diff --git a/.github/workflows/dco.yaml b/.github/workflows/dco.yaml
index 9a5124d8..ee4d1f7e 100644
--- a/.github/workflows/dco.yaml
+++ b/.github/workflows/dco.yaml
@@ -1,20 +1,37 @@
 name: DCO
 on:
-  pull_request:
+  pull_request: {}
+  workflow_dispatch: {}
   merge_group:
-  push:
-    branches:
-      - main
+    types:
+      - checks_requested
+
+permissions:
+  contents: read
+
 jobs:
-  check_dco:
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-    name: Check DCO
+  check-dco:
+    runs-on: ubuntu-latest
     steps:
-      - name: Run dco-check
-        uses: christophebedard/dco-check@ec8bfc43106afe98b323ace9133650df10497e12 # 0.5.1
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Skip DCO check in merge queue
+        if: github.event_name == 'merge_group'
+        run: |
+          echo "Skipping DCO check for merge queue - DCO is validated on PR commits before entering the queue"
+          exit 0
+      - name: Set up Python 3.x
+        if: github.event_name != 'merge_group'
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          args: --exclude-pattern 'dependabot\[bot\]@users\.noreply\.github\.com'
+          python-version: '3.x'
+      - name: Check DCO
+        if: github.event_name != 'merge_group'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          pip3 install -U dco-check
+          # sayadas@redhat.com: upstream commit fc4afb5e has a sign-off whose name
+          # ("Sayak Das") does not match the author name ("Sayak"), which dco-check
+          # rejects. The commit is already in spiffe/spire-controller-manager main.
+          dco-check --exclude-pattern 'dependabot\[bot\]@users\.noreply\.github\.com|sayadas@redhat\.com'
diff --git a/.github/workflows/nightly_build.yaml b/.github/workflows/nightly_build.yaml
index ffab0aa4..a3932357 100644
--- a/.github/workflows/nightly_build.yaml
+++ b/.github/workflows/nightly_build.yaml
@@ -1,9 +1,11 @@
 name: Nightly Build
 on:
-  schedule:
-    # Random minute number to avoid GH scheduler stampede
-    - cron: '37 21 * * *'
-  workflow_dispatch: {}
+  push:
+    tags:
+      - 'nightly-*'
+
+env:
+  DATADOG_INSTRUMENTATION: "true"
 
 jobs:
   build-and-publish-images:
@@ -36,4 +38,4 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Push images
-        run: ./.github/workflows/scripts/push-images.sh nightly
+        run: ./.github/workflows/scripts/push-images.sh "${GITHUB_REF#refs/tags/}"
diff --git a/.github/workflows/release_build.yaml b/.github/workflows/release_build.yaml
index 858196e0..3b0ad9f9 100644
--- a/.github/workflows/release_build.yaml
+++ b/.github/workflows/release_build.yaml
@@ -3,6 +3,10 @@ on:
   push:
     tags:
       - 'v[0-9].[0-9]+.[0-9]+'
+
+env:
+  DATADOG_INSTRUMENTATION: "true"
+
 jobs:
   build-image:
     runs-on: ubuntu-22.04
diff --git a/Dockerfile b/Dockerfile
index 3be98946..450caaf4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,14 +23,29 @@ FROM --platform=${BUILDPLATFORM} tonistiigi/xx@sha256:904fe94f236d36d65aeb5a2462
 
 # Build
 FROM --platform=${BUILDPLATFORM} base AS builder
+ARG datadog_instrumentation=false
+ARG orchestrion_version=v1.11.0
 ARG TARGETPLATFORM
 ARG TARGETARCH
 ENV CGO_ENABLED=0
 COPY --link --from=xx / /
+
+RUN <<EOF
+set -e
+if [ "${datadog_instrumentation}" = "true" ]; then
+  go install "github.com/DataDog/orchestrion@${orchestrion_version}"
+  orchestrion pin
+fi
+EOF
+
 RUN xx-go --wrap
 RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg/mod \
-    go build -o bin/spire-controller-manager cmd/main.go
+    if [ "${datadog_instrumentation}" = "true" ]; then \
+      go build -toolexec="orchestrion toolexec" -o bin/spire-controller-manager cmd/main.go; \
+    else \
+      go build -o bin/spire-controller-manager cmd/main.go; \
+    fi
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
diff --git a/Makefile b/Makefile
index 56b389e8..b808c0bc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,7 @@
 BINARIES := spire-controller-manager
 PLATFORMS ?= linux/amd64,linux/arm64
+DATADOG_INSTRUMENTATION ?= false
+ORCHESTRION_VERSION ?= v1.11.0
 DIR := ${CURDIR}
 
 # Image URL to use all building/pushing image targets
@@ -169,6 +171,8 @@ spire-controller-manager-image.tar: Dockerfile FORCE | container-builder
 		--platform $(PLATFORMS) \
 		--target spire-controller-manager \
 		--build-arg goversion=$(go_version) \
+		--build-arg datadog_instrumentation=$(DATADOG_INSTRUMENTATION) \
+		--build-arg orchestrion_version=$(ORCHESTRION_VERSION) \
 		-o type=oci,dest=$@ \
 	    .
 
diff --git a/api/v1alpha1/controllermanagerconfig_types.go b/api/v1alpha1/controllermanagerconfig_types.go
index 17e47a29..8fe44daa 100644
--- a/api/v1alpha1/controllermanagerconfig_types.go
+++ b/api/v1alpha1/controllermanagerconfig_types.go
@@ -53,7 +53,7 @@ type ControllerManagerConfig struct {
 	// is otherwise idle. This impacts how quickly SPIRE state will converge
 	// after CRDs are removed or SPIRE state is mutated out from underneath
 	// the controller.
-	GCInterval time.Duration `json:"gcInterval"`
+	GCInterval time.Duration `json:"gcInterval,omitempty"`
 
 	// SPIREServerSocketPath is the path to the SPIRE Server API socket
 	SPIREServerSocketPath string `json:"spireServerSocketPath"`
diff --git a/cmd/main.go b/cmd/main.go
index e07843fd..73da2572 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -151,6 +151,9 @@ func parseConfig() (Config, error) {
 		if err := spirev1alpha1.LoadOptionsFromFile(configFileFlag, scheme, &retval.options, &retval.ctrlConfig, expandEnvFlag); err != nil {
 			return retval, fmt.Errorf("unable to load the config file: %w", err)
 		}
+		if retval.ctrlConfig.GCInterval <= 0 {
+			retval.ctrlConfig.GCInterval = defaultGCInterval
+		}
 		for _, ignoredNamespace := range retval.ctrlConfig.IgnoreNamespaces {
 			regex, err := regexp.Compile(ignoredNamespace)
 			if err != nil {
diff --git a/demo/greeter/go.mod b/demo/greeter/go.mod
index e47ef970..318e3049 100644
--- a/demo/greeter/go.mod
+++ b/demo/greeter/go.mod
@@ -3,8 +3,8 @@ module greeter
 go 1.26.4
 
 require (
-	github.com/spiffe/go-spiffe/v2 v2.8.0
-	google.golang.org/grpc v1.81.1
+	github.com/spiffe/go-spiffe/v2 v2.8.1
+	google.golang.org/grpc v1.82.0
 	google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6
 )
 
@@ -14,6 +14,6 @@ require (
 	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )
diff --git a/demo/greeter/go.sum b/demo/greeter/go.sum
index 6b332e58..1fdedd70 100644
--- a/demo/greeter/go.sum
+++ b/demo/greeter/go.sum
@@ -18,8 +18,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/spiffe/go-spiffe/v2 v2.8.0 h1:vHCTEZYhpXZ9y6JkIouIdHLJobWGUFn2467/WsXHHjA=
-github.com/spiffe/go-spiffe/v2 v2.8.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
+github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E=
+github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -42,10 +42,10 @@ golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 h1:ExN12ndbJ608cboPYflpTny6mXSzPrDLh0iTaVrRrds=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6/go.mod h1:6ytKWczdvnpnO+m+JiG9NjEDzR1FJfsnmJdG7B8QVZ8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
diff --git a/go.mod b/go.mod
index d1106597..d9b2c949 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/spiffe/spire-api-sdk v1.15.1
 	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.28.0
-	google.golang.org/grpc v1.81.1
+	google.golang.org/grpc v1.82.0
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
 	k8s.io/api v0.36.2
 	k8s.io/apimachinery v0.36.2
@@ -79,7 +79,7 @@ require (
 	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/tools v0.45.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index e222537f..daf33933 100644
--- a/go.sum
+++ b/go.sum
@@ -196,10 +196,10 @@ gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0
 gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 h1:ExN12ndbJ608cboPYflpTny6mXSzPrDLh0iTaVrRrds=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6/go.mod h1:6ytKWczdvnpnO+m+JiG9NjEDzR1FJfsnmJdG7B8QVZ8=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=