diff --git a/.github/ISSUE_TEMPLATE/bug.md b/.github/ISSUE_TEMPLATE/bug.md
index d933d87883..edaabe1dd6 100644
--- a/.github/ISSUE_TEMPLATE/bug.md
+++ b/.github/ISSUE_TEMPLATE/bug.md
@@ -2,7 +2,7 @@
 name: Bug Report
 about: Report a bug in Hyperlight
 title: ''
-labels: bug
+labels: C-bug
 assignees: ''
 ---
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 30d347fcb2..6145e90a60 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,7 +8,7 @@ updates:
       interval: "daily"
       time: "03:00"
     labels:
-      - "kind/dependencies"
+      - "C-deps"
   - package-ecosystem: "cargo"
     directory: "/"
     cooldown:
@@ -17,7 +17,7 @@ updates:
       interval: "daily"
       time: "03:00"
     labels:
-      - "kind/dependencies"
+      - "C-deps"
     open-pull-requests-limit: 20
     groups:
       windows:
@@ -40,8 +40,7 @@ updates:
       interval: "daily"
       time: "03:00"
     labels:
-      - "kind/dependencies"
-      - "area/guest"
+      - "C-deps"
     open-pull-requests-limit: 5
     groups:
       windows:
diff --git a/.github/release.yml b/.github/release.yml
index 0110edad59..9817f1ba5c 100644
--- a/.github/release.yml
+++ b/.github/release.yml
@@ -7,7 +7,7 @@ changelog:
         - "*"
       exclude:
         labels:
-          - kind/dependencies
+          - C-deps
     - title: Full Changelog (dependencies)
       labels:
-        - kind/dependencies
\ No newline at end of file
+        - C-deps
diff --git a/.github/workflows/Coverage.yml b/.github/workflows/Coverage.yml
index 11efb1cb00..9fb8fa73bb 100644
--- a/.github/workflows/Coverage.yml
+++ b/.github/workflows/Coverage.yml
@@ -94,6 +94,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Coverage Failure
-        run: ./dev/notify-ci-failure.sh --title="Weekly Coverage Failure - ${{ github.run_number }}" --labels="area/ci-periodics,area/testing,lifecycle/needs-review"
+        run: ./dev/notify-ci-failure.sh --title="Weekly Coverage Failure - ${{ github.run_number }}" --labels="A-ci-periodics,A-testing,S-needs-triage"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/DailyArm64.yml b/.github/workflows/DailyArm64.yml
index 952c6416eb..14a2ab12de 100644
--- a/.github/workflows/DailyArm64.yml
+++ b/.github/workflows/DailyArm64.yml
@@ -102,9 +102,9 @@ jobs:
       timeout_minutes: 35 # 5 minutes fuzzing plus setup and build on slower arm64 runners
 
   # File (or update) a release-blocking GitHub issue if any job fails. The first
-  # label (area/ci-periodics-aarch64) is the de-duplication key used by
+  # label (A-ci-periodics-aarch64) is the de-duplication key used by
   # notify-ci-failure.sh, so this workflow maintains its own issue lineage and is
-  # guaranteed to carry release-blocker, instead of commenting on another periodic
+  # guaranteed to carry P-release-blocker, instead of commenting on another periodic
   # job's issue. NOTE: that label must exist in the repo (Issues -> Labels) or the
   # `gh issue create` call will fail.
   notify-failure:
@@ -121,6 +121,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Daily aarch64 Failure
-        run: ./dev/notify-ci-failure.sh --title="Daily aarch64 Failure - ${{ github.run_number }}" --labels="area/ci-periodics-aarch64,area/ci-periodics,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --title="Daily aarch64 Failure - ${{ github.run_number }}" --labels="A-ci-periodics-aarch64,A-ci-periodics,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/DailyBenchmarks.yml b/.github/workflows/DailyBenchmarks.yml
index 9ece6a5ad8..c3a56f22df 100644
--- a/.github/workflows/DailyBenchmarks.yml
+++ b/.github/workflows/DailyBenchmarks.yml
@@ -66,6 +66,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Benchmark Failure
-        run: ./dev/notify-ci-failure.sh --title="Benchmark Failure - ${{ github.run_number }}" --labels="area/benchmarks,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --title="Benchmark Failure - ${{ github.run_number }}" --labels="A-perf,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/Fuzzing.yml b/.github/workflows/Fuzzing.yml
index 522211b07d..c203bfcc3d 100644
--- a/.github/workflows/Fuzzing.yml
+++ b/.github/workflows/Fuzzing.yml
@@ -44,6 +44,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Fuzzing Failure
-        run: ./dev/notify-ci-failure.sh --labels="area/fuzzing,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --labels="A-fuzzing,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/IssueLabelChecker.yml b/.github/workflows/IssueLabelChecker.yml
index 6b117eb4f9..31f91a58a8 100644
--- a/.github/workflows/IssueLabelChecker.yml
+++ b/.github/workflows/IssueLabelChecker.yml
@@ -14,22 +14,12 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
     - name: Check and Add label
       run: |
-        # The cryptic head -c -1 is because otherwise gh always terminates output with a newline
-        readarray -d $'\0' lifecycles < <(gh issue view ${{ github.event.issue.number }} --json labels -q '[.labels[] | .name | select(startswith("lifecycle/"))] | join("\u0000")' | head -c -1)
-        if [[ ${#lifecycles[@]} -ne 1 ]]; then
-          if [[ ${#lifecycles[@]} -ge 1 ]]; then
-            echo 'Too many lifecycle labels; replacing all with `lifecycle/needs-review`'
-          fi
-          commands=()
-          for label in "${lifecycles[@]}"; do
-            if [[ "$label" != "lifecycle/needs-review" ]]; then
-              echo "Removing label ${label}"
-              commands+=("--remove-label" "${label}")
-            fi
-          done
-          echo 'Adding `lifecycle/needs review`'
-          commands+=("--add-label" "lifecycle/needs-review")
-          gh issue edit ${{ github.event.issue.number }} "${commands[@]}"
+        # Preserve existing statuses and add S-needs-triage only when none is present.
+        set -euo pipefail
+        HAS_STATUS="$(gh issue view ${{ github.event.issue.number }} --json labels \
+          -q 'any(.labels[].name; startswith("S-"))')"
+        if [[ "$HAS_STATUS" == "false" ]]; then
+          gh issue edit ${{ github.event.issue.number }} --add-label S-needs-triage
         fi
       env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/PRLabelChecker.yml b/.github/workflows/PRLabelChecker.yml
index 94e0db16c5..fb13ba732d 100644
--- a/.github/workflows/PRLabelChecker.yml
+++ b/.github/workflows/PRLabelChecker.yml
@@ -12,17 +12,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - name: Ensure exactly one "kind/*" label is applied
+      - name: Ensure exactly one "C-*" (Category) label is applied
         run: |
-          # Count the number of "kind/*" labels directly from the PR labels
+          # Count the number of "C-*" labels directly from the PR labels
           PR_NUMBER=${{ github.event.pull_request.number }}
-          KIND_LABEL_COUNT=$(gh pr view "$PR_NUMBER" --json labels -q '.labels.[].name' | grep -c '^kind/')
+          KIND_LABEL_COUNT=$(gh pr view "$PR_NUMBER" --json labels -q '.labels.[].name' | grep -c '^C-')
 
           if [[ "$KIND_LABEL_COUNT" -eq 1 ]]; then
-            echo "✅ Exactly one 'kind/*' label is applied."
+            echo "✅ Exactly one 'C-*' label is applied."
             exit 0
           else
-            echo "❌ PR must have exactly one 'kind/*' label, but found $KIND_LABEL_COUNT."
+            echo "❌ PR must have exactly one 'C-*' label, but found $KIND_LABEL_COUNT."
             exit 1
           fi
         env:
diff --git a/.github/workflows/ReleaseBlockerCheck.yml b/.github/workflows/ReleaseBlockerCheck.yml
index f034181211..8d20bf8748 100644
--- a/.github/workflows/ReleaseBlockerCheck.yml
+++ b/.github/workflows/ReleaseBlockerCheck.yml
@@ -34,7 +34,7 @@ jobs:
           if [[ "${{ github.ref }}" == *"refs/heads/release/"* ]]; then
             echo "Release branch detected - checking for release blockers..."
             if ! ./dev/check-release-blockers.sh "$REPO"; then
-              echo "::error::Release blocked by open issues with 'release-blocker' label"
+              echo "::error::Release blocked by open issues with P-release-blocker"
               exit 1
             fi
           else
diff --git a/.github/workflows/ReleaseBlockerLabelCleanUp.yml b/.github/workflows/ReleaseBlockerLabelCleanUp.yml
index 537272e123..ceea2648da 100644
--- a/.github/workflows/ReleaseBlockerLabelCleanUp.yml
+++ b/.github/workflows/ReleaseBlockerLabelCleanUp.yml
@@ -14,20 +14,20 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - name: Remove release-blocker label from closed issue
+      - name: Remove P-release-blocker label from closed issue
         run: |
           ISSUE_NUMBER=${{ github.event.issue.number }}
-          echo "Checking if issue #$ISSUE_NUMBER has release-blocker label..."
+          echo "Checking if issue #$ISSUE_NUMBER has P-release-blocker label..."
           
-          # Check if the issue has the release-blocker label
-          HAS_LABEL=$(gh issue view "$ISSUE_NUMBER" --json labels -q '.labels[] | select(.name == "release-blocker") | .name')
+          # Check if the issue has the P-release-blocker label
+          HAS_LABEL=$(gh issue view "$ISSUE_NUMBER" --json labels -q '.labels[] | select(.name == "P-release-blocker") | .name')
           
           if [ -n "$HAS_LABEL" ]; then
-            echo "✅ Issue #$ISSUE_NUMBER has release-blocker label, removing it..."
-            gh issue edit "$ISSUE_NUMBER" --remove-label "release-blocker"
-            echo "✅ Successfully removed release-blocker label from issue #$ISSUE_NUMBER"
+            echo "✅ Issue #$ISSUE_NUMBER has P-release-blocker label, removing it..."
+            gh issue edit "$ISSUE_NUMBER" --remove-label "P-release-blocker"
+            echo "✅ Successfully removed P-release-blocker label from issue #$ISSUE_NUMBER"
           else
-            echo "ℹ️ Issue #$ISSUE_NUMBER does not have release-blocker label, no action needed"
+            echo "ℹ️ Issue #$ISSUE_NUMBER does not have P-release-blocker label, no action needed"
           fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/RustNightly.yml b/.github/workflows/RustNightly.yml
index 61aabddc88..62ad5f728d 100644
--- a/.github/workflows/RustNightly.yml
+++ b/.github/workflows/RustNightly.yml
@@ -124,6 +124,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Nightly Failure
-        run: ./dev/notify-ci-failure.sh --title="Nightly musl Failure - ${{ github.run_number }}" --labels="area/ci-periodics-nightly,area/ci-periodics,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --title="Nightly musl Failure - ${{ github.run_number }}" --labels="A-ci-periodics-nightly,A-ci-periodics,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ValidatePullRequest.yml b/.github/workflows/ValidatePullRequest.yml
index 568497f8a7..235fe47793 100644
--- a/.github/workflows/ValidatePullRequest.yml
+++ b/.github/workflows/ValidatePullRequest.yml
@@ -98,7 +98,7 @@ jobs:
     with:
       docs_only: ${{ needs.docs-pr.outputs.docs-only }}
 
-  # Pick the goldens mode. The `regen-goldens` label means regenerate. No label means pull.
+  # Pick the goldens mode. The `S-needs-goldens` label means regenerate. No label means pull.
   # Also validate the label against the goldens state so a stale or missing label fails fast.
   check-golden-label:
     runs-on: ubuntu-latest
@@ -135,13 +135,13 @@ jobs:
         run: |
           labels="$(gh pr view ${{ github.event.pull_request.number }} \
             --repo ${{ github.repository }} --json labels -q '.labels[].name')"
-          if grep -qx regen-goldens <<<"$labels"; then
+          if grep -qx S-needs-goldens <<<"$labels"; then
             echo "should_regen_goldens=true" >> "$GITHUB_OUTPUT"
           else
             echo "should_regen_goldens=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Validate regen-goldens label
+      - name: Validate S-needs-goldens label
         if: github.event_name == 'pull_request'
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}
diff --git a/.github/workflows/WeeklyMshv618.yml b/.github/workflows/WeeklyMshv618.yml
index 13ece032d9..8cfbcbafc5 100644
--- a/.github/workflows/WeeklyMshv618.yml
+++ b/.github/workflows/WeeklyMshv618.yml
@@ -79,6 +79,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Weekly MSHV 6.18 Failure
-        run: ./dev/notify-ci-failure.sh --title="Weekly MSHV 6.18 Failure - ${{ github.run_number }}" --labels="area/ci-periodics-mshv-6.18,area/ci-periodics,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --title="Weekly MSHV 6.18 Failure - ${{ github.run_number }}" --labels="A-ci-periodics-mshv-6.18,A-ci-periodics,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ready-for-review-label.yml b/.github/workflows/ready-for-review-label.yml
index c9e23128ab..77d3e61950 100644
--- a/.github/workflows/ready-for-review-label.yml
+++ b/.github/workflows/ready-for-review-label.yml
@@ -1,6 +1,6 @@
 name: Ready-for-review (collect)
 
-# Stage 1 of a two-stage pipeline that removes the "ready-for-review" label from
+# Stage 1 of a two-stage pipeline that removes the "S-needs-review" label from
 # a pull request once it is no longer awaiting review.
 #
 # Pull-request and review events originating from FORKED repositories only ever
diff --git a/.github/workflows/ready-for-review-manage.yml b/.github/workflows/ready-for-review-manage.yml
index 7eff797694..b46ac2b89a 100644
--- a/.github/workflows/ready-for-review-manage.yml
+++ b/.github/workflows/ready-for-review-manage.yml
@@ -1,6 +1,6 @@
 name: Ready-for-review (manage)
 
-# Stage 2 of the two-stage "ready-for-review" label pipeline. It is triggered
+# Stage 2 of the two-stage "S-needs-review" label pipeline. It is triggered
 # when "Ready-for-review (collect)" completes and runs in the context of the
 # base repository's default branch, so it receives a read-write GITHUB_TOKEN
 # even when the originating event came from a fork. This is what lets us remove
@@ -69,5 +69,7 @@ jobs:
     # Shared workflow in the org-wide `.github` repository, pinned to a commit SHA.
     uses: hyperlight-dev/.github/.github/workflows/manage-ready-for-review.yml@e5e471d927d3a72676ab48433da8a99d15a32ad7
     with:
+      # TODO: Remove this override once the shared workflow defaults to S-needs-review.
+      label: S-needs-review
       # fromJSON turns the validated digit-string into a numeric input.
       pr-number: ${{ fromJSON(needs.read-pr.outputs.pr_number) }}
diff --git a/Justfile b/Justfile
index a05dd8f3d1..528fc4df2e 100644
--- a/Justfile
+++ b/Justfile
@@ -772,7 +772,7 @@ snapshot-goldens-regenerate target=default-target:
     mkdir -p target/snapshot-goldens
     cp -r "${layout}" "${dest}"
 
-# Validate the regen-goldens label against the goldens state.
+# Validate the S-needs-goldens label against the goldens state.
 # has_label is true when a PR carries the label. The label is set
 # when the current GOLDENS_VERSION was bumped and is not published.
 # base_ref is the git ref to diff the version against.
@@ -788,17 +788,17 @@ snapshot-goldens-check-label has_label base_ref image=default-snapshot-goldens-i
         base_version=""
         git cat-file -e "{{ base_ref }}:${version_file}" 2>/dev/null && base_version=$(git show "{{ base_ref }}:${version_file}" | parse_version)
         if [[ "${version}" == "${base_version}" ]]; then
-            echo "::error::regen-goldens is set but GOLDENS_VERSION is unchanged from {{ base_ref }} (${version}). A regen accompanies a version bump. Remove the label or bump the version." >&2
+            echo "::error::S-needs-goldens is set but GOLDENS_VERSION is unchanged from {{ base_ref }} (${version}). A regen accompanies a version bump. Remove the label or bump the version." >&2
             exit 1
         fi
         if published "${version}"; then
-            echo "::error::regen-goldens is set but goldens for ${version} are already published. Remove the label so CI verifies against the published goldens." >&2
+            echo "::error::S-needs-goldens is set but goldens for ${version} are already published. Remove the label so CI verifies against the published goldens." >&2
             exit 1
         fi
         echo "snapshot-goldens-check-label: OK. ${version} bumped from ${base_version} and not yet published."
     else
         if ! published "${version}"; then
-            echo "::error::goldens for ${version} are not published. Add the regen-goldens label, or run RegenSnapshotGoldens first." >&2
+            echo "::error::goldens for ${version} are not published. Add S-needs-goldens, or run RegenSnapshotGoldens first." >&2
             exit 1
         fi
         echo "snapshot-goldens-check-label: OK. ${version} is published."
diff --git a/dev/check-release-blockers.sh b/dev/check-release-blockers.sh
index cf7475c656..e25964b377 100755
--- a/dev/check-release-blockers.sh
+++ b/dev/check-release-blockers.sh
@@ -5,7 +5,7 @@ set -o pipefail
 
 ## DESCRIPTION:
 ##
-## This script checks for open issues with the 'release-blocker' label
+## This script checks for open issues with the 'P-release-blocker' label
 ## in a given GitHub repository. It exits with code 1 if any blocking
 ## issues are found, or 0 if none are found.
 ##
@@ -28,17 +28,17 @@ if [ -z "${1:-}" ]; then
 fi
 
 REPO="$1"
-echo "Checking for open issues with 'release-blocker' label in $REPO..."
+echo "Checking for open issues with 'P-release-blocker' label in $REPO..."
 
 # Extract owner and repo name from the argument
 OWNER=$(echo "$REPO" | cut -d'/' -f1)
 REPO_NAME=$(echo "$REPO" | cut -d'/' -f2)
 
-# Get all open issues with release-blocker label
+# Get all open issues with P-release-blocker label
 BLOCKING_ISSUES=$(gh api graphql -f query='
   query($owner: String!, $repo: String!) {
     repository(owner: $owner, name: $repo) {
-      issues(first: 100, states: OPEN, labels: ["release-blocker"]) {
+      issues(first: 100, states: OPEN, labels: ["P-release-blocker"]) {
         totalCount
         nodes {
           number
@@ -55,7 +55,7 @@ if [ "$BLOCKER_COUNT" -gt 0 ]; then
     echo "❌ Found $BLOCKER_COUNT open release-blocking issue(s):"
     echo "$BLOCKING_ISSUES" | jq -r '.nodes[] | "  - #\(.number): \(.title) (\(.url))"'
     echo ""
-    echo "Release blocked by open issue(s) with 'release-blocker' label"
+    echo "Release blocked by open issue(s) with 'P-release-blocker' label"
     exit 1
 else
     echo "✅ No open release blocking issues found"
diff --git a/dev/notify-ci-failure.sh b/dev/notify-ci-failure.sh
index 69be564c1b..804939ec87 100755
--- a/dev/notify-ci-failure.sh
+++ b/dev/notify-ci-failure.sh
@@ -20,16 +20,16 @@ set -o pipefail
 ## 
 ## Usage examples:
 ##   ./dev/notify-fuzzing-failure.sh
-##   ./dev/notify-fuzzing-failure.sh --title="Nightly Failure" --labels="area/testing,kind/bug"
+##   ./dev/notify-fuzzing-failure.sh --title="Nightly Failure" --labels="A-testing,C-bug"
 ##   ./dev/notify-fuzzing-failure.sh --test
 ## Run this script locally like:
-##   GITHUB_REPOSITORY="fork/hyperlight" GITHUB_RUN_ID=1 ./dev/notify-fuzzing-failure.sh --title="Nightly Failure" --labels="area/testing,kind/bug"
+##   GITHUB_REPOSITORY="fork/hyperlight" GITHUB_RUN_ID=1 ./dev/notify-fuzzing-failure.sh --title="Nightly Failure" --labels="A-testing,C-bug"
 
 REPO="${GITHUB_REPOSITORY:-hyperlight-dev/hyperlight}"
 WORKFLOW_RUN_URL="${GITHUB_SERVER_URL:-https://github.com}/${REPO}/actions/runs/${GITHUB_RUN_ID:-unknown}"
 TEST_MODE=false
 ISSUE_TITLE=""
-LABELS="area/testing,kind/bug,area/fuzzing,lifecycle/needs-review"
+LABELS="A-testing,C-bug,A-fuzzing,S-needs-triage"
 
 for arg in "$@"; do
     case $arg in
@@ -53,7 +53,7 @@ done
 IFS=',' read -r -a LABEL_ARRAY <<< "$LABELS"
 
 # Choose a label to search existing issues for; prefer the first label if present
-SEARCH_LABEL="${LABEL_ARRAY[0]:-area/fuzzing}"
+SEARCH_LABEL="${LABEL_ARRAY[0]:-A-fuzzing}"
 
 # Build issue title if not provided
 if [ -z "$ISSUE_TITLE" ]; then
diff --git a/docs/how-to-make-releases.md b/docs/how-to-make-releases.md
index 4d377c7e44..4b9afe1e1d 100644
--- a/docs/how-to-make-releases.md
+++ b/docs/how-to-make-releases.md
@@ -4,7 +4,7 @@ This document details the process of releasing a new version of Hyperlight to [c
 
 ## Resolve any release blockers
 
-Before starting the release process, check for open issues labeled `release-blocker` in the [issue tracker](https://github.com/hyperlight-dev/hyperlight/issues?q=is%3Aissue+is%3Aopen+label%3Arelease-blocker). All such issues must be resolved (closed) before proceeding — the ["Create a Release"](https://github.com/hyperlight-dev/hyperlight/actions/workflows/CreateRelease.yml) workflow runs a [release blocker check](https://github.com/hyperlight-dev/hyperlight/actions/workflows/ReleaseBlockerCheck.yml) as its first step, and all subsequent jobs depend on it, so the publish will fail if any `release-blocker` issues remain open.
+Before starting the release process, check for open issues labeled `P-release-blocker` in the [issue tracker](https://github.com/hyperlight-dev/hyperlight/issues?q=is%3Aissue+is%3Aopen+label%3AP-release-blocker). All such issues must be resolved (closed) before proceeding — the ["Create a Release"](https://github.com/hyperlight-dev/hyperlight/actions/workflows/CreateRelease.yml) workflow runs a [release blocker check](https://github.com/hyperlight-dev/hyperlight/actions/workflows/ReleaseBlockerCheck.yml) as its first step, and all subsequent jobs depend on it, so the publish will fail if any `P-release-blocker` issues remain open.
 
 ## Update Cargo.toml Versions
 
diff --git a/docs/snapshot-versioning.md b/docs/snapshot-versioning.md
index 1a92a423bc..360b557f81 100644
--- a/docs/snapshot-versioning.md
+++ b/docs/snapshot-versioning.md
@@ -140,7 +140,7 @@ Steps:
    format, dispatching on `abi_version`.
 5. Update the tripwire assertions in `tripwires.rs` and any affected
    tests to match the new values.
-6. Bump `GOLDENS_VERSION` to the next major. Apply the `regen-goldens`
+6. Bump `GOLDENS_VERSION` to the next major. Apply the `S-needs-goldens`
    label to the pull request so the verify job regenerates against the
    branch. See
    [Breaking the format on a pull request](#breaking-the-format-on-a-pull-request)
@@ -168,7 +168,7 @@ Steps:
 3. Bump `SNAPSHOT_ABI_VERSION`.
 4. Update the tripwire assertions in `tripwires.rs` and any affected
    tests to match the new values.
-5. Bump `GOLDENS_VERSION` to the next major. Apply the `regen-goldens`
+5. Bump `GOLDENS_VERSION` to the next major. Apply the `S-needs-goldens`
    label to the pull request so the verify job regenerates against the
    branch. See
    [Breaking the format on a pull request](#breaking-the-format-on-a-pull-request)
@@ -187,7 +187,7 @@ loads the tag `{GOLDENS_VERSION}-{arch}-{hv}-{cpu}-{profile}` from a
 local directory that `just snapshot-goldens-pull` populates from GHCR. A
 freshly bumped `GOLDENS_VERSION` has no tags on GHCR until the bump
 merges to `main` and the publish workflow runs, so pull requests that
-bump the version verify through the `regen-goldens` label instead (see
+bump the version verify through the `S-needs-goldens` label instead (see
 [Breaking the format on a pull request](#breaking-the-format-on-a-pull-request)).
 
 A snapshot is bound to its CPU vendor. The loader rejects a snapshot
@@ -235,7 +235,7 @@ frozen from then on. The publish workflow only publishes a version
 whose completion marker is absent from GHCR, so a published baseline
 cannot be clobbered by a later run. While a developer iterates on a v1
 to v2 bump the new version is unpublished, so they verify locally with
-`just snapshot-goldens-generate` and the `regen-goldens` label rather
+`just snapshot-goldens-generate` and the `S-needs-goldens` label rather
 than pushing to GHCR.
 
 The freeze is enforced by the publish workflow's marker check, not by a
@@ -252,7 +252,7 @@ corrupted push.
 
 A pull request that bumps `GOLDENS_VERSION` introduces a tag set that
 GHCR does not carry yet, so the default pull-and-verify path has nothing
-to load. The `regen-goldens` label switches the verify job into
+to load. The `S-needs-goldens` label switches the verify job into
 regenerate mode for that pull request.
 
 * **Without the label**, the job pulls the published tag set for the
@@ -260,7 +260,7 @@ regenerate mode for that pull request.
   tags fail the job. This is what turns an accidental format break into
   a red build: the published bytes stop loading, and the author must
   either restructure the change or own the break with the label.
-* **With the `regen-goldens` label**, the job generates the current
+* **With the `S-needs-goldens` label**, the job generates the current
   golden from the branch source, pulls the `COMPAT_VERSIONS` goldens
   from the registry, and runs both through the branch loader. This
   proves the new format is internally loadable on each runner and that
@@ -306,7 +306,7 @@ with `force: true` republishes a version that already exists, reserved
 for recovering a corrupted or partial push.
 
 The push-triggered publish closes the window in which a pull request
-that bumped the version needs the `regen-goldens` label. Once `main`
+that bumped the version needs the `S-needs-goldens` label. Once `main`
 carries the bump and the publish lands, new pull requests pass on the
 default pull-and-verify path.
 
@@ -344,7 +344,7 @@ Steps:
 2. Bump `GOLDENS_VERSION` minor (e.g. `v1.2` to `v1.3`). The new prefix
    has no published tags, so the default verify path fails until they
    exist.
-3. Apply the `regen-goldens` label to the pull request. The verify job
+3. Apply the `S-needs-goldens` label to the pull request. The verify job
    regenerates the full check set against the branch and runs it back
    through the branch loader. See
    [Breaking the format on a pull request](#breaking-the-format-on-a-pull-request).