diff --git a/frontend/src/styles.css b/frontend/src/styles.css
index 90b75fa..3e09195 100644
--- a/frontend/src/styles.css
+++ b/frontend/src/styles.css
@@ -296,6 +296,13 @@ footer a { color: var(--text); }
 .private-copy p { margin: 0; color: var(--muted); font-size: 13px; line-height: 1.7; white-space: pre-wrap; overflow-wrap: anywhere; }
 .diagnostic-download { margin-top: 22px; }
 .private-warning { padding: 16px; border-left: 2px solid var(--accent); color: var(--muted); background: var(--surface); font-size: 11px; }
+.support-message { display: grid; grid-template-columns: 1fr auto; gap: 6px 16px; margin-top: 14px; padding: 14px; border: 1px solid var(--line); background: var(--surface); }
+.support-message b, .support-message small { font-size: 11px; }
+.support-message small { color: var(--muted); }
+.support-message p { grid-column: 1 / -1; }
+.message-composer { display: grid; gap: 12px; margin-top: 18px; }
+.message-composer .field { padding: 0; border: 0; }
+.message-composer button { justify-self: start; }
 
 @media (max-width: 760px) {
   .site-header,
diff --git a/frontend/src/support.test.ts b/frontend/src/support.test.ts
index d23cf83..9f24771 100644
--- a/frontend/src/support.test.ts
+++ b/frontend/src/support.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { adminLogin, deleteReceipt, loadProducts, randomIdempotencyKey, reconcileReceipt, updateAdminReportStatus } from './support'
+import { adminLogin, deleteReceipt, loadProducts, randomIdempotencyKey, reconcileReceipt, sendAdminMessage, sendPrivateMessage, updateAdminReportStatus } from './support'
 
 afterEach(() => vi.unstubAllGlobals())
 
@@ -100,4 +100,23 @@ describe('support contract client', () => {
       headers: expect.objectContaining({ 'X-CSRF-Token': 'A'.repeat(43) }),
     }))
   })
+
+  it('posts private conversation messages through the scoped endpoints', async () => {
+    const response = {
+      contractVersion: 1, supportCode: 'OBI-ABCDE-23456', productId: 'synthetic-product', requestType: 'bug',
+      status: 'needs_information', createdAt: '2026-08-13T12:00:00Z', updatedAt: '2026-08-13T13:00:00Z',
+      retentionUntil: '2026-09-12T12:00:00Z', messages: [],
+    }
+    const fetch = vi.fn().mockImplementation(() => Promise.resolve(new Response(JSON.stringify(response), {
+      status: 201, headers: { 'Content-Type': 'application/json' },
+    })))
+    vi.stubGlobal('fetch', fetch)
+    const capability = 'abcdefghijklmnopqrstuvwxyzABCDEFGH_12345678'
+
+    await sendPrivateMessage(capability, 'Reporter reply')
+    await sendAdminMessage('11111111-1111-4111-8111-111111111111', 'Maintainer question')
+
+    expect(fetch).toHaveBeenNthCalledWith(1, `/api/v1/reports/${capability}/messages`, expect.objectContaining({ method: 'POST' }))
+    expect(fetch).toHaveBeenNthCalledWith(2, '/api/v1/admin/reports/11111111-1111-4111-8111-111111111111/messages', expect.objectContaining({ method: 'POST' }))
+  })
 })
diff --git a/frontend/src/support.ts b/frontend/src/support.ts
index 8cfbaae..2f43b8a 100644
--- a/frontend/src/support.ts
+++ b/frontend/src/support.ts
@@ -54,6 +54,14 @@ export interface PrivateStatus {
   createdAt: string
   updatedAt: string
   retentionUntil: string
+  messages: SupportMessage[]
+}
+
+export interface SupportMessage {
+  id: string
+  author: 'maintainer' | 'reporter'
+  body: string
+  createdAt: string
 }
 
 export interface AdminSession {
@@ -81,6 +89,7 @@ export interface AdminReportDetail extends AdminReportSummary {
   description: string
   contact?: string
   release: ReportMetadata['release']
+  messages: SupportMessage[]
 }
 
 export interface AdminReportResponse {
@@ -177,6 +186,15 @@ export async function deletePrivateReport(capability: string): Promise<void> {
   if (!response.ok) throw await apiError(response)
 }
 
+export async function sendPrivateMessage(capability: string, body: string): Promise<PrivateStatus> {
+  const response = await fetch(`/api/v1/reports/${encodeURIComponent(capability)}/messages`, {
+    method: 'POST', headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+    body: JSON.stringify({ body }),
+  })
+  if (!response.ok) throw await apiError(response)
+  return (await response.json()) as PrivateStatus
+}
+
 export async function deleteReceipt(receipt: Receipt): Promise<void> {
   const deletionUrl = new URL(receipt.deletionUrl, window.location.origin)
   const match = /^\/r\/([A-Za-z0-9_-]{43})$/.exec(deletionUrl.pathname)
@@ -226,6 +244,14 @@ export async function updateAdminReportStatus(id: string, status: string): Promi
   })
 }
 
+export async function sendAdminMessage(id: string, body: string): Promise<AdminReportDetail> {
+  return adminJSON<AdminReportDetail>(`/api/v1/admin/reports/${encodeURIComponent(id)}/messages`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': adminCSRFToken },
+    body: JSON.stringify({ body }),
+  })
+}
+
 export function adminDiagnosticsURL(id: string): string {
   return `/api/v1/admin/reports/${encodeURIComponent(id)}/diagnostics`
 }
diff --git a/frontend/src/views/AdminReportsView.vue b/frontend/src/views/AdminReportsView.vue
index 0cb3c98..68f50d5 100644
--- a/frontend/src/views/AdminReportsView.vue
+++ b/frontend/src/views/AdminReportsView.vue
@@ -8,6 +8,7 @@ import {
   loadAdminReport,
   loadAdminReports,
   loadAdminSession,
+  sendAdminMessage,
   SupportApiError,
   updateAdminReportStatus,
 } from '../support'
@@ -21,6 +22,7 @@ const loading = ref(true)
 const loadingDetail = ref(false)
 const saving = ref(false)
 const message = ref('')
+const reply = ref('')
 
 const statuses = ['new', 'needs_information', 'accepted', 'duplicate', 'resolved', 'rejected']
 
@@ -68,6 +70,22 @@ async function changeStatus(event: Event) {
   }
 }
 
+async function askReporter() {
+  if (!selected.value || !reply.value.trim()) return
+  saving.value = true
+  message.value = ''
+  try {
+    selected.value = await sendAdminMessage(selected.value.id, reply.value)
+    reply.value = ''
+    await refreshReports()
+    message.value = 'Message sent. The report now needs information.'
+  } catch (error) {
+    await handleError(error)
+  } finally {
+    saving.value = false
+  }
+}
+
 async function signOut() {
   try {
     await adminLogout()
@@ -137,6 +155,18 @@ function readable(value: string): string {
             </dl>
             <div class="private-copy"><h3>Description</h3><p>{{ selected.description }}</p></div>
             <div v-if="selected.contact" class="private-copy"><h3>Private contact</h3><p>{{ selected.contact }}</p></div>
+            <div class="private-copy"><h3>Private conversation</h3>
+              <p v-if="selected.messages.length === 0">No messages yet.</p>
+              <article v-for="entry in selected.messages" :key="entry.id" class="support-message">
+                <b>{{ entry.author === 'maintainer' ? 'Maintainer' : 'Reporter' }}</b>
+                <small>{{ formatDate(entry.createdAt, true) }}</small>
+                <p>{{ entry.body }}</p>
+              </article>
+              <form class="message-composer" @submit.prevent="askReporter">
+                <label class="field"><span>Ask for more details</span><textarea v-model="reply" maxlength="8192" rows="4" required /></label>
+                <button class="primary" type="submit" :disabled="saving || !reply.trim()">{{ saving ? 'Sending...' : 'Send private message' }}</button>
+              </form>
+            </div>
             <a v-if="selected.hasDiagnostics" class="secondary diagnostic-download" :href="adminDiagnosticsURL(selected.id)">Download diagnostic ZIP</a>
             <p class="private-warning">Private report data must not be copied into a public issue without reviewing and removing personal information.</p>
           </template>
diff --git a/frontend/src/views/PrivateStatusView.vue b/frontend/src/views/PrivateStatusView.vue
index 99df85d..e98e65e 100644
--- a/frontend/src/views/PrivateStatusView.vue
+++ b/frontend/src/views/PrivateStatusView.vue
@@ -2,7 +2,7 @@
 import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
 import { useRoute } from 'vue-router'
 import type { PrivateStatus } from '../support'
-import { deletePrivateReport, loadPrivateStatus } from '../support'
+import { deletePrivateReport, loadPrivateStatus, sendPrivateMessage } from '../support'
 
 const route = useRoute()
 const capability = computed(() => String(route.params.capability ?? ''))
@@ -11,6 +11,8 @@ const loading = ref(true)
 const deleting = ref(false)
 const deleted = ref(false)
 const message = ref('')
+const reply = ref('')
+const sending = ref(false)
 const controller = new AbortController()
 
 onMounted(async () => {
@@ -45,6 +47,21 @@ async function removeReport() {
     deleting.value = false
   }
 }
+
+async function sendReply() {
+  if (!reply.value.trim()) return
+  sending.value = true
+  message.value = ''
+  try {
+    report.value = await sendPrivateMessage(capability.value, reply.value)
+    reply.value = ''
+    message.value = 'Your reply was sent privately.'
+  } catch (error) {
+    message.value = error instanceof Error ? error.message : 'Your reply could not be sent.'
+  } finally {
+    sending.value = false
+  }
+}
 </script>
 
 <template>
@@ -61,6 +78,18 @@ async function removeReport() {
           <div><dt>Submitted</dt><dd>{{ formatDate(report.createdAt, true) }}</dd></div>
           <div><dt>Private data expires</dt><dd>{{ formatDate(report.retentionUntil) }}</dd></div>
         </dl>
+        <div v-if="!deleted" class="private-copy"><h2>Conversation</h2>
+          <p v-if="report.messages.length === 0">Support has not sent any messages yet.</p>
+          <article v-for="entry in report.messages" :key="entry.id" class="support-message">
+            <b>{{ entry.author === 'maintainer' ? 'Support' : 'You' }}</b>
+            <small>{{ formatDate(entry.createdAt, true) }}</small>
+            <p>{{ entry.body }}</p>
+          </article>
+          <form class="message-composer" @submit.prevent="sendReply">
+            <label class="field"><span>Reply privately</span><textarea v-model="reply" maxlength="8192" rows="4" required /></label>
+            <button class="primary" type="submit" :disabled="sending || !reply.trim()">{{ sending ? 'Sending...' : 'Send reply' }}</button>
+          </form>
+        </div>
         <p v-if="!deleted">This link is private. Anyone who has it can view or delete this request. Do not post it publicly.</p>
         <button v-if="!deleted" class="danger" type="button" :disabled="deleting" @click="removeReport">{{ deleting ? 'Deleting...' : 'Delete private request' }}</button>
       </template>
diff --git a/internal/domain/admin.go b/internal/domain/admin.go
index d29d98f..7c47c30 100644
--- a/internal/domain/admin.go
+++ b/internal/domain/admin.go
@@ -37,4 +37,5 @@ type AdminReportDetail struct {
 	Description string          `json:"description"`
 	Contact     string          `json:"contact,omitempty"`
 	Release     ReleaseMetadata `json:"release"`
+	Messages    []Message       `json:"messages"`
 }
diff --git a/internal/domain/report.go b/internal/domain/report.go
index 017bd79..2cce611 100644
--- a/internal/domain/report.go
+++ b/internal/domain/report.go
@@ -6,6 +6,7 @@ const (
 	ContractVersion           = 1
 	MaxMetadataBytes          = 32 * 1024
 	MaxDiagnosticArchiveBytes = 4 * 1024 * 1024
+	MaxMessageBytes           = 8 * 1024
 )
 
 func (value ReportStatus) Valid() bool {
@@ -101,4 +102,21 @@ type PrivateStatus struct {
 	CreatedAt       time.Time `json:"createdAt"`
 	UpdatedAt       time.Time `json:"updatedAt"`
 	RetentionUntil  time.Time `json:"retentionUntil"`
+	Messages        []Message `json:"messages"`
+}
+
+type MessageAuthor string
+
+const (
+	MessageAuthorMaintainer MessageAuthor = "maintainer"
+	MessageAuthorReporter   MessageAuthor = "reporter"
+)
+
+type Message struct {
+	ID             string        `json:"id"`
+	Author         MessageAuthor `json:"author"`
+	Body           string        `json:"body"`
+	CreatedAt      time.Time     `json:"createdAt"`
+	BodyCiphertext []byte        `json:"-"`
+	ReportID       string        `json:"-"`
 }
diff --git a/internal/intake/service.go b/internal/intake/service.go
index 1c7ed98..f565a17 100644
--- a/internal/intake/service.go
+++ b/internal/intake/service.go
@@ -196,7 +196,33 @@ func (service *Service) Status(ctx context.Context, capability string) (domain.P
 	if err != nil {
 		return domain.PrivateStatus{}, err
 	}
-	return privateStatus(report), nil
+	messages, err := service.openMessages(ctx, report.ID)
+	if err != nil {
+		return domain.PrivateStatus{}, err
+	}
+	return privateStatus(report, messages), nil
+}
+
+func (service *Service) ReporterMessage(ctx context.Context, capability, body string) (domain.PrivateStatus, error) {
+	if !validCapability(capability) {
+		return domain.PrivateStatus{}, ErrNotFound
+	}
+	report, err := service.reports.ByCapabilityHash(ctx, hash([]byte(capability)))
+	if errors.Is(err, store.ErrNotFound) {
+		return domain.PrivateStatus{}, ErrNotFound
+	}
+	if err != nil {
+		return domain.PrivateStatus{}, err
+	}
+	report, err = service.addMessage(ctx, report, domain.MessageAuthorReporter, body, nil)
+	if err != nil {
+		return domain.PrivateStatus{}, err
+	}
+	messages, err := service.openMessages(ctx, report.ID)
+	if err != nil {
+		return domain.PrivateStatus{}, err
+	}
+	return privateStatus(report, messages), nil
 }
 
 func (service *Service) Delete(ctx context.Context, capability string) (domain.PrivateStatus, error) {
@@ -215,7 +241,7 @@ func (service *Service) Delete(ctx context.Context, capability string) (domain.P
 			return domain.PrivateStatus{}, fmt.Errorf("delete private diagnostic object: %w", err)
 		}
 	}
-	status := privateStatus(report)
+	status := privateStatus(report, []domain.Message{})
 	status.Status = "deleted"
 	return status, nil
 }
@@ -275,12 +301,11 @@ func (service *Service) AdminDetail(ctx context.Context, id string) (domain.Admi
 	if err != nil {
 		return domain.AdminReportDetail{}, err
 	}
-	return domain.AdminReportDetail{
-		AdminReportSummary: adminSummary(report, payload),
-		Description:        payload.Description,
-		Contact:            payload.Contact,
-		Release:            payload.Release,
-	}, nil
+	messages, err := service.openMessages(ctx, report.ID)
+	if err != nil {
+		return domain.AdminReportDetail{}, err
+	}
+	return adminDetail(report, payload, messages), nil
 }
 
 func (service *Service) AdminDiagnostics(ctx context.Context, id string) ([]byte, string, error) {
@@ -313,12 +338,74 @@ func (service *Service) AdminUpdateStatus(ctx context.Context, id string, status
 	if err != nil {
 		return domain.AdminReportDetail{}, err
 	}
-	return domain.AdminReportDetail{
-		AdminReportSummary: adminSummary(report, payload),
-		Description:        payload.Description,
-		Contact:            payload.Contact,
-		Release:            payload.Release,
-	}, nil
+	messages, err := service.openMessages(ctx, report.ID)
+	if err != nil {
+		return domain.AdminReportDetail{}, err
+	}
+	return adminDetail(report, payload, messages), nil
+}
+
+func (service *Service) AdminMessage(ctx context.Context, id, body string) (domain.AdminReportDetail, error) {
+	report, err := service.reports.AdminByID(ctx, id)
+	if errors.Is(err, store.ErrNotFound) {
+		return domain.AdminReportDetail{}, ErrNotFound
+	}
+	if err != nil {
+		return domain.AdminReportDetail{}, err
+	}
+	status := domain.StatusNeedsInformation
+	report, err = service.addMessage(ctx, report, domain.MessageAuthorMaintainer, body, &status)
+	if err != nil {
+		return domain.AdminReportDetail{}, err
+	}
+	payload, err := service.openPrivatePayload(report)
+	if err != nil {
+		return domain.AdminReportDetail{}, err
+	}
+	messages, err := service.openMessages(ctx, report.ID)
+	if err != nil {
+		return domain.AdminReportDetail{}, err
+	}
+	return adminDetail(report, payload, messages), nil
+}
+
+func (service *Service) addMessage(ctx context.Context, report domain.Report, author domain.MessageAuthor, body string, status *domain.ReportStatus) (domain.Report, error) {
+	body = strings.TrimSpace(body)
+	if !validText(body, 1, domain.MaxMessageBytes, true) {
+		return domain.Report{}, ErrInvalid
+	}
+	id, err := randomUUID()
+	if err != nil {
+		return domain.Report{}, err
+	}
+	sealed, err := service.box.Seal([]byte(body), []byte(report.ID+":message:"+id))
+	if err != nil {
+		return domain.Report{}, err
+	}
+	now := service.now()
+	updated, err := service.reports.AddMessage(ctx, domain.Message{
+		ID: id, ReportID: report.ID, Author: author, BodyCiphertext: sealed, CreatedAt: now,
+	}, status, now)
+	if errors.Is(err, store.ErrNotFound) {
+		return domain.Report{}, ErrNotFound
+	}
+	return updated, err
+}
+
+func (service *Service) openMessages(ctx context.Context, reportID string) ([]domain.Message, error) {
+	messages, err := service.reports.Messages(ctx, reportID)
+	if err != nil {
+		return nil, err
+	}
+	for index := range messages {
+		plaintext, err := service.box.Open(messages[index].BodyCiphertext, []byte(reportID+":message:"+messages[index].ID))
+		if err != nil {
+			return nil, err
+		}
+		messages[index].Body = string(plaintext)
+		messages[index].BodyCiphertext = nil
+	}
+	return messages, nil
 }
 
 func (service *Service) openPrivatePayload(report domain.Report) (domain.PrivatePayload, error) {
@@ -342,6 +429,13 @@ func adminSummary(report domain.Report, payload domain.PrivatePayload) domain.Ad
 	}
 }
 
+func adminDetail(report domain.Report, payload domain.PrivatePayload, messages []domain.Message) domain.AdminReportDetail {
+	return domain.AdminReportDetail{
+		AdminReportSummary: adminSummary(report, payload), Description: payload.Description,
+		Contact: payload.Contact, Release: payload.Release, Messages: messages,
+	}
+}
+
 func (service *Service) receipt(report domain.Report) (domain.Receipt, error) {
 	capability, err := service.box.Open(report.CapabilityCiphertext, []byte(report.ID+":capability"))
 	if err != nil {
@@ -458,12 +552,12 @@ func contains(values []string, wanted string) bool {
 	return false
 }
 
-func privateStatus(report domain.Report) domain.PrivateStatus {
+func privateStatus(report domain.Report, messages []domain.Message) domain.PrivateStatus {
 	return domain.PrivateStatus{
 		ContractVersion: domain.ContractVersion, SupportCode: report.SupportCode,
 		ProductID: report.ProductID, RequestType: string(report.RequestType),
 		Status: string(report.Status), CreatedAt: report.CreatedAt, UpdatedAt: report.UpdatedAt,
-		RetentionUntil: report.RetentionUntil,
+		RetentionUntil: report.RetentionUntil, Messages: messages,
 	}
 }
 
diff --git a/internal/intake/service_test.go b/internal/intake/service_test.go
index 6d730de..4cf557c 100644
--- a/internal/intake/service_test.go
+++ b/internal/intake/service_test.go
@@ -138,6 +138,40 @@ func TestDeleteRevokesCapabilityAndRemovesDiagnosticObject(t *testing.T) {
 	}
 }
 
+func TestPrivateConversationEncryptsMessagesAndUpdatesStatus(t *testing.T) {
+	service, reports, _ := testService(t)
+	receipt, err := service.Submit(context.Background(), validSubmission(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	listed, _, err := service.AdminList(context.Background(), nil, 10, 0)
+	if err != nil || len(listed) != 1 {
+		t.Fatalf("listed reports = %#v, %v", listed, err)
+	}
+	detail, err := service.AdminMessage(context.Background(), listed[0].ID, "Could you describe the last action before the failure?")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if detail.Status != domain.StatusNeedsInformation || len(detail.Messages) != 1 || detail.Messages[0].Author != domain.MessageAuthorMaintainer {
+		t.Fatalf("maintainer message detail = %#v", detail)
+	}
+	capability := receipt.StatusURL[strings.LastIndex(receipt.StatusURL, "/")+1:]
+	status, err := service.ReporterMessage(context.Background(), capability, "It failed after I pressed Update.")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(status.Messages) != 2 || status.Messages[1].Author != domain.MessageAuthorReporter || status.Messages[1].Body != "It failed after I pressed Update." {
+		t.Fatalf("private conversation = %#v", status.Messages)
+	}
+	stored, err := reports.Messages(context.Background(), listed[0].ID)
+	if err != nil || len(stored) != 2 || bytes.Contains(stored[0].BodyCiphertext, []byte("last action")) {
+		t.Fatalf("stored encrypted messages = %#v, %v", stored, err)
+	}
+	if _, err := service.ReporterMessage(context.Background(), capability, "  "); !errors.Is(err, ErrInvalid) {
+		t.Fatalf("blank message error = %v, want ErrInvalid", err)
+	}
+}
+
 func TestPurgeExpiredRemovesEncryptedObjectAndRow(t *testing.T) {
 	service, reports, objects := testService(t)
 	submission := validSubmission(t)
diff --git a/internal/store/memory.go b/internal/store/memory.go
index 694ded2..b7ed286 100644
--- a/internal/store/memory.go
+++ b/internal/store/memory.go
@@ -14,6 +14,7 @@ type Memory struct {
 	reports       []domain.Report
 	cancellations map[string]time.Time
 	sessions      []domain.AdminSession
+	messages      []domain.Message
 }
 
 func NewMemory() *Memory { return &Memory{cancellations: make(map[string]time.Time)} }
@@ -110,6 +111,13 @@ func (memory *Memory) Purge(_ context.Context, id string, before time.Time) erro
 	for index, report := range memory.reports {
 		if report.ID == id && (report.DeletedAt != nil || !report.RetentionUntil.After(before)) {
 			memory.reports = append(memory.reports[:index], memory.reports[index+1:]...)
+			keptMessages := memory.messages[:0]
+			for _, message := range memory.messages {
+				if message.ReportID != id {
+					keptMessages = append(keptMessages, message)
+				}
+			}
+			memory.messages = keptMessages
 			return nil
 		}
 	}
@@ -158,6 +166,34 @@ func (memory *Memory) AdminUpdateStatus(_ context.Context, id string, status dom
 	return domain.Report{}, ErrNotFound
 }
 
+func (memory *Memory) AddMessage(_ context.Context, message domain.Message, status *domain.ReportStatus, now time.Time) (domain.Report, error) {
+	memory.mu.Lock()
+	defer memory.mu.Unlock()
+	for index := range memory.reports {
+		if memory.reports[index].ID == message.ReportID && memory.reports[index].DeletedAt == nil {
+			memory.messages = append(memory.messages, message)
+			if status != nil {
+				memory.reports[index].Status = *status
+			}
+			memory.reports[index].UpdatedAt = now
+			return memory.reports[index], nil
+		}
+	}
+	return domain.Report{}, ErrNotFound
+}
+
+func (memory *Memory) Messages(_ context.Context, reportID string) ([]domain.Message, error) {
+	memory.mu.Lock()
+	defer memory.mu.Unlock()
+	result := make([]domain.Message, 0)
+	for _, message := range memory.messages {
+		if message.ReportID == reportID {
+			result = append(result, message)
+		}
+	}
+	return result, nil
+}
+
 func (memory *Memory) CreateAdminSession(_ context.Context, session domain.AdminSession) error {
 	memory.mu.Lock()
 	defer memory.mu.Unlock()
diff --git a/internal/store/migrations/004_report_messages.sql b/internal/store/migrations/004_report_messages.sql
new file mode 100644
index 0000000..513d615
--- /dev/null
+++ b/internal/store/migrations/004_report_messages.sql
@@ -0,0 +1,10 @@
+CREATE TABLE IF NOT EXISTS support_report_messages (
+    id uuid PRIMARY KEY,
+    report_id uuid NOT NULL REFERENCES support_reports(id) ON DELETE CASCADE,
+    author text NOT NULL CHECK (author IN ('maintainer', 'reporter')),
+    body_ciphertext bytea NOT NULL,
+    created_at timestamptz NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS support_report_messages_report_created_idx
+    ON support_report_messages (report_id, created_at, id);
diff --git a/internal/store/postgres.go b/internal/store/postgres.go
index eef1688..0f72f1d 100644
--- a/internal/store/postgres.go
+++ b/internal/store/postgres.go
@@ -199,6 +199,54 @@ func (postgres *Postgres) AdminUpdateStatus(ctx context.Context, id string, stat
 		capability_hash, created_at, updated_at, retention_until, deleted_at`, status, now, id))
 }
 
+func (postgres *Postgres) AddMessage(ctx context.Context, message domain.Message, status *domain.ReportStatus, now time.Time) (domain.Report, error) {
+	transaction, err := postgres.pool.Begin(ctx)
+	if err != nil {
+		return domain.Report{}, err
+	}
+	defer transaction.Rollback(ctx)
+	var statusValue any
+	if status != nil {
+		statusValue = string(*status)
+	}
+	report, err := scanReport(transaction.QueryRow(ctx, `UPDATE support_reports
+		SET updated_at = $1, status = COALESCE($2::text, status)
+		WHERE id = $3 AND deleted_at IS NULL
+		RETURNING id, support_code, product_id, request_type, status, private_payload,
+		capability_ciphertext, diagnostic_object_key, idempotency_hash, request_hash,
+		capability_hash, created_at, updated_at, retention_until, deleted_at`, now, statusValue, message.ReportID))
+	if err != nil {
+		return domain.Report{}, err
+	}
+	if _, err := transaction.Exec(ctx, `INSERT INTO support_report_messages
+		(id, report_id, author, body_ciphertext, created_at) VALUES ($1,$2,$3,$4,$5)`,
+		message.ID, message.ReportID, message.Author, message.BodyCiphertext, message.CreatedAt); err != nil {
+		return domain.Report{}, err
+	}
+	if err := transaction.Commit(ctx); err != nil {
+		return domain.Report{}, err
+	}
+	return report, nil
+}
+
+func (postgres *Postgres) Messages(ctx context.Context, reportID string) ([]domain.Message, error) {
+	rows, err := postgres.pool.Query(ctx, `SELECT id, report_id, author, body_ciphertext, created_at
+		FROM support_report_messages WHERE report_id = $1 ORDER BY created_at ASC, id ASC`, reportID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.Message, 0)
+	for rows.Next() {
+		var message domain.Message
+		if err := rows.Scan(&message.ID, &message.ReportID, &message.Author, &message.BodyCiphertext, &message.CreatedAt); err != nil {
+			return nil, err
+		}
+		result = append(result, message)
+	}
+	return result, rows.Err()
+}
+
 func (postgres *Postgres) CreateAdminSession(ctx context.Context, session domain.AdminSession) error {
 	_, err := postgres.pool.Exec(ctx, `INSERT INTO support_admin_sessions
 		(token_hash, csrf_hash, username, created_at, expires_at) VALUES ($1,$2,$3,$4,$5)`,
diff --git a/internal/store/store.go b/internal/store/store.go
index 16fbbab..4ff840a 100644
--- a/internal/store/store.go
+++ b/internal/store/store.go
@@ -25,6 +25,8 @@ type Reports interface {
 	AdminList(context.Context, *domain.ReportStatus, int, int) ([]domain.Report, int, error)
 	AdminByID(context.Context, string) (domain.Report, error)
 	AdminUpdateStatus(context.Context, string, domain.ReportStatus, time.Time) (domain.Report, error)
+	AddMessage(context.Context, domain.Message, *domain.ReportStatus, time.Time) (domain.Report, error)
+	Messages(context.Context, string) ([]domain.Message, error)
 	Close()
 }
 
diff --git a/internal/web/admin.go b/internal/web/admin.go
index 98ab833..88831d1 100644
--- a/internal/web/admin.go
+++ b/internal/web/admin.go
@@ -208,6 +208,33 @@ func (server *Server) adminUpdateReport(response http.ResponseWriter, request *h
 	writeJSON(response, http.StatusOK, report)
 }
 
+func (server *Server) adminReportMessage(response http.ResponseWriter, request *http.Request) {
+	_, session, ok := server.requireAdminCSRF(response, request)
+	if !ok {
+		return
+	}
+	var body struct {
+		Body string `json:"body"`
+	}
+	if err := decodeAdminJSON(response, request, &body); err != nil {
+		writeProblem(response, http.StatusBadRequest, "invalid_message", "Enter a message to send to the reporter.")
+		return
+	}
+	id, ok := adminReportID(response, request)
+	if !ok {
+		return
+	}
+	if !server.auditAdmin(response, request, session.Username, "report_message_requested", &id) {
+		return
+	}
+	report, err := server.intake.AdminMessage(request.Context(), id, body.Body)
+	if err != nil {
+		server.writeAdminError(response, err)
+		return
+	}
+	writeJSON(response, http.StatusCreated, report)
+}
+
 func (server *Server) adminDiagnostics(response http.ResponseWriter, request *http.Request) {
 	_, session, ok := server.requireAdmin(response, request)
 	if !ok {
diff --git a/internal/web/admin_test.go b/internal/web/admin_test.go
index 94617b4..f0f2303 100644
--- a/internal/web/admin_test.go
+++ b/internal/web/admin_test.go
@@ -25,7 +25,14 @@ import (
 )
 
 func TestAdminSessionProtectsReviewAndDiagnosticRoutes(t *testing.T) {
-	handler, reportID := testAdminHandler(t)
+	handler, reportID, capability := testAdminHandler(t)
+
+	reporterReply := httptest.NewRecorder()
+	handler.ServeHTTP(reporterReply, httptest.NewRequest(http.MethodPost, "/api/v1/reports/"+capability+"/messages",
+		strings.NewReader(`{"body":"The failure happened after I pressed Update."}`)))
+	if reporterReply.Code != http.StatusCreated || !strings.Contains(reporterReply.Body.String(), `"author":"reporter"`) {
+		t.Fatalf("reporter reply = %d, body = %s", reporterReply.Code, reporterReply.Body.String())
+	}
 
 	unauthorized := httptest.NewRecorder()
 	handler.ServeHTTP(unauthorized, httptest.NewRequest(http.MethodGet, "/api/v1/admin/reports", nil))
@@ -75,6 +82,17 @@ func TestAdminSessionProtectsReviewAndDiagnosticRoutes(t *testing.T) {
 		t.Fatalf("status update = %d, body = %s", updated.Code, updated.Body.String())
 	}
 
+	messageRequest := httptest.NewRequest(http.MethodPost, "/api/v1/admin/reports/"+reportID+"/messages",
+		strings.NewReader(`{"body":"Which package format did you install?"}`))
+	messageRequest.AddCookie(cookies[0])
+	messageRequest.Header.Set("X-CSRF-Token", session.CSRFToken)
+	messaged := httptest.NewRecorder()
+	handler.ServeHTTP(messaged, messageRequest)
+	if messaged.Code != http.StatusCreated || !strings.Contains(messaged.Body.String(), `"status":"needs_information"`) ||
+		!strings.Contains(messaged.Body.String(), `"author":"maintainer"`) {
+		t.Fatalf("maintainer message = %d, body = %s", messaged.Code, messaged.Body.String())
+	}
+
 	download := httptest.NewRequest(http.MethodGet, "/api/v1/admin/reports/"+reportID+"/diagnostics", nil)
 	download.AddCookie(cookies[0])
 	diagnostics := httptest.NewRecorder()
@@ -84,7 +102,7 @@ func TestAdminSessionProtectsReviewAndDiagnosticRoutes(t *testing.T) {
 	}
 }
 
-func testAdminHandler(t *testing.T) (http.Handler, string) {
+func testAdminHandler(t *testing.T) (http.Handler, string, string) {
 	t.Helper()
 	box, err := cryptobox.NewFromBase64(base64.StdEncoding.EncodeToString(make([]byte, 32)))
 	if err != nil {
@@ -129,7 +147,8 @@ func testAdminHandler(t *testing.T) (http.Handler, string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	return server.Handler(), listed[0].ID
+	capability := receipt.StatusURL[strings.LastIndex(receipt.StatusURL, "/")+1:]
+	return server.Handler(), listed[0].ID, capability
 }
 
 func testDiagnosticArchive(t *testing.T) []byte {
diff --git a/internal/web/server.go b/internal/web/server.go
index 93b2fd3..bd2a842 100644
--- a/internal/web/server.go
+++ b/internal/web/server.go
@@ -53,6 +53,7 @@ func (server *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /api/v1/receipts", server.reconcileReceipt)
 	mux.HandleFunc("DELETE /api/v1/receipts", server.cancelSubmission)
 	mux.HandleFunc("GET /api/v1/reports/{capability}", server.reportStatus)
+	mux.HandleFunc("POST /api/v1/reports/{capability}/messages", server.reportMessage)
 	mux.HandleFunc("DELETE /api/v1/reports/{capability}", server.deleteReport)
 	mux.HandleFunc("POST /api/v1/admin/login", server.adminLogin)
 	mux.HandleFunc("GET /api/v1/admin/session", server.adminSession)
@@ -60,6 +61,7 @@ func (server *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /api/v1/admin/reports", server.adminReports)
 	mux.HandleFunc("GET /api/v1/admin/reports/{id}", server.adminReport)
 	mux.HandleFunc("PATCH /api/v1/admin/reports/{id}", server.adminUpdateReport)
+	mux.HandleFunc("POST /api/v1/admin/reports/{id}/messages", server.adminReportMessage)
 	mux.HandleFunc("GET /api/v1/admin/reports/{id}/diagnostics", server.adminDiagnostics)
 	mux.Handle("GET /", server.spa())
 	return securityHeaders(mux)
@@ -186,6 +188,30 @@ func (server *Server) reportStatus(response http.ResponseWriter, request *http.R
 	writeJSON(response, http.StatusOK, status)
 }
 
+func (server *Server) reportMessage(response http.ResponseWriter, request *http.Request) {
+	var body struct {
+		Body string `json:"body"`
+	}
+	request.Body = http.MaxBytesReader(response, request.Body, domain.MaxMessageBytes+1024)
+	decoder := json.NewDecoder(request.Body)
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&body); err != nil {
+		writeProblem(response, http.StatusBadRequest, "invalid_message", "Enter a message to send to support.")
+		return
+	}
+	var extra any
+	if err := decoder.Decode(&extra); !errors.Is(err, io.EOF) {
+		writeProblem(response, http.StatusBadRequest, "invalid_message", "Enter one message to send to support.")
+		return
+	}
+	status, err := server.intake.ReporterMessage(request.Context(), request.PathValue("capability"), body.Body)
+	if err != nil {
+		server.writeIntakeError(response, err)
+		return
+	}
+	writeJSON(response, http.StatusCreated, status)
+}
+
 func (server *Server) deleteReport(response http.ResponseWriter, request *http.Request) {
 	status, err := server.intake.Delete(request.Context(), request.PathValue("capability"))
 	if err != nil {
diff --git a/internal/web/server_test.go b/internal/web/server_test.go
index c7a4981..ede9c82 100644
--- a/internal/web/server_test.go
+++ b/internal/web/server_test.go
@@ -32,7 +32,7 @@ func TestSecurityHeadersKeepPrivateRoutesOutOfIndexes(t *testing.T) {
 }
 
 func TestCancellationEndpointReturnsTerminalResult(t *testing.T) {
-	handler, _ := testAdminHandler(t)
+	handler, _, _ := testAdminHandler(t)
 	idempotencyKey := strings.Repeat("A", 43)
 
 	cancelRequest := httptest.NewRequest(http.MethodDelete, "/api/v1/receipts", nil)
diff --git a/openapi.yaml b/openapi.yaml
index 23b2084..9ed487b 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -105,6 +105,28 @@ paths:
               schema:
                 $ref: "#/components/schemas/PrivateStatus"
         "404": { $ref: "#/components/responses/Problem" }
+  /api/v1/reports/{capability}/messages:
+    post:
+      summary: Reply to a private support conversation
+      operationId: createPrivateReportMessage
+      parameters:
+        - name: capability
+          in: path
+          required: true
+          schema: { type: string, minLength: 43, maxLength: 43 }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/MessageInput" }
+      responses:
+        "201":
+          description: Message added to the private report.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/PrivateStatus" }
+        "400": { $ref: "#/components/responses/Problem" }
+        "404": { $ref: "#/components/responses/Problem" }
   /api/v1/admin/login:
     post:
       summary: Sign in a support maintainer
@@ -233,6 +255,32 @@ paths:
               schema: { type: string, format: binary }
         "401": { $ref: "#/components/responses/Problem" }
         "404": { $ref: "#/components/responses/Problem" }
+  /api/v1/admin/reports/{id}/messages:
+    post:
+      summary: Ask a reporter for more information
+      operationId: createAdminReportMessage
+      security: [{ AdminSessionCookie: [] }]
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema: { type: string, format: uuid }
+        - $ref: "#/components/parameters/CSRFToken"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/MessageInput" }
+      responses:
+        "201":
+          description: Encrypted maintainer message added and report marked as needing information.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/AdminReportDetail" }
+        "400": { $ref: "#/components/responses/Problem" }
+        "401": { $ref: "#/components/responses/Problem" }
+        "403": { $ref: "#/components/responses/Problem" }
+        "404": { $ref: "#/components/responses/Problem" }
 components:
   securitySchemes:
     AdminSessionCookie:
@@ -313,7 +361,7 @@ components:
         retentionUntil: { type: string, format: date-time }
     PrivateStatus:
       type: object
-      required: [contractVersion, supportCode, productId, requestType, status, createdAt, updatedAt, retentionUntil]
+      required: [contractVersion, supportCode, productId, requestType, status, createdAt, updatedAt, retentionUntil, messages]
       properties:
         contractVersion: { const: 1 }
         supportCode: { type: string }
@@ -323,6 +371,22 @@ components:
         createdAt: { type: string, format: date-time }
         updatedAt: { type: string, format: date-time }
         retentionUntil: { type: string, format: date-time }
+        messages:
+          type: array
+          items: { $ref: "#/components/schemas/SupportMessage" }
+    MessageInput:
+      type: object
+      required: [body]
+      properties:
+        body: { type: string, minLength: 1, maxLength: 8192 }
+    SupportMessage:
+      type: object
+      required: [id, author, body, createdAt]
+      properties:
+        id: { type: string, format: uuid }
+        author: { enum: [maintainer, reporter] }
+        body: { type: string }
+        createdAt: { type: string, format: date-time }
     ReportStatus:
       type: string
       enum: [new, needs_information, accepted, duplicate, resolved, rejected]
@@ -353,7 +417,7 @@ components:
       allOf:
         - $ref: "#/components/schemas/AdminReportSummary"
         - type: object
-          required: [description, release]
+          required: [description, release, messages]
           properties:
             description: { type: string }
             contact: { type: string }
@@ -366,6 +430,9 @@ components:
                 platform: { type: string }
                 osVersion: { type: string }
                 architecture: { type: string }
+            messages:
+              type: array
+              items: { $ref: "#/components/schemas/SupportMessage" }
     AdminReportResponse:
       type: object
       required: [contractVersion, reports, total, limit, offset]