diff --git a/apps/docs/content/docs/integrations/atlassian-service-account.mdx b/apps/docs/content/docs/integrations/atlassian-service-account.mdx
index cdd139e837c..4a8aee1dd2e 100644
--- a/apps/docs/content/docs/integrations/atlassian-service-account.mdx
+++ b/apps/docs/content/docs/integrations/atlassian-service-account.mdx
@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 Use an Atlassian service account for Jira, Jira Service Management, and Confluence workflows. One credential can serve all three products on the same site when its account access and token scopes cover each product.
 
 <Callout type="info">
-Setting up Search? Follow the [Confluence Search service-account guide](/search/confluence#using-a-service-account) for its content and permission scopes. [Jira Search](/search/jira) uses each teammate's OAuth account; a workflow service account does not replace that connection.
+Setting up a Confluence knowledge base connector? Use the [connector scope list](#confluence-knowledge-base-connectors). For Search, follow the [Confluence Search service-account guide](/search/confluence#using-a-service-account). [Jira Search](/search/jira) uses each teammate's OAuth account; a workflow service account does not replace that connection.
 </Callout>
 
 ## Create the account and token
@@ -56,6 +56,28 @@ read:page:confluence
 
 `read:confluence-user` covers the [current-user check](https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-users/#api-wiki-rest-api-user-current-get). The [space picker](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space/#api-spaces-get) needs `read:space:confluence`; page reads and the page picker need `read:page:confluence`.
 
+### Confluence knowledge base connectors
+
+A Confluence knowledge base connector reads pages, blog posts, attachments, labels, and the space permissions and page restrictions it mirrors. Its service-account token needs every scope below, not only the Confluence scopes above:
+
+```text
+read:confluence-content.all
+read:page:confluence
+read:blogpost:confluence
+read:attachment:confluence
+read:space:confluence
+read:label:confluence
+search:confluence
+read:confluence-space.summary
+read:content.metadata:confluence
+read:space.permission:confluence
+read:confluence-user
+read:user:confluence
+read:group:confluence
+```
+
+Without `read:attachment:confluence`, pages still sync, but their PDF, Word, Excel, and PowerPoint attachments are not indexed and each sync reports a partial source listing. To fix a token that is missing scopes, create a replacement token with the full list. A credential admin then opens the credential in **Integrations**, selects **Reconnect**, and enters the new token and site domain. Connectors that use the credential keep using it.
+
 ### Workflow actions
 
 Add scopes for the actions your workflow performs:
diff --git a/apps/sim/connectors/confluence/attachments.test.ts b/apps/sim/connectors/confluence/attachments.test.ts
index dcff9b8117e..86a5e00915b 100644
--- a/apps/sim/connectors/confluence/attachments.test.ts
+++ b/apps/sim/connectors/confluence/attachments.test.ts
@@ -1,3 +1,4 @@
+import { getAllMockLoggers } from '@sim/testing/mocks/logger.mock'
 import JSZip from 'jszip'
 import { PDFDocument, StandardFonts } from 'pdf-lib'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
@@ -249,6 +250,133 @@ describe('Confluence attachment listing', () => {
     }
   )
 
+  describe('server errors', () => {
+    const parents = (ids: string[]) =>
+      vi.fn(
+        async (): Promise<ExternalDocumentList> => ({
+          documents: ids.map((id) => parent(id)),
+          hasMore: false,
+        })
+      )
+
+    /** Answers a parent's attachment listing with `status` while `failing` says so. */
+    function listingFails(failing: (parentId: string) => boolean, status = 500) {
+      fetchMock.mockImplementation(async (input) => {
+        const parentId = new URL(String(input)).pathname.split('/').at(-2) ?? ''
+        if (failing(parentId)) return new Response('upstream error', { status })
+        return Response.json({ results: [file({ id: `${parentId}-file`, pageId: parentId })] })
+      })
+    }
+
+    /** Runs a listing past the shared backoff (~31 s for five retries) without real waits. */
+    async function listPastBackoff(input: Parameters<typeof listConfluenceAttachments>[0]) {
+      vi.useFakeTimers()
+      try {
+        const listing = listConfluenceAttachments(input)
+        const settled = listing.then(
+          () => undefined,
+          () => undefined
+        )
+        for (let i = 0; i < 20; i++) await vi.advanceTimersByTimeAsync(10_000)
+        await settled
+        return await listing
+      } finally {
+        vi.useRealTimers()
+      }
+    }
+
+    it.each([
+      ['a complete body', () => 'upstream error'],
+      ['a body that never finishes', () => new ReadableStream<Uint8Array>()],
+      [
+        'a body stream that already errored',
+        () =>
+          new ReadableStream<Uint8Array>({
+            start: (controller) => controller.error(new Error('connection reset')),
+          }),
+      ],
+    ])('retries a transient 500 with %s instead of failing the listing', async (_, body) => {
+      let failed = false
+      fetchMock.mockImplementation(async () => {
+        if (failed) return Response.json({ results: [file({ id: 'p1-file' })] })
+        failed = true
+        return new Response(body(), { status: 500 })
+      })
+      const result = await listPastBackoff({ ...INPUT, listParents: parents(['p1']) })
+      expect(result.documents.map((doc) => doc.externalId)).toEqual([
+        'p1',
+        'attachment:page:p1:p1-file',
+      ])
+      expect(result.listingFailures).toBeUndefined()
+    })
+
+    it('skips isolated parents whose listing keeps failing and keeps listing the rest', async () => {
+      listingFails((id) => id === 'p1' || id === 'p3' || id === 'p5')
+      const context: Record<string, unknown> = {}
+      const result = await listPastBackoff({
+        ...INPUT,
+        listParents: parents(['p1', 'p2', 'p3', 'p4', 'p5']),
+        syncContext: context,
+      })
+      expect(result.documents.map((doc) => doc.externalId)).toEqual([
+        'p1',
+        'p2',
+        'p3',
+        'p4',
+        'p5',
+        'attachment:page:p2:p2-file',
+        'attachment:page:p4:p4-file',
+      ])
+      expect(result.listingFailures).toEqual({
+        count: 3,
+        samples: ['p1', 'p3', 'p5'].map((scope) => ({
+          scope,
+          operation: 'confluence.attachments.list',
+          status: 500,
+          reasons: ['attachment_listing_unavailable'],
+        })),
+      })
+      expect(result.reconciliationSafe).toBe(false)
+      expect(context.reconciliationUnsafe).toBe(true)
+    })
+
+    it('logs Atlassian trace identifiers for a 500 but never its body', async () => {
+      let failed = false
+      fetchMock.mockImplementation(async () => {
+        if (failed) return Response.json({ results: [] })
+        failed = true
+        return Response.json(
+          {
+            errors: [{ code: 'INTERNAL_SERVER_ERROR', title: 'x', detail: 'leaked-secret-value' }],
+          },
+          {
+            status: 500,
+            headers: { 'atl-traceid': '5c1f0e2a9b7d4e1f', 'x-arequestid': 'not an id; <script>' },
+          }
+        )
+      })
+      await listPastBackoff({ ...INPUT, listParents: parents(['p1']) })
+      const logged = JSON.stringify(
+        getAllMockLoggers().flatMap((logger) =>
+          [logger.info, logger.warn, logger.error, logger.debug].flatMap((fn) => fn.mock.calls)
+        )
+      )
+      expect(logged).toContain('5c1f0e2a9b7d4e1f')
+      expect(logged).not.toContain('<script>')
+      expect(logged).not.toContain('leaked-secret-value')
+    })
+
+    it.each([500, 503])(
+      'fails the sync when consecutive parents answer %s, as during an outage',
+      async (status) => {
+        listingFails(() => true, status)
+        await expect(
+          listPastBackoff({ ...INPUT, listParents: parents(['p1', 'p2', 'p3', 'p4']) })
+        ).rejects.toMatchObject({ status })
+      }
+    )
+  })
+
   it('surfaces known oversized files as skipped without downloading', async () => {
     fetchMock.mockResolvedValue(
       Response.json({ results: [file({ fileSize: CONNECTOR_MAX_FILE_BYTES + 1 })] })
diff --git a/apps/sim/connectors/confluence/attachments.ts b/apps/sim/connectors/confluence/attachments.ts
index c3e6467d540..388e1768c98 100644
--- a/apps/sim/connectors/confluence/attachments.ts
+++ b/apps/sim/connectors/confluence/attachments.ts
@@ -1,13 +1,17 @@
+import { createLogger } from '@sim/logger'
 import { z } from 'zod'
 import { isPayloadSizeLimitError, readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
 import { fetchWithRetry, secureFetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import {
   createRetryableHttpError,
+  isRetryableError,
+  type RetryOptions,
   readBoundedHttpErrorPayload,
 } from '@/lib/knowledge/documents/utils'
 import { extractCursor } from '@/connectors/confluence/cursor'
 import { listingFailuresSchema, MAX_LISTING_FAILURE_SAMPLES } from '@/connectors/listing-failures'
 import { isAllSourceItems } from '@/connectors/selection'
+import { ConnectorSourceError } from '@/connectors/source-error'
 import type { ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
   CONNECTOR_MAX_FILE_BYTES,
@@ -20,12 +24,20 @@ import {
   stubOrSkipBySize,
 } from '@/connectors/utils'
 
+const logger = createLogger('ConfluenceAttachments')
+
 const ATTACHMENT_PREFIX = 'attachment:'
 const CURSOR_PREFIX = 'attachments:'
 const PAGE_SIZE = 50
 const REQUESTS_PER_CALL = 5
 const MAX_CURSOR_BYTES = 512 * 1024
 const MAX_METADATA_BYTES = 2 * 1024 * 1024
+/**
+ * Consecutive parents whose attachment listing failed server-side. An isolated
+ * failure is skipped and recorded; a run of them means Atlassian itself is down,
+ * so the sync fails instead of spending the retry budget on every remaining parent.
+ */
+const MAX_CONSECUTIVE_SERVER_FAILURES = 3
 /**
  * Attachment formats listed for indexing: a deliberate subset of the shared
  * `PIPELINE_PARSED_MIME_TYPES`, limited to the headline PDF, Word, Excel and
@@ -47,6 +59,12 @@ const cursorSchema = z.object({
   parentsListed: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
   parentsDone: z.boolean(),
   failures: listingFailuresSchema.optional(),
+  serverFailureStreak: z
+    .number()
+    .int()
+    .nonnegative()
+    .max(MAX_CONSECUTIVE_SERVER_FAILURES)
+    .optional(),
 })
 const attachmentSchema = z.object({
   id: boundedId,
@@ -64,12 +82,14 @@ const attachmentPageSchema = z.object({
   results: z.array(attachmentSchema).max(250),
   _links: z.object({ next: providerCursor.optional() }).optional(),
 })
+const OPAQUE_HEADER_VALUE = /^[A-Za-z0-9_.-]{1,128}$/
 const scopeMismatchSchema = z.object({
   code: z.literal(401),
   message: z.literal('Unauthorized; scope does not match'),
 })
 
 type Attachment = z.infer<typeof attachmentSchema>
+type AttachmentPage = z.infer<typeof attachmentPageSchema>
 type AttachmentCursor = z.infer<typeof cursorSchema>
 type AttachmentParent = z.infer<typeof parentSchema>
 
@@ -111,18 +131,73 @@ function apiBase(cloudId: string): string {
   return `https://api.atlassian.com/ex/confluence/${encodeURIComponent(cloudId)}/wiki`
 }
 
+function metadataServerError(status: number): ConnectorSourceError {
+  return new ConnectorSourceError(
+    `Failed to read Confluence attachment metadata: ${status}`,
+    status,
+    'provider_unavailable'
+  )
+}
+
+function opaqueHeader(response: Response, name: string): string | undefined {
+  const value = response.headers.get(name)
+  return value && OPAQUE_HEADER_VALUE.test(value) ? value : undefined
+}
+
+/**
+ * Metadata reads are idempotent GETs, and Atlassian intermittently answers them
+ * with a bare 500 that the shared transient-status set omits. Raising it inside
+ * the transport lets the shared backoff retry it like a 503. Every 5xx attempt
+ * logs Atlassian's trace identifiers from its headers, which support resolves a
+ * failure from; the body is never read here, so a stalled body cannot consume
+ * the retry budget and no raw payload reaches the logs.
+ */
+const METADATA_RETRY_OPTIONS: RetryOptions = {
+  fetcher: async (input, init, transport) => {
+    const response = await transport(input, init)
+    if (response.status < 500) return response
+    logger.warn('Confluence attachment metadata request failed', {
+      status: response.status,
+      path: new URL(String(input)).pathname,
+      traceId: opaqueHeader(response, 'atl-traceid'),
+      requestId: opaqueHeader(response, 'x-arequestid'),
+    })
+    if (response.status !== 500) return response
+    await response.body?.cancel().catch(() => undefined)
+    throw metadataServerError(response.status)
+  },
+  retryCondition: (error) =>
+    (error instanceof ConnectorSourceError && error.status === 500) || isRetryableError(error),
+}
+
 async function requestMetadata(input: AttachmentRequest, path: string): Promise<Response> {
-  return fetchWithRetry(`${apiBase(input.cloudId)}${path}`, {
-    headers: { Authorization: `Bearer ${input.accessToken}`, Accept: 'application/json' },
-    signal: signalFor(input),
-    redirect: 'error',
-  })
+  return fetchWithRetry(
+    `${apiBase(input.cloudId)}${path}`,
+    {
+      headers: { Authorization: `Bearer ${input.accessToken}`, Accept: 'application/json' },
+      signal: signalFor(input),
+      redirect: 'error',
+    },
+    METADATA_RETRY_OPTIONS
+  )
+}
+
+/** A 5xx that outlasted its retries; aborts and budget timeouts carry no status. */
+function isServerFailure(error: unknown): error is Error & { status: number } {
+  return (
+    error instanceof Error &&
+    'status' in error &&
+    typeof error.status === 'number' &&
+    error.status >= 500 &&
+    error.status <= 599
+  )
 }
 
 async function readMetadata(response: Response): Promise<unknown> {
   if (!response.ok) {
     if (response.status === 401) throw await unauthorizedAttachmentError(response)
-    await response.body?.cancel()
+    await response.body?.cancel().catch(() => undefined)
+    if (response.status >= 500) throw metadataServerError(response.status)
     throw new Error(
       response.status === 403
         ? 'Confluence attachment access was denied. Check the parent content permissions and the read:attachment:confluence credential scope.'
@@ -210,6 +285,58 @@ function decodeCursor(cursor: string | undefined, totalFetched: unknown): Attach
   return parsed.data
 }
 
+type ParentAttachmentListing =
+  | { ok: true; page: AttachmentPage }
+  | {
+      ok: false
+      status: number
+      reason:
+        | 'attachment_scope_mismatch'
+        | 'attachment_access_denied'
+        | 'attachment_listing_unavailable'
+      error: unknown
+    }
+
+/**
+ * Reads one page of a parent's attachments. Failures scoped to that parent —
+ * a missing scope, denied or deleted content, or a server error that outlasted
+ * its retries — are returned so the caller can skip the parent; anything else
+ * (malformed bodies, rate limits, aborts) still fails the sync.
+ */
+async function listParentAttachmentPage(
+  input: AttachmentRequest,
+  parent: AttachmentParent,
+  cursor: string | undefined
+): Promise<ParentAttachmentListing> {
+  const query = new URLSearchParams({ limit: String(PAGE_SIZE), status: 'current' })
+  if (cursor) query.set('cursor', cursor)
+  let response: Response
+  try {
+    response = await requestMetadata(
+      input,
+      `/api/v2/${parent.type}s/${encodeURIComponent(parent.id)}/attachments?${query}`
+    )
+  } catch (error) {
+    if (!isServerFailure(error)) throw error
+    return { ok: false, status: error.status, reason: 'attachment_listing_unavailable', error }
+  }
+  try {
+    return { ok: true, page: attachmentPageSchema.parse(await readMetadata(response)) }
+  } catch (error) {
+    const { status } = response
+    if (error instanceof ConfluenceAttachmentScopeError) {
+      return { ok: false, status, reason: 'attachment_scope_mismatch', error }
+    }
+    if (status === 403 || status === 404) {
+      return { ok: false, status, reason: 'attachment_access_denied', error }
+    }
+    if (isServerFailure(error)) {
+      return { ok: false, status, reason: 'attachment_listing_unavailable', error }
+    }
+    throw error
+  }
+}
+
 /**
  * Visits attachment metadata beneath the already-filtered parents. The cursor
  * contains only a bounded parent queue, never bodies or binary data. Parent caps
@@ -244,32 +371,39 @@ export async function listConfluenceAttachments(
 
   for (let request = 0; state.parents.length > 0 && request < REQUESTS_PER_CALL; request++) {
     const parent = state.parents[0]
-    const query = new URLSearchParams({ limit: String(PAGE_SIZE), status: 'current' })
-    if (state.attachmentCursor) query.set('cursor', state.attachmentCursor)
-    const response = await requestMetadata(
-      input,
-      `/api/v2/${parent.type}s/${encodeURIComponent(parent.id)}/attachments?${query}`
-    )
-    let page: z.infer<typeof attachmentPageSchema>
-    try {
-      page = attachmentPageSchema.parse(await readMetadata(response))
-    } catch (error) {
-      const missingScope = error instanceof ConfluenceAttachmentScopeError
-      if (!missingScope && response.status !== 403 && response.status !== 404) throw error
+    const listing = await listParentAttachmentPage(input, parent, state.attachmentCursor)
+    if (!listing.ok) {
+      const serverFailure = listing.reason === 'attachment_listing_unavailable'
+      state.serverFailureStreak = serverFailure ? (state.serverFailureStreak ?? 0) + 1 : 0
+      if (serverFailure) {
+        logger.warn('Confluence attachment listing failed after retries', {
+          parentId: parent.id,
+          parentType: parent.type,
+          status: listing.status,
+          consecutiveFailures: state.serverFailureStreak,
+          action:
+            state.serverFailureStreak >= MAX_CONSECUTIVE_SERVER_FAILURES
+              ? 'fail_sync'
+              : 'skip_parent',
+        })
+      }
+      if (state.serverFailureStreak >= MAX_CONSECUTIVE_SERVER_FAILURES) throw listing.error
       state.failures ??= { count: 0, samples: [] }
       state.failures.count += 1
       if (state.failures.samples.length < MAX_LISTING_FAILURE_SAMPLES) {
         state.failures.samples.push({
           scope: parent.id,
           operation: 'confluence.attachments.list',
-          status: response.status,
-          reasons: [missingScope ? 'attachment_scope_mismatch' : 'attachment_access_denied'],
+          status: listing.status,
+          reasons: [listing.reason],
         })
       }
       state.parents.shift()
       state.attachmentCursor = undefined
       continue
     }
+    state.serverFailureStreak = 0
+    const { page } = listing
     for (const attachment of page.results) {
       if (attachment.status !== 'current' || !attachmentMimeType(attachment)) continue
       if (!sameParent(attachmentParent(attachment), parent)) {