@@ -33,16 +33,69 @@ github:
     squash: true
     squash_commit_message: PR_TITLE_AND_COMMIT_DETAILS
     rebase: true
-  protected_branches:
-    main:
-      required_status_checks:
-        # strict means "Require branches to be up to date before merging".
-        strict: true
-
+  # Disabled: GitHub blocks ruleset bypass while classic protection exists.
+  # The "Default Branch Protection" ruleset replaces it.
+  protected_branches: ~
+  rulesets:
+    - name: "Default Branch Protection"
+      type: branch
+      branches:
+        includes:
+          - "~DEFAULT_BRANCH"
+        excludes: []
+      bypass_teams:
+        - root
+      restrict_deletion: true
+      restrict_force_push: true
+      required_linear_history: true
       required_pull_request_reviews:
         required_approving_review_count: 1
+    - name: Merge Queue
+      target: branch
+      enforcement: active
+      bypass_actors:
+        # apache/root (ASF Infra).
+        - actor_id: 118420
+          actor_type: Team
+          bypass_mode: always
+        # apache/iceberg-public. Iceberg committers can opt into this team via
+        # https://gitbox.apache.org/boxer/.
+        - actor_id: 20107235
+          actor_type: Team
+          bypass_mode: pull_request
+      conditions:
+        ref_name:
+          include:
+            - "~DEFAULT_BRANCH"
+          exclude: []
+      rules:
+        - type: required_status_checks
+          parameters:
+            # Merge Queue already tests each entry against the latest main
+            strict_required_status_checks_policy: false
+            required_status_checks:
+              # Repository policy and security checks.
+              - context: Analyze Actions
+              - context: Run zizmor 🌈
+              - context: asf-allowlist-check
+              - context: rat
 
-      required_linear_history: true
+              # Documentation checks.
+              - context: docs
+              - context: markdown-link-check
+
+              # Python workflow gates.
+              - context: python-ci-required
+              - context: python-integration-required
+        - type: merge_queue
+          parameters:
+            check_response_timeout_minutes: 180
+            grouping_strategy: ALLGREEN
+            max_entries_to_build: 2
+            max_entries_to_merge: 1
+            merge_method: SQUASH
+            min_entries_to_merge: 1
+            min_entries_to_merge_wait_minutes: 0
   pull_requests:
     # allow pull requests to merge automatically once all requirements are met
     allow_auto_merge: true
 
@@ -28,7 +28,9 @@ body:
       description: What Apache Iceberg version are you using?
       multiple: false
       options:
-        - "0.11.0 (latest release)"
+        - "0.12.0 (latest release)"
+        - "0.11.1"
+        - "0.11.0"
         - "0.10.0"
         - "0.9.1"
         - "0.9.0"
 
@@ -22,7 +22,7 @@ updates:
   - package-ecosystem: "uv"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 50
     ignore:
       - dependency-name: "datafusion"
@@ -31,7 +31,7 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     cooldown:
       default-days: 7
     groups:
@@ -41,3 +41,16 @@ updates:
       codeql-action:
         patterns:
           - "github/codeql-action*"
+  # dev/spark/Dockerfile is not listed: its base image tag comes from an ARG, which Dependabot cannot resolve
+  - package-ecosystem: "docker"
+    directory: "/dev/hive"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "docker-compose"
+    directory: "/dev"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
@@ -25,16 +25,18 @@ name: "ASF Allowlist Check"
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
+  merge_group:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   asf-allowlist-check:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-slim
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
 
@@ -20,24 +20,20 @@
 name: Check Markdown links
 
 on:
-  push:
-    paths:
-      - '.github/workflows/check-md-link.yml'
-      - 'mkdocs/**'
-    branches:
-    - 'main'
   pull_request:
-    paths:
-      - '.github/workflows/check-md-link.yml'
-      - 'mkdocs/**'
+  merge_group:
   workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   markdown-link-check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
 
@@ -24,12 +24,17 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  merge_group:
   schedule:
     - cron: '16 4 * * 1'
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     name: Analyze Actions
@@ -46,11 +51,11 @@ jobs:
         persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         languages: actions
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         category: "/language:actions"
@@ -18,16 +18,26 @@
 #
 
 name: "Run License Check"
-on: pull_request
+on:
+  pull_request:
+  merge_group:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   rat:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
+    - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+      with:
+        distribution: temurin
+        java-version: 21
     - run: dev/check-license
@@ -30,7 +30,7 @@ permissions:
 jobs:
   set-version:
     if: github.repository == 'apache/iceberg-python' || github.event_name == 'workflow_dispatch' # Run on schedule for apache repo, or on manual dispatch from any repo
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     outputs:
       VERSION: ${{ steps.set-version.outputs.VERSION }}
     steps:
@@ -44,7 +44,7 @@ jobs:
           python-version: 3.12
 
       - name: Install UV
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
       - name: Set version
         id: set-version
@@ -69,7 +69,7 @@ jobs:
     if: github.repository == 'apache/iceberg-python' # Only run for apache repo
     needs:
       - nightly-build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     environment:
       name: testpypi
       url: https://test.pypi.org/p/pyiceberg
 
@@ -36,7 +36,7 @@ jobs:
     strategy:
       max-parallel: 15
       matrix:
-        os: [ ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest ]
+        os: [ ubuntu-24.04, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest ]
         include:
           - os: windows-11-arm
             windows_archs: "ARM64"
@@ -59,7 +59,7 @@ jobs:
             3.14
 
       - name: Install UV
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
       - name: Set version with RC
         shell: bash
@@ -71,10 +71,10 @@ jobs:
       # the repository, otherwise the tests will fail
       - name: Compile source distribution
         run: uv build --sdist
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-24.04'
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074 # v4.2.0
+        uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae # v4.2.1
         with:
           output-dir: wheelhouse
           config-file: "pyproject.toml"
@@ -95,7 +95,7 @@ jobs:
 
 
       - name: Add source distribution
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-24.04'
         run: ls -lah dist/* && cp dist/* wheelhouse/
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -104,7 +104,7 @@ jobs:
           path: ./wheelhouse/*
 
   pypi-merge-artifacts:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     needs:
       - pypi-build-artifacts
     steps:
 
@@ -20,18 +20,16 @@
 name: "Python CI Docs"
 
 on:
-  push:
-    branches:
-      - 'main'
   pull_request:
+  merge_group:
 
 permissions:
   contents: read
 
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: true
 
 jobs:
   docs:
@@ -45,8 +43,6 @@ jobs:
         with:
           python-version: 3.12
       - name: Install UV
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       - name: Build docs
         run: make docs-build
-      - name: Run linters
-        run: make lint