diff --git a/.bazelrc b/.bazelrc
index 2a35375ed..7452c4571 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -72,6 +72,8 @@ build:x86_64-linux --extra_toolchains=@score_toolchains_rust//toolchains/ferroce
 
 test:x86_64-linux --//config:integration_mode=docker
 test:x86_64-linux --//config:unit_mode=host
+# Show a failing test's log (incl. the crash-dump banner) in the console.
+test:x86_64-linux --test_output=errors
 
 # Target configuration for CPU:AArch64|OS:Linux build (do not use it in case of system toolchains!)
 build:arm64-linux --config=stub
@@ -181,3 +183,11 @@ test:tsan --test_tag_filters=-no-tsan
 test:tsan --build_tests_only
 test:tsan --cxxopt=-Wno-maybe-uninitialized
 test:tsan --cxxopt=-Wno-redundant-move
+
+# Core-dump capture — opt in with --config=core_dump. The env var gates the
+# plugin at runtime; the build flag selects the gdb-equipped debug image so cores
+# can be analysed in-container and a backtrace is auto-captured. -c dbg is implied
+# so the auto-captured backtrace carries file/line symbols.
+build:core_dump --compilation_mode=dbg
+test:core_dump --test_env=SCORE_ENABLE_CORE_DUMP=1
+test:core_dump --//config:core_dump=True
diff --git a/.gitignore b/.gitignore
index f3a58c2f5..5f3da465e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,6 +71,10 @@ target/
 tests/**/*.html
 tests/**/*.xml
 
+# Backup of the kernel core_pattern saved by the integration test core-dump
+# capture (--config=core_dump); auto-removed after restore
+/.original_core_pattern
+
 # IDE Code files
 *.orig
 .venv_docs
diff --git a/MODULE.bazel b/MODULE.bazel
index 44cb0f648..7a42c2ecf 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -19,6 +19,7 @@ bazel_dep(name = "rules_python", version = "1.8.5")
 bazel_dep(name = "rules_rust", version = "0.68.2-score")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "rules_oci", version = "2.3.0")
+bazel_dep(name = "rules_distroless", version = "0.8.0")
 bazel_dep(name = "rules_shell", version = "0.6.1")
 bazel_dep(name = "aspect_rules_lint", version = "2.3.0")
 bazel_dep(name = "buildifier_prebuilt", version = "8.5.1")
@@ -175,6 +176,20 @@ oci.pull(
 )
 use_repo(oci, "debian-test-runtime", "debian-test-runtime_linux_amd64")
 
+# gdb (+ dependency closure) layered onto the debug test image; see
+# tests/utils/environments/x86_64-linux/gdb_apt.yaml. Regenerate the lockfile
+# with: bazel run @gdb_apt//:lock
+apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
+apt.install(
+    name = "gdb_apt",
+    lock = "//tests/utils/environments/x86_64-linux:gdb_apt.lock.json",
+    manifest = "//tests/utils/environments/x86_64-linux:gdb_apt.yaml",
+    # Normalize to a merged-usr layout so the layer does not clobber the base
+    # image's /bin, /lib, ... usr-merge symlinks (which would break /bin/sh).
+    mergedusr = True,
+)
+use_repo(apt, "gdb_apt")
+
 bazel_dep(name = "score_baselibs", version = "0.2.10")
 
 # Hedron's Compile Commands Extractor for Bazel
diff --git a/config/BUILD b/config/BUILD
index 1b432cad5..4d3e19721 100644
--- a/config/BUILD
+++ b/config/BUILD
@@ -50,6 +50,29 @@ config_setting(
     },
 )
 
+# Opt in with --config=core_dump: selects the gdb-equipped debug test image so
+# core dumps can be analysed in-container (see .bazelrc, tests/integration/readme.md).
+bool_flag(
+    name = "core_dump",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "core_dump_enabled",
+    flag_values = {
+        ":core_dump": "True",
+    },
+)
+
+# Specialization of :integration_docker; select() prefers it when both match.
+config_setting(
+    name = "integration_docker_core_dump",
+    flag_values = {
+        ":integration_mode": "docker",
+        ":core_dump": "True",
+    },
+)
+
 # How to run unit tests:
 #
 # - qemu: in a QEMU virtual machine
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/graph.cpp b/score/launch_manager/src/daemon/src/process_group_manager/details/graph.cpp
index c503c84ef..abfa8920c 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/graph.cpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/graph.cpp
@@ -14,6 +14,8 @@
 #include <ctime>
 
 #include <score/span.hpp>
+#include <algorithm>
+#include <chrono>
 #include <functional>
 #include <type_traits>
 #include <variant>
@@ -542,6 +544,23 @@ void Graph::forceKillProcesses()
     }
 }
 
+std::chrono::milliseconds Graph::getMaxTerminationTimeout()
+{
+    std::chrono::milliseconds max_timeout{0};
+    for (const auto& component : nodes_)
+    {
+        if (const ProcessInfoNode* process = std::get_if<ProcessInfoNode>(&component))
+        {
+            // Only processes with a live OS process still to stop count
+            if (process->getPid() > 0 && process->getState() < ProcessState::kTerminated)
+            {
+                max_timeout = std::max(max_timeout, process->getTerminationTimeout());
+            }
+        }
+    }
+    return max_timeout;
+}
+
 void Graph::updateCancelMessage()
 {
     ControlClientCode code = getPendingEvent();
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/graph.hpp b/score/launch_manager/src/daemon/src/process_group_manager/details/graph.hpp
index ba383ed08..4849623d4 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/graph.hpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/graph.hpp
@@ -288,6 +288,10 @@ class Graph final
     /// @brief For forced shutdown, kill all leftover processes
     void forceKillProcesses();
 
+    /// @brief Returns the largest configured shutdown_timeout across all running processes
+    /// @return The timeout in milliseconds, or zero if there are no live processes to stop.
+    std::chrono::milliseconds getMaxTerminationTimeout();
+
   private:
     /// @brief Helper function to identify a node with ready state "Terminated" from the legacy configuration
     bool nodeHasTerminatedDeps(IdentifierHash pg_name, uint32_t node_index);
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/graph_UT.cpp b/score/launch_manager/src/daemon/src/process_group_manager/details/graph_UT.cpp
index 2f4181357..5391b4a73 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/graph_UT.cpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/graph_UT.cpp
@@ -607,4 +607,65 @@ TEST_F(GraphUtilitiesTest, gettersSetters)
     EXPECT_LE(graph_time, after_time);
 }
 
+class GraphMaxTerminationTimeoutTest : public GraphTest
+{
+  protected:
+    uint32_t SetConfig() override
+    {
+        auto procs = generateProcessComponents(3);
+        auto count = procs.size();
+        procs[0].deployment_config.shutdown_timeout_ms = 1500;
+        procs[0].component_properties.application_profile.is_self_terminating = true;
+        procs[1].deployment_config.shutdown_timeout_ms = 500;
+        procs[2].deployment_config.shutdown_timeout_ms = 5000;
+        auto rts = generateRunTargets(2);
+        rts[1].depends_on = {procs[0].name, procs[1].name};
+        rts[2].depends_on = {procs[2].name};
+        const auto config = ConfigBuilder{}
+                                .setComponents(std::move(procs))
+                                .setRunTargets(std::move(rts))
+                                .setInitialRunTarget("Startup")
+                                .setFallbackRunTarget(std::move(fallback))
+                                .build();
+        config_.initialize(config);
+
+        return count;
+    }
+};
+
+TEST_F(GraphMaxTerminationTimeoutTest, ignoresNodesWithoutLiveProcess)
+{
+    RecordProperty(
+        "Description",
+        "Test that getMaxTerminationTimeout returns the max shutdown_timeout over running processes and ignores "
+        "never-started (pid == 0) nodes");
+
+    // No process started yet, so there is nothing to wait on.
+    EXPECT_EQ(graph_.getMaxTerminationTimeout(), 0ms);
+
+    // Bring up RunTarget0 (proc0 + proc1); proc2, with the largest timeout, stays idle in RunTarget1.
+    completeTransition(state_name(run_target_name(0)));
+
+    // Max over the two live processes; proc2's 5000 ms is ignored because it never started.
+    EXPECT_EQ(graph_.getMaxTerminationTimeout(), 1500ms);
+}
+
+TEST_F(GraphMaxTerminationTimeoutTest, ignoresTerminatedProcesses)
+{
+    RecordProperty(
+        "Description",
+        "Test that getMaxTerminationTimeout ignores processes that have already terminated, even if they carry the "
+        "largest shutdown_timeout");
+
+    completeTransition(state_name(run_target_name(0)));
+    ASSERT_EQ(graph_.getMaxTerminationTimeout(), 1500ms);
+
+    // proc0 is a self-terminating one-shot with the largest timeout; it exits on its own
+    // (status 0) and stays kTerminated, so it no longer needs to be waited on at shutdown.
+    static_cast<void>(graph_.getProcessInfoNode(0)->tryHandleTermination(0));
+
+    // Only proc1 remains live, so its timeout bounds the wait.
+    EXPECT_EQ(graph_.getMaxTerminationTimeout(), 500ms);
+}
+
 }  // namespace score::mw::lifecycle::internal
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.cpp b/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.cpp
index 806a11d9c..01fd8f347 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.cpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.cpp
@@ -432,6 +432,11 @@ score::mw::lifecycle::ProcessState ProcessInfoNode::getState() const
     return process_state_.load();
 }
 
+std::chrono::milliseconds ProcessInfoNode::getTerminationTimeout() const
+{
+    return config_ != nullptr ? config_->pgm_config_.termination_timeout_ms_ : std::chrono::milliseconds{0};
+}
+
 uint32_t ProcessInfoNode::getIndex() const
 {
     return process_index_;
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.hpp b/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.hpp
index 8310330a8..237b4e0b1 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.hpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.hpp
@@ -21,6 +21,7 @@
 #include "score/mw/launch_manager/supervision_control_client/isupervision_event_publisher.hpp"
 #include <score/stop_token.hpp>
 #include <atomic>
+#include <chrono>
 
 namespace score::mw::lifecycle::internal
 {
@@ -99,6 +100,9 @@ class ProcessInfoNode final : public IComponent
     /// @return The current state of this process.
     score::mw::lifecycle::ProcessState getState() const;
 
+    /// @return The configured shutdown_timeout for this process, or zero
+    std::chrono::milliseconds getTerminationTimeout() const;
+
     /// @return The ControlClientChannel for this process, or nullptr if none exists.
     ControlClientChannelP getControlClientChannel() const;
 
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.cpp b/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.cpp
index 358fa9e11..6caaabb92 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.cpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.cpp
@@ -153,10 +153,17 @@ void ProcessGroupManager::deinitialize()
     process_monitor_.reset();
     alive_monitor_thread_->stop();
     configuration_.deinitialize();
-    process_groups_.clear();
 
+    // Stop and join the worker threads BEFORE destroying the process groups.
+    // Worker threads run ProcessInfoNode::doWork(), which dereferences its Graph
+    // (nodeExecuted(), getState(), ...) via a raw back-pointer. If a transition is
+    // still completing on a worker thread (e.g. an in-progress switch to Off that
+    // is allowed to continue during shutdown), destroying the graphs first would be
+    // a use-after-free.
     thread_pool_.reset();
     worker_jobs_.reset();
+
+    process_groups_.clear();
     process_map_.reset();
 }
 
@@ -237,14 +244,16 @@ bool ProcessGroupManager::initializeProcessGroups()
             const auto* states = configuration_.getListOfProcessGroupStates(pg_name).value_or(nullptr);
             const uint32_t num_run_targets = states ? static_cast<uint32_t>(states->size()) : 0U;
 
-            process_groups_.push_back(std::make_shared<Graph>(
-                num_processes + num_run_targets,
-                &configuration_,
-                worker_jobs_,
-                &process_interface_,
-                process_map_,
-                *supervision_control_notifier_.get(),
-                this));
+            process_groups_.push_back(
+
+                std::make_shared<Graph>(
+                    num_processes + num_run_targets,
+                    &configuration_,
+                    worker_jobs_,
+                    &process_interface_,
+                    process_map_,
+                    *supervision_control_notifier_.get(),
+                    this));
         }
     }
     else
@@ -321,6 +330,7 @@ bool ProcessGroupManager::run()
     bool overflow_logged = false;
 
     if (result)
+    {
         while (!em_cancelled.load())
         {
             // Wait for something to happen...
@@ -350,6 +360,8 @@ bool ProcessGroupManager::run()
 
             watchdog_->serviceWatchdog();
         }
+        LM_LOG_INFO() << "ProcessGroupManager::run() - received SIGTERM, exiting";
+    }
 
     allProcessGroupsOff();
 
@@ -457,8 +469,15 @@ void ProcessGroupManager::allProcessGroupsOff()
     }
 
     LM_LOG_DEBUG() << "Wait for all process groups to complete the transition";
-    if (!waitForStateCompletion(GraphState::kInTransition, 1000))
+
+    // Bound the whole transition-to-Off wait by the slowest still-running process's
+    // shutdown_timeout (plus the SIGKILL grace), so every component's configured
+    // timeout is honoured. Processes deactivate in parallel.
+    const auto off_transition_timeout = graph.getMaxTerminationTimeout() + kMaxSigKillDelay;
+    if (!waitForStateCompletion(GraphState::kInTransition, static_cast<int32_t>(off_transition_timeout.count())))
     {
+        // Last resort: a process ignored even SIGKILL within its budget. Force-kill
+        // whatever is left and tear down the worker pool so shutdown can still proceed.
         LM_LOG_ERROR() << "NOTE: Transition to Off state timed out";
         thread_pool_->stop();
 
@@ -466,6 +485,8 @@ void ProcessGroupManager::allProcessGroupsOff()
         {
             pg->forceKillProcesses();
         }
+
+        thread_pool_.reset();
     }
 }
 
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.hpp b/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.hpp
index fdb998869..33cde73da 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.hpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.hpp
@@ -259,7 +259,8 @@ class ProcessGroupManager final : public ITransitionResultPublisher
     /// @brief Send all process groups to the "Off" state
     /// @details cancel any Graph for a process group not in the "Off" state, wait for up to 2 seconds for all graphs
     /// to be no longer in the `kCancelled` state, start a transition of remaining process groups to "Off" state,
-    /// and finally wait for up to a second for all graphs to complete.
+    /// and finally wait for all graphs to complete. The final wait is bounded by the largest configured per-process
+    /// shutdown_timeout (plus the SIGKILL grace) so each component's individual shutdown_timeout is respected.
     /// @warning Side effect: Depending if it is needed to forcefully terminate processes, worker jobs might be stopped
     /// after this call
     void allProcessGroupsOff();
diff --git a/tests/integration/lm_shutdown_during_rt_switch/BUILD b/tests/integration/lm_shutdown_during_rt_switch/BUILD
new file mode 100644
index 000000000..d5b2c0d52
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/BUILD
@@ -0,0 +1,56 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("//tests/utils/bazel:integration.bzl", "integration_test")
+
+cc_library(
+    name = "lm_shutdown_common",
+    hdrs = ["common.hpp"],
+)
+
+cc_binary(
+    name = "control_client_test_driver",
+    srcs = ["control_client_test_driver.cpp"],
+    deps = [
+        ":lm_shutdown_common",
+        "//score/launch_manager:control_cc",
+        "//score/launch_manager:lifecycle_cc",
+        "//tests/utils/test_helper",
+        "@googletest//:gtest_main",
+    ],
+)
+
+cc_binary(
+    name = "component_c",
+    srcs = ["component_c.cpp"],
+    deps = [
+        ":lm_shutdown_common",
+        "//score/launch_manager:lifecycle_cc",
+        "//tests/utils/test_helper",
+        "@googletest//:gtest_main",
+    ],
+)
+
+integration_test(
+    name = "lm_shutdown_during_rt_switch",
+    timeout = "short",
+    srcs = ["lm_shutdown_during_rt_switch.py"],
+    binaries = [
+        "//tests/utils/test_helper:process_hanging_on_sigterm",
+        ":component_c",
+        ":control_client_test_driver",
+        "//score/launch_manager",
+    ],
+    config = ":lm_shutdown_during_rt_switch.json",
+)
diff --git a/tests/integration/lm_shutdown_during_rt_switch/common.hpp b/tests/integration/lm_shutdown_during_rt_switch/common.hpp
new file mode 100644
index 000000000..4e45fe3dd
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/common.hpp
@@ -0,0 +1,34 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+
+#ifndef SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_COMMON_HPP
+#define SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_COMMON_HPP
+
+#include <string_view>
+
+/// @brief Written by component_a when it has reported running (run_target_a is
+/// active).
+constexpr std::string_view a_started = "component_a_started";
+
+/// @brief Written by component_a when it starts being terminated (i.e. the
+/// switch away from run_target_a has begun). component_a then stalls, which
+/// keeps the run-target switch in progress and gives the test a deterministic
+/// window in which to send SIGTERM to the launch manager.
+constexpr std::string_view a_terminating = "component_a_terminating";
+
+/// @brief Written by component_c when it starts. component_c belongs only to
+/// run_target_c, so this file must NEVER appear: a SIGTERM to the launch manager
+/// during the switch must cancel the pending activation of run_target_c.
+constexpr std::string_view c_started = "component_c_started";
+
+#endif  // SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_COMMON_HPP
diff --git a/tests/integration/lm_shutdown_during_rt_switch/component_c.cpp b/tests/integration/lm_shutdown_during_rt_switch/component_c.cpp
new file mode 100644
index 000000000..299ef0385
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/component_c.cpp
@@ -0,0 +1,46 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+#include <gtest/gtest.h>
+#include <unistd.h>
+
+#include "common.hpp"
+#include "tests/utils/test_helper/test_helper.hpp"
+#include <score/mw/lifecycle/report_running.h>
+
+// component_c belongs only to run_target_c. Because the switch to run_target_c
+// must be cancelled by the SIGTERM sent to the launch manager, this process must
+// never be launched. Should it ever start, it records `c_started`, which makes
+// both the control client and the Python-side assertions fail.
+TEST(LmShutdownDuringRtSwitch, ComponentC)
+{
+    TEST_STEP("Report running")
+    {
+        // This code should be never executed. In Python code there is also an assertion
+        // that component_c must not be started (i.e. c_started should not exist).
+        // This is a second line of defense in case the Python code is not executed or fails to detect the problem.
+        ADD_FAILURE() << "component_c must never be started";
+
+        EXPECT_TRUE(touch_file(c_started));
+        score::mw::lifecycle::report_running();
+    }
+
+    while (!TestRunner::exitRequested)
+    {
+        pause();
+    }
+}
+
+int main()
+{
+    return TestRunner(__FILE__).RunTests();
+}
diff --git a/tests/integration/lm_shutdown_during_rt_switch/control_client_test_driver.cpp b/tests/integration/lm_shutdown_during_rt_switch/control_client_test_driver.cpp
new file mode 100644
index 000000000..e3c2b8207
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/control_client_test_driver.cpp
@@ -0,0 +1,76 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+#include <gtest/gtest.h>
+#include <unistd.h>
+#include <filesystem>
+
+#include "common.hpp"
+#include "tests/utils/test_helper/test_helper.hpp"
+#include <score/mw/lifecycle/control_client.h>
+#include <score/mw/lifecycle/report_running.h>
+
+// The Launch Manager shall exit after performing a shutdown - stopping all the
+// processes it owns in dependency order - when requested (i.e. when it receives
+// a SIGTERM). A shutdown request takes priority over an in-progress run-target
+// switch, which must therefore be cancelled.
+//
+// This control client activates run_target_a and then requests a switch to
+// run_target_c. component_a (only part of run_target_a) stalls while it is being
+// terminated during that switch, so the switch is still in progress when the
+// test sends a SIGTERM to the launch manager from the Python side. The launch
+// manager must then cancel the pending switch (component_c, only part of
+// run_target_c, must never start) and shut everything down.
+TEST(LmShutdownDuringRtSwitch, ControlClient)
+{
+    score::mw::lifecycle::ControlClient client{};
+    ASSERT_TRUE(check_clean({test_end_location, a_started, a_terminating, c_started}));
+
+    TEST_STEP("Report running")
+    {
+        score::mw::lifecycle::report_running();
+    }
+
+    TEST_STEP("Activate run_target_a")
+    {
+        score::cpp::stop_token stop_token;
+        auto result = client.ActivateRunTarget("run_target_a").Get(stop_token);
+        EXPECT_TRUE(result.has_value()) << "Activating run_target_a failed: " << result.error().Message();
+        EXPECT_TRUE(std::filesystem::exists(a_started)) << "component_a was not started";
+    }
+
+    TEST_STEP("Request switch to run_target_c")
+    {
+        // Fire-and-forget: this transition is expected to be cancelled by an
+        // external SIGTERM to the launch manager, so we must not wait for a
+        // result. The launch manager will shut this process down instead of ever
+        // completing the switch.
+        client.ActivateRunTarget("run_target_c");
+    }
+
+    // Block until the launch manager terminates us as part of its own shutdown.
+    while (!TestRunner::exitRequested)
+    {
+        pause();
+    }
+
+    TEST_STEP("Verify run_target_c was never activated")
+    {
+        EXPECT_FALSE(std::filesystem::exists(c_started))
+            << "run_target_c must not be activated: a SIGTERM to the launch manager must cancel the pending switch";
+    }
+}
+
+int main()
+{
+    return TestRunner(__FILE__, TerminationBehavior::kWait, TerminationNotification::kTestEnd).RunTests();
+}
diff --git a/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.json b/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.json
new file mode 100644
index 000000000..9376cba98
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.json
@@ -0,0 +1,114 @@
+{
+    "schema_version": 1,
+    "defaults": {
+        "deployment_config": {
+            "bin_dir": "/tmp/tests/lm_shutdown_during_rt_switch",
+            "ready_timeout": 1.0,
+            "shutdown_timeout": 1.0,
+            "ready_recovery_action": {
+                "restart": {
+                    "number_of_attempts": 0
+                }
+            },
+            "recovery_action": {
+                "switch_run_target": {
+                    "run_target": "fallback_run_target"
+                }
+            },
+            "environmental_variables": {
+                "LD_LIBRARY_PATH": "/opt/lib"
+            },
+            "sandbox": {
+                "uid": 0,
+                "gid": 0,
+                "scheduling_policy": "SCHED_OTHER",
+                "scheduling_priority": 0
+            }
+        },
+        "component_properties": {
+            "application_profile": {
+                "application_type": "Reporting",
+                "is_self_terminating": false,
+                "alive_supervision": {
+                    "reporting_cycle": 0.1,
+                    "min_indications": 1,
+                    "max_indications": 3,
+                    "failed_cycles_tolerance": 1
+                }
+            },
+            "ready_condition": {
+                "process_state": "Running"
+            }
+        }
+    },
+    "components": {
+        "component_initial": {
+            "component_properties": {
+                "binary_name": "control_client_test_driver",
+                "application_profile": {
+                    "application_type": "State_Manager",
+                    "alive_supervision": {
+                        "min_indications": 0
+                    }
+                }
+            },
+            "deployment_config": {
+                "ready_timeout": 1.0,
+                "shutdown_timeout": 1.0,
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "control_client_test_driver"
+                }
+            }
+        },
+        "component_a": {
+            "component_properties": {
+                "binary_name": "process_hanging_on_sigterm"
+            },
+            "deployment_config": {
+                "shutdown_timeout": 5.0,
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "component_a"
+                }
+            }
+        },
+        "component_c": {
+            "component_properties": {
+                "binary_name": "component_c"
+            },
+            "deployment_config": {
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "component_c"
+                }
+            }
+        }
+    },
+    "run_targets": {
+        "Startup": {
+            "depends_on": [
+                "component_initial"
+            ]
+        },
+        "run_target_a": {
+            "depends_on": [
+                "component_initial",
+                "component_a"
+            ]
+        },
+        "run_target_c": {
+            "depends_on": [
+                "component_initial",
+                "component_c"
+            ]
+        },
+        "Off": {
+            "depends_on": []
+        }
+    },
+    "initial_run_target": "Startup",
+    "alive_supervision": {
+        "evaluation_cycle": 0.05
+    },
+    "fallback_run_target": {
+        "depends_on": []
+    }
+}
diff --git a/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.py b/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.py
new file mode 100644
index 000000000..52cd0141d
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.py
@@ -0,0 +1,62 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+from tests.utils.testing_utils.run_until_file_deployed import run_until_file_deployed
+from tests.utils.testing_utils.setup_test import setup_test
+from tests.utils.testing_utils.test_results import assert_test_results
+from attribute_plugin import add_test_properties
+
+
+@add_test_properties(
+    fully_verifies=[],
+    partially_verifies=[
+        "comp_req__launch_man__launcher_exit_shutdown",
+    ],
+    test_type="requirements-based",
+    derivation_technique="requirements-analysis",
+)
+def test_lm_shutdown(target, setup_test, assert_test_results, remote_test_dir):
+    """
+    Objective: Verifies that the Launch Manager exits after performing a shutdown
+    (stopping all processes it owns) when requested via SIGTERM, and that this
+    shutdown takes priority over an in-progress run-target switch (the switch is
+    cancelled).
+
+    The control client activates run_target_a and then requests a switch to
+    run_target_c. component_a (only part of run_target_a) stalls while it is being
+    terminated during the switch, keeping the switch in progress. That window is
+    signalled by the file `component_a_terminating`, at which point the launch
+    manager is sent a SIGTERM.
+
+    Expected Behaviour: The launch manager cancels the pending switch - so
+    component_c (only part of run_target_c) is never started - stops all the
+    processes it owns, and exits cleanly.
+    """
+
+    new_config_path = str(remote_test_dir / "etc/lm_shutdown_during_rt_switch.bin")
+    a_terminating = remote_test_dir / "component_a_terminating"
+
+    # Run until `component_a_terminating` is deployed so we can request shutdown during
+    # the transition to run target c
+    run_until_file_deployed(
+        target=target,
+        binary_path=str(remote_test_dir / "launch_manager"),
+        file_path=a_terminating,
+        cwd=str(remote_test_dir),
+        args=["-c", new_config_path],
+        timeout_s=10.0,
+    )
+
+    # component_c never runs (the pending switch was cancelled), so it produces no XML
+    # result; component_a and the control client shut down gracefully. The control
+    # client additionally asserts that run_target_c was never activated.
+    assert_test_results({"control_client_test_driver.xml", "component_a.xml"})
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/BUILD b/tests/integration/lm_shutdown_during_switch_to_off/BUILD
new file mode 100644
index 000000000..88512b86c
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/BUILD
@@ -0,0 +1,44 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("//tests/utils/bazel:integration.bzl", "integration_test")
+
+cc_library(
+    name = "lm_shutdown_common",
+    hdrs = ["common.hpp"],
+)
+
+cc_binary(
+    name = "control_client_test_driver",
+    srcs = ["control_client_test_driver.cpp"],
+    deps = [
+        ":lm_shutdown_common",
+        "//score/launch_manager:control_cc",
+        "//score/launch_manager:lifecycle_cc",
+        "//tests/utils/test_helper",
+        "@googletest//:gtest_main",
+    ],
+)
+
+integration_test(
+    name = "lm_shutdown_during_switch_to_off",
+    timeout = "short",
+    srcs = ["lm_shutdown_during_switch_to_off.py"],
+    binaries = [
+        "//tests/utils/test_helper:process_hanging_on_sigterm",
+        ":control_client_test_driver",
+        "//score/launch_manager",
+    ],
+    config = ":lm_shutdown_during_switch_to_off.json",
+)
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/common.hpp b/tests/integration/lm_shutdown_during_switch_to_off/common.hpp
new file mode 100644
index 000000000..f3b5eb946
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/common.hpp
@@ -0,0 +1,30 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+
+#ifndef SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_DURING_SWITCH_TO_OFF_COMMON_HPP
+#define SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_DURING_SWITCH_TO_OFF_COMMON_HPP
+
+#include <string_view>
+
+/// @brief Written by component_a when it has reported running (run_target_a is
+/// active).
+constexpr std::string_view a_started = "component_a_started";
+
+/// @brief Written by component_a when it starts being terminated (i.e. the
+/// switch away from run_target_a - here, the switch to the "Off" run target -
+/// has begun). component_a then stalls, which keeps the run-target switch in
+/// progress and gives the test a deterministic window in which to send SIGTERM
+/// to the launch manager.
+constexpr std::string_view a_terminating = "component_a_terminating";
+
+#endif  // SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_DURING_SWITCH_TO_OFF_COMMON_HPP
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/control_client_test_driver.cpp b/tests/integration/lm_shutdown_during_switch_to_off/control_client_test_driver.cpp
new file mode 100644
index 000000000..9a8187e62
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/control_client_test_driver.cpp
@@ -0,0 +1,76 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+#include <gtest/gtest.h>
+#include <unistd.h>
+#include <filesystem>
+
+#include "common.hpp"
+#include "tests/utils/test_helper/test_helper.hpp"
+#include <score/mw/lifecycle/control_client.h>
+#include <score/mw/lifecycle/report_running.h>
+
+// The Launch Manager shall exit after performing a shutdown - stopping all the
+// processes it owns in dependency order - when requested (i.e. when it receives
+// a SIGTERM).
+//
+// This variant differs from lm_shutdown_during_rt_switch: instead of switching
+// to another (non-Off) run target, the control client explicitly switches to
+// the "Off" run target. component_a (part of run_target_a) stalls while it is
+// being terminated during that switch, so the switch to Off is still in progress
+// when the test sends a SIGTERM to the launch manager from the Python side.
+//
+// Because the process group is ALREADY heading to Off, the SIGTERM-triggered
+// shutdown must simply let that in-progress switch to Off continue to completion
+// - it must NOT cancel the explicit switch to Off and redo it. Either way the
+// launch manager must end up stopping everything it owns and exit cleanly.
+TEST(LmShutdownDuringSwitchToOff, ControlClient)
+{
+    score::mw::lifecycle::ControlClient client{};
+    ASSERT_TRUE(check_clean({test_end_location, a_started, a_terminating}));
+
+    const auto pid = getpid();
+    const std::string step_msg = "Report running with pid == " + std::to_string(pid);
+
+    TEST_STEP(step_msg)
+    {
+        score::mw::lifecycle::report_running();
+    }
+
+    TEST_STEP("Activate run_target_a")
+    {
+        score::cpp::stop_token stop_token;
+        auto result = client.ActivateRunTarget("run_target_a").Get(stop_token);
+        EXPECT_TRUE(result.has_value()) << "Activating run_target_a failed: " << result.error().Message();
+        EXPECT_TRUE(std::filesystem::exists(a_started)) << "component_a was not started";
+    }
+
+    TEST_STEP("Request switch to Off")
+    {
+        // Fire-and-forget: switching to the "Off" run target terminates this
+        // control client too (it is not part of "Off"), so we must not wait for a
+        // result. The launch manager will shut this process down as part of the
+        // switch to Off.
+        client.ActivateRunTarget("Off");
+    }
+
+    // Block until the launch manager terminates us as part of its own shutdown.
+    while (!TestRunner::exitRequested)
+    {
+        pause();
+    }
+}
+
+int main()
+{
+    return TestRunner(__FILE__, TerminationBehavior::kContinue, TerminationNotification::kTestEnd).RunTests();
+}
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.json b/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.json
new file mode 100644
index 000000000..ac67c6af7
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.json
@@ -0,0 +1,98 @@
+{
+    "schema_version": 1,
+    "defaults": {
+        "deployment_config": {
+            "bin_dir": "/tmp/tests/lm_shutdown_during_switch_to_off",
+            "ready_timeout": 1.0,
+            "shutdown_timeout": 1.0,
+            "ready_recovery_action": {
+                "restart": {
+                    "number_of_attempts": 0
+                }
+            },
+            "recovery_action": {
+                "switch_run_target": {
+                    "run_target": "fallback_run_target"
+                }
+            },
+            "environmental_variables": {
+                "LD_LIBRARY_PATH": "/opt/lib"
+            },
+            "sandbox": {
+                "uid": 0,
+                "gid": 0,
+                "scheduling_policy": "SCHED_OTHER",
+                "scheduling_priority": 0
+            }
+        },
+        "component_properties": {
+            "application_profile": {
+                "application_type": "Reporting",
+                "is_self_terminating": false,
+                "alive_supervision": {
+                    "reporting_cycle": 0.1,
+                    "min_indications": 1,
+                    "max_indications": 3,
+                    "failed_cycles_tolerance": 1
+                }
+            },
+            "ready_condition": {
+                "process_state": "Running"
+            }
+        }
+    },
+    "components": {
+        "component_initial": {
+            "component_properties": {
+                "binary_name": "control_client_test_driver",
+                "application_profile": {
+                    "application_type": "State_Manager",
+                    "alive_supervision": {
+                        "min_indications": 0
+                    }
+                }
+            },
+            "deployment_config": {
+                "ready_timeout": 1.0,
+                "shutdown_timeout": 5.0,
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "control_client_test_driver"
+                }
+            }
+        },
+        "component_a": {
+            "component_properties": {
+                "binary_name": "process_hanging_on_sigterm"
+            },
+            "deployment_config": {
+                "shutdown_timeout": 5.0,
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "component_a"
+                }
+            }
+        }
+    },
+    "run_targets": {
+        "Startup": {
+            "depends_on": [
+                "component_initial"
+            ]
+        },
+        "run_target_a": {
+            "depends_on": [
+                "component_initial",
+                "component_a"
+            ]
+        },
+        "Off": {
+            "depends_on": []
+        }
+    },
+    "initial_run_target": "Startup",
+    "alive_supervision": {
+        "evaluation_cycle": 0.05
+    },
+    "fallback_run_target": {
+        "depends_on": []
+    }
+}
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.py b/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.py
new file mode 100644
index 000000000..a35641533
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.py
@@ -0,0 +1,64 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+from tests.utils.testing_utils.run_until_file_deployed import run_until_file_deployed
+from tests.utils.testing_utils.setup_test import setup_test
+from tests.utils.testing_utils.test_results import assert_test_results
+from attribute_plugin import add_test_properties
+
+
+@add_test_properties(
+    fully_verifies=[],
+    partially_verifies=[
+        "comp_req__launch_man__launcher_exit_shutdown",
+    ],
+    test_type="requirements-based",
+    derivation_technique="requirements-analysis",
+)
+def test_lm_shutdown(target, setup_test, assert_test_results, remote_test_dir):
+    """
+    Objective: Verifies that the Launch Manager exits after performing a shutdown
+    (stopping all processes it owns) when a SIGTERM arrives while an explicit switch
+    to the "Off" run target is already in progress.
+
+    The control client activates run_target_a and then explicitly requests a switch
+    to the "Off" run target. component_a (part of run_target_a) stalls while it is
+    being terminated during that switch, keeping the switch to Off in progress. That
+    window is signalled by the file `component_a_terminating`, at which point the
+    launch manager is sent a SIGTERM.
+
+    Expected Behaviour: The launch manager lets the in-progress switch to Off
+    continue, stops all the processes it owns, and exits cleanly. It honours each
+    component's shutdown_timeout, so component_a - which stalls for less than its
+    shutdown_timeout - exits gracefully (producing its XML result) rather than being
+    force-terminated.
+    """
+
+    new_config_path = str(remote_test_dir / "etc/lm_shutdown_during_switch_to_off.bin")
+    a_terminating = remote_test_dir / "component_a_terminating"
+
+    # Run until `component_a_terminating` is deployed so we can send SIGTERM
+    # to launch manager during the transition to Off
+    run_until_file_deployed(
+        target=target,
+        binary_path=str(remote_test_dir / "launch_manager"),
+        file_path=a_terminating,
+        cwd=str(remote_test_dir),
+        args=["-c", new_config_path],
+        timeout_s=10.0,
+    )
+
+    # Both processes are stopped gracefully as part of the switch to Off and produce
+    # their XML results: the control client is terminated when the switch to Off
+    # begins, and component_a exits within its shutdown_timeout (which the launch
+    # manager honours) instead of being force-terminated.
+    assert_test_results({"control_client_test_driver.xml", "component_a.xml"})
diff --git a/tests/integration/readme.md b/tests/integration/readme.md
index 92d514dd3..2521ec3d2 100644
--- a/tests/integration/readme.md
+++ b/tests/integration/readme.md
@@ -23,3 +23,121 @@ Currently the following configs are supported:
 - `host`
 - `x86_64-linux`
 
+## Crash dumps (core dumps)
+
+Core-dump capture is **opt-in**: add `--config=core_dump` to include the support. **Attention: This influences the kernel `core_pattern` value of your host system!**
+
+
+How it works:
+- `--config=core_dump` forwards `SCORE_ENABLE_CORE_DUMP=1` into the test
+  environment and sets the `//config:core_dump` build flag (see `.bazelrc`); the
+  shared pytest plugin keys off the env var, individual tests need no adaptions.
+- The build flag selects a **debug image variant** (`score_itf_examples_debug`,
+  the normal image plus `gdb`) so cores can be analysed inside the container.
+  Normal runs keep the slim `score_itf_examples` image, unchanged.
+- The sandbox container runs privileged with an unlimited core-file `ulimit` and
+  a read-write bind-mount of the workspace root.
+- A shared fixture sets the kernel `core_pattern` to a sandbox-local path
+  (`/tmp/score_cores/core.%e.%p.%s.%t`). On teardown it symbolizes each core
+  **inside the container** (where the binary and matching libraries live) into a
+  `<core>.bt.txt` backtrace, copies the cores and backtraces into the Bazel test
+  outputs, and restores the original `core_pattern`.
+- Before changing `core_pattern`, the fixture mirrors the original value to
+  `.original_core_pattern` in the workspace root. The sandboxed test process sees
+  the source tree read-only, so this file is written from inside the privileged
+  container via the workspace bind-mount (hence it is root-owned). It is removed
+  again once the value is restored, so it exists only if a run is force-killed.
+
+Further technical limitations are described in [Important: the `core_pattern` is a global kernel setting](#important-the-core_pattern-is-a-global-kernel-setting)
+
+### Getting a crash dump
+
+Run the (crashing) test with `--config=core_dump`, disabling the cache so it
+actually executes:
+```
+bazel test //tests/integration/<test> --config=x86_64-linux --config=core_dump --nocache_test_results
+```
+
+If a crash dump was created, a `CRASH DUMP` section is printed right under the
+pytest `FAILURES` section at the end of the run (the `x86_64-linux` config
+enables `--test_output=errors`, so the failing log is shown automatically):
+```
+=================================== FAILURES ===================================
+...
+================================== CRASH DUMP ==================================
+CRASH DUMP HAS BEEN CREATED! See <.../test.outputs/cores> for details.
+
+core.launch_manager.42.6.1787209649:
+    Program terminated with signal SIGABRT, Aborted.
+    #0  0x... in ?? () from /lib/x86_64-linux-gnu/libc.so.6
+    #1  0x... in raise () from /lib/x86_64-linux-gnu/libc.so.6
+    #2  0x... in abort () from /lib/x86_64-linux-gnu/libc.so.6
+    #3  0x... in <your crashing frame> at <file>:<line>
+    ...
+    Full backtrace (all threads): <.../cores/core.launch_manager.*.bt.txt>
+    Reopen in gdb inside the debug image:
+        docker run --rm -it -v <.../launch_manager>:/tmp/.../launch_manager:ro -v <.../cores>:/cores:ro score_itf_examples_debug:latest gdb /tmp/.../launch_manager /cores/core.launch_manager.*
+=========================== short test summary info ============================
+```
+The crashing thread's stack is printed **inline** (symbolized inside the
+container, so libraries match). The printed paths are absolute and
+copy-pasteable. Core files are named `core.<exe>.<pid>.<signal>.<time>` (signal
+`11` = `SIGSEGV`, `6` = `SIGABRT`); they are only produced on an actual crash and
+can be large (hundreds of MB).
+
+### Analysing a crash dump
+
+The crashing thread is already in the banner above. For the **full all-threads**
+dump, open the auto-captured backtrace file the fixture wrote next to the core:
+```
+cat "$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores/"*.bt.txt
+```
+`--config=core_dump` builds with `-c dbg` automatically, so the backtrace carries
+file/line information — no extra flag needed.
+
+The banner already prints a ready-to-run `docker run … gdb …` command per core.
+It must run **inside** the debug image (tagged `score_itf_examples_debug:latest`,
+which ships `gdb`), not on the host: the core references the container's
+libraries, so a host `gdb` unwind walks garbage. The command mounts the host
+binary at its original in-container path (so gdb matches the core without
+warnings) and the cores directory, then drops you into an interactive session:
+```
+CORES="$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores"
+BIN="$(bazel info bazel-bin)/<path-to-crashing-binary>"
+docker run --rm -it -v "$BIN:/tmp/<remote>/<binary>:ro" -v "$CORES:/cores:ro" \
+    score_itf_examples_debug:latest \
+    gdb /tmp/<remote>/<binary> /cores/core.*
+```
+Running host `gdb` against the core is a last resort; if you must, point it at an
+exported container rootfs via `set sysroot` / `solib-search-path`.
+
+## Important: the `core_pattern` is a global kernel setting
+
+`core_pattern` is **not** namespaced per container - it is shared with the
+host. The fixture therefore changes it globally at the start of a test and
+restores the original value on teardown. Two consequences:
+
+- **Run one crashing target at a time when investigating.** Concurrent tests
+  race on the shared `core_pattern`, so a parallel run can miss dumps or leave
+  a stale value.
+- **If a run is force-killed before teardown**, the restore may not run and
+  `core_pattern` is left pointing at `/tmp/score_cores/...`. The original value
+  was saved to `.original_core_pattern` in the workspace root before it was
+  changed, so you never lose it. **Simply re-running a core-dump test recovers
+  automatically**: the fixture sees the leftover backup, treats it (not the
+  current test value) as the original, and restores it on teardown. To fix it by
+  hand instead:
+  ```
+  cat /proc/sys/kernel/core_pattern          # current (likely /tmp/score_cores/...)
+  cat .original_core_pattern                 # the value to restore
+  # On WSL, write the saved value back from a privileged container:
+  docker run --rm --privileged -v "$PWD/.original_core_pattern:/orig:ro" \
+    debian:bookworm-slim \
+    bash -c 'cat /orig > /proc/sys/kernel/core_pattern'
+  rm .original_core_pattern
+  ```
+  If `.original_core_pattern` is absent, the restore already ran (the file is
+  removed on success). The default `core_pattern` differs per system (e.g.
+  `|/wsl-capture-crash ...` on WSL, `|/lib/systemd/systemd-coredump ...` on
+  systemd hosts, or plain `core`).
+
diff --git a/tests/utils/bazel/integration.bzl b/tests/utils/bazel/integration.bzl
index be754b194..b2b875e8d 100644
--- a/tests/utils/bazel/integration.bzl
+++ b/tests/utils/bazel/integration.bzl
@@ -75,6 +75,11 @@ def integration_test(
         "//tests/utils/testing_utils",
     ]
     final_data = kwargs.pop("data", []) + [":environment"] + select({
+        # More specialized than :integration_docker; select() prefers it under
+        # --config=core_dump so cores can be analysed against matching libraries.
+        "//config:integration_docker_core_dump": [
+            "//tests/utils/environments/x86_64-linux:x86_64-linux-debug",
+        ],
         "//config:integration_docker": [
             "//tests/utils/environments/x86_64-linux",
         ],
@@ -89,6 +94,10 @@ def integration_test(
         "--score-test-binary-path=$(locations :environment)",
         "--score-test-remote-directory={}/tests/{}".format(install_prefix, name),
     ] + select({
+        "//config:integration_docker_core_dump": [
+            "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux:x86_64-linux-debug)",
+            "--docker-image=score_itf_examples_debug:latest",
+        ],
         "//config:integration_docker": [
             "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux)",
             "--docker-image=score_itf_examples:latest",
@@ -101,11 +110,15 @@ def integration_test(
             "--local-dir=/tmp/score_itf_host/{}".format(name),
         ],
     })
-    final_plugins = ["//tests/utils/plugins:integration_plugin"] + select({
+
+    # integration_plugin is listed last so pytest registers it after the
+    # target plugin: its docker_configuration fixture then overrides the
+    # score_itf default (last-registered -p plugin wins fixture overrides).
+    final_plugins = select({
         "//config:integration_docker": ["@score_itf//score/itf/plugins:docker_plugin"],
         "//config:integration_qemu": ["@score_itf//score/itf/plugins:qemu_plugin"],
         "//config:integration_host": ["//tests/utils/plugins:localhost_plugin"],
-    })
+    }) + ["//tests/utils/plugins:integration_plugin"]
 
     # The QEMU plugin uses a hardcoded port so we can only run one test at a time.
     # See https://github.com/eclipse-score/itf/issues/125.
diff --git a/tests/utils/environments/x86_64-linux/BUILD b/tests/utils/environments/x86_64-linux/BUILD
index 3faeeb227..014bfc24e 100644
--- a/tests/utils/environments/x86_64-linux/BUILD
+++ b/tests/utils/environments/x86_64-linux/BUILD
@@ -43,3 +43,28 @@ oci_load(
         "//tests:__subpackages__",
     ],
 )
+
+# Debug variant: the normal image plus gdb (and its dependency closure), selected
+# under --config=core_dump so core dumps can be analysed inside the container
+# against matching libraries. The gdb layer is built by rules_distroless from
+# gdb_apt.yaml (regenerate its lockfile with: bazel run @gdb_apt//:lock).
+oci_image(
+    name = "image_debug",
+    base = "@debian-test-runtime",
+    target_compatible_with = ["@platforms//os:linux"],
+    tars = [
+        ":ecu_logging_config_layer",
+        "@gdb_apt//:flat",
+    ],
+)
+
+oci_load(
+    name = "x86_64-linux-debug",
+    image = ":image_debug",
+    repo_tags = ["score_itf_examples_debug:latest"],
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = [
+        "//examples:__subpackages__",
+        "//tests:__subpackages__",
+    ],
+)
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.lock.json b/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
new file mode 100644
index 000000000..b76309c67
--- /dev/null
+++ b/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
@@ -0,0 +1,865 @@
+{
+	"packages": [
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
+					"name": "zlib1g",
+					"version": "1:1.2.13.dfsg-1"
+				},
+				{
+					"key": "libc6_2.36-9-p-deb12u10_amd64",
+					"name": "libc6",
+					"version": "2.36-9+deb12u10"
+				},
+				{
+					"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
+					"name": "libgcc-s1",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
+					"name": "gcc-12-base",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
+					"name": "libzstd1",
+					"version": "1.5.4+dfsg2-5"
+				},
+				{
+					"key": "libxxhash0_0.8.1-1_amd64",
+					"name": "libxxhash0",
+					"version": "0.8.1-1"
+				},
+				{
+					"key": "libtinfo6_6.4-4_amd64",
+					"name": "libtinfo6",
+					"version": "6.4-4"
+				},
+				{
+					"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
+					"name": "libstdc++6",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "libreadline8_8.2-1.3_amd64",
+					"name": "libreadline8",
+					"version": "8.2-1.3"
+				},
+				{
+					"key": "readline-common_8.2-1.3_amd64",
+					"name": "readline-common",
+					"version": "8.2-1.3"
+				},
+				{
+					"key": "dpkg_1.21.22_amd64",
+					"name": "dpkg",
+					"version": "1.21.22"
+				},
+				{
+					"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
+					"name": "tar",
+					"version": "1.34+dfsg-1.2+deb12u1"
+				},
+				{
+					"key": "libselinux1_3.4-1-p-b6_amd64",
+					"name": "libselinux1",
+					"version": "3.4-1+b6"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-1"
+				},
+				{
+					"key": "libacl1_2.3.1-3_amd64",
+					"name": "libacl1",
+					"version": "2.3.1-3"
+				},
+				{
+					"key": "libmd0_1.0.4-2_amd64",
+					"name": "libmd0",
+					"version": "1.0.4-2"
+				},
+				{
+					"key": "liblzma5_5.4.1-1_amd64",
+					"name": "liblzma5",
+					"version": "5.4.1-1"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5+b1"
+				},
+				{
+					"key": "libipt2_2.0.5-1_amd64",
+					"name": "libipt2",
+					"version": "2.0.5-1"
+				},
+				{
+					"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
+					"name": "libgmp10",
+					"version": "2:6.2.1+dfsg1-1.1"
+				},
+				{
+					"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
+					"name": "libexpat1",
+					"version": "2.5.0-1+deb12u1"
+				},
+				{
+					"key": "libdebuginfod1_0.188-2.1_amd64",
+					"name": "libdebuginfod1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libdebuginfod-common_0.188-2.1_amd64",
+					"name": "libdebuginfod-common",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
+					"name": "ucf",
+					"version": "3.0043+nmu1+deb12u1"
+				},
+				{
+					"key": "sensible-utils_0.0.17-p-nmu1_amd64",
+					"name": "sensible-utils",
+					"version": "0.0.17+nmu1"
+				},
+				{
+					"key": "debconf_1.5.82_amd64",
+					"name": "debconf",
+					"version": "1.5.82"
+				},
+				{
+					"key": "libdw1_0.188-2.1_amd64",
+					"name": "libdw1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libelf1_0.188-2.1_amd64",
+					"name": "libelf1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
+					"name": "libcurl3-gnutls",
+					"version": "7.88.1-10+deb12u12"
+				},
+				{
+					"key": "libssh2-1_1.10.0-3-p-b1_amd64",
+					"name": "libssh2-1",
+					"version": "1.10.0-3+b1"
+				},
+				{
+					"key": "libssl3_3.0.16-1_deb12u1_amd64",
+					"name": "libssl3",
+					"version": "3.0.16-1~deb12u1"
+				},
+				{
+					"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
+					"name": "librtmp1",
+					"version": "2.4+20151223.gitfa8646d.1-2+b2"
+				},
+				{
+					"key": "libnettle8_3.8.1-2_amd64",
+					"name": "libnettle8",
+					"version": "3.8.1-2"
+				},
+				{
+					"key": "libhogweed6_3.8.1-2_amd64",
+					"name": "libhogweed6",
+					"version": "3.8.1-2"
+				},
+				{
+					"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
+					"name": "libgnutls30",
+					"version": "3.7.9-2+deb12u4"
+				},
+				{
+					"key": "libunistring2_1.0-2_amd64",
+					"name": "libunistring2",
+					"version": "1.0-2"
+				},
+				{
+					"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
+					"name": "libtasn1-6",
+					"version": "4.19.0-2+deb12u1"
+				},
+				{
+					"key": "libp11-kit0_0.24.1-2_amd64",
+					"name": "libp11-kit0",
+					"version": "0.24.1-2"
+				},
+				{
+					"key": "libffi8_3.4.4-1_amd64",
+					"name": "libffi8",
+					"version": "3.4.4-1"
+				},
+				{
+					"key": "libidn2-0_2.3.3-1-p-b1_amd64",
+					"name": "libidn2-0",
+					"version": "2.3.3-1+b1"
+				},
+				{
+					"key": "libpsl5_0.21.2-1_amd64",
+					"name": "libpsl5",
+					"version": "0.21.2-1"
+				},
+				{
+					"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
+					"name": "libnghttp2-14",
+					"version": "1.52.0-1+deb12u2"
+				},
+				{
+					"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
+					"name": "libldap-2.5-0",
+					"version": "2.5.13+dfsg-5"
+				},
+				{
+					"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
+					"name": "libsasl2-2",
+					"version": "2.1.28+dfsg-10"
+				},
+				{
+					"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
+					"name": "libsasl2-modules-db",
+					"version": "2.1.28+dfsg-10"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-1"
+				},
+				{
+					"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
+					"name": "libgssapi-krb5-2",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
+					"name": "libkrb5support0",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
+					"name": "libkrb5-3",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkeyutils1_1.6.3-2_amd64",
+					"name": "libkeyutils1",
+					"version": "1.6.3-2"
+				},
+				{
+					"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
+					"name": "libk5crypto3",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libcom-err2_1.47.0-2_amd64",
+					"name": "libcom-err2",
+					"version": "1.47.0-2"
+				},
+				{
+					"key": "libbrotli1_1.0.9-2-p-b6_amd64",
+					"name": "libbrotli1",
+					"version": "1.0.9-2+b6"
+				}
+			],
+			"key": "gdb-minimal_13.1-3_amd64",
+			"name": "gdb-minimal",
+			"sha256": "4aabd8955f0fa362e0474ddd02b5bbed77489b11dae04bbe2c420a54ac27e8ce",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gdb/gdb-minimal_13.1-3_amd64.deb"
+			],
+			"version": "13.1-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
+			"name": "zlib1g",
+			"sha256": "d7dd1d1411fedf27f5e27650a6eff20ef294077b568f4c8c5e51466dc7c08ce4",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/z/zlib/zlib1g_1.2.13.dfsg-1_amd64.deb"
+			],
+			"version": "1:1.2.13.dfsg-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libc6_2.36-9-p-deb12u10_amd64",
+			"name": "libc6",
+			"sha256": "5dc83256f10ca4d0f2a53dd6583ffd0d0e319af30074ea6c82fb0ae77bd16365",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/glibc/libc6_2.36-9+deb12u10_amd64.deb"
+			],
+			"version": "2.36-9+deb12u10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
+			"name": "libgcc-s1",
+			"sha256": "3016e62cb4b7cd8038822870601f5ed131befe942774d0f745622cc77d8a88f7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libgcc-s1_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
+			"name": "gcc-12-base",
+			"sha256": "1896a2aacf4ad681ff5eacc24a5b0ca4d5d9c9b9c9e4b6de5197bc1e116ea619",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/gcc-12-base_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
+			"name": "libzstd1",
+			"sha256": "6315b5ac38b724a710fb96bf1042019398cb656718b1522279a5185ed39318fa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libz/libzstd/libzstd1_1.5.4+dfsg2-5_amd64.deb"
+			],
+			"version": "1.5.4+dfsg2-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libxxhash0_0.8.1-1_amd64",
+			"name": "libxxhash0",
+			"sha256": "6c19a5d18c8350744581fbd25d5d29e2b7101053e25aafa4e1ffcc2b505b2f1c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/x/xxhash/libxxhash0_0.8.1-1_amd64.deb"
+			],
+			"version": "0.8.1-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtinfo6_6.4-4_amd64",
+			"name": "libtinfo6",
+			"sha256": "072d908f38f51090ca28ca5afa3b46b2957dc61fe35094c0b851426859a49a51",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/ncurses/libtinfo6_6.4-4_amd64.deb"
+			],
+			"version": "6.4-4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
+			"name": "libstdc++6",
+			"sha256": "5cd3171216d4ab0fc911cfe9c35509bf2dd8f47761c43b7f6a4296701551a24d",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libstdc++6_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libreadline8_8.2-1.3_amd64",
+			"name": "libreadline8",
+			"sha256": "e02ebbd3701cf468dbf98d6d917fbe0325e881f07fe8b316150c8d2a64486e66",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/libreadline8_8.2-1.3_amd64.deb"
+			],
+			"version": "8.2-1.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "readline-common_8.2-1.3_amd64",
+			"name": "readline-common",
+			"sha256": "69317523fe56429aa361545416ad339d138c1500e5a604856a80dd9074b4e35c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/readline-common_8.2-1.3_all.deb"
+			],
+			"version": "8.2-1.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "dpkg_1.21.22_amd64",
+			"name": "dpkg",
+			"sha256": "9d97f27d8a8a06dd4800e8e0291337ca02e11cdfd7df09a4566a982a6d9fe4c4",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/dpkg/dpkg_1.21.22_amd64.deb"
+			],
+			"version": "1.21.22"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
+			"name": "tar",
+			"sha256": "24fb92e98c2969171f81a8b589263d705f6b1670f95d121cd74c810d4605acc3",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/t/tar/tar_1.34+dfsg-1.2+deb12u1_amd64.deb"
+			],
+			"version": "1.34+dfsg-1.2+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libselinux1_3.4-1-p-b6_amd64",
+			"name": "libselinux1",
+			"sha256": "2b07f5287b9105f40158b56e4d70cc1652dac56a408f3507b4ab3d061eed425f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libselinux/libselinux1_3.4-1+b6_amd64.deb"
+			],
+			"version": "3.4-1+b6"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpcre2-8-0_10.42-1_amd64",
+			"name": "libpcre2-8-0",
+			"sha256": "030db54f4d76cdfe2bf0e8eb5f9efea0233ab3c7aa942d672c7b63b52dbaf935",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/pcre2/libpcre2-8-0_10.42-1_amd64.deb"
+			],
+			"version": "10.42-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libacl1_2.3.1-3_amd64",
+			"name": "libacl1",
+			"sha256": "8be9df5795114bfe90e2be3d208ef47a5edd3fc7b3e20d387a597486d444e5e2",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/a/acl/libacl1_2.3.1-3_amd64.deb"
+			],
+			"version": "2.3.1-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libmd0_1.0.4-2_amd64",
+			"name": "libmd0",
+			"sha256": "03539fd30c509e27101d13a56e52eda9062bdf1aefe337c07ab56def25a13eab",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libm/libmd/libmd0_1.0.4-2_amd64.deb"
+			],
+			"version": "1.0.4-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "liblzma5_5.4.1-1_amd64",
+			"name": "liblzma5",
+			"sha256": "d321b9502b16aac534e1c691afbe3dc5e125e5091aa35bea026c59b25ebe82e7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/x/xz-utils/liblzma5_5.4.1-1_amd64.deb"
+			],
+			"version": "5.4.1-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
+			"name": "libbz2-1.0",
+			"sha256": "54149da3f44b22d523b26b692033b84503d822cc5122fed606ea69cc83ca5aeb",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/bzip2/libbz2-1.0_1.0.8-5+b1_amd64.deb"
+			],
+			"version": "1.0.8-5+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libipt2_2.0.5-1_amd64",
+			"name": "libipt2",
+			"sha256": "d3687e2b7654a6450dbdfbadde216ce08cd84f52155f70cd7104309f897e62e5",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/i/intel-processor-trace/libipt2_2.0.5-1_amd64.deb"
+			],
+			"version": "2.0.5-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
+			"name": "libgmp10",
+			"sha256": "187aedef2ed763f425c1e523753b9719677633c7eede660401739e9c893482bd",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gmp/libgmp10_6.2.1+dfsg1-1.1_amd64.deb"
+			],
+			"version": "2:6.2.1+dfsg1-1.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
+			"name": "libexpat1",
+			"sha256": "c2bd305125bcece5816b2521f293a99499d674cd2dd744416caa4952158ad99d",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/e/expat/libexpat1_2.5.0-1+deb12u1_amd64.deb"
+			],
+			"version": "2.5.0-1+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdebuginfod1_0.188-2.1_amd64",
+			"name": "libdebuginfod1",
+			"sha256": "9650db2043d4e231a355940467e47dd0b4727700c2ce150010f03baaabfb0d0b",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdebuginfod-common_0.188-2.1_amd64",
+			"name": "libdebuginfod-common",
+			"sha256": "447be2fea4f171c32b32ea172ef83d12c6fc39636bb2bd9f95242b8ab4560369",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod-common_0.188-2.1_all.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
+			"name": "ucf",
+			"sha256": "928f2d5d327ef0f8d1b9c03a506134f56564cd2acf3e9f041df3dbdc68b00525",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/u/ucf/ucf_3.0043+nmu1+deb12u1_all.deb"
+			],
+			"version": "3.0043+nmu1+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "sensible-utils_0.0.17-p-nmu1_amd64",
+			"name": "sensible-utils",
+			"sha256": "e0e66f783996ec4670ed5041c446160ec671c723d4be47d3bc27af93c2958a76",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/s/sensible-utils/sensible-utils_0.0.17+nmu1_all.deb"
+			],
+			"version": "0.0.17+nmu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "debconf_1.5.82_amd64",
+			"name": "debconf",
+			"sha256": "74ab14194a3762b2fc717917dcfda42929ab98e3c59295a063344dc551cd7cc8",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/debconf/debconf_1.5.82_all.deb"
+			],
+			"version": "1.5.82"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdw1_0.188-2.1_amd64",
+			"name": "libdw1",
+			"sha256": "ffd7b1bad982ad1afd9c2b75ab2edd18e229508df731a8f4d8443f093a91442f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdw1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libelf1_0.188-2.1_amd64",
+			"name": "libelf1",
+			"sha256": "619add379c606b3ac6c1a175853b918e6939598a83d8ebadf3bdfd50d10b3c8c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libelf1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
+			"name": "libcurl3-gnutls",
+			"sha256": "0ef8f287b5d49ad3293c15913a796352ef1f0afc55c082ce64fe493527538c11",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/curl/libcurl3-gnutls_7.88.1-10+deb12u12_amd64.deb"
+			],
+			"version": "7.88.1-10+deb12u12"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssh2-1_1.10.0-3-p-b1_amd64",
+			"name": "libssh2-1",
+			"sha256": "d20a3ee34fa84ad8bd381e8be6e9c2c2ea32347cff5e1169c10e978d43f54f24",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libssh2/libssh2-1_1.10.0-3+b1_amd64.deb"
+			],
+			"version": "1.10.0-3+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssl3_3.0.16-1_deb12u1_amd64",
+			"name": "libssl3",
+			"sha256": "eaa2bab2130820f09361dc8186ddeb11d2a18ec5e5e3806f24414d5d8065a57a",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openssl/libssl3_3.0.16-1~deb12u1_amd64.deb"
+			],
+			"version": "3.0.16-1~deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
+			"name": "librtmp1",
+			"sha256": "e1f69020dc2c466e421ec6a58406b643be8b5c382abf0f8989011c1d3df91c87",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/rtmpdump/librtmp1_2.4+20151223.gitfa8646d.1-2+b2_amd64.deb"
+			],
+			"version": "2.4+20151223.gitfa8646d.1-2+b2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnettle8_3.8.1-2_amd64",
+			"name": "libnettle8",
+			"sha256": "45922e6e289ffd92f0f92d2bb9159e84236ff202d552a461bf10e5335b3f0261",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libnettle8_3.8.1-2_amd64.deb"
+			],
+			"version": "3.8.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libhogweed6_3.8.1-2_amd64",
+			"name": "libhogweed6",
+			"sha256": "ed8185c28b2cb519744a5a462dcd720d3b332c9b88a1d0002eac06dc8550cb94",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libhogweed6_3.8.1-2_amd64.deb"
+			],
+			"version": "3.8.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
+			"name": "libgnutls30",
+			"sha256": "1c113d2a3eb06d66fc3a6f30d00e8c38b102e3b1d9f8911272bd0e45c22ed36b",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/g/gnutls28/libgnutls30_3.7.9-2+deb12u4_amd64.deb"
+			],
+			"version": "3.7.9-2+deb12u4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libunistring2_1.0-2_amd64",
+			"name": "libunistring2",
+			"sha256": "d466bbfe011d764d793c1d9d777cad9c7cf65b938e11598f27408171ad95a951",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libu/libunistring/libunistring2_1.0-2_amd64.deb"
+			],
+			"version": "1.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
+			"name": "libtasn1-6",
+			"sha256": "2c27c613b69be248d09432839ea3d3382f6ee27fabaa65987aa2d884cd00afda",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/libt/libtasn1-6/libtasn1-6_4.19.0-2+deb12u1_amd64.deb"
+			],
+			"version": "4.19.0-2+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libp11-kit0_0.24.1-2_amd64",
+			"name": "libp11-kit0",
+			"sha256": "251330faddbf013f060fcdb41f4b0c037c8a6e89ba7c09b04bfcc4e3f0807b22",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/p11-kit/libp11-kit0_0.24.1-2_amd64.deb"
+			],
+			"version": "0.24.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libffi8_3.4.4-1_amd64",
+			"name": "libffi8",
+			"sha256": "6d9f6c25c30efccce6d4bceaa48ea86c329a3432abb360a141f76ac223a4c34a",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libf/libffi/libffi8_3.4.4-1_amd64.deb"
+			],
+			"version": "3.4.4-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libidn2-0_2.3.3-1-p-b1_amd64",
+			"name": "libidn2-0",
+			"sha256": "d50716d5824083d667427817d506b45d3f59dc77e1ca52de000f3f62d4918afa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libi/libidn2/libidn2-0_2.3.3-1+b1_amd64.deb"
+			],
+			"version": "2.3.3-1+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpsl5_0.21.2-1_amd64",
+			"name": "libpsl5",
+			"sha256": "4f0d35610204e4e754b057748719744114621f2f6f4202d846c314860a981afb",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libp/libpsl/libpsl5_0.21.2-1_amd64.deb"
+			],
+			"version": "0.21.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
+			"name": "libnghttp2-14",
+			"sha256": "dbe3eb8c831e654ac7d5cf045d605d53fd763e8ebc238607c25f301996103bb9",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nghttp2/libnghttp2-14_1.52.0-1+deb12u2_amd64.deb"
+			],
+			"version": "1.52.0-1+deb12u2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
+			"name": "libldap-2.5-0",
+			"sha256": "4b6c30f6554149c594628d945edc6003f0eea8d0cc1341638c0e71375db147ed",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openldap/libldap-2.5-0_2.5.13+dfsg-5_amd64.deb"
+			],
+			"version": "2.5.13+dfsg-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
+			"name": "libsasl2-2",
+			"sha256": "11ee190ad39f8d7af441d2c8347388b9449434c73acc67b4b372445ac4152efa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-2_2.1.28+dfsg-10_amd64.deb"
+			],
+			"version": "2.1.28+dfsg-10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
+			"name": "libsasl2-modules-db",
+			"sha256": "3ac4fd6cbe3b3b06e68d24b931bf3eb9385b42f15604a37ed25310e948ca0ee6",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-modules-db_2.1.28+dfsg-10_amd64.deb"
+			],
+			"version": "2.1.28+dfsg-10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
+			"name": "libdb5.3",
+			"sha256": "7dc5127b8dd0da80e992ba594954c005ae4359d839a24eb65d0d8129b5235c84",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/db5.3/libdb5.3_5.3.28+dfsg2-1_amd64.deb"
+			],
+			"version": "5.3.28+dfsg2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
+			"name": "libgssapi-krb5-2",
+			"sha256": "34a3fcd0e5aeeb01e895b8ce563b06b12b0d763f1b5943b97feffed07a3f56f1",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libgssapi-krb5-2_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
+			"name": "libkrb5support0",
+			"sha256": "8862ae9677f2361d888fcefb2734e4ddfb2678f82535d21c4c0cc77d8e406e9f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5support0_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
+			"name": "libkrb5-3",
+			"sha256": "e3c228ea202bf5a278329f5a96cbe3ca48927e0ed7fea849680b0996fece4879",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5-3_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkeyutils1_1.6.3-2_amd64",
+			"name": "libkeyutils1",
+			"sha256": "cfac89e6a7a54ff3c6a4f843310e25efeddaa771baeae470bd98bd588c373563",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/keyutils/libkeyutils1_1.6.3-2_amd64.deb"
+			],
+			"version": "1.6.3-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
+			"name": "libk5crypto3",
+			"sha256": "6aff44ea189ad062eb7a83b9fac99861f1efa35bf66bc7605c2ade644a08bb94",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libk5crypto3_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcom-err2_1.47.0-2_amd64",
+			"name": "libcom-err2",
+			"sha256": "8010e4285276bb344c05ae780deae2fffb45e237116c3a78481365c5954125ec",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/e2fsprogs/libcom-err2_1.47.0-2_amd64.deb"
+			],
+			"version": "1.47.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbrotli1_1.0.9-2-p-b6_amd64",
+			"name": "libbrotli1",
+			"sha256": "563b4caec1aa5e876bd3355b36e7a38e1484baf5a293b48d1e8bd22db786e4d7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/brotli/libbrotli1_1.0.9-2+b6_amd64.deb"
+			],
+			"version": "1.0.9-2+b6"
+		}
+	],
+	"version": 1
+}
\ No newline at end of file
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.yaml b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
new file mode 100644
index 000000000..9f6eb82b7
--- /dev/null
+++ b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
@@ -0,0 +1,24 @@
+# Packages layered onto the debian:bookworm-slim test image to build the
+# gdb-equipped debug variant (score_itf_examples_debug), selected under
+# --config=core_dump so core dumps can be analysed in-container.
+#
+# Pinned to a Debian bookworm snapshot for reproducibility; regenerate the
+# lockfile after any change with:  bazel run @gdb_apt//:lock
+version: 1
+
+sources:
+  - channel: bookworm main
+    urls:
+      - https://snapshot.debian.org/archive/debian/20250601T000000Z
+  - channel: bookworm-updates main
+    urls:
+      - https://snapshot.debian.org/archive/debian/20250601T000000Z
+  - channel: bookworm-security main
+    urls:
+      - https://snapshot.debian.org/archive/debian-security/20250601T000000Z
+
+archs:
+  - "amd64"
+
+packages:
+  - "gdb"
diff --git a/tests/utils/plugins/integration.py b/tests/utils/plugins/integration.py
index 89bf90747..e473712a2 100644
--- a/tests/utils/plugins/integration.py
+++ b/tests/utils/plugins/integration.py
@@ -10,11 +10,57 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
+import json
+import logging
 import os
+import re
+import shlex
 from pathlib import Path
 
 import pytest
 
+from score.itf.plugins.core import determine_target_scope
+
+logger = logging.getLogger(__name__)
+
+# Sandbox-local directory a crashing process writes its core dump to, plus the
+# core_pattern that routes cores there. core_pattern is a global (non-namespaced)
+# kernel setting, so it is written from inside the privileged container and
+# restored on teardown - the host is not modified permanently.
+CORE_DUMP_DIR = "/tmp/score_cores"
+CORE_PATTERN = f"{CORE_DUMP_DIR}/core.%e.%p.%s.%t"
+
+# Workspace-root file the original core_pattern is mirrored to before it is
+# changed, so it is never lost if a run is force-killed. It is written
+# from inside the privileged container (see _capture_core_dumps) because the
+# sandboxed test process only sees the source tree read-only.
+CORE_PATTERN_BACKUP_NAME = ".original_core_pattern"
+
+# Suffix of the symbolized backtrace written next to each core by gdb, inside the
+# container where the binary and matching libraries are present.
+BACKTRACE_SUFFIX = ".bt.txt"
+
+# gdb-equipped debug image (see tests/utils/bazel/integration.bzl). A core must be
+# reopened here, not with host gdb: the core references the container's libraries,
+# so a host unwind walks garbage.
+DEBUG_IMAGE = "score_itf_examples_debug:latest"
+
+
+def _core_dumps_enabled() -> bool:
+    """Core-dump capture is opt-in via ``--config=core_dump`` (see .bazelrc),
+    which forwards ``SCORE_ENABLE_CORE_DUMP`` into the test environment. When it
+    is off, the plugin behaves as if the crash-dump feature did not exist."""
+    return os.environ.get("SCORE_ENABLE_CORE_DUMP") == "1"
+
+
+def _host_workspace_root():
+    """Resolve the real (host) workspace root from this file's symlink target."""
+    resolved = Path(os.path.realpath(__file__))
+    for ancestor in resolved.parents:
+        if (ancestor / "MODULE.bazel").is_file():
+            return ancestor
+    return None
+
 
 def pytest_addoption(parser):
     parser.addoption(
@@ -43,6 +89,316 @@ def test_output_dir() -> Path:
     return Path(os.environ["TEST_UNDECLARED_OUTPUTS_DIR"])
 
 
+@pytest.fixture(scope=determine_target_scope)
+def docker_configuration():
+    """Run the test container privileged with an unlimited core-file ulimit so
+    crashing processes produce core dumps inside the sandbox.
+
+    Only when core-dump capture is enabled (--config=core_dump); otherwise
+    stick to unprivileged container. The workspace is bind-mounted read-write so
+    the container can persist the core_pattern backup to the host source tree,
+    which the sandboxed test process cannot write itself."""
+
+    if not _core_dumps_enabled():
+        return {}
+
+    import docker  # imported lazily: only the docker target has this dependency
+
+    config = {
+        "privileged": True,
+        "ulimits": [docker.types.Ulimit(name="core", soft=-1, hard=-1)],
+    }
+    workspace = _host_workspace_root()
+    if workspace is not None:
+        config["volumes"] = {str(workspace): {"bind": str(workspace), "mode": "rw"}}
+    return config
+
+
+# Length the kernel truncates a process comm (core_pattern %e) to: TASK_COMM_LEN
+# is 16 bytes including the NUL terminator, so 15 usable characters.
+_COMM_MAX = 15
+
+
+def _load_binary_src_map(cores_dir: str):
+    """Map each packaged test binary's basename to its execroot-relative source
+    path (``bazel-out/<config>/bin/...``), read from the pkg_tar manifest that
+    ``integration_test`` builds next to ``environment.tar``.
+
+    This is Bazel's own dest->src mapping, so it resolves aliases and the right
+    per-config path automatically. Returns an empty dict on any failure; callers
+    then fall back to a ``<path-to-binary>`` placeholder."""
+    try:
+        tar = os.path.realpath(os.environ["SCORE_TEST_BINARY_PATH"])
+        manifest = Path(tar).with_suffix(".manifest")
+        if not manifest.is_file():
+            # Fall back to reconstructing the manifest path under bazel-out.
+            m = re.search(r"^(.*)/bazel-out/([^/]+)/", cores_dir)
+            rel = Path(os.environ["SCORE_TEST_BINARY_PATH"]).with_suffix(".manifest")
+            manifest = Path(f"{m.group(1)}/bazel-out/{m.group(2)}/bin") / rel
+        entries = json.loads(manifest.read_text())
+        return {
+            os.path.basename(e["dest"]): e["src"]
+            for e in entries
+            if e.get("type") == "file"
+        }
+    except Exception:
+        logger.warning("Could not load binary manifest for gdb hints", exc_info=True)
+        return {}
+
+
+def _persistent_outputs_dir(undeclared: str) -> str:
+    """Translate the in-sandbox TEST_UNDECLARED_OUTPUTS_DIR into the persistent
+    path Bazel copies the outputs to (drops the ``.../sandbox/<type>/<n>/``
+    segment) so the reported paths survive the test and are copy-pasteable."""
+    return re.sub(r"/sandbox/[^/]+/\d+/execroot/", "/execroot/", undeclared)
+
+
+def _primary_backtrace(bt_path: str, max_frames: int = 40):
+    """Extract the crashing thread's frames from an auto-captured ``.bt.txt``:
+    the ``Program terminated`` line and the first ``bt`` block, stopping at the
+    all-threads (``thread apply all bt``) section. Returns [] if unreadable."""
+    try:
+        with open(bt_path, encoding="utf-8", errors="replace") as f:
+            raw = f.read().splitlines()
+    except OSError:
+        return []
+    lines = []
+    started = False
+    for line in raw:
+        if line.startswith("Program terminated"):
+            lines = [line]
+        elif line.startswith("Thread "):
+            break  # start of the all-threads dump; crashing thread already captured
+        elif line.startswith("#"):
+            started = True
+            if lines and lines[-1] == line:
+                continue  # gdb repeats frame #0 (stop location + bt); keep one
+            lines.append(line)
+        elif started and not line.strip():
+            break  # blank line ends the first bt block
+    return lines[: max_frames + 1]
+
+
+def _core_dump_report_lines(names, cores_dir: str, read_dir: str | None = None):
+    """Build the crash-dump banner body: per core, the crashing thread's stack
+    inline plus pointers to the full backtrace file and a ready-to-run gdb
+    command. ``cores_dir`` is the persistent path shown to the user; ``read_dir``
+    (defaults to it) is where the ``.bt.txt`` files are actually read from."""
+    read_dir = read_dir or cores_dir
+    remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
+    m = re.search(r"^(.*)/bazel-out/", cores_dir)
+    out_root = m.group(1) if m else ""
+    src_map = _load_binary_src_map(cores_dir)
+
+    lines = [f"CRASH DUMP HAS BEEN CREATED! See {cores_dir} for details."]
+    for name in names:
+        exe = name.split(".")[1] if name.count(".") >= 1 else name
+        # %e is the comm truncated to _COMM_MAX chars, so match on that prefix;
+        # bail out to a placeholder unless exactly one binary matches.
+        matches = [src for base, src in src_map.items() if base[:_COMM_MAX] == exe]
+        binary = f"{out_root}/{matches[0]}" if len(matches) == 1 else "<path-to-binary>"
+        # The core records the binary's in-container path; mount the host binary
+        # there so gdb matches it without a "core may not match" warning.
+        in_container = (
+            _incontainer_binary(name, remote_dir, src_map) if remote_dir else "/binary"
+        )
+        bt = _primary_backtrace(f"{read_dir}/{name}{BACKTRACE_SUFFIX}")
+        lines.append("")
+        lines.append(f"{name}:")
+        if bt:
+            lines += [f"    {frame}" for frame in bt]
+            lines.append(
+                f"    Full backtrace (all threads): "
+                f"{cores_dir}/{name}{BACKTRACE_SUFFIX}"
+            )
+        else:
+            lines.append(
+                "    (no backtrace auto-captured; only the debug image ships gdb "
+                "- run with --config=core_dump)"
+            )
+        # Reopen inside the debug image (not host gdb) so the core's libraries
+        # match; mount the binary and the cores dir read-only.
+        lines.append("    Reopen in gdb inside the debug image:")
+        lines.append(
+            f"        docker run --rm -it "
+            f"-v {binary}:{in_container}:ro -v {cores_dir}:/cores:ro "
+            f"{DEBUG_IMAGE} gdb {in_container} /cores/{name}"
+        )
+    return lines
+
+
+def _collect_core_dumps(target, test_output_dir: Path):
+    """Download any core dumps (and their auto-captured ``.bt.txt`` backtraces)
+    produced in the sandbox into the Bazel test outputs; return the list of
+    downloaded core-dump names (backtraces excluded)."""
+    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
+    if rc != 0:
+        return []
+    names = [n for n in out.decode(errors="replace").split() if n]
+    if not any(not n.endswith(BACKTRACE_SUFFIX) for n in names):
+        return []
+    dest_dir = Path(test_output_dir) / "cores"
+    dest_dir.mkdir(parents=True, exist_ok=True)
+    downloaded = []
+    for name in names:
+        try:
+            target.download(f"{CORE_DUMP_DIR}/{name}", str(dest_dir / name))
+            if not name.endswith(BACKTRACE_SUFFIX):
+                downloaded.append(name)
+        except Exception:
+            logger.warning(f"Failed to download {name}", exc_info=True)
+    return downloaded
+
+
+def _enable_core_dumps_cmd(backup: str | None) -> str:
+    """Shell run inside the container to start capturing: back up the original
+    core_pattern to the workspace file (only if not already saved and not already
+    our test pattern), then route cores to the sandbox dir."""
+    cmd = f"mkdir -p {CORE_DUMP_DIR} && chmod 0777 {CORE_DUMP_DIR}"
+    if backup is not None:
+        cmd += (
+            f" && CUR=$(cat /proc/sys/kernel/core_pattern)"
+            f' && if [ ! -e {shlex.quote(backup)} ] && [ "$CUR" != {shlex.quote(CORE_PATTERN)} ]; then'
+            f' printf "%s" "$CUR" > {shlex.quote(backup)}; fi'
+        )
+    cmd += (
+        f" && printf '%s' {shlex.quote(CORE_PATTERN)} > /proc/sys/kernel/core_pattern"
+    )
+    return cmd
+
+
+def _restore_core_pattern_cmd(backup: str) -> str:
+    """Shell run inside the container on teardown: restore core_pattern from the
+    workspace backup and remove it. A no-op if the backup is absent (nothing was
+    saved, or the original is unknown)."""
+    return (
+        f"if [ -e {shlex.quote(backup)} ]; then "
+        f"cat {shlex.quote(backup)} > /proc/sys/kernel/core_pattern && "
+        f"rm -f {shlex.quote(backup)}; fi"
+    )
+
+
+# gdb exit code the container command uses to signal "gdb not installed", so the
+# plugin can log a hint instead of silently producing no backtrace.
+_GDB_MISSING_RC = 42
+
+
+def _incontainer_binary(core_name: str, remote_dir: str, src_map: dict) -> str:
+    """In-container path of the binary that produced ``core_name``.
+
+    Cores are named ``core.<comm>.<pid>.<sig>.<time>``; %e is the comm truncated
+    to _COMM_MAX chars, so match that prefix against the packaged binaries (same
+    rule as the banner). Falls back to the raw comm if the match is ambiguous."""
+    exe = core_name.split(".")[1] if core_name.count(".") >= 1 else core_name
+    matches = [base for base in src_map if base[:_COMM_MAX] == exe]
+    basename = matches[0] if len(matches) == 1 else exe
+    return f"{remote_dir}/{basename}"
+
+
+def _capture_backtraces_cmd(core_to_binary: dict) -> str | None:
+    """Shell run inside the container: symbolize each core next to itself as
+    ``<core>.bt.txt``. Run here (not on the host) because the container holds the
+    binary and the matching libraries, so the unwind is correct. Exits
+    ``_GDB_MISSING_RC`` if gdb is absent (only the debug image ships it)."""
+    if not core_to_binary:
+        return None
+    parts = [f"command -v gdb >/dev/null 2>&1 || exit {_GDB_MISSING_RC}"]
+    for core, binary in core_to_binary.items():
+        core_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}")
+        bt_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}{BACKTRACE_SUFFIX}")
+        parts.append(
+            f"gdb -batch -nx -q -ex 'set pagination off' "
+            f"-ex bt -ex 'thread apply all bt' "
+            f"{shlex.quote(binary)} {core_path} > {bt_path} 2>&1 || true"
+        )
+    return " ; ".join(parts)
+
+
+def _capture_backtraces(target, test_output_dir: Path, remote_dir):
+    """Generate a symbolized backtrace next to each core before it is collected."""
+    if not remote_dir:
+        return
+    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
+    if rc != 0:
+        return
+    cores = [
+        n
+        for n in out.decode(errors="replace").split()
+        if n and not n.endswith(BACKTRACE_SUFFIX)
+    ]
+    if not cores:
+        return
+    cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
+    src_map = _load_binary_src_map(cores_dir)
+    cmd = _capture_backtraces_cmd(
+        {c: _incontainer_binary(c, remote_dir, src_map) for c in cores}
+    )
+    rc, _ = target.execute(cmd)
+    if rc == _GDB_MISSING_RC:
+        logger.warning(
+            "gdb not found in the test container; no backtrace captured. "
+            "Run with --config=core_dump to select the gdb-equipped debug image."
+        )
+
+
+@pytest.fixture(autouse=True)
+def _capture_core_dumps(request, target, test_output_dir):
+    """Route core dumps to a sandbox-local directory for the duration of the
+    test, collect any that were produced, then restore the original
+    core_pattern."""
+    if not _core_dumps_enabled():
+        yield  # core-dump capture not requested (--config=core_dump)
+        return
+    if request.config.getoption("docker_image", default=None) is None:
+        yield  # not the docker sandbox; nothing to capture
+        return
+
+    workspace = _host_workspace_root()
+    backup = (
+        f"{workspace}/{CORE_PATTERN_BACKUP_NAME}" if workspace is not None else None
+    )
+
+    rc, _ = target.execute(_enable_core_dumps_cmd(backup))
+    enabled = rc == 0
+    if not enabled:
+        logger.warning(
+            "Could not enable sandbox core dumps (core_pattern write failed)"
+        )
+
+    try:
+        yield
+    finally:
+        try:
+            remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
+            _capture_backtraces(target, test_output_dir, remote_dir)
+            downloaded = _collect_core_dumps(target, test_output_dir)
+            if downloaded:
+                cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
+                # Read the just-downloaded backtraces from the sandbox path; Bazel
+                # only copies them to cores_dir after the test process exits.
+                read_dir = str(Path(test_output_dir) / "cores")
+                banners = getattr(request.config, "_score_core_dump_banners", [])
+                banners.append(
+                    _core_dump_report_lines(downloaded, cores_dir, read_dir)
+                )
+                request.config._score_core_dump_banners = banners
+        finally:
+            if enabled and backup is not None:
+                target.execute(_restore_core_pattern_cmd(backup))
+
+
+def pytest_terminal_summary(terminalreporter, exitstatus, config):
+    """Print the crash-dump banner(s) after the FAILURES section, so the pointer
+    to each core dump and its gdb command is the last thing shown."""
+    banners = getattr(config, "_score_core_dump_banners", None)
+    if not banners:
+        return
+    for lines in banners:
+        terminalreporter.write_sep("=", "CRASH DUMP", red=True, bold=True)
+        for line in lines:
+            terminalreporter.write_line(line)
+
+
 def pytest_configure(config):
     binary_path = config.getoption("--score-test-binary-path", default=None)
     if binary_path is not None:
diff --git a/tests/utils/test_helper/BUILD b/tests/utils/test_helper/BUILD
index c044cce2c..900780ca1 100644
--- a/tests/utils/test_helper/BUILD
+++ b/tests/utils/test_helper/BUILD
@@ -64,6 +64,17 @@ cc_binary(
     ],
 )
 
+cc_binary(
+    name = "process_hanging_on_sigterm",
+    srcs = ["process_hanging_on_sigterm.cpp"],
+    visibility = ["//tests:__subpackages__"],
+    deps = [
+        ":test_helper",
+        "//score/launch_manager:lifecycle_cc",
+        "@googletest//:gtest_main",
+    ],
+)
+
 cc_binary(
     name = "process_crashing_on_startup_n_times",
     srcs = ["process_crashing_on_startup_n_times.cpp"],
diff --git a/tests/utils/test_helper/process_hanging_on_sigterm.cpp b/tests/utils/test_helper/process_hanging_on_sigterm.cpp
new file mode 100644
index 000000000..86a61d064
--- /dev/null
+++ b/tests/utils/test_helper/process_hanging_on_sigterm.cpp
@@ -0,0 +1,73 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+#include <gtest/gtest.h>
+#include <unistd.h>
+
+#include <cstdlib>
+#include <string>
+#include <string_view>
+
+#include "tests/utils/test_helper/test_helper.hpp"
+#include <score/mw/lifecycle/report_running.h>
+
+namespace
+{
+/// @brief How long the process stalls while being terminated, keeping an in-progress
+/// run-target switch alive so the test has a deterministic window to send SIGTERM to
+/// the launch manager. Must be smaller than the configured shutdown_timeout so the
+/// process still exits gracefully.
+constexpr unsigned int kTerminationDelaySeconds = 2U;
+
+/// @return "<PROCESSIDENTIFIER>_<suffix>", or just <suffix> if PROCESSIDENTIFIER is
+/// unset. Keeps signal files distinct when this shared binary is deployed as several
+/// components.
+std::string signal_file(const std::string_view suffix)
+{
+    const char* process_id = std::getenv("PROCESSIDENTIFIER");
+    return process_id ? (std::string{process_id} + "_" + std::string{suffix}) : std::string{suffix};
+}
+}  // namespace
+
+// Reports running, then - once the launch manager asks it to terminate (SIGTERM),
+// which happens when the switch away from its run target begins - stalls for a short
+// while before exiting. The stall keeps that run-target switch in progress, giving the
+// surrounding test a deterministic window to act (e.g. send a SIGTERM to the launch
+// manager).
+TEST(ProcessHangingOnSigterm, StallsDuringTermination)
+{
+    TEST_STEP("Report running")
+    {
+        EXPECT_TRUE(touch_file(signal_file("started"))) << "failed to deploy file";
+        score::mw::lifecycle::report_running();
+    }
+
+    while (!TestRunner::exitRequested)
+    {
+        pause();
+    }
+
+    TEST_STEP("Stall during termination to keep the run-target switch in progress")
+    {
+        EXPECT_TRUE(touch_file(signal_file("terminating"))) << "failed to deploy file";
+        static_cast<void>(sleep(kTerminationDelaySeconds));
+    }
+}
+
+int main()
+{
+    // Name the XML result after the deployed component so multiple deployments of this
+    // shared binary don't collide.
+    const char* process_id = std::getenv("PROCESSIDENTIFIER");
+    const std::string xml_name = process_id ? std::string{process_id} : __FILE__;
+    return TestRunner(xml_name).RunTests();
+}
diff --git a/tests/utils/test_helper/test_helper.hpp b/tests/utils/test_helper/test_helper.hpp
index 569ec7f1b..82c942946 100644
--- a/tests/utils/test_helper/test_helper.hpp
+++ b/tests/utils/test_helper/test_helper.hpp
@@ -14,9 +14,12 @@
 #define TESTS_UTILS_TEST_HELPER_HPP
 
 #include <gtest/gtest.h>
+#include <atomic>
+#include <chrono>
 #include <filesystem>
 #include <string>
 #include <string_view>
+#include <thread>
 
 /// @return File path to an xml adjacent to the input file path
 inline std::string xmlPath(const std::string_view file)