repo;
+
+            async function claSigned(sha) {
+              const { data } = await github.rest.repos.getCombinedStatusForRef({
+                owner, repo, ref: sha, per_page: 100,
+              });
+              return data.statuses.find((s) => s.context === CLA_CONTEXT)?.state === "success";
+            }
+
+            async function findMarkerComment(prNumber) {
+              const comments = await github.paginate(github.rest.issues.listComments, {
+                owner, repo, issue_number: prNumber, per_page: 100,
+              });
+              return comments.find((c) => c.body?.includes(MARKER));
+            }
+
+            function parseMarker(body) {
+              try {
+                const start = body.indexOf(MARKER) + MARKER.length;
+                return JSON.parse(body.slice(start, body.indexOf(" -->", start)));
+              } catch {
+                return { reviewers: [], team_reviewers: [] };
+              }
+            }
+
+            async function ensureLabel() {
+              await github.rest.issues
+                .createLabel({
+                  owner, repo, name: LABEL, color: "d93f0b",
+                  description: "PR is in draft until the contributor signs the CLA",
+                })
+                .catch(() => {}); // already exists
+            }
+
+            async function gate(pr) {
+              const labels = pr.labels.map((l) => l.name);
+              if (labels.includes(EXEMPT_LABEL)) return;
+
+              const reviewers = (pr.requested_reviewers ?? []).map((u) => u.login);
+              const teamReviewers = (pr.requested_teams ?? []).map((t) => t.slug);
+
+              const existing = await findMarkerComment(pr.number);
+              if (!existing) {
+                const meta = { reviewers, team_reviewers: teamReviewers };
+                const body = [
+                  `${MARKER}${JSON.stringify(meta)} -->`,
+                  `Hi @${pr.user.login}, thanks a lot for your contribution! :pray:`,
+                  "",
+                  "We noticed that the **Contributor License Agreement (CLA)** check " +
+                    `(\`${CLA_CONTEXT}\`) hasn't passed yet, so we've temporarily moved this ` +
+                    "PR to **draft** and paused the review assignment.",
+                  "",
+                  "To get your PR reviewed, please sign the CLA via the link in the " +
+                    `\`${CLA_CONTEXT}\` check below (or in the CLA bot comment). As soon as ` +
+                    "the check turns green, this PR will automatically be marked ready " +
+                    "for review again and a reviewer will be re-assigned.",
+                ].join("\n");
+                await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body });
+              } else if (reviewers.length || teamReviewers.length) {
+                // Merge any newly requested reviewers into the stored metadata.
+                const meta = parseMarker(existing.body);
+                meta.reviewers = [...new Set([...(meta.reviewers ?? []), ...reviewers])];
+                meta.team_reviewers = [...new Set([...(meta.team_reviewers ?? []), ...teamReviewers])];
+                const rest = existing.body.slice(existing.body.indexOf(" -->") + 4);
+                await github.rest.issues.updateComment({
+                  owner, repo, comment_id: existing.id,
+                  body: `${MARKER}${JSON.stringify(meta)} -->${rest}`,
+                });
+              }
+
+              if (reviewers.length || teamReviewers.length) {
+                await github.rest.pulls.removeRequestedReviewers({
+                  owner, repo, pull_number: pr.number,
+                  reviewers, team_reviewers: teamReviewers,
+                });
+              }
+              if (!labels.includes(LABEL)) {
+                await ensureLabel();
+                await github.rest.issues.addLabels({
+                  owner, repo, issue_number: pr.number, labels: [LABEL],
+                });
+              }
+              await github.graphql(
+                "mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }",
+                { id: pr.node_id },
+              );
+              core.info(`Gated PR #${pr.number} (CLA not signed)`);
+            }
+
+            async function restore(pr) {
+              const comment = await findMarkerComment(pr.number);
+              const meta = comment ? parseMarker(comment.body) : { reviewers: [], team_reviewers: [] };
+
+              await github.graphql(
+                "mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }",
+                { id: pr.node_id },
+              );
+
+              // Prefer the individual reviewers we removed; re-requesting the team
+              // instead would make round-robin pick somebody new.
+              const reviewers = (meta.reviewers ?? []).filter((r) => r !== pr.user.login);
+              const teamReviewers = reviewers.length ? [] : (meta.team_reviewers ?? []);
+              if (reviewers.length || teamReviewers.length) {
+                await github.rest.pulls.requestReviewers({
+                  owner, repo, pull_number: pr.number,
+                  reviewers, team_reviewers: teamReviewers,
+                });
+              }
+
+              await github.rest.issues
+                .removeLabel({ owner, repo, issue_number: pr.number, name: LABEL })
+                .catch(() => {});
+              await github.rest.issues.createComment({
+                owner, repo, issue_number: pr.number,
+                body:
+                  `Thanks for signing the CLA, @${pr.user.login}! :tada: ` +
+                  "This PR is now ready for review again and the reviewer has been re-assigned.",
+              });
+              core.info(`Restored PR #${pr.number} (CLA signed)`);
+            }
+
+            // Escalation for PRs that stay gated: reminder after 5 days, final
+            // warning after 10 days, auto-close after 14 days. Steps are also
+            // anchored to the previous comment's age so contributors always get
+            // the full sequence, even on PRs that were old when first gated.
+            async function escalate(pr) {
+              const ageMs = Date.now() - new Date(pr.created_at).getTime();
+              if (ageMs < 5 * DAY_MS) return;
+
+              const comments = await github.paginate(github.rest.issues.listComments, {
+                owner, repo, issue_number: pr.number, per_page: 100,
+              });
+              const reminder = comments.find((c) => c.body?.includes(REMINDER_MARKER));
+              const warning = comments.find((c) => c.body?.includes(WARNING_MARKER));
+              const ageOf = (comment) => Date.now() - new Date(comment.created_at).getTime();
+
+              if (!reminder) {
+                await github.rest.issues.createComment({
+                  owner, repo, issue_number: pr.number,
+                  body: [
+                    REMINDER_MARKER,
+                    `Hi @${pr.user.login}, just a friendly reminder: this PR is still in ` +
+                      "draft because the **Contributor License Agreement (CLA)** hasn't " +
+                      "been signed yet. We'd love to review your contribution! Please " +
+                      `sign the CLA via the link in the \`${CLA_CONTEXT}\` check, and this ` +
+                      "PR will automatically be marked ready for review.",
+                  ].join("\n"),
+                });
+                core.info(`Posted 5-day CLA reminder on PR #${pr.number}`);
+                return;
+              }
+
+              if (!warning) {
+                if (ageMs >= 10 * DAY_MS && ageOf(reminder) >= 5 * DAY_MS) {
+                  await github.rest.issues.createComment({
+                    owner, repo, issue_number: pr.number,
+                    body: [
+                      WARNING_MARKER,
+                      `Hi @${pr.user.login}, this PR is still waiting for the ` +
+                        "**Contributor License Agreement (CLA)** to be signed. Please " +
+                        "note that if the CLA isn't signed within the **next 4 days**, " +
+                        "this PR will be automatically closed as stale. Signing only " +
+                        `takes a minute via the link in the \`${CLA_CONTEXT}\` check, and ` +
+                        "the PR will then automatically be marked ready for review.",
+                    ].join("\n"),
+                  });
+                  core.info(`Posted 10-day CLA warning on PR #${pr.number}`);
+                }
+                return;
+              }
+
+              if (ageMs >= 14 * DAY_MS && ageOf(warning) >= 4 * DAY_MS) {
+                await github.rest.issues.createComment({
+                  owner, repo, issue_number: pr.number,
+                  body:
+                    `Hi @${pr.user.login}, we're closing this PR because the ` +
+                    "**Contributor License Agreement (CLA)** wasn't signed within two " +
+                    "weeks. Thanks a lot for your interest in contributing to Haystack! " +
+                    "If you'd still like to see this change merged, please sign the CLA " +
+                    "and reopen this PR — it will then automatically be marked ready " +
+                    "for review.",
+                });
+                await github.rest.pulls.update({
+                  owner, repo, pull_number: pr.number, state: "closed",
+                });
+                core.info(`Closed PR #${pr.number} (CLA not signed after 14 days)`);
+              }
+            }
+
+            // --- Event dispatch -------------------------------------------------
+
+            if (context.eventName === "status") {
+              // CLA turned green on some commit: restore any gated PRs for it.
+              const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                owner, repo, commit_sha: context.payload.sha,
+              });
+              for (const prLite of prs) {
+                if (prLite.state !== "open" || !prLite.draft) continue;
+                if (!prLite.labels.some((l) => l.name === LABEL)) continue;
+                const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: prLite.number });
+                await restore(pr);
+              }
+              return;
+            }
+
+            // Scheduled sweep (also backstop for missed status events).
+            const prs = await github.paginate(github.rest.pulls.list, {
+              owner, repo, state: "open", per_page: 100,
+            });
+            for (const pr of prs) {
+              try {
+                if (pr.user?.type === "Bot") continue;
+                const labels = pr.labels.map((l) => l.name);
+                if (pr.draft) {
+                  if (!labels.includes(LABEL) || labels.includes(EXEMPT_LABEL)) continue;
+                  if (await claSigned(pr.head.sha)) {
+                    await restore(pr);
+                  } else {
+                    await escalate(pr);
+                  }
+                  continue;
+                }
+                if (!FIRST_TIMER.has(pr.author_association)) continue;
+                if (Date.now() - new Date(pr.created_at).getTime() < GRACE_MS) continue;
+                if (await claSigned(pr.head.sha)) continue;
+                await gate(pr);
+              } catch (error) {
+                core.warning(`PR #${pr.number}: ${error.message}`);
+              }
+            }
diff --git a/.github/workflows/linked_issue_review.yml b/.github/workflows/linked_issue_review.yml
new file mode 100644
index 00000000000..1780fb3a3e4
--- /dev/null
+++ b/.github/workflows/linked_issue_review.yml
@@ -0,0 +1,161 @@
+name: Linked issue review sync
+
+# When a PR links an issue (via "Fixes #123" & co.), assign the PR's requested
+# reviewer(s) to that issue and move it to the review column of the Open Source
+# GitHub project (https://github.com/orgs/deepset-ai/projects/5). An assigned
+# issue signals other contributors (and their coding agents) that the issue is
+# taken, which prevents duplicate PRs.
+#
+# Uses pull_request_target so it also has write permissions on fork PRs; this
+# is safe because the workflow never checks out or executes PR code.
+
+on:
+  pull_request_target:
+    types: [opened, ready_for_review, review_requested]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+concurrency:
+  group: linked-issue-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-slim
+    # Draft PRs (e.g. gated by the CLA draft gate) are handled once they become
+    # ready for review.
+    if: ${{ !github.event.pull_request.draft }}
+    steps:
+      - name: Assign reviewers to linked issues
+        id: link
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const pr = context.payload.pull_request;
+
+            if (pr.user?.type === "Bot") return;
+            const reviewers = (pr.requested_reviewers ?? []).map((u) => u.login);
+            if (!reviewers.length) {
+              // CODEOWNERS assignment triggers a later review_requested event.
+              core.info("No individual reviewers requested yet, nothing to do.");
+              return;
+            }
+
+            const result = await github.graphql(
+              `query($owner: String!, $repo: String!, $number: Int!) {
+                repository(owner: $owner, name: $repo) {
+                  pullRequest(number: $number) {
+                    closingIssuesReferences(first: 10) {
+                      nodes {
+                        id number repository { nameWithOwner }
+                        assignees(first: 1) { totalCount }
+                      }
+                    }
+                  }
+                }
+              }`,
+              { owner, repo, number: pr.number },
+            );
+            const issues = result.repository.pullRequest.closingIssuesReferences.nodes.filter(
+              (issue) => issue.repository.nameWithOwner === `${owner}/${repo}`,
+            );
+            if (!issues.length) {
+              core.info("PR has no linked issues.");
+              return;
+            }
+
+            for (const issue of issues) {
+              // Don't touch issues somebody is already assigned to.
+              if (issue.assignees.totalCount > 0) {
+                core.info(`Issue #${issue.number} already has an assignee, skipping assignment.`);
+                continue;
+              }
+              await github.rest.issues.addAssignees({
+                owner, repo, issue_number: issue.number, assignees: reviewers,
+              });
+              core.info(`Assigned ${reviewers.join(", ")} to issue #${issue.number}`);
+            }
+            core.setOutput("issue_node_ids", JSON.stringify(issues.map((issue) => issue.id)));
+
+      - name: Move linked issues to review in the project board
+        if: steps.link.outputs.issue_node_ids && steps.link.outputs.issue_node_ids != '[]'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          ISSUE_NODE_IDS: ${{ steps.link.outputs.issue_node_ids }}
+          PROJECT_ORG: deepset-ai
+          PROJECT_NUMBER: "5"
+          # Name of the Status option to move issues to; matched
+          # case-insensitively, falling back to a substring match
+          # (the actual option is ":eyes: In review").
+          REVIEW_STATUS_NAME: In review
+        with:
+          # The default GITHUB_TOKEN cannot access org-level projects.
+          github-token: ${{ secrets.GH_PROJECT_PAT }}
+          script: |
+            const issueIds = JSON.parse(process.env.ISSUE_NODE_IDS);
+            const statusName = process.env.REVIEW_STATUS_NAME;
+
+            const result = await github.graphql(
+              `query($org: String!, $number: Int!) {
+                organization(login: $org) {
+                  projectV2(number: $number) {
+                    id
+                    field(name: "Status") {
+                      ... on ProjectV2SingleSelectField { id options { id name } }
+                    }
+                  }
+                }
+              }`,
+              { org: process.env.PROJECT_ORG, number: Number(process.env.PROJECT_NUMBER) },
+            );
+            const project = result.organization.projectV2;
+            const field = project.field;
+            const option =
+              field.options.find((o) => o.name.toLowerCase() === statusName.toLowerCase()) ??
+              field.options.find((o) => o.name.toLowerCase().includes(statusName.toLowerCase()));
+            if (!option) {
+              core.warning(
+                `No Status option matching "${statusName}" in project ` +
+                  `${process.env.PROJECT_NUMBER}. Available: ${field.options.map((o) => o.name).join(", ")}`,
+              );
+              return;
+            }
+
+            for (const issueId of issueIds) {
+              const node = await github.graphql(
+                `query($id: ID!) {
+                  node(id: $id) {
+                    ... on Issue { projectItems(first: 50) { nodes { id project { id } } } }
+                  }
+                }`,
+                { id: issueId },
+              );
+              let item = node.node.projectItems.nodes.find((n) => n.project.id === project.id);
+              if (!item) {
+                const added = await github.graphql(
+                  `mutation($projectId: ID!, $contentId: ID!) {
+                    addProjectV2ItemById(input: { projectId: $projectId, contentId: $contentId }) {
+                      item { id }
+                    }
+                  }`,
+                  { projectId: project.id, contentId: issueId },
+                );
+                item = added.addProjectV2ItemById.item;
+              }
+              await github.graphql(
+                `mutation($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
+                  updateProjectV2ItemFieldValue(
+                    input: {
+                      projectId: $projectId, itemId: $itemId, fieldId: $fieldId,
+                      value: { singleSelectOptionId: $optionId }
+                    }
+                  ) { projectV2Item { id } }
+                }`,
+                { projectId: project.id, itemId: item.id, fieldId: field.id, optionId: option.id },
+              );
+              core.info(`Moved issue ${issueId} to "${option.name}"`);
+            }
diff --git a/.github/workflows/pr_flood_guard.yml b/.github/workflows/pr_flood_guard.yml
new file mode 100644
index 00000000000..cfdd8199ce8
--- /dev/null
+++ b/.github/workflows/pr_flood_guard.yml
@@ -0,0 +1,105 @@
+name: PR flood guard
+
+# Ask community contributors to slow down when review capacity is the
+# bottleneck. On every newly opened PR from outside the org, warn if:
+#  - another open PR already targets the same linked issue (duplicate), or
+#  - the author already has more than two PRs open in this repository.
+#
+# Uses pull_request_target so it can comment on fork PRs; this is safe because
+# the workflow never checks out or executes PR code.
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  guard:
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const MAX_OPEN_PRS = 2;
+            const { owner, repo } = context.repo;
+            const pr = context.payload.pull_request;
+
+            if (pr.user?.type === "Bot") return;
+            if (["MEMBER", "OWNER", "COLLABORATOR"].includes(pr.author_association)) return;
+
+            const warnings = [];
+
+            // --- Duplicate check: other open PRs linked to the same issue(s) --
+            const result = await github.graphql(
+              `query($owner: String!, $repo: String!, $number: Int!) {
+                repository(owner: $owner, name: $repo) {
+                  pullRequest(number: $number) {
+                    closingIssuesReferences(first: 10) {
+                      nodes {
+                        number
+                        repository { nameWithOwner }
+                        closedByPullRequestsReferences(first: 20, includeClosedPrs: false) {
+                          nodes { number state }
+                        }
+                      }
+                    }
+                  }
+                }
+              }`,
+              { owner, repo, number: pr.number },
+            );
+            const linkedIssues = result.repository.pullRequest.closingIssuesReferences.nodes.filter(
+              (issue) => issue.repository.nameWithOwner === `${owner}/${repo}`,
+            );
+            for (const issue of linkedIssues) {
+              const others = issue.closedByPullRequestsReferences.nodes.filter(
+                (other) => other.number !== pr.number && other.state === "OPEN",
+              );
+              if (others.length) {
+                const list = others.map((o) => `#${o.number}`).join(", ");
+                warnings.push(
+                  `Issue #${issue.number} is already being addressed by open pull ` +
+                    `request(s) ${list}. Before opening a PR for an issue, please check ` +
+                    "whether a PR is already linked to it, and consider contributing to " +
+                    "the existing PR instead. We may close duplicate PRs to keep the " +
+                    "review queue manageable.",
+                );
+              }
+            }
+
+            // --- Flood check: author has too many open PRs --------------------
+            const openPrs = await github.paginate(github.rest.pulls.list, {
+              owner, repo, state: "open", per_page: 100,
+            });
+            const authored = openPrs.filter((p) => p.user?.login === pr.user.login);
+            if (authored.length > MAX_OPEN_PRS) {
+              const others = authored
+                .filter((p) => p.number !== pr.number)
+                .map((p) => `#${p.number}`)
+                .join(", ");
+              warnings.push(
+                `You currently have ${authored.length} open pull requests in this ` +
+                  `repository (${others} and this one). Our review capacity is limited, ` +
+                  "so please hold off opening more PRs until we've had a chance to " +
+                  `review your first ${MAX_OPEN_PRS} open PRs. This helps us give each ` +
+                  "contribution the attention it deserves. Thank you!",
+              );
+            }
+
+            if (!warnings.length) return;
+
+            const body = [
+              "<!-- pr-flood-guard -->",
+              `Hi @${pr.user.login}, thanks for your interest in contributing to Haystack! :pray:`,
+              "",
+              warnings.map((w) => `:warning: ${w}`).join("\n\n"),
+              "",
+              "_This is an automated message to help us keep the review queue healthy._",
+            ].join("\n");
+            await github.rest.issues.createComment({
+              owner, repo, issue_number: pr.number, body,
+            });