diff --git a/src/content/changes/highlights/2025-04-17.md b/src/content/changes/highlights/2025-04-17.md
new file mode 100644
index 0000000000..6c099f5eaa
--- /dev/null
+++ b/src/content/changes/highlights/2025-04-17.md
@@ -0,0 +1,76 @@
+---
+date: 2025-04-17T14:00:00
+title: Highlights for the week ending 2025-04-17
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [observability-operator](https://github.com/giantswarm/observability-operator) 
+  - [0.24.0](https://github.com/giantswarm/observability-
+operator/compare/v0.23.2...v0.24.0) 
+      * Update Silence link in notification-template to point to the new GitOps approach.
+      * Add `helm.sh/resource-policy: keep` annotation on the grafana organization CRD to prevent it's deletion.
+- [backstage](https://github.com/giantswarm/backstage) 
+  - [0.64.2](https://github.com/giantswarm/backstage/compare/v0.64.1...v0.64.2) 
+In this release, cluster details page component was refactored to simplify the
+rendering flow.
+See
+[./docs/releases/v0.64.2-changelog.md](./docs/releases/v0.64.2-changelog.md)
+for more information.
+  - [0.64.1](https://github.com/giantswarm/backstage/compare/v0.64.0...v0.64.1) 
+In this release:
+      * custom scaffolder actions were replaced with the `@devangelista/backstage-scaffolder-kubernetes` plugin;
+      * the bug where the cluster details page may be displayed as blank was fixed.
+See
+[./docs/releases/v0.64.1-changelog.md](./docs/releases/v0.64.1-changelog.md)
+for more information. 
+
+
+  - [0.64.0](https://github.com/giantswarm/backstage/compare/v0.63.1...v0.64.0) 
+In this release:
+      * Dex sign-in resolver was changed to use username from an email as user reference;
+      * `gitopsRepositories` configuration was changed to support GitHub repositories by default.
+See
+[./docs/releases/v0.64.0-changelog.md](./docs/releases/v0.64.0-changelog.md)
+for more information. 
+
+
+- [konfigure-operator](https://github.com/giantswarm/konfigure-operator) 
+  - [0.3.0](https://github.com/giantswarm/konfigure-
+operator/compare/v0.2.0...v0.3.0) 
+      * Use a single `CiliumNetworkPolicy` to access Kubernetes API and allow traffic within the cluster.
+      * Remove `NetworkPolicy` that only allowed access to the Flux `source-controller`. Replaced with above `CiliumNetworkPolicy`.
+  - [0.2.0](https://github.com/giantswarm/konfigure-
+operator/compare/v0.1.2...v0.2.0) 
+      * Support `.spec.reconciliation.suspend` on `ManagementClusterConfiguration` CRD.
+      * Support Helm chart value `.image.pullPolicy`, defaults to: `IfNotPresent`. 
+
+
+- [kyverno-policies-ux](https://github.com/giantswarm/kyverno-policies-ux) 
+  - [0.10.0](https://github.com/giantswarm/kyverno-policies-
+ux/compare/v0.9.0...v0.10.0) 
+      * Add `clusterRole` to support Kyverno `v0.19.0`.
+  - [0.9.0](https://github.com/giantswarm/kyverno-policies-
+ux/compare/v0.8.0...v0.9.0) 
+      * Prevent active releases from being deleted.
+      * Cluster names can start with a number. Remove restriction that prevented that. 
+
+
+- [cert-manager-app](https://github.com/giantswarm/cert-manager-app) 
+  - [3.9.1](https://github.com/giantswarm/cert-manager-
+app/compare/v3.9.0...v3.9.1) 
+      * Added Vertical Pod Autoscaler support for `controller` pods.
+      * Added renovate configutarion
+      * Removed dependabot configuration
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-04-24.md b/src/content/changes/highlights/2025-04-24.md
new file mode 100644
index 0000000000..9f2f6bc9d2
--- /dev/null
+++ b/src/content/changes/highlights/2025-04-24.md
@@ -0,0 +1,86 @@
+---
+date: 2025-04-24T14:00:00
+title: Highlights for the week ending 2025-04-24
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [logging-operator](https://github.com/giantswarm/logging-operator) 
+  - [0.28.0](https://github.com/giantswarm/logging-
+operator/compare/v0.27.0...v0.28.0) 
+      * Fix network policy to support loading Prometheus Rules for logs (clustering and loki-backend direct access on MCs).
+  - [0.27.0](https://github.com/giantswarm/logging-
+operator/compare/v0.26.1...v0.27.0) 
+      * Add support for loading log-based Prometheus Rules in the Loki Ruler from management and workload clusters. 
+
+
+- [object-storage-operator](https://github.com/giantswarm/object-storage-operator) 
+  - [0.10.4](https://github.com/giantswarm/object-storage-
+operator/compare/v0.10.3...v0.10.4) 
+      * Fix golangci-lint v2 problems.
+- [observability-operator](https://github.com/giantswarm/observability-operator) 
+  - [0.26.0](https://github.com/giantswarm/observability-
+operator/compare/v0.25.0...v0.26.0) 
+      * Add validation webhook to validate the alertmanager config before it is send to the alertmanager.
+      * Ensure support for loading Prometheus Rules in the Mimir Ruler from workload clusters is only enabled for observability-bundle version 1.9.0 and above (extra query matchers have been added in alloy 1.5.0).
+  - [0.25.0](https://github.com/giantswarm/observability-
+operator/compare/v0.24.0...v0.25.0) 
+      * Add support for loading Prometheus Rules in the Mimir Ruler from workload clusters.
+      * Load Prometheus Rules in the Mimir Ruler via Alloy Metrics instead of Alloy Rules on management clusters.
+      * Remove loading of Prometheus Rules for logs into the Loki Ruler via Alloy Rules as it is now managed by Alloy Logs. 
+
+
+- [prometheus-rules](https://github.com/giantswarm/prometheus-rules) 
+  - [4.55.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.54.1...v4.55.0) 
+      * Improve ClusterCrossplaneResourcesNotReady with new metrics where available
+      * Improve alert for Karpenter machines not being Ready
+      * Use `exported_namespace` for certificate expiration alerts.
+      * Remove alerts related to `alloy-rules`.
+- [kyverno-policies-ux](https://github.com/giantswarm/kyverno-policies-ux) 
+  - [0.11.0](https://github.com/giantswarm/kyverno-policies-
+ux/compare/v0.10.0...v0.11.0) 
+      * Add `clusterRole` for `admission-controller` on `cloud-director` clusters to support Kyverno `v0.19.0`.
+- [aws-load-balancer-controller-app](https://github.com/giantswarm/aws-load-balancer-controller-app) 
+  - [2.2.0](https://github.com/giantswarm/aws-load-balancer-controller-
+app/compare/v2.1.0...v2.2.0) 
+      * Get rid of legacy in-house slo framework.
+      * Set home URL in chart metadata.
+- [azure-workload-identity-webhook-app](https://github.com/giantswarm/azure-workload-identity-webhook-app) 
+  - [0.2.0](https://github.com/giantswarm/azure-workload-identity-webhook-
+app/compare/v0.1.1...v0.2.0) 
+      * Chart: Update to upstream v1.5.0. ([#11](https://github.com/giantswarm/azure-workload-identity-webhook-app/pull/11))
+  - [0.1.1](https://github.com/giantswarm/azure-workload-identity-webhook-
+app/compare/v0.1.0...v0.1.1) 
+      * Chart: Further increase memory limit. ([#9](https://github.com/giantswarm/azure-workload-identity-webhook-app/pull/9)) 
+
+
+  - [0.1.0](https://github.com/giantswarm/azure-workload-identity-webhook-
+app/releases/tag/v0.1.0) 
+      * Repository: Some chores. ([#6](https://github.com/giantswarm/azure-workload-identity-webhook-app/pull/6))
+      * CircleCI: Fix app collection namespace. ([#7](https://github.com/giantswarm/azure-workload-identity-webhook-app/pull/7)) 
+
+
+- [nos-app](https://github.com/giantswarm/nos-app) 
+  - [0.1.2](https://github.com/giantswarm/nos-app/compare/v0.1.1...v0.1.2) 
+      * Actual fix for values
+  - [0.1.1](https://github.com/giantswarm/nos-app/compare/v0.1.0...v0.1.1) 
+      * try to fix broken webhook 
+
+
+- [teleport-kube-agent-app](https://github.com/giantswarm/teleport-kube-agent-app) 
+  - [0.10.5](https://github.com/giantswarm/teleport-kube-agent-
+app/compare/v0.10.4...v0.10.5) 
+      * Set Home URL in chart metadata.
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-05-01.md b/src/content/changes/highlights/2025-05-01.md
new file mode 100644
index 0000000000..9fc72f5235
--- /dev/null
+++ b/src/content/changes/highlights/2025-05-01.md
@@ -0,0 +1,122 @@
+---
+date: 2025-05-01T14:00:00
+title: Highlights for the week ending 2025-05-01
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [dashboards](https://github.com/giantswarm/dashboards) 
+  - [4.4.3](https://github.com/giantswarm/dashboards/compare/v4.4.2...v4.4.3) 
+      * dns dashboard: fixed logs row
+  - [4.4.2](https://github.com/giantswarm/dashboards/compare/v4.4.1...v4.4.2) 
+### Chunged
+      * Cluster Overview dashboard: improve alerts links 
+
+
+  - [4.4.1](https://github.com/giantswarm/dashboards/compare/v4.4.0...v4.4.1) 
+      * alerts timeline dashboard:
+        * fix silences count
+        * add links to silences, alerts, notifications
+        * fix consistency between alerts timeline and alerts list
+        * update title
+      * alertmanager overview update to mimir alertmanager 
+
+
+- [grafana-app](https://github.com/giantswarm/grafana-app) 
+  - [2.21.0](https://github.com/giantswarm/grafana-app/compare/v2.20.0...v2.21.0)
+      * Fix CNP apiversion and fix changelog and app version.
+      * upgrade grafana chart: 8.11.3 => 8.14.0
+      * upgrade grafana : 11.5.1 => 11.6.1
+- [observability-operator](https://github.com/giantswarm/observability-operator) 
+  - [0.28.0](https://github.com/giantswarm/observability-
+operator/compare/v0.27.0...v0.28.0) 
+      * Fix alertmanager configuration to not drop alerts when stable-testing management cluster's default apps are failing.
+      * Remove alloy-rules deletion code which is no longer needed since the last release.
+      * Remove PodSecurityPolicy.
+- [prometheus-rules](https://github.com/giantswarm/prometheus-rules) 
+  - [4.57.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.56.1...v4.57.0) 
+      * PromtailRequestsErrors does not fire anymore when alloy-logs is running
+      * Added PromtailConflictsWithAlloy alert
+  - [4.56.1](https://github.com/giantswarm/prometheus-
+rules/compare/v4.56.0...v4.56.1) 
+      * Reenabled storage alerts LogVolumeSpaceTooLow and RootVolumeSpaceTooLow as paging during working hours until we have node problem detector deployed.
+      * Fix SLOs recording rules sent to Grafana Cloud that sometimes trigger PrometheusRulesFailure due to the origin metric pod changing. 
+
+
+- [cilium-app](https://github.com/giantswarm/cilium-app) 
+  - [1.1.0](https://github.com/giantswarm/cilium-app/compare/v1.0.0...v1.1.0) 
+      * Upgrade Cilium to [v1.17.3](https://github.com/cilium/cilium/releases/tag/v1.17.3).
+  - [0.31.3](https://github.com/giantswarm/cilium-app/compare/v0.31.2...v0.31.3)
+      * Upgrade Cilium to [v1.16.9](https://github.com/cilium/cilium/releases/tag/v1.16.9). 
+
+
+- [backstage](https://github.com/giantswarm/backstage) 
+  - [0.71.0](https://github.com/giantswarm/backstage/compare/v0.70.0...v0.71.0) 
+In this release:
+      * Cloud Director support was added;
+      * GS auth backend module was changed to use `fetch` method from `node-fetch` package.
+See
+[./docs/releases/v0.71.0-changelog.md](./docs/releases/v0.71.0-changelog.md)
+for more information.
+  - [0.70.0](https://github.com/giantswarm/backstage/compare/v0.69.0...v0.70.0) 
+In this release, custom Kubernetes client was improved. Now it delegates
+unimplemented methods to the standard Kubernetes backend client.
+See
+[./docs/releases/v0.70.0-changelog.md](./docs/releases/v0.70.0-changelog.md)
+for more information. 
+
+
+  - [0.69.0](https://github.com/giantswarm/backstage/compare/v0.68.0...v0.69.0) 
+In this release, custom GitHub auth provider was removed.
+See
+[./docs/releases/v0.69.0-changelog.md](./docs/releases/v0.69.0-changelog.md)
+for more information. 
+
+
+- [konfigure-operator](https://github.com/giantswarm/konfigure-operator) 
+  - [0.5.0](https://github.com/giantswarm/konfigure-
+operator/compare/v0.4.0...v0.5.0) 
+      * Add push releases to CAPx root collection repositories.
+  - [0.4.0](https://github.com/giantswarm/konfigure-
+operator/compare/v0.3.1...v0.4.0) 
+      * Push to `control-plane-catalog` instead of `giantswarm`. 
+
+
+- [azure-ad-pod-identity-app](https://github.com/giantswarm/azure-ad-pod-identity-app) 
+  - [0.16.0](https://github.com/giantswarm/azure-ad-pod-identity-
+app/compare/v0.15.4...v0.16.0) 
+      * Bump `apiVersion` for Kyverno PolicyExceptions from `v2alpha1` to `v2beta1`.
+      * Fixed liveness probe configuration by explicitly exposing probe ports in NMI daemonset and MIC deployment.
+- [nos-app](https://github.com/giantswarm/nos-app) 
+  - [0.2.0](https://github.com/giantswarm/nos-app/compare/v0.1.2...v0.2.0) 
+      * Make cilium network policies optional.
+      * Make cluster issuer work in non GS clusters.
+- [cluster-vsphere](https://github.com/giantswarm/cluster-vsphere) 
+  - [1.2.0](https://github.com/giantswarm/cluster-vsphere/compare/v1.1.0...v1.2.0)
+      * Update `kube-vip` to `0.9.0`.
+      * Update `kube-vip` to `0.9.1`.
+- [auth-bundle](https://github.com/giantswarm/auth-bundle) 
+  - [0.2.3](https://github.com/giantswarm/auth-bundle/compare/v0.1.2...v0.2.3) 
+- [kyverno-crds](https://github.com/giantswarm/kyverno-crds) 
+  - [1.13.1](https://github.com/giantswarm/kyverno-crds/compare/v1.13.0...v1.13.1)
+      * Bring back `PolicyExceptions v2alpha1` API version.
+- [organization-operator](https://github.com/giantswarm/organization-operator) 
+  - [2.1.0](https://github.com/giantswarm/organization-
+operator/compare/v2.0.2...v2.1.0) 
+      * Enable TLS and authentication for metrics endpoint.
+      * `golang` version updated to `1.24`
+      * Update go dependencies.
+      * Remove unused code left over from migration to kubebuilder.
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-05-08.md b/src/content/changes/highlights/2025-05-08.md
new file mode 100644
index 0000000000..00a0efeebb
--- /dev/null
+++ b/src/content/changes/highlights/2025-05-08.md
@@ -0,0 +1,62 @@
+---
+date: 2025-05-08T14:00:00
+title: Highlights for the week ending 2025-05-08
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [dashboards](https://github.com/giantswarm/dashboards) 
+  - [4.5.0](https://github.com/giantswarm/dashboards/compare/v4.4.3...v4.5.0) 
+      * Add Konfigure Operator dashboard
+- [observability-operator](https://github.com/giantswarm/observability-operator) 
+  - [0.29.0](https://github.com/giantswarm/observability-
+operator/compare/v0.28.0...v0.29.0) 
+      * Switch alloy-metrics secret from env variables to alloy `remote.kubernetes.secret` component to support secret changes without having to terminate pods.
+- [prometheus-rules](https://github.com/giantswarm/prometheus-rules) 
+  - [4.58.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.57.0...v4.58.0) 
+      * DeploymentNotSatisfiedAtlas: lower sensitivity and page only during business hours
+      * Add new alert `ClusterUpgradeStuck` to detect if the cluster app cannot be upgraded.
+- [flux-app](https://github.com/giantswarm/flux-app) 
+  - [1.6.0](https://github.com/giantswarm/flux-app/compare/v1.5.0...v1.6.0) 
+      * Updgrade Flux to 2.3.0 version.
+- [cloudnative-pg-app](https://github.com/giantswarm/cloudnative-pg-app) 
+  - [0.0.8](https://github.com/giantswarm/cloudnative-pg-
+app/compare/v0.0.7...v0.0.8) 
+      * Update to cloudnative-pg v1.25.1 (chart v0.23.2).
+      * Update <https://github.com/cloudnative-pg/grafana-dashboards> from v0.0.2 to v0.0.4.
+- [dex-app](https://github.com/giantswarm/dex-app) 
+  - [1.42.14](https://github.com/giantswarm/dex-app/compare/v1.42.13...v1.42.14)
+      * Added renovate configuration
+      * Make Ingress annotations configurable via values (`.Values.ingress.annotations`)
+      * Increased request header size limit in NGINX ingress controller annotations
+      * Removed dependabot configuration
+- [etcd-backup-operator](https://github.com/giantswarm/etcd-backup-operator) 
+  - [4.13.0](https://github.com/giantswarm/etcd-backup-
+operator/compare/v4.12.0...v4.13.0) 
+      * Add option to use IAM Roles for Service Accounts (IRSA) for `etcd-backup-operator`.
+      * Fix linting issues.
+- [event-exporter-app](https://github.com/giantswarm/event-exporter-app) 
+  - [2.2.0](https://github.com/giantswarm/event-exporter-
+app/compare/v2.1.0...v2.2.0) 
+      * Include source.component from the CAPI events (cluster-api-events-controller).
+- [vertical-pod-autoscaler-app](https://github.com/giantswarm/vertical-pod-autoscaler-app) 
+  - [5.4.1](https://github.com/giantswarm/vertical-pod-autoscaler-
+app/compare/v5.4.0...v5.4.1) 
+      * Chart: Update Helm release vertical-pod-autoscaler to v10.0.1. ([#346](https://github.com/giantswarm/vertical-pod-autoscaler-app/pull/346))
+- [vertical-pod-autoscaler-crd](https://github.com/giantswarm/vertical-pod-autoscaler-crd) 
+  - [3.2.1](https://github.com/giantswarm/vertical-pod-autoscaler-
+crd/compare/v3.2.0...v3.2.1) 
+      * Chart: Sync to upstream. ([#136](https://github.com/giantswarm/vertical-pod-autoscaler-crd/pull/136))
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-05-15.md b/src/content/changes/highlights/2025-05-15.md
new file mode 100644
index 0000000000..2046ba6c16
--- /dev/null
+++ b/src/content/changes/highlights/2025-05-15.md
@@ -0,0 +1,129 @@
+---
+date: 2025-05-15T14:00:00
+title: Highlights for the week ending 2025-05-15
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [grafana-app](https://github.com/giantswarm/grafana-app) 
+  - [2.22.0](https://github.com/giantswarm/grafana-app/compare/v2.21.1...v2.22.0)
+      * upgrade grafana chart: 8.15.0 => 9.0.0
+      * upgrade grafana : 11.6.1 => 12.0.0
+  - [2.21.1](https://github.com/giantswarm/grafana-app/compare/v2.21.0...v2.21.1)
+      * upgrade grafana chart: 8.14.0 => 8.15.0 
+
+
+- [loki-app](https://github.com/giantswarm/loki-app) 
+  - [0.28.1](https://github.com/giantswarm/loki-app/compare/v0.28.0...v0.28.1) 
+      * Upgraded upstream chart from 6.27.0 to 6.29.0 - see [changelog](https://github.com/grafana/loki/blob/main/production/helm/loki/CHANGELOG.md) for more information.
+      * ensured `.loki.enabled: false` prevents creating any resource
+- [object-storage-operator](https://github.com/giantswarm/object-storage-operator) 
+  - [0.11.0](https://github.com/giantswarm/object-storage-
+operator/compare/v0.10.4...v0.11.0) 
+      * Azure: read ClusterIdentity's namespace from Cluster resource
+- [observability-bundle](https://github.com/giantswarm/observability-bundle) 
+  - [1.14.0](https://github.com/giantswarm/observability-
+bundle/compare/v1.13.0...v1.14.0) 
+- [observability-operator](https://github.com/giantswarm/observability-operator) 
+  - [0.30.0](https://github.com/giantswarm/observability-
+operator/compare/v0.29.0...v0.30.0) 
+      * Remove crds template as the CRDs are now deployed via management-cluster-bases (https://github.com/giantswarm/management-cluster-bases/pull/232)
+      * Grafana API client is now generated on every requests to support grafana secret changes and allows for better mc-bootstrap testing (https://github.com/giantswarm/giantswarm/issues/32664)
+      * Updated alertmanager's inhibitions, getting rid of vintage-specifics.
+      * Clean up old teams and unused inhibitions.
+- [kube-prometheus-stack-app](https://github.com/giantswarm/kube-prometheus-stack-app) 
+  - [16.0.0](https://github.com/giantswarm/kube-prometheus-stack-
+app/compare/v15.0.0...v16.0.0) 
+      * Upgraded chart dependency to [kube-prometheus-stack-72.3.0](https://github.com/prometheus-community/helm-charts/releases/tag/kube-prometheus-stack-72.3.0)
+      * prometheus-operator to [0.82.0](https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.82.0)
+- [prometheus-operator-crd](https://github.com/giantswarm/prometheus-operator-crd) 
+  - [16.0.0](https://github.com/giantswarm/prometheus-operator-
+crd/compare/v15.0.0...v16.0.0) 
+      * Upgrade CRDs chart to 20.0.0 (prometheus-operator 0.82.0) - See [upstream changelog](https://github.com/prometheus-operator/prometheus-operator/blob/main/CHANGELOG.md#0820--2025-04-17) for more information
+- [prometheus-rules](https://github.com/giantswarm/prometheus-rules) 
+  - [4.61.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.60.0...v4.61.0) 
+      * Add `grafana-postgresql` in the `ObservabilityStorageSpaceTooLow` alert's monitored PVCs.
+      * Add `GrafanaPostgresqlReplicationFailure` and `GrafanaPostgresqlArchivingFailure` alerting rules in `grafana.rules.yml`.
+      * Vintage cleanup:
+      * Removed code behind obvious vintage/capi conditions in Cabbage rules.
+      * Removed code behind obvious vintage/capi conditions in Honeybadger rules.
+      * Removed code behind obvious vintage/capi conditions in Tenet rules.
+      * Removed code behind obvious vintage/capi conditions in Shield rules.
+      * Remove the "aws" provider.
+      * Clean up mimir-heartbeat type that was needed when we have both old and new heartbeats.
+      * Add `CAPATooManyReconciliations` to page when CAPA controllers are stuck reconciling over and over.
+  - [4.60.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.59.2...v4.60.0) 
+      * Add `OnPremCloudProviderAPIIsDown` alert to all clusters
+      * Vintage cleanup:
+      * Stopped running tests for vintage. Meaning some vintage-specific labels had to be removed.
+      * Removed code behind obvious vintage/capi conditions in Atlas rules.
+      * Removed code behind obvious vintage/capi conditions in Phoenix rules. 
+
+
+  - [4.59.2](https://github.com/giantswarm/prometheus-
+rules/compare/v4.59.1...v4.59.2) 
+      * Improved `AlloyUnhealthyComponents` alert by adding pod name 
+
+
+  - [4.59.1](https://github.com/giantswarm/prometheus-
+rules/compare/v4.59.0...v4.59.1) 
+      * `LogForwardingErrors`: don't page out of business hours 
+
+
+- [silence-operator](https://github.com/giantswarm/silence-operator) 
+  - [0.15.0](https://github.com/giantswarm/silence-
+operator/compare/v0.14.1...v0.15.0) 
+      * Migrate from Giant Swarm deprecated operatorkit framework to kube-builder.
+      * Add CiliumNetworkPolicy support.
+      * Migrate from Giant Swarm deprecated `operatorkit` framework to `kube-builder`. This change introduces a few **breaking changes** :
+      * Operator configuration has been moved from a configmap to command-line arguments. **This does not affect helm chart users**
+      * The operator needs new rbac capabilities to be able manage `leases` and to create `events`
+      * http port has been changed from 8000 to 8080.
+      * Finalizers set on silences have been changed from `operatorkit.giantswarm.io/silence-operator-silence-controller` to `monitoring.giantswarm.io/silence-protection`
+      * **helm** `.registry.domain` has been renamed to `image.registry` ( **breaking change** )
+      * **helm** deprecated PodSecurityPolicy has been removed ( **breaking change** with kubernetes < 1.25)
+      * Use `app-build-suite` to build the operator.
+      * Changed container image from alpine to a non-root distroless image.
+      * Fixed the linting errors from golangci-lint v2.
+      * Remove the unnecessary sync job to rely on GitOps. **Breaking change** : this means that you should now use your favorite GitOps tool (flux, ArgoCD) to deploy silences on your clusters.
+      * Removed Giant Swarm legacy `microerrors` package for error handling
+- [backstage](https://github.com/giantswarm/backstage) 
+  - [0.72.1](https://github.com/giantswarm/backstage/compare/v0.72.0...v0.72.1) 
+In this release, Helm chart templates have been cleaned up.
+See
+[./docs/releases/v0.72.1-changelog.md](./docs/releases/v0.72.1-changelog.md)
+for more information.
+  - [0.72.0](https://github.com/giantswarm/backstage/compare/v0.71.0...v0.72.0) 
+In this release:
+      * headless backend package has been added to serve auth and scaffolder plugins separately from the main backend instance;
+      * custom discovery and scaffolder API clients have been added to interact with the headless backend instances.
+See
+[./docs/releases/v0.72.0-changelog.md](./docs/releases/v0.72.0-changelog.md)
+for more information. 
+
+
+- [konfigure](https://github.com/giantswarm/konfigure) 
+  - [1.0.0](https://github.com/giantswarm/konfigure/compare/v0.17.2...v1.0.0) 
+      * Almost completely exposed previously internal functions to generate the raw configurations in order to be able to use this logic as a library, e.g. in [konfigure-operator](https://github.com/giantswarm/konfigure-operator/). In was merely a refactor and exposing functionality without changing any functionality.
+      * Replace `microerror` with normal Go errors.
+      * Replace `micrologger` with `logr` interface and `zapr` as implementation.
+- [konfigure-operator](https://github.com/giantswarm/konfigure-operator) 
+  - [0.5.1](https://github.com/giantswarm/konfigure-
+operator/compare/v0.5.0...v0.5.1) 
+- [etcd-defrag-app](https://github.com/giantswarm/etcd-defrag-app) 
+  - [1.0.4](https://github.com/giantswarm/etcd-defrag-app/compare/v1.0.3...v1.0.4)
+      * Chart: Update dependency ahrtr/etcd-defrag to v0.27.0. ([#29](https://github.com/giantswarm/etcd-defrag-app/pull/29))
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-05-22.md b/src/content/changes/highlights/2025-05-22.md
new file mode 100644
index 0000000000..b6eafa6157
--- /dev/null
+++ b/src/content/changes/highlights/2025-05-22.md
@@ -0,0 +1,105 @@
+---
+date: 2025-05-22T14:00:00
+title: Highlights for the week ending 2025-05-22
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [kyverno-policies-observability](https://github.com/giantswarm/kyverno-policies-observability) 
+  - [0.7.0](https://github.com/giantswarm/kyverno-policies-
+observability/compare/v0.6.0...v0.7.0) 
+      * Each policy now has a matching ClusterRole
+- [observability-bundle](https://github.com/giantswarm/observability-bundle) 
+  - [1.14.1](https://github.com/giantswarm/observability-
+bundle/compare/v1.14.0...v1.14.1) 
+      * Reconfigure Flux-related part of the KSM to use wildcards instead of hardcoded versions.
+      * Rename Flux-related metrics produced by the KSM.
+- [silence-operator](https://github.com/giantswarm/silence-operator) 
+  - [0.16.1](https://github.com/giantswarm/silence-
+operator/compare/v0.16.0...v0.16.1) 
+      * Remove duplicate container `securityContext` from the Helm chart deployment template.
+  - [0.16.0](https://github.com/giantswarm/silence-
+operator/compare/v0.15.0...v0.16.0) 
+      * Helm chart now supports conditional installation of the Silence CRD via the `crds.install` value. The CRD is templated and installed by default, but you can disable it by setting `crds.install` to `false`. 
+
+
+- [observability-policies-app](https://github.com/giantswarm/observability-policies-app) 
+  - [0.0.2](https://github.com/giantswarm/observability-policies-
+app/compare/v0.0.1...v0.0.2) 
+      * Add Cluster Role to allow latest Kyverno versions to work (https://github.com/giantswarm/giantswarm/issues/33416)
+      * Switch `.Values.disabled` to `.Values.enabled` to follow best practices.
+- [cilium-app](https://github.com/giantswarm/cilium-app) 
+  - [1.1.1](https://github.com/giantswarm/cilium-app/compare/v1.1.0...v1.1.1) 
+      * Upgrade Cilium to [v1.17.4](https://github.com/cilium/cilium/releases/tag/v1.17.4).
+      * Cilium v1.17.4 disables kubernetes api connectivity check for liveness probes. (Upstream PR: https://github.com/cilium/cilium/pull/38703)
+  - [0.31.4](https://github.com/giantswarm/cilium-app/compare/v0.31.3...v0.31.4)
+      * Upgrade Cilium to [v1.16.10](https://github.com/cilium/cilium/releases/tag/v1.16.10). 
+
+
+- [backstage](https://github.com/giantswarm/backstage) 
+  - [0.72.7](https://github.com/giantswarm/backstage/compare/v0.72.6...v0.72.7) 
+In this release, custom scaffolder API client code has been refactored.
+See
+[./docs/releases/v0.72.7-changelog.md](./docs/releases/v0.72.7-changelog.md)
+for more information.
+  - [0.72.6](https://github.com/giantswarm/backstage/compare/v0.72.5...v0.72.6) 
+This release fixed an issue in custom scaffolder client that caused the cient
+to fail when some GS installations are unreachable.
+See
+[./docs/releases/v0.72.6-changelog.md](./docs/releases/v0.72.6-changelog.md)
+for more information. 
+
+
+  - [0.72.5](https://github.com/giantswarm/backstage/compare/v0.72.4...v0.72.5) 
+This release fixed an issue in custom scaffolder client that caused the cient
+to fail when some GS installations are unreachable.
+See
+[./docs/releases/v0.72.5-changelog.md](./docs/releases/v0.72.5-changelog.md)
+for more information. 
+
+
+  - [0.72.4](https://github.com/giantswarm/backstage/compare/v0.72.3...v0.72.4) 
+In this release, ReleasePicker scaffolder field has been improved to allow to
+filter releases by provider.
+See
+[./docs/releases/v0.72.4-changelog.md](./docs/releases/v0.72.4-changelog.md)
+for more information. 
+
+
+  - [0.72.3](https://github.com/giantswarm/backstage/compare/v0.72.2...v0.72.3) 
+In this release, custom OIDC provider implementation was removed from GS auth
+backend module.
+See
+[./docs/releases/v0.72.3-changelog.md](./docs/releases/v0.72.3-changelog.md)
+for more information. 
+
+
+- [konfigure](https://github.com/giantswarm/konfigure) 
+  - [1.0.1](https://github.com/giantswarm/konfigure/compare/v1.0.0...v1.0.1) 
+      * The flux updater now returns the message from the falsy `Ready` condition of the `GitRepository` when it exists and the `.status.artifact.url` field is missing or empty. This usually indicates that the source is broken for some reason and the `Ready` condition might have a better indication why rather than just failing with the message of the URL being empty.
+- [aws-crossplane-cluster-config-operator](https://github.com/giantswarm/aws-crossplane-cluster-config-operator) 
+  - [0.5.0](https://github.com/giantswarm/aws-crossplane-cluster-config-
+operator/compare/v0.4.0...v0.5.0) 
+      * Use `gsoci.azurecr.io` as default container registry.
+- [cluster-azure](https://github.com/giantswarm/cluster-azure) 
+  - [2.1.1](https://github.com/giantswarm/cluster-azure/compare/v2.1.0...v2.1.1)
+      * Chart: Update `cluster` to v2.2.1.
+- [cluster-cloud-director](https://github.com/giantswarm/cluster-cloud-director) 
+  - [0.66.1](https://github.com/giantswarm/cluster-cloud-
+director/compare/v0.66.0...v0.66.1) 
+      * Chart: Update `cluster` to v2.2.1.
+- [cluster-api-app](https://github.com/giantswarm/cluster-api-app) 
+  - [3.0.0](https://github.com/giantswarm/cluster-api-app/compare/v2.0.0...v3.0.0)
+      * Chart: Upgrade CAPI to v1.8.12. ([#267](https://github.com/giantswarm/cluster-api-app/pull/267))
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-05-29.md b/src/content/changes/highlights/2025-05-29.md
new file mode 100644
index 0000000000..4d0794901c
--- /dev/null
+++ b/src/content/changes/highlights/2025-05-29.md
@@ -0,0 +1,185 @@
+---
+date: 2025-05-29T14:00:00
+title: Highlights for the week ending 2025-05-29
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [grafana-app](https://github.com/giantswarm/grafana-app) 
+  - [2.22.1](https://github.com/giantswarm/grafana-app/compare/v2.22.0...v2.22.1)
+      * upgrade grafana chart: 9.0.0 => 9.2.1
+      * upgrade grafana : 12.0.0 => 12.0.0-security-01
+- [logging-operator](https://github.com/giantswarm/logging-operator) 
+  - [0.29.0](https://github.com/giantswarm/logging-
+operator/compare/v0.28.0...v0.29.0) 
+      * Introduce the new `remote_timeout` parameter to configure timeouts for remote write operations. This change affects the following agents: `promtail`, `grafana-agent`, `alloy-events`, and `alloy-logs`. The default value has been updated to better support larger installations.
+      * Remove vintage mode from the operator. This includes the vintage MC and WC reconciliers.
+- [backstage](https://github.com/giantswarm/backstage) 
+  - [0.73.3](https://github.com/giantswarm/backstage/compare/v0.73.2...v0.73.3) 
+In this release, installations status check has been improved.
+See
+[./docs/releases/v0.73.3-changelog.md](./docs/releases/v0.73.3-changelog.md)
+for more information.
+  - [0.73.2](https://github.com/giantswarm/backstage/compare/v0.73.1...v0.73.2) 
+In this release:
+      * timeout for scaffolder API requests has been added;
+      * disabled installations check logic has been refactored.
+See
+[./docs/releases/v0.73.2-changelog.md](./docs/releases/v0.73.2-changelog.md)
+for more information. 
+
+
+  - [0.73.1](https://github.com/giantswarm/backstage/compare/v0.73.0...v0.73.1) 
+In this release:
+      * installations picker has been changed to use Autocomplete component;
+      * validation function has been added for the installations picker scaffolder field.
+See
+[./docs/releases/v0.73.1-changelog.md](./docs/releases/v0.73.1-changelog.md)
+for more information. 
+
+
+- [capa-karpenter-taint-remover](https://github.com/giantswarm/capa-karpenter-taint-remover) 
+  - [0.6.0](https://github.com/giantswarm/capa-karpenter-taint-
+remover/compare/v0.5.0...v0.6.0) 
+      * Update Go version in Dockerfile to 1.23.
+- [cluster-api-provider-azure-app](https://github.com/giantswarm/cluster-api-provider-azure-app) 
+  - [2.0.0](https://github.com/giantswarm/cluster-api-provider-azure-
+app/compare/v1.12.4-gs2...v2.0.0) 
+      * Chart: Some chores. ([#186](https://github.com/giantswarm/cluster-api-provider-azure-app/pull/186))
+      * Helpers: Add `cluster-api-provider-azure.fullname`.
+      * Helpers: Add `cluster-api-provider-azure.crd-install.labels`.
+      * Repository: Rework sync. ([#182](https://github.com/giantswarm/cluster-api-provider-azure-app/pull/182))
+      * Hack: Extract `fetch-manifest.sh`.
+      * Hack: Rework `generate-kustomize-patches.sh` into `generate-webhook-patches.sh`.
+      * Config: Move `ssh-sso-public-key-secret.yaml` to `bases/secrets/cluster-api-provider-azure-ssh-sso-pub-key.yaml`.
+      * Config: Move `secret-bootstrap-credentials.yaml` to `bases/secrets/credential-default.yaml`.
+      * Config: Transform `common-labels.yaml` into `labels`.
+      * Config: Move `webhook-prefix.yaml` to `patches/mutatingwebhooks/zzz-prefix.yaml`.
+      * Config: Rework `images`.
+      * Config: Move `deployment-capz-args.yaml` to `patches/deployments/capz-controller-manager.yaml`.
+      * Config: Move `deployment-affinity.yaml` to `patches/deployments/capz-controller-manager.yaml`.
+      * Config: Move `deployment-environment.yaml` to `patches/deployments/capz-controller-manager.yaml`.
+      * Config: Move `deployment-metrics-port.yaml` to `patches/deployments/capz-controller-manager.yaml`.
+      * Config: Move `deployment-securitycontext.yaml` to `patches/deployments/capz-controller-manager.yaml`.
+      * Config: Move `deployment-toleration.yaml` to `patches/deployments/capz-controller-manager.yaml`.
+      * Config: Move `deployment-aso-securitycontext.yaml` to `patches/deployments/azureserviceoperator-controller-manager.yaml`.
+      * Config: Move `deployment-aso-volume.yaml` to `patches/deployments/azureserviceoperator-controller-manager.yaml`.
+      * Config: Split `webhook-certificate.yaml` into `patches/mutatingwebhooks/capz-mutating-webhook-configuration.yaml` & `patches/validatingwebhooks/capz-validating-webhook-configuration.yaml`.
+      * Config: Split `webhook-certificate-aso.yaml` into `patches/mutatingwebhooks/azureserviceoperator-mutating-webhook-configuration.yaml` & `patches/validatingwebhooks/azureserviceoperator-validating-webhook-configuration.yaml`.
+      * Config: Move `service-add-metrics-port.yaml` to `patches/services/capz-webhook-service.yaml`.
+      * Config: Move `certificate.yaml` to `patches/certificates/capz-serving-cert.yaml`.
+      * Config: Move `certificate-serviceoperator.yaml` to `patches/certificates/azureserviceoperator-serving-cert.yaml`.
+      * Config: Move `delete-selfsigned-cert-issuer.yaml` to `patches/issuers/capz-selfsigned-issuer.yaml`.
+      * Config: Move `delete-ns.yaml` to `patches/namespaces/capz-system.yaml`.
+      * Config: Move `delete-nmi.yaml` to `patches/daemonsets/capz-nmi.yaml`.
+      * Config: Move `secret-aso-controller-settings.yaml` to `patches/secrets/aso-controller-settings.yaml`.
+      * Config: Move `deployment-aso-remove-kube-proxy.yaml` to `patches/deployments/azureserviceoperator-controller-manager.yaml`.
+      * Config: Move `delete_aadpodidentity_crds.yaml` to `patches/crds/unapproved.yaml`.
+      * Config: Move `crd_cainjection.yaml` to `patches/crds/capz.yaml`.
+      * Config: Move `aso_crd_cainjection.yaml` to `patches/crds/azureserviceoperator.yaml`.
+      * Config: Move `crd_webhook.yaml` to `patches/crds/capz.yaml`.
+      * Config: Move `crd_clusterctl_labels.yaml` to `patches/crds/capz.yaml`.
+      * Config: Move `mutating-webhook-watchfilter.yaml` to `patches/mutatingwebhooks/capz-mutating-webhook-configuration-object-selector.yaml`.
+      * Config: Move `validating-webhook-watchfilter.yaml` to `patches/validatingwebhooks/capz-validating-webhook-configuration-object-selector.yaml`.
+      * Config: Move `config/helm/copy` to `helm/cluster-api-provider-azure/templates/static`.
+      * Config: Extract inline patch into `patches/services/azureserviceoperator.yaml`.
+      * Config: Extract inline patch into `patches/services/azureserviceoperator-proxy-service.yaml`.
+      * Config: Extract inline patch into `patches/crds/all.yaml`.
+      * Hack: Rework `move-generated-crds.sh` into `move-crds.sh`.
+      * Hack: Rename `generate-crd-version-patches.sh` into `generate-crd-patches.sh`.
+      * Hack: Rework `generate-helm-conditions.sh` into `wrap-in-conditions.sh`.
+      * Hack: Rework `cleanup-helm-templates.sh` into `remove-quotes.sh`.
+      * Chart: Some chores. ([#186](https://github.com/giantswarm/cluster-api-provider-azure-app/pull/186))
+      * Chart: Rework `Chart.yaml`.
+      * Values: Update `values.schema.json`.
+      * Values: Rework `image`.
+      * Values: Rework `aso`.
+      * Values: Rework `project`.
+      * Values: Rework `provider`.
+      * Values: Rework `ciliumNetworkPolicy`.
+      * Values: Rework `crdInstall`.
+      * Values: Rework `workloadCluster`.
+      * Values: Rework `controller`.
+      * Values: Rework `verticalPodAutoscaler`.
+      * Values: Rework `serviceMonitor`.
+      * Values: Rework `global.podSecurityStandards`.
+      * Helpers: Rework `name` into `cluster-api-provider-azure.name`.
+      * Helpers: Rework `chart` into `cluster-api-provider-azure.chart`.
+      * Helpers: Rework `labels.common` into `cluster-api-provider-azure.labels`.
+      * Helpers: Rework `labels.selector` into `cluster-api-provider-azure.selectorLabels`.
+      * Helpers: Rework `capz.crdInstall` into `cluster-api-provider-azure.crd-install.fullname`.
+      * Helpers: Rework `capz.CRDInstallAnnotations` into `cluster-api-provider-azure.crd-install.annotations`.
+      * Helpers: Rework `capz.selectorLabels` into `cluster-api-provider-azure.crd-install.selectorLabels`.
+      * Helpers: Rework `capz.webhookObjectSelector` into `cluster-api-provider-azure.objectSelector`.
+      * Helpers: Rework `deployment.args.watchfiltervalue` into `cluster-api-provider-azure.watchFilter`.
+      * CRD Install: Rework `crd-np.yaml` into `networkpolicy.yaml`.
+      * CRD Install: Rework `crd-configmap.yaml` into `configmap.yaml`.
+      * CRD Install: Rework `crd-serviceaccount.yaml` into `serviceaccount.yaml`.
+      * CRD Install: Extract ClusterRole into `clusterrole.yaml`.
+      * CRD Install: Extract ClusterRoleBinding into `clusterrolebinding.yaml`.
+      * CRD Install: Rework `crd-job.yaml` into `job.yaml`.
+      * Static: Rework `vpa.yaml` into `capz-controller-manager-verticalpodautoscaler.yaml`.
+      * Static: Rework `service-monitor.yaml` into `capz-controller-manager-servicemonitor.yaml`.
+      * Static: Rework `rbac.authorization.k8s.io_v1_clusterrolebinding_azureserviceoperator-crd-manager-rolebinding.yaml` into `azureserviceoperator-crd-manager-clusterrolebinding.yaml`.
+      * Static: Rework `rbac.authorization.k8s.io_v1_clusterrole_azureserviceoperator-crd-manager-role.yaml` into `azureserviceoperator-crd-manager-clusterrole.yaml`.
+      * Static: Rework `networking.k8s.io_v1_networkpolicy_azureserviceoperator-controller-manager.yaml` into `azureserviceoperator-controller-manager-networkpolicy.yaml`.
+      * Static: Rework `networking.k8s.io_v1_networkpolicy_capz-controller-manager.yaml` into `capz-controller-manager-networkpolicy.yaml`.
+      * Static: Rework `cilium.io_v2_ciliumnetworkpolicy_azure-service-operator-controller-manager.yaml` into `azureserviceoperator-controller-manager-ciliumnetworkpolicy.yaml`.
+      * Static: Rework `cilium.io_v2_ciliumnetworkpolicy_capz-controller-manager.yaml` into `capz-controller-manager-ciliumnetworkpolicy.yaml`.
+      * Repository: Rework sync. ([#182](https://github.com/giantswarm/cluster-api-provider-azure-app/pull/182))
+      * Config: Remove obsolete `daemonset-nmi-args.yaml`.
+      * Chart: Some chores. ([#186](https://github.com/giantswarm/cluster-api-provider-azure-app/pull/186))
+      * CI: Remove values.
+      * Values: Remove `name`.
+      * Helpers: Remove `_resource.tpl`.
+      * Helpers: Remove `labels.provider`.
+      * Helpers: Remove `capz.CRDInstallConfigmapNameGenerate`.
+      * Helpers: Remove `capz.CRDInstallSelector`.
+      * CRD Install: Remove `crd-ciliumnetworkpolicy.yaml`.
+      * CRD Install: Remove `crd-psp.yaml`.
+- [descheduler-app](https://github.com/giantswarm/descheduler-app) 
+  - [1.0.1](https://github.com/giantswarm/descheduler-app/compare/v1.0.0...v1.0.1)
+      * Update deps.
+  - [1.0.1](https://github.com/giantswarm/descheduler-app/compare/v1.0.0...v1.0.1)
+      * Update deps. 
+
+
+- [cloudnative-pg-app](https://github.com/giantswarm/cloudnative-pg-app) 
+  - [0.0.9](https://github.com/giantswarm/cloudnative-pg-
+app/compare/v0.0.8...v0.0.9) 
+      * Update to cloudnative-pg v1.26.0 (chart v0.24.0).
+      * This version allows users to upgrade major versions of postgresql clusters.
+      * This version is now using CNPG-I for extensions (like barman for backups).
+- [security-bundle](https://github.com/giantswarm/security-bundle) 
+  - [1.11.0](https://github.com/giantswarm/security-
+bundle/compare/v1.10.1...v1.11.0) 
+      * Add `policy-api-crds` app to manage Policy API CRDs.
+      * Update `trivy` (app) to v0.13.4.
+      * Update `cloudnative-pg` (app) to v0.0.7.
+      * Update `starboard-exporter` (app) to v0.8.1.
+      * Update `kyverno-policy-operator` (app) to v0.0.11.
+      * Update `cloudnative-pg` (app) to v0.0.9.
+- [cluster-api-app](https://github.com/giantswarm/cluster-api-app) 
+  - [3.0.1](https://github.com/giantswarm/cluster-api-app/compare/v3.0.0...v3.0.1)
+      * Chart: Use CAPI v1.8.12-gs-5fe235a73. ([#269](https://github.com/giantswarm/cluster-api-app/pull/269))
+- [vertical-pod-autoscaler-app](https://github.com/giantswarm/vertical-pod-autoscaler-app) 
+  - [5.5.0](https://github.com/giantswarm/vertical-pod-autoscaler-
+app/compare/v5.4.1...v5.5.0) 
+      * Chart: Update Helm release vertical-pod-autoscaler to v10.1.0. ([#350](https://github.com/giantswarm/vertical-pod-autoscaler-app/pull/350))
+      * Chart: Update Helm release vertical-pod-autoscaler to v10.2.0. ([#351](https://github.com/giantswarm/vertical-pod-autoscaler-app/pull/351))
+- [vertical-pod-autoscaler-crd](https://github.com/giantswarm/vertical-pod-autoscaler-crd) 
+  - [3.3.0](https://github.com/giantswarm/vertical-pod-autoscaler-
+crd/compare/v3.2.1...v3.3.0) 
+      * Chart: Sync to upstream. ([#140](https://github.com/giantswarm/vertical-pod-autoscaler-crd/pull/140))
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-06-05.md b/src/content/changes/highlights/2025-06-05.md
new file mode 100644
index 0000000000..0a77f4d5a4
--- /dev/null
+++ b/src/content/changes/highlights/2025-06-05.md
@@ -0,0 +1,180 @@
+---
+date: 2025-06-05T14:00:00
+title: Highlights for the week ending 2025-06-05
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [alloy-app](https://github.com/giantswarm/alloy-app) 
+  - [0.11.0](https://github.com/giantswarm/alloy-app/compare/v0.10.0...v0.11.0) 
+      * Upgrade Alloy upstream chart from 1.0.3 to 1.1.0
+      * This bumps the version of Alloy from 1.8.3 to 1.9.0
+  - [0.10.0](https://github.com/giantswarm/alloy-app/compare/v0.9.0...v0.10.0) 
+      * Add e2e tests.
+      * Upgrade Alloy upstream chart from 0.12.1 to 1.0.3
+      * This bumps the version of Alloy from 1.7.1 to 1.8.3 
+
+
+- [observability-bundle](https://github.com/giantswarm/observability-bundle) 
+  - [2.0.0](https://github.com/giantswarm/observability-
+bundle/compare/v1.16.1...v2.0.0) 
+      * Clean up old and deprecated telemetry collectors:
+      * `promtail`
+      * `grafana-agent`
+      * `promtheus-agent`
+      * Disable PodSecurityPolicies by default as PodSecurityPolicies are deprecated and removed in Kubernetes v1.25+ clusters
+  - [1.16.1](https://github.com/giantswarm/observability-
+bundle/compare/v1.16.0...v1.16.1) 
+      * Fix catalog for alloy apps as it is now pushed to the default catalog. 
+
+
+  - [1.16.0](https://github.com/giantswarm/observability-
+bundle/compare/v1.15.0...v1.16.0) 
+      * Upgrade `alloy-app` from 0.10.0 to 0.11.0
+      * This bumps the version of `Alloy` from 1.8.3 to 1.9.0 
+
+
+  - [1.15.0](https://github.com/giantswarm/observability-
+bundle/compare/v1.14.1...v1.15.0) 
+      * Upgrade `alloy-app` from 0.9.0 to 0.10.0
+      * This bumps the version of `Alloy` from 1.7.1 to 1.8.3 
+
+
+- [observability-operator](https://github.com/giantswarm/observability-operator) 
+  - [0.32.1](https://github.com/giantswarm/observability-
+operator/compare/v0.32.0...v0.32.1) 
+      * Fix Alloy image templating when the alloy app is running the latest version.
+  - [0.32.0](https://github.com/giantswarm/observability-
+operator/compare/v0.31.0...v0.32.0) 
+      * Updated Alloy configuration (`pkg/monitoring/alloy/configmap.go` and `pkg/monitoring/alloy/templates/monitoring-config.yaml.template`):
+        * Conditionally set `alloy.alloy.image.tag` in `monitoring-config.yaml.template`. The operator now explicitly sets the tag to `1.8.3` if the deployed `alloy-metrics` app version is older than `0.10.0`. For `alloy-metrics` app versions `0.10.0` or newer, the image tag will rely on the Alloy Helm chart's defaults or user-provided values, facilitating easier Alloy image updates via the chart.
+        * Adjusted indentation for `AlloyConfig` in `monitoring-config.yaml.template` from `indent 8` to `nindent 8`.
+      * Improve Mimir Datasource configuration (https://github.com/giantswarm/giantswarm/issues/33470)
+      * Enable medium level caching (caching of `/api/v1/label/${name}/values`, `/api/v1/series`, `/api/v1/labels` and `/api/v1/metadata` for 10 minutes)
+      * Enable incremental querying (only query new data when refreshing dashboards)
+      * Remove old mimir datasource on all installations. 
+
+
+- [kube-prometheus-stack-app](https://github.com/giantswarm/kube-prometheus-stack-app) 
+  - [16.1.0](https://github.com/giantswarm/kube-prometheus-stack-
+app/compare/v16.0.0...v16.1.0) 
+      * Disable PodSecurityPolicies by default as PodSecurityPolicies are deprecated and removed in Kubernetes v1.25+ clusters
+- [pg-cluster-recovery-test](https://github.com/giantswarm/pg-cluster-recovery-test) 
+  - [0.1.3](https://github.com/giantswarm/pg-cluster-recovery-
+test/compare/v0.1.2...v0.1.3) 
+      * Move `imagePullPolicy` field from cronjob template to values.
+  - [0.1.2](https://github.com/giantswarm/pg-cluster-recovery-
+test/compare/v0.1.1...v0.1.2) 
+      * Fixed issues preventing chart to be deployed as a subchart in other charts. 
+
+
+  - [0.1.1](https://github.com/giantswarm/pg-cluster-recovery-
+test/compare/v0.1.0...v0.1.1) 
+      * Fix issues in chart to allow pushing to app catalog. 
+
+
+  - [0.1.0](https://github.com/giantswarm/pg-cluster-recovery-
+test/releases/tag/v0.1.0) 
+      * Repo creation and configuration. 
+
+
+- [prometheus-rules](https://github.com/giantswarm/prometheus-rules) 
+  - [4.63.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.62.0...v4.63.0) 
+      * Add `IncorrectResourceUsageData` alert.
+      * Made `MimirIngesterNeedsToBeScaledUp` alert less sensitive to CPU usage.
+      * Increase `MimirIngesterNeedsToBeScaledUp` alert's time to trigger from 1h to 6h to avoid noise coming from temporary spikes like from `stable-testing` installations (https://github.com/giantswarm/giantswarm/issues/33513)
+      * Rewrite Flux alerting rules towards the `gotk_resource_info` emitted by the Kube State Metrics.
+      * Drop customer-related alerting rules of Flux.
+      * Rules unit tests: support for `$provider` template so we can move provider-specific tests to global tests.
+      * Rules unit tests: simplify files organization by removing the `capi` folder. Also fixes a bug in cloud-director tests.
+      * Rules linting: run against all configured providers.
+      * Exclude more containers from Rocket's `ManagementClusterContainerIsRestartingTooFrequently` alert.
+- [cilium-app](https://github.com/giantswarm/cilium-app) 
+  - [1.2.0](https://github.com/giantswarm/cilium-app/compare/v1.1.1...v1.2.0) 
+      * Re-enable Cilium agent and operator metrics port.
+      * Add resource requests and limits to Hubble UI and Relay.
+      * Add resource requests and limits to Cilium Operator.
+- [net-exporter](https://github.com/giantswarm/net-exporter) 
+  - [1.23.0](https://github.com/giantswarm/net-exporter/compare/v1.22.0...v1.23.0)
+      * Check for errors when closing connections.
+      * Switch from Endpoints to EndpointSlices for neighbors discovery.
+- [backstage](https://github.com/giantswarm/backstage) 
+  - [0.76.0](https://github.com/giantswarm/backstage/compare/v0.75.0...v0.76.0) 
+In this release, configurable links have been added to the home page and
+cluster details page.
+See
+[./docs/releases/v0.76.0-changelog.md](./docs/releases/v0.76.0-changelog.md)
+for more information.
+  - [0.75.0](https://github.com/giantswarm/backstage/compare/v0.74.1...v0.75.0) 
+In this release:
+      * The use case where there is only one installation connected is handled by hiding the installations selector.
+      * The use case where there is only one provider available is handled by hiding the provider filter.
+See
+[./docs/releases/v0.75.0-changelog.md](./docs/releases/v0.75.0-changelog.md)
+for more information. 
+
+
+- [aws-cloud-controller-manager-app](https://github.com/giantswarm/aws-cloud-controller-manager-app) 
+  - [1.31.5-gs1](https://github.com/giantswarm/aws-cloud-controller-manager-
+app/compare/v1.30.8-gs1...v1.31.5-gs1) 
+      * Chart: Update to upstream v1.31.5.
+- [cluster-aws](https://github.com/giantswarm/cluster-aws) 
+  - [3.3.0](https://github.com/giantswarm/cluster-aws/compare/v3.2.2...v3.3.0) 
+      * Add `cert-manager-crossplane-resources` App in private clusters so `DNS01` `clusterIssuer`.
+      * Add configuration for `DNS01` `clusterIssuer` deployed by `cert-manager-app` in private clusters.
+      * Apply startup taint `ebs.csi.aws.com/agent-not-ready` for AWS EBS CSI driver on worker nodes.
+      * Configure HelmReleases to retry indefinitely when installation or upgrade fails by setting retries: -1.
+      * Chart: Update `cluster` to v2.4.0.
+- [cluster-azure](https://github.com/giantswarm/cluster-azure) 
+  - [2.2.0](https://github.com/giantswarm/cluster-azure/compare/v2.1.1...v2.2.0)
+      * Chart: Update `cluster` to v2.4.0.
+- [karpenter-nodepools](https://github.com/giantswarm/karpenter-nodepools) 
+  - [0.1.0](https://github.com/giantswarm/karpenter-nodepools/releases/tag/v0.1.0)
+      * changed: `app.giantswarm.io` label group was changed to `application.giantswarm.io`
+- [cluster-cloud-director](https://github.com/giantswarm/cluster-cloud-director) 
+  - [0.67.0](https://github.com/giantswarm/cluster-cloud-
+director/compare/v0.66.1...v0.67.0) 
+      * Chart: Update `cluster` to v2.3.0.
+      * Chart: Update `cluster` to v2.4.0.
+- [cluster-vsphere](https://github.com/giantswarm/cluster-vsphere) 
+  - [1.4.0](https://github.com/giantswarm/cluster-vsphere/compare/v1.3.0...v1.4.0)
+      * Chart: update `cluster` to v2.4.0.
+  - [1.3.0](https://github.com/giantswarm/cluster-vsphere/compare/v1.2.0...v1.3.0)
+      * Chart: Update `cluster` to v2.3.0. 
+
+
+- [cluster](https://github.com/giantswarm/cluster) 
+  - [2.4.0](https://github.com/giantswarm/cluster/compare/v2.3.0...v2.4.0) 
+      * Introduce `type` property in the node pools to be consumed by provider charts when they want to use `karpenter`.
+- [cluster-autoscaler-app](https://github.com/giantswarm/cluster-autoscaler-app) 
+  - [1.31.2-gs2](https://github.com/giantswarm/cluster-autoscaler-
+app/compare/v1.31.2-gs1...v1.31.2-gs2) 
+      * Chart: Use v1.31.2.
+  - [1.31.2-gs1](https://github.com/giantswarm/cluster-autoscaler-
+app/compare/v1.30.4-gs2...v1.31.2-gs1) 
+      * Add additional labels to ignore during ASG balancing check
+      * Chart: Update to upstream v1.31.2. ([#325](https://github.com/giantswarm/cluster-autoscaler-app/pull/325)) 
+
+
+- [etcd-kubernetes-resources-count-exporter](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter) 
+  - [1.10.4](https://github.com/giantswarm/etcd-kubernetes-resources-count-
+exporter/compare/v1.10.3...v1.10.4) 
+      * Fix linting issues.
+      * Go: Update dependencies.
+- [node-exporter-app](https://github.com/giantswarm/node-exporter-app) 
+  - [1.20.3](https://github.com/giantswarm/node-exporter-
+app/compare/v1.20.2...v1.20.3) 
+      * Go: Update dependencies.
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-06-12.md b/src/content/changes/highlights/2025-06-12.md
new file mode 100644
index 0000000000..05f188348a
--- /dev/null
+++ b/src/content/changes/highlights/2025-06-12.md
@@ -0,0 +1,72 @@
+---
+date: 2025-06-12T14:00:00
+title: Highlights for the week ending 2025-06-12
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [prometheus-rules](https://github.com/giantswarm/prometheus-rules) 
+  - [4.65.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.64.0...v4.65.0) 
+      * Improved `ClusterAutoscalerFailedScaling` alert expression to reduce false positives by detecting ongoing scaling failures rather than cumulative historical failures.
+- [cilium-app](https://github.com/giantswarm/cilium-app) 
+  - [1.2.1](https://github.com/giantswarm/cilium-app/compare/v1.2.0...v1.2.1) 
+      * Enable conntrack accounting in Cilium agent by default.
+- [gateway-api-crds-app](https://github.com/giantswarm/gateway-api-crds-app) 
+  - [1.2.1](https://github.com/giantswarm/gateway-api-crds-
+app/compare/v1.2.0...v1.2.1) 
+      * Add `helm.sh/resource-policy` annotation to all CRDs to prevent deletion by default
+- [backstage](https://github.com/giantswarm/backstage) 
+  - [0.77.0](https://github.com/giantswarm/backstage/compare/v0.76.1...v0.77.0) 
+In this release, a possibility to configure how labels of Kubernetes resources
+are being displayed has been added.
+See
+[./docs/releases/v0.77.0-changelog.md](./docs/releases/v0.77.0-changelog.md)
+for more information.
+  - [0.76.1](https://github.com/giantswarm/backstage/compare/v0.76.0...v0.76.1) 
+In this release, source reference namespace for Kustomization objects has been
+fixed.
+See
+[./docs/releases/v0.76.1-changelog.md](./docs/releases/v0.76.1-changelog.md)
+for more information. 
+
+
+- [karpenter-app](https://github.com/giantswarm/karpenter-app) 
+  - [1.0.0](https://github.com/giantswarm/karpenter-app/compare/v0.14.0...v1.0.0)
+      * Updated Karpenter to `v1.5.0`.
+      * Update README.
+      * Migrate to use `abs` to build the chart.
+      * Drop deprecated `flowcontrol.apiserver.k8s.io/v1beta2` version of FlowSchema and PriorityLevelConfiguration.
+- [karpenter-bundle](https://github.com/giantswarm/karpenter-bundle) 
+  - [2.0.0](https://github.com/giantswarm/karpenter-
+bundle/compare/v1.4.0...v2.0.0) 
+      * Add karpenter-app dependency on karpenter-crossplane-resources app.
+      * Bump karpenter to `v1.5.0`.
+- [kyverno-crds](https://github.com/giantswarm/kyverno-crds) 
+  - [1.14.0](https://github.com/giantswarm/kyverno-crds/compare/v1.13.1...v1.14.0)
+      * Update Kyverno CRDs to Kyverno 1.14.2.
+### Notes
+This release includes an upstream update. Please refer to the following
+Release Notes from upstream for the latest changes:
+      * [1.14.0](https://github.com/kyverno/kyverno/releases/tag/v1.14.0)
+      * [1.14.1](https://github.com/kyverno/kyverno/releases/tag/v1.14.1)
+      * [1.14.2](https://github.com/kyverno/kyverno/releases/tag/v1.14.2)
+- [etcd-defrag-app](https://github.com/giantswarm/etcd-defrag-app) 
+  - [1.0.5](https://github.com/giantswarm/etcd-defrag-app/compare/v1.0.4...v1.0.5)
+      * Chart: Update dependency ahrtr/etcd-defrag to v0.28.0. ([#34](https://github.com/giantswarm/etcd-defrag-app/pull/34))
+- [etcd-kubernetes-resources-count-exporter](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter) 
+  - [1.10.5](https://github.com/giantswarm/etcd-kubernetes-resources-count-
+exporter/compare/v1.10.4...v1.10.5) 
+      * Go: Update dependencies.
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-06-19.md b/src/content/changes/highlights/2025-06-19.md
new file mode 100644
index 0000000000..463fba43f9
--- /dev/null
+++ b/src/content/changes/highlights/2025-06-19.md
@@ -0,0 +1,83 @@
+---
+date: 2025-06-19T14:00:00
+title: Highlights for the week ending 2025-06-19
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [prometheus-rules](https://github.com/giantswarm/prometheus-rules) 
+  - [4.65.1](https://github.com/giantswarm/prometheus-
+rules/compare/v4.65.0...v4.65.1) 
+      * Increase `MimirIngesterNeedsToBeScaledUp` alert's time to trigger from 6h to 12h to avoid noise coming from temporary spikes.
+      * WorkloadClusterWebhookDurationExceedsTimeoutSolutionEngineers alert: make it page only during business hours, and increase delay to 1h before it pages
+      * MetricForwardingErrors alert: make it less sensitive
+- [gateway-api-bundle](https://github.com/giantswarm/gateway-api-bundle) 
+  - [0.4.0](https://github.com/giantswarm/gateway-api-
+bundle/compare/v0.3.0...v0.4.0) 
+      * Update dependency giantswarm/gateway-api-crds-app to v1.2.1 (#27)
+      * Update dependency giantswarm/gateway-api-config-app to v0.5.0 (#30)
+- [gateway-api-config-app](https://github.com/giantswarm/gateway-api-config-app) 
+  - [0.5.0](https://github.com/giantswarm/gateway-api-config-
+app/compare/v0.4.0...v0.5.0) 
+      * Values.gateway.hostnames now accepts a list of subdomains only.
+      * baseDomain can be overridden per Gateway.
+- [k8s-dns-node-cache-app](https://github.com/giantswarm/k8s-dns-node-cache-app) 
+  - [2.9.0](https://github.com/giantswarm/k8s-dns-node-cache-
+app/compare/v2.8.1...v2.9.0) 
+      * Upgrade application to version 1.26.4 (includes coredns 1.11.3)
+      * Increase ServiceMonitor's scrapping interval to 1m.
+      * Remove obsolete PSPs
+- [kong-app](https://github.com/giantswarm/kong-app) 
+  - [5.1.0](https://github.com/giantswarm/kong-app/compare/v5.0.0...v5.1.0) 
+      * Align with upstream chart version [2.49.0](https://github.com/Kong/charts/releases/tag/kong-2.49.0) ([Changes in upstream repository](https://github.com/Kong/charts/compare/kong-2.48.0...kong-2.49.0))
+      * Update kong ingress controller to [3.4.6](https://github.com/Kong/kubernetes-ingress-controller/blob/main/CHANGELOG.md#346)
+      * Update kong to [3.9.1](https://github.com/Kong/kong/blob/release/3.9.x/CHANGELOG.md#391)
+- [backstage](https://github.com/giantswarm/backstage) 
+  - [0.78.0](https://github.com/giantswarm/backstage/compare/v0.77.0...v0.78.0) 
+In this release, a possibility to configure how annotations of Kubernetes
+resources are being displayed has been added.
+See
+[./docs/releases/v0.78.0-changelog.md](./docs/releases/v0.78.0-changelog.md)
+for more information.
+- [aws-resolver-rules-operator](https://github.com/giantswarm/aws-resolver-rules-operator) 
+  - [0.19.0](https://github.com/giantswarm/aws-resolver-rules-
+operator/compare/v0.18.0...v0.19.0) 
+      * Add crossplane controller to create crossplane provider cluster config.
+  - [0.18.0](https://github.com/giantswarm/aws-resolver-rules-
+operator/compare/v0.17.0...v0.18.0) 
+      * Add controller to create node pool bootstrap data on S3.
+      * Dynamically calculate CAPI and CAPA versions from go cache, so that we use the right path when installing the CRDs during tests.
+      * Add tags to VPC created for acceptance tests.
+      * Resolve several linting errors. 
+
+
+- [azure-cloud-controller-manager-app](https://github.com/giantswarm/azure-cloud-controller-manager-app) 
+  - [1.30.13-gs1](https://github.com/giantswarm/azure-cloud-controller-manager-
+app/compare/v1.30.6-gs1...v1.30.13-gs1) 
+      * Add Annotations and labels for use of azure workload identity.
+      * Chart: Update to upstream v1.30.13. ([#103](https://github.com/giantswarm/azure-cloud-controller-manager-app/pull/103))
+- [azure-cloud-node-manager-app](https://github.com/giantswarm/azure-cloud-node-manager-app) 
+  - [1.30.13-gs1](https://github.com/giantswarm/azure-cloud-node-manager-
+app/compare/v1.30.6-gs1...v1.30.13-gs1) 
+      * Add Annotations and labels for use of azure workload identity.
+      * Chart: Update to upstream v1.30.13. ([#93](https://github.com/giantswarm/azure-cloud-node-manager-app/pull/93))
+- [dex-app](https://github.com/giantswarm/dex-app) 
+  - [2.0.0](https://github.com/giantswarm/dex-app/compare/v1.42.15...v2.0.0) 
+      * Added sync workflow to sync from upstream
+      * Refactored chart to align with upstream
+- [keda-app](https://github.com/giantswarm/keda-app) 
+  - [3.0.0](https://github.com/giantswarm/keda-app/compare/v2.0.0...v3.0.0) 
+      * Upgrade app to version 2.17.1 to support kubernetes 1.30 to 1.32.
+      * Upgrade chart to upstream version 2.17.1.
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-06-26.md b/src/content/changes/highlights/2025-06-26.md
new file mode 100644
index 0000000000..ec1971a24c
--- /dev/null
+++ b/src/content/changes/highlights/2025-06-26.md
@@ -0,0 +1,88 @@
+---
+date: 2025-06-26T14:00:00
+title: Highlights for the week ending 2025-06-26
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [prometheus-rules](https://github.com/giantswarm/prometheus-rules) 
+  - [4.66.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.65.1...v4.66.0) 
+      * Added `cancel_if_metrics_broken` inhibition to following alerts:
+      * `ManagementClusterDeploymentMissingCAPA`
+      * `ManagementClusterDeploymentMissingCAPI`
+      * `ETCDBackupMetricsMissing`
+      * `PrometheusMissingGrafanaCloud`
+      * `MimirToGrafanaCloudExporterDown`
+      * `ManagementClusterDexAppMissing`
+      * Add CiliumAgentPodPending alert for Cabbage.
+      * `LogForwardingErrors` description improvement
+- [coredns-app](https://github.com/giantswarm/coredns-app) 
+  - [1.26.0](https://github.com/giantswarm/coredns-app/compare/v1.25.0...v1.26.0)
+      * Update `coredns` image to [1.12.2](https://github.com/coredns/coredns/releases/tag/v1.12.2).
+- [gateway-api-bundle](https://github.com/giantswarm/gateway-api-bundle) 
+  - [0.5.0](https://github.com/giantswarm/gateway-api-
+bundle/compare/v0.4.0...v0.5.0) 
+      * Update dependency giantswarm/gateway-api-config-app to v0.5.1 (#32)
+- [gateway-api-config-app](https://github.com/giantswarm/gateway-api-config-app) 
+  - [0.5.1](https://github.com/giantswarm/gateway-api-config-
+app/compare/v0.5.0...v0.5.1) 
+      * Ensure that the Gateway is correctly templated when only certificateRefs are used.
+- [kong-app](https://github.com/giantswarm/kong-app) 
+  - [5.1.1](https://github.com/giantswarm/kong-app/compare/v5.1.0...v5.1.1) 
+      * Fix SeccompProfile in CRD apply job
+      * Rename `helm/kong-app/crds` folder to `helm/kong-app/files`
+- [kubectl-apply-job](https://github.com/giantswarm/kubectl-apply-job) 
+  - [0.10.0](https://github.com/giantswarm/kubectl-apply-
+job/compare/v0.9.2...v0.10.0) 
+      * Set seccompProfileType to `RuntimeDefault` for kubectl Job by default.
+      * Update gsoci.azurecr.io/giantswarm/docker-kubectl Docker tag to v1.33.2
+- [aws-node-termination-handler-app](https://github.com/giantswarm/aws-node-termination-handler-app) 
+  - [1.21.0](https://github.com/giantswarm/aws-node-termination-handler-
+app/compare/v1.20.0...v1.21.0) 
+      * Upgrade image to 1.25.1
+      * Upgrade chart from upstream
+      * Allow metrics port in network policy
+- [aws-resolver-rules-operator](https://github.com/giantswarm/aws-resolver-rules-operator) 
+  - [0.20.0](https://github.com/giantswarm/aws-resolver-rules-
+operator/compare/v0.19.0...v0.20.0) 
+      * Change `renovate` configuration to only get upgrades for CAPA compatible versions of k8s dependencies.
+      * Don't reconcile the `ShareReconciler` if only the status field has changed.
+      * Only remove `finalizer` after there are no more karpenter instances to terminate.
+- [cloudnative-pg-app](https://github.com/giantswarm/cloudnative-pg-app) 
+  - [0.0.10](https://github.com/giantswarm/cloudnative-pg-
+app/compare/v0.0.9...v0.0.10) 
+      * Move dependency `grafana-dashboards` from root chart to upstream.
+      * Change dashboard organization from `Shared Org` to `Giant Swarm`.
+- [dex-app](https://github.com/giantswarm/dex-app) 
+  - [2.0.2](https://github.com/giantswarm/dex-app/compare/v2.0.1...v2.0.2) 
+      * Allow for `managementCluster` value to be a `string` or `object`.
+  - [2.0.1](https://github.com/giantswarm/dex-app/compare/v2.0.0...v2.0.1) 
+      * Allow for additionalProperties in the Chart values schema. 
+
+
+- [cluster-api-app](https://github.com/giantswarm/cluster-api-app) 
+  - [3.1.1](https://github.com/giantswarm/cluster-api-app/compare/v3.1.0...v3.1.1)
+      * Removed extra input file
+  - [3.1.0](https://github.com/giantswarm/cluster-api-app/compare/v3.0.1...v3.1.0)
+      * Enabled the `MachineSetPreflightChecks` feature gate to ensure safe rolling of nodes 
+
+
+- [cluster-api-events](https://github.com/giantswarm/cluster-api-events) 
+  - [0.4.0](https://github.com/giantswarm/cluster-api-
+events/compare/v0.3.0...v0.4.0) 
+      * Disable logger development mode to avoid panicking, use zap as logger.
+      * Go: Update dependencies.
+      * Fix linting issues.
+
+## Docs
+
+<!-- FER is filling this one -->
diff --git a/src/content/changes/highlights/2025-07-03.md b/src/content/changes/highlights/2025-07-03.md
new file mode 100644
index 0000000000..a5e7bd8a57
--- /dev/null
+++ b/src/content/changes/highlights/2025-07-03.md
@@ -0,0 +1,63 @@
+---
+date: 2025-07-03T14:00:00
+title: Highlights for the week ending 2025-07-03
+changes_categories:
+  - Highlights
+owner:
+  - https://github.com/orgs/giantswarm/teams/sig-product
+---
+
+## General
+
+<!-- This where BREAKING CHANGES ARE HIGHLIGHTED -->
+
+## Apps
+
+- [grafana-app](https://github.com/giantswarm/grafana-app) 
+  - [2.24.0](https://github.com/giantswarm/grafana-app/compare/v2.23.0...v2.24.0)
+      * Updated dependencies (pg-cluster-recovery-test subchart, architect and docker tags).
+- [pg-cluster-recovery-test](https://github.com/giantswarm/pg-cluster-recovery-test) 
+  - [0.1.5](https://github.com/giantswarm/pg-cluster-recovery-
+test/compare/v0.1.4...v0.1.5) 
+      * Update recovery cluster image tag.
+- [prometheus-rules](https://github.com/giantswarm/prometheus-rules) 
+  - [4.68.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.67.0...v4.68.0) 
+      * Update CoreDNS alerts to page only for resources in "kube-system" namespace.
+      * Route `FluxKustomizationFailed` for `silences` kustomization to Atlas.
+  - [4.67.0](https://github.com/giantswarm/prometheus-
+rules/compare/v4.66.0...v4.67.0) 
+      * `FluentbitDropRatio` only pages for management cluster instances (giantswarm-managed).
+      * Removed `FluentbitTooManyErrors` alerts, at this is already covered by `FluentbitDropRatio` alerts and they mostly page together. 
+
+
+- [backstage](https://github.com/giantswarm/backstage) 
+  - [0.80.1](https://github.com/giantswarm/backstage/compare/v0.80.0...v0.80.1) 
+This releases fixes a problem where the chart would not render when
+`.backstage.extraEnvVars` was set.
+See
+[./docs/releases/v0.80.1-changelog.md](./docs/releases/v0.80.1-changelog.md)
+for more information.
+- [external-secrets](https://github.com/giantswarm/external-secrets) 
+  - [0.18.0](https://github.com/giantswarm/external-
+secrets/compare/v0.11.1...v0.18.0) 
+      * Upgrading to the `v0.18.0` version. Includes **breaking changes** , including API version changes:
+      * https://github.com/external-secrets/external-secrets/releases/tag/v0.12.1
+      * https://github.com/external-secrets/external-secrets/releases/tag/v0.13.0
+      * https://github.com/external-secrets/external-secrets/releases/tag/v0.14.0
+      * https://github.com/external-secrets/external-secrets/releases/tag/v0.16.0
+        * `externalsecrets.external-secrets.io` got `v1alpha1` removed, promoted to `v1`
+        * `secretstores.external-secrets.io` got `v1alpha1` removed, promoted to `v1`
+        * `clustersecretstores.external-secrets.io` got `v1alpha1` removed, promoted to `v1`
+        * `clusterexternalsecrets.external-secrets.io` got `v1alpha1` removed, promoted to `v1`
+      * https://github.com/external-secrets/external-secrets/releases/tag/v0.18.0
+- [konfigure-operator](https://github.com/giantswarm/konfigure-operator) 
+  - [0.6.0](https://github.com/giantswarm/konfigure-
+operator/compare/v0.5.1...v0.6.0) 
+      * Add support for `configuration.giantswarm.io/reconcile` label on generated config maps and secrets. When set to `disabled`, the resource will not be regenerated on reconciliation loops of the `ManagementClusterConfiguration` CR. Other values or absence of the label will normally reconcile and regenerate the resources on each run. Skipped resources will be marked on the `ManagementClusterConfiguration` CR status under `.disabledReconciles` field.
+- [zot](https://github.com/giantswarm/zot) 
+  - [2.2.1](https://github.com/giantswarm/zot/compare/v2.2.0...v2.2.1) 
+
+## Docs
+
+<!-- FER is filling this one -->