diff --git a/.github/workflows/close-on-invalid-label.yaml b/.github/workflows/close-on-invalid-label.yaml
index c7a0230d7c90..8e051df87d4b 100644
--- a/.github/workflows/close-on-invalid-label.yaml
+++ b/.github/workflows/close-on-invalid-label.yaml
@@ -1,23 +1,26 @@
 name: Close issue/PR on adding invalid label
 
 # Closes public issues and PRs when the invalid label is added.
+# Re-closes invalid PRs that someone without write access reopens.
 
 on:
   issues:
     types: [labeled]
-  # pull_request_target lets the workflow close forked PRs after the invalid label is added.
+  # pull_request_target lets the workflow close forked PRs when they're labeled invalid or reopened.
   pull_request_target:
-    types: [labeled]
+    types: [labeled, reopened]
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   close-on-adding-invalid-label:
     if: github.repository == 'github/docs' && github.event.label.name == 'invalid'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
 
     steps:
       - name: Close issue
@@ -42,3 +45,29 @@ jobs:
         if: ${{ failure() && github.event_name != 'pull_request_target' }}
         with:
           slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
+
+  # Authors can reopen PRs they closed themselves, even after the invalid label is added.
+  reclose-reopened-invalid-pr:
+    if: >
+      github.repository == 'github/docs' && github.event_name == 'pull_request_target' &&
+      github.event.action == 'reopened' &&
+      contains(github.event.pull_request.labels.*.name, 'invalid')
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Re-close PR unless reopened by someone with write access
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          SENDER: ${{ github.event.sender.login }}
+        run: |
+          if ! permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$SENDER/permission" --jq '.permission'); then
+            echo "::warning::Couldn't look up permission for $SENDER, so treating them as read-only."
+            permission=none
+          fi
+          if [[ "$permission" == "admin" || "$permission" == "write" ]]; then
+            echo "$SENDER has $permission access, so leaving the PR open."
+            exit 0
+          fi
+          gh pr close "$PR_URL" --comment 'This pull request is labeled `invalid`, so only maintainers can reopen it. If you think this is incorrect, please mention this in a corresponding issue.'
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index b3022cb9e60e..6b60088308b3 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -30,7 +30,8 @@ jobs:
           persist-credentials: false
       - name: Sync repo to branch
         env:
-          SOURCE_REPO: https://${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}@github.com/github/${{ github.repository == 'github/docs-internal' && 'docs' || 'docs-internal' }}.git
+          # https://github.com/actions/runner-images/issues/15014
+          SOURCE_REPO: https://x-access-token:${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}@github.com/github/${{ github.repository == 'github/docs-internal' && 'docs' || 'docs-internal' }}.git
           SOURCE_BRANCH: main
           DESTINATION_BRANCH: repo-sync
           GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}
diff --git a/content/admin/data-residency/github-copilot-with-data-residency.md b/content/admin/data-residency/github-copilot-with-data-residency.md
index 6e4b1c8b49e5..a5a1d9d54804 100644
--- a/content/admin/data-residency/github-copilot-with-data-residency.md
+++ b/content/admin/data-residency/github-copilot-with-data-residency.md
@@ -71,6 +71,7 @@ The models available for {% data variables.product.prodname_copilot_short %} var
 * {% data variables.copilot.claude_opus_55 %}
 * {% data variables.copilot.claude_sonnet_5 %}
 * {% data variables.copilot.claude_sonnet_55 %}
+* {% data variables.copilot.gemini_4_argon %}
 
 ## Pricing changes
 
diff --git a/content/code-security/how-tos/secure-your-secrets/customize-leak-detection/exclude-folders-and-files.md b/content/code-security/how-tos/secure-your-secrets/customize-leak-detection/exclude-folders-and-files.md
index 814b2365ba12..24713d72f59e 100644
--- a/content/code-security/how-tos/secure-your-secrets/customize-leak-detection/exclude-folders-and-files.md
+++ b/content/code-security/how-tos/secure-your-secrets/customize-leak-detection/exclude-folders-and-files.md
@@ -17,7 +17,7 @@ category:
 
 You may have a reason to commit a secret to a repository, such as when you want to provide a fake secret in documentation, or in an example application. In these scenarios, you can quickly dismiss the alert and document the reasons. However, there may be cases where you want to ignore a directory entirely to avoid creating false positive alerts at scale. For example, you might have a monolithic application with several integrations containing a file of dummy keys that could set off numerous false alerts to triage.
 
-You can configure a `secret_scanning.yml` file to automatically close alerts found in specific directories from {% data variables.product.prodname_secret_scanning %}, and exclude these directories included in push protection. These alerts are closed as "ignored by configuration".
+You can configure a `secret_scanning.yml` file to automatically close alerts found in specific directories from {% data variables.product.prodname_secret_scanning %}, and exclude these directories included in push protection. These alerts are closed as "ignored by configuration". They do not trigger `secret_scanning_alert` or `secret_scanning_alert_location` webhook events.
 
 ## Excluding directories from {% data variables.secret-scanning.user_alerts %}
 
diff --git a/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md b/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md
index aff8fb5c8170..2f4607364452 100644
--- a/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md
+++ b/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md
@@ -545,6 +545,10 @@ The `/sandbox` dialog groups Git authentication, `gh` authentication, and masked
 
 Host rules and `sandbox.userPolicy.network.proxy` use a built-in local proxy. When both are configured, the local proxy applies the host rules before forwarding traffic to the upstream proxy. Upstream credentials stay outside the sandboxed child process. Host rules and proxy settings are inactive when outbound access is off.
 
+When no proxy is set in sandbox settings, the local proxy selects its upstream proxy from the first non-empty environment variable on the host in this order: `HTTPS_PROXY`, `HTTP_PROXY`, `ALL_PROXY`. Only `http://` and `https://` proxies are supported, not `socks5`.
+
+Destinations matching the host's `NO_PROXY` bypass only this inherited upstream proxy. The sandbox's local proxy still handles these connections and applies its host rules. A proxy configured in sandbox settings ignores `NO_PROXY`.
+
 On macOS and Linux, the sandbox restricts direct connections so programs cannot avoid the proxy. On Windows, the sandbox relies on programs honoring the proxy settings. As a result, programs that ignore the proxy settings on Windows can connect directly and get around your host rules. Windows proxying and host rules also require a supported host and `allowLocalNetwork: true`, which permits private-network access. On Linux, proxy settings reject IPv6 address literals other than the `[::]` dual-stack wildcard. Use an IPv4 endpoint or a hostname with IPv4 support.
 
 Sandbox settings are user-level or enterprise-managed. They are not repository-overridable. For configuration steps and network limitations, see [AUTOTITLE](/copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings).
diff --git a/data/reusables/copilot/model-compliance/us-models.md b/data/reusables/copilot/model-compliance/us-models.md
index d98fced64102..5e4f2f31ba5f 100644
--- a/data/reusables/copilot/model-compliance/us-models.md
+++ b/data/reusables/copilot/model-compliance/us-models.md
@@ -11,3 +11,4 @@
 * Claude Opus 4.8
 * Claude Opus 5
 * Claude Opus 5.5
+* Gemini 4 Argon
diff --git a/src/content-pipelines/state/copilot-cli.sha b/src/content-pipelines/state/copilot-cli.sha
index 8b56a4ad4020..32b895154e8d 100644
--- a/src/content-pipelines/state/copilot-cli.sha
+++ b/src/content-pipelines/state/copilot-cli.sha
@@ -1 +1 @@
-4fe31058ce5a3e55180ccda41fc625afcb7f5ead
+394f59ad9f91b3772c5ca6d45ebd8ce48150e9b7