diff --git a/.gitlab/ci/database.gitlab-ci.yml b/.gitlab/ci/database.gitlab-ci.yml
index f2c9093c967..64229671a2d 100644
--- a/.gitlab/ci/database.gitlab-ci.yml
+++ b/.gitlab/ci/database.gitlab-ci.yml
@@ -111,7 +111,7 @@ db:migrate:reset single-db:
 db:check-schema:
   extends:
     - .db-job-base
-    - .rails:rules:ee-mr-and-default-branch-only
+    - .rails:rules:db:check-schema
   script:
     - run_timed_command "bundle exec rake db:drop db:create db:migrate"
 
diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml
index 94982b8acfe..752f380bbab 100644
--- a/.gitlab/ci/rails.gitlab-ci.yml
+++ b/.gitlab/ci/rails.gitlab-ci.yml
@@ -448,7 +448,7 @@ rspec:artifact-collector part-a:
   needs:
     - job: rspec system pg14  # 32 jobs
       optional: true
-    - job: rspec background_migration pg14  # 10 jobs
+    - job: rspec background_migration pg14  # 17 jobs
       optional: true
 
 rspec:artifact-collector part-b:
diff --git a/.gitlab/ci/rails/shared.gitlab-ci.yml b/.gitlab/ci/rails/shared.gitlab-ci.yml
index c8bf625f7f5..8553d6ccf60 100644
--- a/.gitlab/ci/rails/shared.gitlab-ci.yml
+++ b/.gitlab/ci/rails/shared.gitlab-ci.yml
@@ -330,6 +330,16 @@ include:
 #
 #     parallel_job_count = ceil(current_job_count * (average_duration / target_duration))
 #
+# Here's an example in Ruby:
+#
+#     current_job_count = 10
+#     average_duration  = 53
+#     target_duration   = 30
+#
+#     parallel_job_count = (current_job_count.to_f * (average_duration.to_f / target_duration.to_f)).ceil
+#
+#     => To reach 30min target duration, we would need 18 parallel jobs instead of 10.
+#
 # At the moment, we set the target to 30 minutes
 #
 # https://app.snowflake.com/ys68254/gitlab/w2woEkSvsfYa/chart
@@ -337,8 +347,10 @@ include:
   parallel: 26
 
 # https://app.snowflake.com/ys68254/gitlab/wpUmrAF0RJL/chart
+#
+# Please set back to around 10 once https://gitlab.com/gitlab-org/gitlab/-/issues/503221 is closed
 .rspec-background-migration-parallel:
-  parallel: 10
+  parallel: 17
 
 # https://app.snowflake.com/ys68254/gitlab/w4cxPH8ySQlP/chart
 .rspec-ee-migration-parallel:
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index e12cdc30697..a1af590690b 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -2334,13 +2334,15 @@
       when: manual
       allow_failure: true
 
-.rails:rules:ee-mr-and-default-branch-only:
+.rails:rules:db:check-schema:
   rules:
     - <<: *if-not-ee
       when: never
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
     - <<: *if-merge-request-labels-run-all-rspec
+    # Remove the rule below once https://gitlab.com/gitlab-org/gitlab/-/issues/503221 is closed.
+    - !reference [".prevent-tier-1", rules]
     - <<: *if-merge-request
       changes: *code-backstage-patterns
     - <<: *if-default-branch-refs
diff --git a/.rubocop_todo/layout/empty_line_after_magic_comment.yml b/.rubocop_todo/layout/empty_line_after_magic_comment.yml
index d8df41e728f..444f241949c 100644
--- a/.rubocop_todo/layout/empty_line_after_magic_comment.yml
+++ b/.rubocop_todo/layout/empty_line_after_magic_comment.yml
@@ -410,7 +410,6 @@ Layout/EmptyLineAfterMagicComment:
     - 'spec/finders/packages/conan/package_finder_spec.rb'
     - 'spec/finders/packages/group_packages_finder_spec.rb'
     - 'spec/finders/packages/npm/package_finder_spec.rb'
-    - 'spec/finders/packages/nuget/package_finder_spec.rb'
     - 'spec/finders/packages/package_file_finder_spec.rb'
     - 'spec/finders/packages/tags_finder_spec.rb'
     - 'spec/finders/projects/members/effective_access_level_finder_spec.rb'
diff --git a/GITLAB_PAGES_VERSION b/GITLAB_PAGES_VERSION
index d87582f9008..14a4f309f85 100644
--- a/GITLAB_PAGES_VERSION
+++ b/GITLAB_PAGES_VERSION
@@ -1 +1 @@
-6546b58c9c2eb0a7696b5d6d876980dec961a9f9
+17af60d3c2af0b548781cda116c11b54640ff125
diff --git a/app/assets/javascripts/ml/model_registry/apps/index_ml_models.vue b/app/assets/javascripts/ml/model_registry/apps/index_ml_models.vue
index ea185f942ad..9a0b413585e 100644
--- a/app/assets/javascripts/ml/model_registry/apps/index_ml_models.vue
+++ b/app/assets/javascripts/ml/model_registry/apps/index_ml_models.vue
@@ -1,5 +1,5 @@
 <script>
-import { GlButton, GlExperimentBadge, GlIcon } from '@gitlab/ui';
+import { GlButton, GlIcon } from '@gitlab/ui';
 import TitleArea from '~/vue_shared/components/registry/title_area.vue';
 import { helpPagePath } from '~/helpers/help_page_helper';
 import * as Sentry from '~/sentry/sentry_browser_wrapper';
@@ -18,7 +18,6 @@ export default {
     GlIcon,
     TitleArea,
     GlButton,
-    GlExperimentBadge,
     EmptyState,
     ActionsDropdown,
     SearchableTable,
@@ -137,7 +136,6 @@ export default {
       <template #title>
         <div class="gl-flex gl-grow gl-items-center">
           <span>{{ $options.i18n.TITLE_LABEL }}</span>
-          <gl-experiment-badge :help-page-url="$options.docHref" type="beta" />
         </div>
       </template>
       <template #metadata-models-count>
diff --git a/app/finders/concerns/packages/finder_helper.rb b/app/finders/concerns/packages/finder_helper.rb
index 4bb12389f99..673b2cbe4a7 100644
--- a/app/finders/concerns/packages/finder_helper.rb
+++ b/app/finders/concerns/packages/finder_helper.rb
@@ -41,7 +41,7 @@ module Packages
     def packages_visible_to_user_including_public_registries(user, within_group:)
       projects = projects_visible_to_user_including_public_registries(user, within_group: within_group)
 
-      ::Packages::Package.for_projects(projects.select(:id)).installable
+      packages_class.for_projects(projects.select(:id)).installable
     end
 
     def projects_visible_to_user(user, within_group:)
diff --git a/app/finders/packages/nuget/package_finder.rb b/app/finders/packages/nuget/package_finder.rb
index 76d4b01a61a..0fe222f6daf 100644
--- a/app/finders/packages/nuget/package_finder.rb
+++ b/app/finders/packages/nuget/package_finder.rb
@@ -9,7 +9,7 @@ module Packages
       FORCE_NORMALIZATION_CLIENT_VERSION = '>= 3'
 
       def execute
-        return ::Packages::Package.none unless @params[:package_name].present?
+        return packages_class.none unless @params[:package_name].present?
 
         packages.limit_recent(@params[:limit] || MAX_PACKAGES_COUNT)
       end
@@ -22,10 +22,16 @@ module Packages
       end
 
       def find_by_name
-        base
-          .nuget
-          .has_version
-          .with_case_insensitive_name(@params[:package_name])
+        if Feature.enabled?(:nuget_extract_nuget_package_model, Feature.current_request)
+          base
+            .has_version
+            .with_case_insensitive_name(@params[:package_name])
+        else
+          base
+            .nuget
+            .has_version
+            .with_case_insensitive_name(@params[:package_name])
+        end
       end
 
       def find_by_version(result)
@@ -48,6 +54,15 @@ module Packages
 
         VersionSorter.compare(FORCE_NORMALIZATION_CLIENT_VERSION, @params[:client_version]) <= 0
       end
+
+      override :packages_class
+      def packages_class
+        if Feature.enabled?(:nuget_extract_nuget_package_model, Feature.current_request)
+          ::Packages::Nuget::Package
+        else
+          super
+        end
+      end
     end
   end
 end
diff --git a/app/finders/todos_finder.rb b/app/finders/todos_finder.rb
index 5f1be5c8690..13a7e38391c 100644
--- a/app/finders/todos_finder.rb
+++ b/app/finders/todos_finder.rb
@@ -139,7 +139,17 @@ class TodosFinder
 
   def sort(items)
     if params[:sort]
-      items.sort_by_attribute(params[:sort])
+      # For users with a lot of todos, sorting by created_at can be unusably slow.
+      # Given that todos have sequential ids, we can simply sort by them instead
+      sort_by = case params[:sort]
+                when :created_desc
+                  :id_desc
+                when :created_asc
+                  :id_asc
+                else
+                  params[:sort]
+                end
+      items.sort_by_attribute(sort_by)
     else
       items.order_id_desc
     end
diff --git a/app/models/packages/nuget/metadatum.rb b/app/models/packages/nuget/metadatum.rb
index 71c173354a9..3edf3b21e34 100644
--- a/app/models/packages/nuget/metadatum.rb
+++ b/app/models/packages/nuget/metadatum.rb
@@ -2,14 +2,26 @@
 
 class Packages::Nuget::Metadatum < ApplicationRecord
   include Packages::Nuget::VersionNormalizable
+  include Gitlab::Utils::StrongMemoize
 
   MAX_AUTHORS_LENGTH = 255
   MAX_DESCRIPTION_LENGTH = 4000
   MAX_URL_LENGTH = 255
 
-  belongs_to :package, -> { where(package_type: :nuget) }, inverse_of: :nuget_metadatum
+  belongs_to :package, class_name: 'Packages::Nuget::Package', inverse_of: :nuget_metadatum
+
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+  belongs_to :legacy_package, -> {
+    where(package_type: :nuget)
+  }, inverse_of: :nuget_metadatum, class_name: 'Packages::Package', foreign_key: :package_id
+
+  validates :package, presence: true, if: -> { nuget_extract_nuget_package_model_enabled? }
+
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+  validates :legacy_package, presence: true, unless: -> { nuget_extract_nuget_package_model_enabled? }
 
-  validates :package, presence: true
   validate :ensure_valid_urls
   with_options if: :url_validation_enabled?, public_url: { allow_blank: true } do
     validates :license_url
@@ -25,9 +37,11 @@ class Packages::Nuget::Metadatum < ApplicationRecord
   validates :description, presence: true, length: { maximum: MAX_DESCRIPTION_LENGTH }
   validates :normalized_version, presence: true
 
-  validate :ensure_nuget_package_type
+  validate :ensure_nuget_package_type, unless: -> { nuget_extract_nuget_package_model_enabled? }
 
-  delegate :version, to: :package, prefix: true
+  # TODO: Use `prefix: true` with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+  delegate :version, to: :package_or_legacy_package, prefix: :package
 
   scope :normalized_version_in, ->(version) { where(normalized_version: version.downcase) }
 
@@ -38,7 +52,7 @@ class Packages::Nuget::Metadatum < ApplicationRecord
   end
 
   def ensure_nuget_package_type
-    return if package&.nuget?
+    return if legacy_package&.nuget?
 
     errors.add(:base, _('Package type must be NuGet'))
   end
@@ -52,4 +66,20 @@ class Packages::Nuget::Metadatum < ApplicationRecord
       errors.add(field, _('is an invalid URL')) unless Gitlab::UrlSanitizer.valid_web?(value)
     end
   end
+
+  # TODO: Use `package` directly in `delegate` with the rollout of
+  # the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+  def package_or_legacy_package
+    if nuget_extract_nuget_package_model_enabled?
+      package
+    else
+      legacy_package
+    end
+  end
+
+  def nuget_extract_nuget_package_model_enabled?
+    Feature.enabled?(:nuget_extract_nuget_package_model, Feature.current_request)
+  end
+  strong_memoize_attr :nuget_extract_nuget_package_model_enabled?
 end
diff --git a/app/models/packages/nuget/package.rb b/app/models/packages/nuget/package.rb
new file mode 100644
index 00000000000..e8a7d321ca4
--- /dev/null
+++ b/app/models/packages/nuget/package.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Packages
+  module Nuget
+    class Package < Packages::Package
+      self.allow_legacy_sti_class = true
+
+      has_many :installable_nuget_package_files, -> {
+        installable.with_nuget_format
+      }, class_name: 'Packages::PackageFile', inverse_of: :package
+
+      has_one :nuget_metadatum, inverse_of: :package, class_name: 'Packages::Nuget::Metadatum'
+      has_many :nuget_symbols, inverse_of: :package, class_name: 'Packages::Nuget::Symbol'
+
+      validates :name, format: { with: Gitlab::Regex.nuget_package_name_regex }
+      validates :version, format: { with: Gitlab::Regex.nuget_version_regex }
+
+      scope :with_nuget_version_or_normalized_version, ->(version, with_normalized: true) do
+        relation = with_case_insensitive_version(version)
+
+        return relation unless with_normalized
+
+        relation
+          .left_joins(:nuget_metadatum)
+          .or(
+            merge(Packages::Nuget::Metadatum.normalized_version_in(version))
+          )
+      end
+
+      scope :without_nuget_temporary_name, -> { where.not(name: Packages::Nuget::TEMPORARY_PACKAGE_NAME) }
+
+      scope :including_dependency_links_with_nuget_metadatum, -> do
+        includes(dependency_links: [:dependency, :nuget_metadatum])
+      end
+
+      scope :preload_nuget_metadatum, -> { preload(:nuget_metadatum) }
+      scope :preload_nuget_files, -> { preload(:installable_nuget_package_files) }
+
+      def normalized_nuget_version
+        nuget_metadatum&.normalized_version
+      end
+    end
+  end
+end
diff --git a/app/models/packages/nuget/symbol.rb b/app/models/packages/nuget/symbol.rb
index f0590ac1eaa..18fc09f5ffd 100644
--- a/app/models/packages/nuget/symbol.rb
+++ b/app/models/packages/nuget/symbol.rb
@@ -6,18 +6,31 @@ module Packages
       include FileStoreMounter
       include ShaAttribute
       include Packages::Destructible
+      include Gitlab::Utils::StrongMemoize
 
       # Used in destroying stale symbols in worker
       enum :status, default: 0, processing: 1, error: 3
 
-      belongs_to :package, -> { where(package_type: :nuget) }, inverse_of: :nuget_symbols
+      belongs_to :package, class_name: 'Packages::Nuget::Package', inverse_of: :nuget_symbols
+
+      # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+      # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+      belongs_to :legacy_package, -> {
+        where(package_type: :nuget)
+      }, inverse_of: :nuget_symbols, class_name: 'Packages::Package', foreign_key: :package_id
+
       belongs_to :project
 
-      delegate :project_id, :project, to: :package
+      delegate :project_id, :project, to: :package_or_legacy_package
 
-      validates :package, :file, :file_path, :signature, :object_storage_key, :size, presence: true
+      validates :file, :file_path, :signature, :object_storage_key, :size, presence: true
       validates :signature, uniqueness: { scope: :file_path }
       validates :object_storage_key, uniqueness: true
+      validates :package, presence: true, if: -> { nuget_extract_nuget_package_model_enabled? }
+
+      # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+      # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+      validates :legacy_package, presence: true, unless: -> { nuget_extract_nuget_package_model_enabled? }
 
       sha256_attribute :file_sha256
 
@@ -48,6 +61,22 @@ module Packages
           root_hash: project_id
         ).to_s
       end
+
+      # TODO: Use `package` directly in `delegate` with the rollout of
+      # the FF nuget_extract_nuget_package_model
+      # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+      def package_or_legacy_package
+        if nuget_extract_nuget_package_model_enabled?
+          package
+        else
+          legacy_package
+        end
+      end
+
+      def nuget_extract_nuget_package_model_enabled?
+        Feature.enabled?(:nuget_extract_nuget_package_model, Feature.current_request)
+      end
+      strong_memoize_attr :nuget_extract_nuget_package_model_enabled?
     end
   end
 end
diff --git a/app/models/packages/package.rb b/app/models/packages/package.rb
index cea3358ca01..cd04d61d546 100644
--- a/app/models/packages/package.rb
+++ b/app/models/packages/package.rb
@@ -40,12 +40,18 @@ class Packages::Package < ApplicationRecord
   # TODO: put the installable default scope on the :package_files association once the dependent: :destroy is removed
   # See https://gitlab.com/gitlab-org/gitlab/-/issues/349191
   has_many :installable_package_files, -> { installable }, class_name: 'Packages::PackageFile', inverse_of: :package
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   has_many :installable_nuget_package_files, -> { installable.with_nuget_format }, class_name: 'Packages::PackageFile', inverse_of: :package
   has_many :dependency_links, inverse_of: :package, class_name: 'Packages::DependencyLink'
   has_many :tags, inverse_of: :package, class_name: 'Packages::Tag'
 
   has_one :maven_metadatum, inverse_of: :package, class_name: 'Packages::Maven::Metadatum'
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   has_one :nuget_metadatum, inverse_of: :package, class_name: 'Packages::Nuget::Metadatum'
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   has_many :nuget_symbols, inverse_of: :package, class_name: 'Packages::Nuget::Symbol'
   has_one :npm_metadatum, inverse_of: :package, class_name: 'Packages::Npm::Metadatum'
 
@@ -70,8 +76,12 @@ class Packages::Package < ApplicationRecord
   validate :npm_package_already_taken, if: :npm?
 
   validates :name, format: { with: Gitlab::Regex.npm_package_name_regex, message: Gitlab::Regex.npm_package_name_regex_message }, if: :npm?
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   validates :name, format: { with: Gitlab::Regex.nuget_package_name_regex }, if: :nuget?
 
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   validates :version, format: { with: Gitlab::Regex.nuget_version_regex }, if: :nuget?
   validates :version, format: { with: Gitlab::Regex.maven_version_regex }, if: -> { version? && maven? }
 
@@ -90,6 +100,8 @@ class Packages::Package < ApplicationRecord
     where(arel_table[:name].lower.eq(name.downcase))
   end
 
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   scope :with_nuget_version_or_normalized_version, ->(version, with_normalized: true) do
     relation = with_case_insensitive_version(version)
 
@@ -112,19 +124,27 @@ class Packages::Package < ApplicationRecord
   scope :including_project_namespace_route, -> { includes(project: { namespace: :route }) }
   scope :including_tags, -> { includes(:tags) }
   scope :including_dependency_links, -> { includes(dependency_links: :dependency) }
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   scope :including_dependency_links_with_nuget_metadatum, -> { includes(dependency_links: [:dependency, :nuget_metadatum]) }
 
   scope :preload_npm_metadatum, -> { preload(:npm_metadatum) }
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   scope :preload_nuget_metadatum, -> { preload(:nuget_metadatum) }
 
   scope :with_npm_scope, ->(scope) do
     npm.where("position('/' in packages_packages.name) > 0 AND split_part(packages_packages.name, '/', 1) = :package_scope", package_scope: "@#{sanitize_sql_like(scope)}")
   end
 
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   scope :without_nuget_temporary_name, -> { where.not(name: Packages::Nuget::TEMPORARY_PACKAGE_NAME) }
 
   scope :has_version, -> { where.not(version: nil) }
   scope :preload_files, -> { preload(:installable_package_files) }
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   scope :preload_nuget_files, -> { preload(:installable_nuget_package_files) }
   scope :preload_pipelines, -> { preload(pipelines: :user) }
   scope :preload_tags, -> { preload(:tags) }
@@ -167,7 +187,7 @@ class Packages::Package < ApplicationRecord
   def self.inheritance_column = 'package_type'
 
   def self.inheritance_column_to_class_map
-    {
+    hash = {
       ml_model: 'Packages::MlModel::Package',
       golang: 'Packages::Go::Package',
       rubygems: 'Packages::Rubygems::Package',
@@ -179,7 +199,13 @@ class Packages::Package < ApplicationRecord
       generic: 'Packages::Generic::Package',
       pypi: 'Packages::Pypi::Package',
       terraform_module: 'Packages::TerraformModule::Package'
-    }.freeze
+    }
+
+    if Feature.enabled?(:nuget_extract_nuget_package_model, Feature.current_request)
+      hash[:nuget] = 'Packages::Nuget::Package'
+    end
+
+    hash
   end
 
   def self.only_maven_packages_with_path(path, use_cte: false)
@@ -299,6 +325,8 @@ class Packages::Package < ApplicationRecord
     ::Packages::MarkPackageFilesForDestructionWorker.perform_async(id)
   end
 
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   def normalized_nuget_version
     return unless nuget?
 
diff --git a/app/presenters/packages/detail/package_presenter.rb b/app/presenters/packages/detail/package_presenter.rb
index 3eccb2997d9..258a42a4e15 100644
--- a/app/presenters/packages/detail/package_presenter.rb
+++ b/app/presenters/packages/detail/package_presenter.rb
@@ -26,7 +26,7 @@ module Packages
 
         package_detail[:conan_package_name] = @package.name if @package.conan?
         package_detail[:maven_metadatum] = @package.maven_metadatum if @package.maven_metadatum
-        package_detail[:nuget_metadatum] = @package.nuget_metadatum if @package.nuget_metadatum
+        package_detail[:nuget_metadatum] = @package.nuget_metadatum if @package.try(:nuget_metadatum)
         package_detail[:composer_metadatum] = @package.composer_metadatum if @package.try(:composer_metadatum)
         package_detail[:conan_metadatum] = @package.conan_metadatum if @package.conan? && @package.conan_metadatum
         if @package.terraform_module? && @package.terraform_module_metadatum
diff --git a/app/services/packages/nuget/search_service.rb b/app/services/packages/nuget/search_service.rb
index c9faeba7059..8ae68829085 100644
--- a/app/services/packages/nuget/search_service.rb
+++ b/app/services/packages/nuget/search_service.rb
@@ -42,12 +42,12 @@ module Packages
         # and https://docs.microsoft.com/en-us/nuget/api/search-query-service-resource
         subquery_name = :partition_subquery
         arel_table = Arel::Table.new(subquery_name)
-        column_names = Packages::Package.column_names.map do |cn|
+        column_names = packages_class.column_names.map do |cn|
           "#{subquery_name}.#{quote_column_name(cn)}"
         end
 
         # rubocop: disable CodeReuse/ActiveRecord
-        pkgs = Packages::Package
+        pkgs = packages_class.unscope(where: :package_type)
         pkgs = pkgs.with(project_ids_cte.to_arel) if use_project_ids_cte?
         pkgs = pkgs.select(column_names.join(','))
                    .from(package_names_partition, subquery_name)
@@ -62,7 +62,7 @@ module Packages
 
       def package_names_partition
         # rubocop: disable CodeReuse/ActiveRecord
-        table_name = quote_table_name(Packages::Package.table_name)
+        table_name = quote_table_name(packages_class.table_name)
         name_column = "#{table_name}.#{quote_column_name('name')}"
         created_at_column = "#{table_name}.#{quote_column_name('created_at')}"
         select_sql = "ROW_NUMBER() OVER (PARTITION BY #{name_column} ORDER BY #{created_at_column} DESC) AS row_number, #{table_name}.*"
@@ -101,9 +101,13 @@ module Packages
       strong_memoize_attr :base_matching_package_names
 
       def nuget_packages
-        Packages::Package.nuget
-                         .installable
-                         .has_version
+        if Feature.enabled?(:nuget_extract_nuget_package_model, Feature.current_request)
+          ::Packages::Nuget::Package.installable.has_version
+        else
+          Packages::Package.nuget
+                           .installable
+                           .has_version
+        end
       end
 
       def project_ids_cte
@@ -150,6 +154,14 @@ module Packages
         [@options[:per_page], MAX_PER_PAGE].min
       end
 
+      def packages_class
+        if Feature.enabled?(:nuget_extract_nuget_package_model, Feature.current_request)
+          ::Packages::Nuget::Package
+        else
+          ::Packages::Package
+        end
+      end
+
       class Result
         include ActiveModel::Model
 
diff --git a/config/feature_flags/experiment/prompt_migration_epic_reader.yml b/config/feature_flags/experiment/prompt_migration_epic_reader.yml
deleted file mode 100644
index 70654ecb097..00000000000
--- a/config/feature_flags/experiment/prompt_migration_epic_reader.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: prompt_migration_epic_reader
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/475052
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/167401
-rollout_issue_url: https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/issues/595
-milestone: '17.6'
-group: group::custom models
-type: experiment
-default_enabled: false
diff --git a/config/feature_flags/experiment/prompt_migration_explain_code.yml b/config/feature_flags/experiment/prompt_migration_explain_code.yml
deleted file mode 100644
index ba653b60133..00000000000
--- a/config/feature_flags/experiment/prompt_migration_explain_code.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: prompt_migration_explain_code
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/475050
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/160252
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/476589
-milestone: '17.3'
-group: group::custom models
-type: experiment
-default_enabled: false
diff --git a/config/feature_flags/experiment/prompt_migration_fix_code.yml b/config/feature_flags/experiment/prompt_migration_fix_code.yml
deleted file mode 100644
index e67ed953688..00000000000
--- a/config/feature_flags/experiment/prompt_migration_fix_code.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: prompt_migration_fix_code
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/475047
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/167399
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/496750
-milestone: '17.5'
-group: group::custom models
-type: experiment
-default_enabled: false
diff --git a/config/feature_flags/experiment/prompt_migration_issue_reader.yml b/config/feature_flags/experiment/prompt_migration_issue_reader.yml
deleted file mode 100644
index 524e13308f3..00000000000
--- a/config/feature_flags/experiment/prompt_migration_issue_reader.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: prompt_migration_issue_reader
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/475053
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/167401
-rollout_issue_url: https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/issues/595
-milestone: '17.6'
-group: group::custom models
-type: experiment
-default_enabled: false
diff --git a/config/feature_flags/experiment/prompt_migration_refactor_code.yml b/config/feature_flags/experiment/prompt_migration_refactor_code.yml
deleted file mode 100644
index bc999ad6d4a..00000000000
--- a/config/feature_flags/experiment/prompt_migration_refactor_code.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: prompt_migration_refactor_code
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/475050
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/162716
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/479117
-milestone: '17.4'
-group: group::custom models
-type: experiment
-default_enabled: false
diff --git a/config/feature_flags/experiment/prompt_migration_write_tests.yml b/config/feature_flags/gitlab_com_derisk/nuget_extract_nuget_package_model.yml
similarity index 60%
rename from config/feature_flags/experiment/prompt_migration_write_tests.yml
rename to config/feature_flags/gitlab_com_derisk/nuget_extract_nuget_package_model.yml
index 58552e87e63..cb6bb91bce1 100644
--- a/config/feature_flags/experiment/prompt_migration_write_tests.yml
+++ b/config/feature_flags/gitlab_com_derisk/nuget_extract_nuget_package_model.yml
@@ -1,9 +1,9 @@
 ---
-name: prompt_migration_write_tests
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/475049
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/163449
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/479799
-milestone: '17.4'
-group: group::custom models
-type: experiment
+name: nuget_extract_nuget_package_model
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/435826
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170692
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+milestone: '17.6'
+group: group::package registry
+type: gitlab_com_derisk
 default_enabled: false
diff --git a/db/docs/group_scim_auth_access_tokens.yml b/db/docs/group_scim_auth_access_tokens.yml
new file mode 100644
index 00000000000..6dd5b3c3888
--- /dev/null
+++ b/db/docs/group_scim_auth_access_tokens.yml
@@ -0,0 +1,13 @@
+---
+table_name: group_scim_auth_access_tokens
+milestone: '17.6'
+classes:
+- GroupScimAuthAccessToken
+feature_categories:
+- system_access
+description: Bearer token used  for authenticating SCIM requests. This is table used
+  for Group SCIM
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170565/diffs
+gitlab_schema: gitlab_main_cell
+sharding_key:
+  group_id: namespaces
diff --git a/db/docs/group_scim_identities.yml b/db/docs/group_scim_identities.yml
new file mode 100644
index 00000000000..cc52679fae0
--- /dev/null
+++ b/db/docs/group_scim_identities.yml
@@ -0,0 +1,12 @@
+---
+table_name: group_scim_identities
+classes:
+- GroupScimIdentity
+feature_categories:
+- system_access
+description: Table to persisit scim identities of the user in SaaS
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26124
+milestone: '17.6'
+gitlab_schema: gitlab_main_cell
+sharding_key:
+  group_id: namespaces
diff --git a/db/docs/packages_packages.yml b/db/docs/packages_packages.yml
index 41edd51a569..4b6dc7bd4d5 100644
--- a/db/docs/packages_packages.yml
+++ b/db/docs/packages_packages.yml
@@ -8,6 +8,7 @@ classes:
 - Packages::Go::Package
 - Packages::Helm::Package
 - Packages::MlModel::Package
+- Packages::Nuget::Package
 - Packages::Package
 - Packages::Pypi::Package
 - Packages::TerraformModule::Package
diff --git a/db/docs/scim_identities.yml b/db/docs/scim_identities.yml
index 48f533ede48..3af1963358b 100644
--- a/db/docs/scim_identities.yml
+++ b/db/docs/scim_identities.yml
@@ -4,8 +4,8 @@ classes:
 - ScimIdentity
 feature_categories:
 - system_access
-description: TODO
+description: Table to persisit scim identities of the user in instance wide SCIM
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26124
 milestone: '12.9'
-gitlab_schema: gitlab_main
-sharding_key_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/463930
+gitlab_schema: gitlab_main_cell
+exempt_from_sharding: true
diff --git a/db/docs/scim_oauth_access_tokens.yml b/db/docs/scim_oauth_access_tokens.yml
index 4f43faa3f04..20b7ef8ca3a 100644
--- a/db/docs/scim_oauth_access_tokens.yml
+++ b/db/docs/scim_oauth_access_tokens.yml
@@ -4,8 +4,8 @@ classes:
 - ScimOauthAccessToken
 feature_categories:
 - system_access
-description: TODO
+description: Bearer token used  for authenticating SCIM requests. This is table used for Instance SCIM
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/e9b2253fe3538234d1c4d173c4549a955233d836
 milestone: '11.10'
-gitlab_schema: gitlab_main
-sharding_key_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/463930
+gitlab_schema: gitlab_main_cell
+exempt_from_sharding: true
diff --git a/db/migrate/20241024145113_create_group_scim_identities.rb b/db/migrate/20241024145113_create_group_scim_identities.rb
new file mode 100644
index 00000000000..72c4113f9de
--- /dev/null
+++ b/db/migrate/20241024145113_create_group_scim_identities.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class CreateGroupScimIdentities < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+  milestone '17.6'
+
+  def change
+    create_table :group_scim_identities do |t|
+      t.references :group, foreign_key: { to_table: :namespaces, on_delete: :cascade }, null: false
+      t.references :user, index: false, foreign_key: { on_delete: :cascade }, null: false
+
+      t.timestamps_with_timezone null: false
+      t.bigint :temp_source_id, index: { unique: true }, comment: 'Temporary column to store scim_idenity id'
+      t.boolean :active, default: false
+      t.text :extern_uid, limit: 255, null: false
+
+      t.index [:user_id, :group_id], unique: true
+      t.index "lower(extern_uid), group_id", unique: true
+    end
+  end
+end
diff --git a/db/migrate/20241024145500_create_group_scim_auth_tokens.rb b/db/migrate/20241024145500_create_group_scim_auth_tokens.rb
new file mode 100644
index 00000000000..26c0a14416b
--- /dev/null
+++ b/db/migrate/20241024145500_create_group_scim_auth_tokens.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class CreateGroupScimAuthTokens < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+  milestone '17.6'
+
+  def change
+    create_table :group_scim_auth_access_tokens do |t|
+      t.references :group, foreign_key: { to_table: :namespaces, on_delete: :cascade }, null: false, index: false
+      t.timestamps_with_timezone null: false
+      t.bigint :temp_source_id, index: { unique: true }, comment: 'Temporary column to store scim_tokens id'
+      t.binary :token_encrypted, null: false
+
+      t.index [:group_id, :token_encrypted],
+        name: 'index_group_scim_access_tokens_on_group_id_and_token', unique: true
+    end
+  end
+end
diff --git a/db/schema_migrations/20241024145113 b/db/schema_migrations/20241024145113
new file mode 100644
index 00000000000..1730de09784
--- /dev/null
+++ b/db/schema_migrations/20241024145113
@@ -0,0 +1 @@
+c5ac4236d1347426a7de5b116703a1e9c64347765826212fad95e107f373d4c6
\ No newline at end of file
diff --git a/db/schema_migrations/20241024145500 b/db/schema_migrations/20241024145500
new file mode 100644
index 00000000000..6fbfb01b4b3
--- /dev/null
+++ b/db/schema_migrations/20241024145500
@@ -0,0 +1 @@
+488dacf857a90faf00188a2536e05513d1ead87fa344a18b9cb829113d901bb2
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 297da1709fa..1b28b6535eb 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -12483,6 +12483,49 @@ CREATE SEQUENCE group_saved_replies_id_seq
 
 ALTER SEQUENCE group_saved_replies_id_seq OWNED BY group_saved_replies.id;
 
+CREATE TABLE group_scim_auth_access_tokens (
+    id bigint NOT NULL,
+    group_id bigint NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    temp_source_id bigint,
+    token_encrypted bytea NOT NULL
+);
+
+COMMENT ON COLUMN group_scim_auth_access_tokens.temp_source_id IS 'Temporary column to store scim_tokens id';
+
+CREATE SEQUENCE group_scim_auth_access_tokens_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE group_scim_auth_access_tokens_id_seq OWNED BY group_scim_auth_access_tokens.id;
+
+CREATE TABLE group_scim_identities (
+    id bigint NOT NULL,
+    group_id bigint NOT NULL,
+    user_id bigint NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    temp_source_id bigint,
+    active boolean DEFAULT false,
+    extern_uid text NOT NULL,
+    CONSTRAINT check_53de3ba272 CHECK ((char_length(extern_uid) <= 255))
+);
+
+COMMENT ON COLUMN group_scim_identities.temp_source_id IS 'Temporary column to store scim_idenity id';
+
+CREATE SEQUENCE group_scim_identities_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE group_scim_identities_id_seq OWNED BY group_scim_identities.id;
+
 CREATE TABLE group_security_exclusions (
     id bigint NOT NULL,
     group_id bigint NOT NULL,
@@ -23055,6 +23098,10 @@ ALTER TABLE ONLY group_repository_storage_moves ALTER COLUMN id SET DEFAULT next
 
 ALTER TABLE ONLY group_saved_replies ALTER COLUMN id SET DEFAULT nextval('group_saved_replies_id_seq'::regclass);
 
+ALTER TABLE ONLY group_scim_auth_access_tokens ALTER COLUMN id SET DEFAULT nextval('group_scim_auth_access_tokens_id_seq'::regclass);
+
+ALTER TABLE ONLY group_scim_identities ALTER COLUMN id SET DEFAULT nextval('group_scim_identities_id_seq'::regclass);
+
 ALTER TABLE ONLY group_security_exclusions ALTER COLUMN id SET DEFAULT nextval('group_security_exclusions_id_seq'::regclass);
 
 ALTER TABLE ONLY group_ssh_certificates ALTER COLUMN id SET DEFAULT nextval('group_ssh_certificates_id_seq'::regclass);
@@ -25308,6 +25355,12 @@ ALTER TABLE ONLY group_repository_storage_moves
 ALTER TABLE ONLY group_saved_replies
     ADD CONSTRAINT group_saved_replies_pkey PRIMARY KEY (id);
 
+ALTER TABLE ONLY group_scim_auth_access_tokens
+    ADD CONSTRAINT group_scim_auth_access_tokens_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY group_scim_identities
+    ADD CONSTRAINT group_scim_identities_pkey PRIMARY KEY (id);
+
 ALTER TABLE ONLY group_security_exclusions
     ADD CONSTRAINT group_security_exclusions_pkey PRIMARY KEY (id);
 
@@ -30011,6 +30064,18 @@ CREATE INDEX index_group_repository_storage_moves_on_group_id ON group_repositor
 
 CREATE INDEX index_group_saved_replies_on_group_id ON group_saved_replies USING btree (group_id);
 
+CREATE UNIQUE INDEX index_group_scim_access_tokens_on_group_id_and_token ON group_scim_auth_access_tokens USING btree (group_id, token_encrypted);
+
+CREATE UNIQUE INDEX index_group_scim_auth_access_tokens_on_temp_source_id ON group_scim_auth_access_tokens USING btree (temp_source_id);
+
+CREATE INDEX index_group_scim_identities_on_group_id ON group_scim_identities USING btree (group_id);
+
+CREATE UNIQUE INDEX index_group_scim_identities_on_lower_extern_uid_group_id ON group_scim_identities USING btree (lower(extern_uid), group_id);
+
+CREATE UNIQUE INDEX index_group_scim_identities_on_temp_source_id ON group_scim_identities USING btree (temp_source_id);
+
+CREATE UNIQUE INDEX index_group_scim_identities_on_user_id_and_group_id ON group_scim_identities USING btree (user_id, group_id);
+
 CREATE INDEX index_group_security_exclusions_on_group_id ON group_security_exclusions USING btree (group_id);
 
 CREATE UNIQUE INDEX index_group_ssh_certificates_on_fingerprint ON group_ssh_certificates USING btree (fingerprint);
@@ -37099,6 +37164,9 @@ ALTER TABLE ONLY custom_fields
 ALTER TABLE ONLY chat_teams
     ADD CONSTRAINT fk_rails_3b543909cb FOREIGN KEY (namespace_id) REFERENCES namespaces(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY group_scim_auth_access_tokens
+    ADD CONSTRAINT fk_rails_3caca5d6d0 FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY ci_build_needs
     ADD CONSTRAINT fk_rails_3cf221d4ed_p FOREIGN KEY (partition_id, build_id) REFERENCES p_ci_builds(partition_id, id) ON UPDATE CASCADE ON DELETE CASCADE;
 
@@ -37114,6 +37182,9 @@ ALTER TABLE ONLY virtual_registries_packages_maven_registry_upstreams
 ALTER TABLE ONLY snippet_user_mentions
     ADD CONSTRAINT fk_rails_3e00189191 FOREIGN KEY (snippet_id) REFERENCES snippets(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY group_scim_identities
+    ADD CONSTRAINT fk_rails_3e0678e2d9 FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY early_access_program_tracking_events
     ADD CONSTRAINT fk_rails_3e8c32b3dd FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
 
@@ -37570,6 +37641,9 @@ ALTER TABLE ONLY system_access_instance_microsoft_graph_access_tokens
 ALTER TABLE ONLY packages_debian_group_distribution_keys
     ADD CONSTRAINT fk_rails_779438f163 FOREIGN KEY (distribution_id) REFERENCES packages_debian_group_distributions(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY group_scim_identities
+    ADD CONSTRAINT fk_rails_77cb698c8d FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY terraform_states
     ADD CONSTRAINT fk_rails_78f54ca485 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
diff --git a/doc/.vale/gitlab_base/SubstitutionWarning.yml b/doc/.vale/gitlab_base/SubstitutionWarning.yml
index 0f12e912326..3240ea9f49b 100644
--- a/doc/.vale/gitlab_base/SubstitutionWarning.yml
+++ b/doc/.vale/gitlab_base/SubstitutionWarning.yml
@@ -40,8 +40,6 @@ swap:
   installation from source: self-compiled installation
   installations from source: self-compiled installations
   it is recommended: "you should"
-  life cycle: "lifecycle"
-  life-cycle: "lifecycle"
   log in: "sign in"
   log-in: "sign in"
   logged in user: "authenticated user"
diff --git a/doc/.vale/gitlab_base/Substitutions.yml b/doc/.vale/gitlab_base/Substitutions.yml
index cee6784c5cf..0ef8622d608 100644
--- a/doc/.vale/gitlab_base/Substitutions.yml
+++ b/doc/.vale/gitlab_base/Substitutions.yml
@@ -41,6 +41,8 @@ swap:
   guest access: the Guest role
   guest permission: the Guest role
   guest permissions: the Guest role
+  life cycle: "lifecycle"
+  life-cycle: "lifecycle"
   maintainer access: the Maintainer role
   maintainer permission: the Maintainer role
   maintainer permissions: the Maintainer role
diff --git a/doc/administration/self_hosted_models/index.md b/doc/administration/self_hosted_models/index.md
index 1f6f30385be..3a23e784616 100644
--- a/doc/administration/self_hosted_models/index.md
+++ b/doc/administration/self_hosted_models/index.md
@@ -45,16 +45,30 @@ Before setting up a self-hosted model infrastructure, you must have:
 
 There are two configuration options for self-managed customers:
 
-- [**GitLab.com AI Gateway**](configuration_types.md#gitlabcom-ai-gateway):
-  Use the GitLab-hosted AI Gateway with external
-  LLM providers (for example, Google Vertex or Anthropic).
-- [**Self-hosted AI Gateway**](configuration_types.md#self-hosted-ai-gateway):
-  Deploy your own AI Gateway and LLMs within
-  your infrastructure, without relying on external public services.
+- GitLab.com AI gateway with default GitLab external vendor LLMs
+- Self-hosted AI gateway and LLMs
 
 Before setting up a self-hosted model infrastructure, you must decide which
 configuration type to implement.
 
+### GitLab.com AI gateway with default GitLab external vendor LLMs
+
+This is the default Enterprise offering and is not fully self-hosted. In this configuration, you connect your self-managed GitLab instance to the GitLab-hosted AI gateway, which integrates with external vendor LLM providers (such as Google Vertex or Anthropic).
+
+These LLMs communicate through the [GitLab Cloud Connector](../../development/cloud_connector/index.md), offering a ready-to-use AI solution without the need for on-premise infrastructure.
+
+For licensing, you must have a GitLab Premium or Ultimate subscription and [GitLab Duo Enterprise](https://about.gitlab.com/solutions/gitlab-duo-pro/sales/?type=free-trial).
+
+For more information, see the [GitLab.com AI gateway configuration diagram](configuration_types.md#gitlabcom-ai-gateway).
+
+### Self-hosted AI gateway and LLMs
+
+In this configuration, you deploy your own AI gateway and LLMs within your infrastructure, without relying on external public services. This gives you full control over your data and security.
+
+For licensing, you must have a valid GitLab license. You can request a license through the [Customers Portal](../../subscriptions/customers_portal.md).
+
+For more information, see the [self-hosted AI gateway configuration diagram](configuration_types.md#self-hosted-ai-gateway).
+
 ## Set up a self-hosted infrastructure
 
 To set up a fully isolated self-hosted model infrastructure:
diff --git a/doc/api/model_registry.md b/doc/api/model_registry.md
index 3e6facb977c..fd6aa5886e1 100644
--- a/doc/api/model_registry.md
+++ b/doc/api/model_registry.md
@@ -9,7 +9,6 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
-**Status:** Beta
 
 ## Download a machine learning model package
 
diff --git a/doc/user/project/ml/model_registry/index.md b/doc/user/project/ml/model_registry/index.md
index 26d15a165cf..3dd549916ab 100644
--- a/doc/user/project/ml/model_registry/index.md
+++ b/doc/user/project/ml/model_registry/index.md
@@ -9,10 +9,10 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 DETAILS:
 **Tier:** Free, Premium, Ultimate
 **Offering:** GitLab.com, Self-managed, GitLab Dedicated
-**Status:** Beta
 
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/9423) in GitLab 16.8 as an [experiment](../../../../policy/experiment-beta-support.md#experiment) release [with a flag](../../../../administration/feature_flags.md) named `model_registry`. Disabled by default. To enable the feature, an administrator can [enable the feature flag](../../../../administration/feature_flags.md) named `model_registry`.
 > - [Changed](https://gitlab.com/groups/gitlab-org/-/epics/9423) to beta in GitLab 17.1.
+> - [Changed](https://gitlab.com/groups/gitlab-org/-/epics/14998) to general availability in GitLab 17.6.
 
 Model registry allows data scientists and developers to manage their machine learning
 models, along with all metadata associated with their creation: parameters, performance
diff --git a/lib/gitlab/changelog/release.rb b/lib/gitlab/changelog/release.rb
index 46f0981b7aa..41ad03eaa1c 100644
--- a/lib/gitlab/changelog/release.rb
+++ b/lib/gitlab/changelog/release.rb
@@ -80,7 +80,7 @@ module Gitlab
       end
 
       def header_start_pattern
-        /^##\s*#{Regexp.escape(version)}/
+        /^##\s*#{Regexp.escape(version)}\s/
       end
 
       private
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 31a8bacd5cd..06e0bc932b1 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -3846,15 +3846,9 @@ msgstr ""
 msgid "AdminSelfHostedModels|Add a new AI model that can be used for GitLab Duo features."
 msgstr ""
 
-msgid "AdminSelfHostedModels|Add and manage models that can be used for GitLab AI features."
-msgstr ""
-
 msgid "AdminSelfHostedModels|Add self-hosted model"
 msgstr ""
 
-msgid "AdminSelfHostedModels|Add self-hosted models"
-msgstr ""
-
 msgid "AdminSelfHostedModels|An error occurred while deleting your self-hosted model. Please try again."
 msgstr ""
 
@@ -3885,9 +3879,6 @@ msgstr ""
 msgid "AdminSelfHostedModels|Endpoint"
 msgstr ""
 
-msgid "AdminSelfHostedModels|Get started with Self‑hosted models"
-msgstr ""
-
 msgid "AdminSelfHostedModels|Get started with self-hosted models"
 msgstr ""
 
@@ -3897,9 +3888,6 @@ msgstr ""
 msgid "AdminSelfHostedModels|If required, provide the API token that grants access to your self-hosted model deployment."
 msgstr ""
 
-msgid "AdminSelfHostedModels|Manage AI models that can be used for GitLab AI features."
-msgstr ""
-
 msgid "AdminSelfHostedModels|Manage GitLab Duo by configuring and assigning self-hosted models to AI-powered features."
 msgstr ""
 
diff --git a/spec/db/schema_spec.rb b/spec/db/schema_spec.rb
index dd4da20a8c2..fbe7ef0fe36 100644
--- a/spec/db/schema_spec.rb
+++ b/spec/db/schema_spec.rb
@@ -244,6 +244,8 @@ RSpec.describe 'Database schema',
       workspaces_agent_config_versions: %w[item_id], # polymorphic associations
       work_item_types: %w[correct_id], # temporary column that is not a foreign key
       instance_integrations: %w[project_id group_id inherit_from_id], # these columns are not used in instance integrations
+      group_scim_identities: %w[temp_source_id], # temporary column that is not a foreign key
+      group_scim_auth_access_tokens: %w[temp_source_id], # temporary column that is not a foreign key
       subscription_user_add_on_assignment_versions: %w[item_id user_id purchase_id] # Managed by paper_trail gem, no need for FK on the historical data
     }.with_indifferent_access.freeze
   end
diff --git a/spec/factories/packages/nuget/packages.rb b/spec/factories/packages/nuget/packages.rb
new file mode 100644
index 00000000000..bccd0ecefbb
--- /dev/null
+++ b/spec/factories/packages/nuget/packages.rb
@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :nuget_package, class: 'Packages::Nuget::Package', parent: :package do
+    sequence(:name) { |n| "NugetPackage#{n}" }
+    sequence(:version) { |n| "1.0.#{n}" }
+    package_type { :nuget }
+
+    transient do
+      without_package_files { false }
+    end
+
+    package_files do
+      if without_package_files
+        []
+      else
+        [association(:package_file, :nuget, package: instance, file_name: "#{instance.name}.#{instance.version}.nupkg")]
+      end
+    end
+
+    trait(:with_metadatum) do
+      nuget_metadatum do
+        association(:nuget_metadatum, package: instance)
+      end
+    end
+
+    trait(:with_symbol_package) do
+      package_files do
+        package_files = []
+
+        unless without_package_files
+          package_files.push(
+            association(
+              :package_file,
+              :nuget,
+              package: instance,
+              file_name: "#{instance.name}.#{instance.version}.nupkg"
+            )
+          )
+        end
+
+        package_files.push(
+          association(
+            :package_file,
+            :snupkg,
+            package: instance,
+            file_name: "#{instance.name}.#{instance.version}.snupkg"
+          )
+        )
+
+        package_files
+      end
+    end
+
+    trait :with_build do
+      build_infos do
+        [association(:package_build_info, package: instance)]
+      end
+    end
+  end
+end
diff --git a/spec/factories/packages/packages.rb b/spec/factories/packages/packages.rb
index 18db6e38b97..02eacba73fb 100644
--- a/spec/factories/packages/packages.rb
+++ b/spec/factories/packages/packages.rb
@@ -62,7 +62,9 @@ FactoryBot.define do
       end
     end
 
-    factory :nuget_package do
+    # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+    factory :nuget_package_legacy do
       sequence(:name) { |n| "NugetPackage#{n}" }
       sequence(:version) { |n| "1.0.#{n}" }
       package_type { :nuget }
diff --git a/spec/finders/packages/nuget/package_finder_spec.rb b/spec/finders/packages/nuget/package_finder_spec.rb
index 5022e21521b..381a21cd876 100644
--- a/spec/finders/packages/nuget/package_finder_spec.rb
+++ b/spec/finders/packages/nuget/package_finder_spec.rb
@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require 'spec_helper'
 
 RSpec.describe Packages::Nuget::PackageFinder, feature_category: :package_registry do
@@ -16,19 +17,26 @@ RSpec.describe Packages::Nuget::PackageFinder, feature_category: :package_regist
   let(:package_version) { nil }
   let(:limit) { 50 }
   let(:client_version) { nil }
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # and use ::Packages::Nuget::Package instead
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+  let(:packages_class) { package1.class }
 
   describe '#execute!' do
     subject { described_class.new(user, target, package_name: package_name, package_version: package_version, limit: limit, client_version: client_version).execute }
 
     shared_examples 'calling with_nuget_version_or_normalized_version scope' do |with_normalized:|
       it 'calls with_nuget_version_or_normalized_version scope with the correct arguments' do
-        expect(::Packages::Package).to receive(:with_nuget_version_or_normalized_version).with(package_version, with_normalized: with_normalized).and_call_original
+        expect(packages_class)
+          .to receive(:with_nuget_version_or_normalized_version)
+          .with(package_version, with_normalized: with_normalized)
+          .and_call_original
 
         subject
       end
     end
 
-    shared_examples 'handling all the conditions' do
+    shared_examples 'handling all the conditions' do |factory: :nuget_package|
       it { is_expected.to match_array([package1, package2]) }
 
       context 'with lower case package name' do
@@ -80,9 +88,9 @@ RSpec.describe Packages::Nuget::PackageFinder, feature_category: :package_regist
       end
 
       context 'with limit hit' do
-        let_it_be(:package4) { create(:nuget_package, name: package1.name, project: project) }
-        let_it_be(:package5) { create(:nuget_package, name: package1.name, project: project) }
-        let_it_be(:package6) { create(:nuget_package, name: package1.name, project: project) }
+        let_it_be(:package4) { create(factory, name: package1.name, project: project) }
+        let_it_be(:package5) { create(factory, name: package1.name, project: project) }
+        let_it_be(:package6) { create(factory, name: package1.name, project: project) }
 
         let(:limit) { 2 }
 
@@ -164,12 +172,84 @@ RSpec.describe Packages::Nuget::PackageFinder, feature_category: :package_regist
 
       before_all do
         [subgroup, group, project].each do |entity|
-          entity.update!(visibility_level: Gitlab::VisibilityLevel.const_get(:PRIVATE, false))
+          entity.reload.update!(visibility_level: Gitlab::VisibilityLevel.const_get(:PRIVATE, false))
         end
         project.project_feature.update!(package_registry_access_level: ::ProjectFeature::PUBLIC)
       end
 
       it { is_expected.to match_array([package1, package2]) }
     end
+
+    context 'when nuget_extract_nuget_package_model is disabled' do
+      let_it_be_with_refind(:package1) { create(:nuget_package_legacy, project: project, name: FFaker::Lorem.word) }
+
+      let_it_be(:package2) do
+        create(:nuget_package_legacy, :with_metadatum, name: package1.name, version: '2.0.0+ABC', project: project)
+      end
+
+      let_it_be(:package3) { create(:nuget_package_legacy, name: FFaker::Lorem.word, project: project) }
+      let_it_be(:other_package_1) { create(:nuget_package_legacy, name: package1.name, version: package1.version) }
+      let_it_be(:other_package_2) { create(:nuget_package_legacy, name: package1.name, version: package2.version) }
+
+      before do
+        stub_feature_flags(nuget_extract_nuget_package_model: false)
+      end
+
+      context 'with a project' do
+        let(:target) { project }
+
+        before do
+          project.add_developer(user)
+        end
+
+        it_behaves_like 'handling all the conditions', factory: :nuget_package_legacy
+      end
+
+      context 'with a subgroup' do
+        let(:target) { subgroup }
+
+        before do
+          subgroup.add_developer(user)
+        end
+
+        it_behaves_like 'handling all the conditions', factory: :nuget_package_legacy
+      end
+
+      context 'with a group' do
+        let(:target) { group }
+
+        before do
+          group.add_developer(user)
+        end
+
+        it_behaves_like 'handling all the conditions', factory: :nuget_package_legacy
+      end
+
+      context 'with nil' do
+        let(:target) { nil }
+
+        it { is_expected.to be_empty }
+      end
+
+      context 'when package name is blank' do
+        let(:target) { project }
+        let(:package_name) { nil }
+
+        it { is_expected.to be_empty }
+      end
+
+      context 'with public package registry in private group' do
+        let(:target) { group }
+
+        before_all do
+          [subgroup, group, project].each do |entity|
+            entity.reload.update!(visibility_level: Gitlab::VisibilityLevel.const_get(:PRIVATE, false))
+          end
+          project.project_feature.update!(package_registry_access_level: ::ProjectFeature::PUBLIC)
+        end
+
+        it { is_expected.to match_array([package1, package2]) }
+      end
+    end
   end
 end
diff --git a/spec/finders/todos_finder_spec.rb b/spec/finders/todos_finder_spec.rb
index 72c6f4d2336..0cc6bd05089 100644
--- a/spec/finders/todos_finder_spec.rb
+++ b/spec/finders/todos_finder_spec.rb
@@ -276,10 +276,14 @@ RSpec.describe TodosFinder, feature_category: :notifications do
       context 'by date' do
         let!(:todo1) { create(:todo, user: user, project: project) }
         let!(:todo2) { create(:todo, user: user, project: project) }
-        let!(:todo3) { create(:todo, user: user, project: project) }
+        # Todos are created sequentially, so id is a reasonable proxy for created_at
+        # We use this fact to optimize the performance of the finder
+        # In this test we are purposefully setting the created_at to be before the todo1
+        # in order to show that we are actually sorting by id
+        let!(:todo3) { create(:todo, user: user, project: project, created_at: 3.hours.ago) }
 
         it 'sorts with oldest created first' do
-          todos = finder.new(user, { sort: 'id_asc' }).execute
+          todos = finder.new(user, { sort: :created_asc }).execute
 
           expect(todos.first).to eq(todo1)
           expect(todos.second).to eq(todo2)
@@ -287,7 +291,7 @@ RSpec.describe TodosFinder, feature_category: :notifications do
         end
 
         it 'sorts with newest created first' do
-          todos = finder.new(user, { sort: 'id_desc' }).execute
+          todos = finder.new(user, { sort: :created_desc }).execute
 
           expect(todos.first).to eq(todo3)
           expect(todos.second).to eq(todo2)
@@ -326,13 +330,13 @@ RSpec.describe TodosFinder, feature_category: :notifications do
 
         project_2.add_developer(user)
 
-        todos_asc_1 = finder.new(user, { sort: 'priority' }).execute
+        todos_asc_1 = finder.new(user, { sort: :priority }).execute
         expect(todos_asc_1).to eq([todo_3, todo_5, todo_4, todo_2, todo_1])
 
-        todos_asc_2 = finder.new(user, { sort: 'label_priority_asc' }).execute
+        todos_asc_2 = finder.new(user, { sort: :label_priority_asc }).execute
         expect(todos_asc_2).to eq([todo_3, todo_5, todo_4, todo_2, todo_1])
 
-        todos_desc = finder.new(user, { sort: 'label_priority_desc' }).execute
+        todos_desc = finder.new(user, { sort: :label_priority_desc }).execute
         expect(todos_desc).to eq([todo_1, todo_2, todo_4, todo_5, todo_3])
       end
     end
diff --git a/spec/frontend/ml/model_registry/apps/index_ml_models_spec.js b/spec/frontend/ml/model_registry/apps/index_ml_models_spec.js
index f85ee289c55..cf1e8b3f57e 100644
--- a/spec/frontend/ml/model_registry/apps/index_ml_models_spec.js
+++ b/spec/frontend/ml/model_registry/apps/index_ml_models_spec.js
@@ -1,4 +1,3 @@
-import { GlExperimentBadge } from '@gitlab/ui';
 import Vue from 'vue';
 import VueApollo from 'vue-apollo';
 import { mountExtended } from 'helpers/vue_test_utils_helper';
@@ -64,7 +63,6 @@ describeSkipVue3(skipReason, () => {
   const findEmptyState = () => wrapper.findComponent(EmptyState);
   const findTitleArea = () => wrapper.findComponent(TitleArea);
   const findModelCountMetadataItem = () => wrapper.findByTestId('metadata-item');
-  const findBadge = () => wrapper.findComponent(GlExperimentBadge);
   const findModelCreate = () => wrapper.findByTestId('create-model-button');
   const findActionsDropdown = () => wrapper.findComponent(ActionsDropdown);
 
@@ -77,13 +75,6 @@ describeSkipVue3(skipReason, () => {
       expect(findTitleArea().text()).toContain('Model registry');
     });
 
-    it('displays the experiment badge', () => {
-      expect(findBadge().props()).toMatchObject({
-        helpPageUrl: '/help/user/project/ml/model_registry/index.md',
-        type: 'beta',
-      });
-    });
-
     it('renders the extra actions button', () => {
       expect(findActionsDropdown().exists()).toBe(true);
     });
diff --git a/spec/graphql/resolvers/todos_resolver_spec.rb b/spec/graphql/resolvers/todos_resolver_spec.rb
index 7e0798a5cef..e9651c48c9d 100644
--- a/spec/graphql/resolvers/todos_resolver_spec.rb
+++ b/spec/graphql/resolvers/todos_resolver_spec.rb
@@ -125,9 +125,9 @@ RSpec.describe Resolvers::TodosResolver, feature_category: :notifications do
     context 'when sort is provided' do
       let_it_be(:new_user) { create(:user) }
 
-      let(:todo1) { create(:todo, user: new_user, project: project, created_at: 5.hours.ago) }
-      let(:todo2) { create(:todo, user: new_user, project: project, created_at: 4.hours.ago) }
-      let(:todo3) { create(:todo, user: new_user, project: project, created_at: 3.hours.ago) }
+      let!(:todo1) { create(:todo, user: new_user, project: project, created_at: 5.hours.ago) }
+      let!(:todo2) { create(:todo, user: new_user, project: project, created_at: 4.hours.ago) }
+      let!(:todo3) { create(:todo, user: new_user, project: project, created_at: 3.hours.ago) }
 
       it 'sorts in ascendent order' do
         todos = resolve_todos(args: { sort: 'CREATED_ASC' }, context: { current_user: new_user })
diff --git a/spec/lib/gitlab/auth/auth_finders_spec.rb b/spec/lib/gitlab/auth/auth_finders_spec.rb
index 5a43bc2fd9b..88710033f0f 100644
--- a/spec/lib/gitlab/auth/auth_finders_spec.rb
+++ b/spec/lib/gitlab/auth/auth_finders_spec.rb
@@ -6,6 +6,8 @@ RSpec.describe Gitlab::Auth::AuthFinders, feature_category: :system_access do
   include described_class
   include HttpBasicAuthHelpers
 
+  let_it_be(:organization) { create(:organization) }
+
   # Create the feed_token and static_object_token for the user
   let_it_be(:user, freeze: true) { create(:user).tap(&:feed_token).tap(&:static_object_token) }
   let_it_be(:personal_access_token, freeze: true) { create(:personal_access_token, user: user) }
@@ -129,7 +131,7 @@ RSpec.describe Gitlab::Auth::AuthFinders, feature_category: :system_access do
 
     context 'with oauth token' do
       let(:application) { Doorkeeper::Application.create!(name: 'MyApp', redirect_uri: 'https://app.com', owner: user) }
-      let(:doorkeeper_access_token) { Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'api') }
+      let(:doorkeeper_access_token) { Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'api', organization_id: organization.id) }
 
       before do
         set_bearer_token(doorkeeper_access_token.plaintext_token)
@@ -707,7 +709,7 @@ RSpec.describe Gitlab::Auth::AuthFinders, feature_category: :system_access do
 
   describe '#find_oauth_access_token' do
     let(:application) { Doorkeeper::Application.create!(name: 'MyApp', redirect_uri: 'https://app.com', owner: user) }
-    let(:doorkeeper_access_token) { Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'api') }
+    let(:doorkeeper_access_token) { Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'api', organization_id: organization.id) }
 
     context 'passed as header' do
       before do
diff --git a/spec/lib/gitlab/auth_spec.rb b/spec/lib/gitlab/auth_spec.rb
index 1300218ff97..a6a4e3ac5ff 100644
--- a/spec/lib/gitlab/auth_spec.rb
+++ b/spec/lib/gitlab/auth_spec.rb
@@ -473,12 +473,13 @@ RSpec.describe Gitlab::Auth, :use_clean_rails_memory_store_caching, feature_cate
     end
 
     context 'while using OAuth tokens as passwords' do
-      let(:user) { create(:user) }
+      let_it_be(:organization) { create(:organization) }
+      let(:user) { create(:user, organizations: [organization]) }
       let(:application) { Doorkeeper::Application.create!(name: 'MyApp', redirect_uri: 'https://app.com', owner: user) }
 
       shared_examples 'an oauth failure' do
         it 'fails' do
-          access_token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'api')
+          access_token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'api', organization_id: organization.id)
 
           expect(gl_auth.find_for_git_client("oauth2", access_token.token, project: nil, request: request))
             .to have_attributes(auth_failure)
@@ -506,14 +507,14 @@ RSpec.describe Gitlab::Auth, :use_clean_rails_memory_store_caching, feature_cate
 
         with_them do
           it 'authenticates with correct abilities' do
-            access_token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: scopes)
+            access_token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: scopes, organization_id: organization.id)
 
             expect(gl_auth.find_for_git_client("oauth2", access_token.token, project: nil, request: request))
               .to have_attributes(actor: user, project: nil, type: :oauth, authentication_abilities: abilities)
           end
 
           it 'authenticates with correct abilities without special username' do
-            access_token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: scopes)
+            access_token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: scopes, organization_id: organization.id)
 
             expect(gl_auth.find_for_git_client(user.username, access_token.token, project: nil, request: request))
               .to have_attributes(actor: user, project: nil, type: :oauth, authentication_abilities: abilities)
@@ -522,7 +523,7 @@ RSpec.describe Gitlab::Auth, :use_clean_rails_memory_store_caching, feature_cate
       end
 
       it 'does not try password auth before oauth' do
-        access_token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'api')
+        access_token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'api', organization_id: organization.id)
 
         expect(gl_auth).not_to receive(:find_with_user_password)
 
diff --git a/spec/lib/gitlab/changelog/committer_spec.rb b/spec/lib/gitlab/changelog/committer_spec.rb
index 1e04fe346cb..fcffc098ebc 100644
--- a/spec/lib/gitlab/changelog/committer_spec.rb
+++ b/spec/lib/gitlab/changelog/committer_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Gitlab::Changelog::Committer do
+RSpec.describe Gitlab::Changelog::Committer, feature_category: :source_code_management do
   let(:project) { create(:project, :repository) }
   let(:user) { project.creator }
   let(:committer) { described_class.new(project, user) }
@@ -55,6 +55,42 @@ RSpec.describe Gitlab::Changelog::Committer do
       end
     end
 
+    context 'when the pre-release is already in the changelog' do
+      it "commits changes" do
+        pre_release = Gitlab::Changelog::Release
+          .new(version: '1.0.0-rc1', date: Time.utc(2020, 1, 1), config: config)
+
+        committer.commit(
+          release: pre_release,
+          file: 'CHANGELOG.md',
+          branch: 'master',
+          message: 'Test commit'
+        )
+
+        release = Gitlab::Changelog::Release
+          .new(version: '1.0.0', date: Time.utc(2020, 1, 1), config: config)
+
+        committer.commit(
+          release: release,
+          file: 'CHANGELOG.md',
+          branch: 'master',
+          message: 'Test commit'
+        )
+
+        content = project.repository.blob_at('master', 'CHANGELOG.md').data
+
+        expect(content).to eq(<<~MARKDOWN)
+          ## 1.0.0 (2020-01-01)
+
+          No changes.
+
+          ## 1.0.0-rc1 (2020-01-01)
+
+          No changes.
+        MARKDOWN
+      end
+    end
+
     context 'when committing the changes fails' do
       it 'retries the operation' do
         release = Gitlab::Changelog::Release
diff --git a/spec/lib/gitlab/changelog/release_spec.rb b/spec/lib/gitlab/changelog/release_spec.rb
index b8d007724e5..a8e08215332 100644
--- a/spec/lib/gitlab/changelog/release_spec.rb
+++ b/spec/lib/gitlab/changelog/release_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Gitlab::Changelog::Release do
+RSpec.describe Gitlab::Changelog::Release, feature_category: :source_code_management do
   describe '#to_markdown' do
     let(:config) { Gitlab::Changelog::Config.new(build_stubbed(:project)) }
     let(:commit) { build_stubbed(:commit) }
@@ -179,13 +179,13 @@ RSpec.describe Gitlab::Changelog::Release do
     end
   end
 
-  describe '#header_start_position' do
+  describe '#header_start_pattern' do
     it 'returns a regular expression for finding the start of a release section' do
       config = Gitlab::Changelog::Config.new(build_stubbed(:project))
       release = described_class
         .new(version: '1.0.0', date: Time.utc(2021, 1, 5), config: config)
 
-      expect(release.header_start_pattern).to eq(/^##\s*1\.0\.0/)
+      expect(release.header_start_pattern).to eq(/^##\s*1\.0\.0\s/)
     end
   end
 end
diff --git a/spec/models/packages/nuget/metadatum_spec.rb b/spec/models/packages/nuget/metadatum_spec.rb
index 04dc2706049..0bf02ef19a3 100644
--- a/spec/models/packages/nuget/metadatum_spec.rb
+++ b/spec/models/packages/nuget/metadatum_spec.rb
@@ -6,12 +6,32 @@ RSpec.describe Packages::Nuget::Metadatum, type: :model, feature_category: :pack
   it { is_expected.to be_a Packages::Nuget::VersionNormalizable }
 
   describe 'relationships' do
-    it { is_expected.to belong_to(:package).inverse_of(:nuget_metadatum) }
+    it { is_expected.to belong_to(:package).class_name('Packages::Nuget::Package').inverse_of(:nuget_metadatum) }
+
+    # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+    it 'belongs to `legacy_package`' do
+      is_expected.to belong_to(:legacy_package).conditions(package_type: :nuget).class_name('Packages::Package')
+        .inverse_of(:nuget_metadatum).with_foreign_key(:package_id)
+    end
   end
 
   describe 'validations' do
     it { is_expected.to validate_presence_of(:package) }
 
+    # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+    it { is_expected.not_to validate_presence_of(:legacy_package) }
+
+    context 'when nuget_extract_nuget_package_model is disabled' do
+      before do
+        stub_feature_flags(nuget_extract_nuget_package_model: false)
+      end
+
+      it { is_expected.to validate_presence_of(:legacy_package) }
+      it { is_expected.not_to validate_presence_of(:package) }
+    end
+
     it { is_expected.to validate_presence_of(:authors) }
     it { is_expected.to validate_length_of(:authors).is_at_most(described_class::MAX_AUTHORS_LENGTH) }
     it { is_expected.to validate_presence_of(:description) }
@@ -36,20 +56,52 @@ RSpec.describe Packages::Nuget::Metadatum, type: :model, feature_category: :pack
         it { is_expected.not_to allow_value('sandbox.com').for(url) }
       end
 
-      describe '#ensure_nuget_package_type' do
-        subject { build(:nuget_metadatum) }
+      describe '#ensure_nuget_package_type', :aggregate_failures do
+        subject(:nuget_metadatum) { build(:nuget_metadatum) }
 
-        it 'rejects if not linked to a nuget package' do
-          subject.package = build(:npm_package)
+        it 'builds a valid metadatum' do
+          expect { nuget_metadatum }.not_to raise_error
+          expect(nuget_metadatum).to be_valid
+        end
 
-          expect(subject).not_to be_valid
-          expect(subject.errors).to contain_exactly('Package type must be NuGet')
+        context 'with a different package type' do
+          let(:package) { build(:package) }
+
+          it 'raises the error' do
+            expect { build(:nuget_metadatum, package: package) }.to raise_error(ActiveRecord::AssociationTypeMismatch)
+          end
+
+          context 'when nuget_extract_nuget_package_model is disabled' do
+            before do
+              stub_feature_flags(nuget_extract_nuget_package_model: false)
+            end
+
+            it 'adds the validation error' do
+              nuget_metadatum = build(:nuget_metadatum, legacy_package: package, package: nil)
+
+              expect(nuget_metadatum).not_to be_valid
+              expect(nuget_metadatum.errors.to_a).to include('Package type must be NuGet')
+            end
+          end
         end
       end
     end
   end
 
-  it { is_expected.to delegate_method(:version).to(:package).with_prefix }
+  describe 'delegations' do
+    # TODO: Change `with_prefix(:package)` to `with_prefix` with the rollout of
+    # the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+    it { is_expected.to delegate_method(:version).to(:package).with_prefix(:package) }
+
+    context 'when nuget_extract_nuget_package_model is disabled' do
+      before do
+        stub_feature_flags(nuget_extract_nuget_package_model: false)
+      end
+
+      it { is_expected.to delegate_method(:version).to(:legacy_package).with_prefix(:package) }
+    end
+  end
 
   describe '.normalized_version_in' do
     let_it_be(:nuget_metadatums) { create_list(:nuget_metadatum, 2) }
diff --git a/spec/models/packages/nuget/package_spec.rb b/spec/models/packages/nuget/package_spec.rb
new file mode 100644
index 00000000000..146575c8a53
--- /dev/null
+++ b/spec/models/packages/nuget/package_spec.rb
@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Packages::Nuget::Package, type: :model, feature_category: :package_registry do
+  using RSpec::Parameterized::TableSyntax
+
+  describe 'relationships' do
+    it { is_expected.to have_many(:installable_nuget_package_files).inverse_of(:package) }
+    it { is_expected.to have_one(:nuget_metadatum).inverse_of(:package) }
+    it { is_expected.to have_many(:nuget_symbols).inverse_of(:package) }
+  end
+
+  describe 'validations' do
+    describe '#name' do
+      it 'allows accepted values' do
+        is_expected.to allow_values('My.Package', 'My.Package.Mvc', 'MyPackage', 'My.23.Package', 'My23Package',
+          'runtime.my-test64.runtime.package.Mvc', 'my_package').for(:name)
+      end
+
+      it 'does not allow unaccepted values' do
+        is_expected.not_to allow_values('My/package', '../../../my_package', '%2e%2e%2fmy_package').for(:name)
+      end
+    end
+
+    describe '#version' do
+      it 'allows accepted values' do
+        is_expected.to allow_values('1.2', '1.2.3', '1.2.3.4', '1.2.3-beta', '1.2.3-alpha.3').for(:version)
+      end
+
+      it 'does not allow unaccepted values' do
+        is_expected.not_to allow_values('1', '1./2.3', '../../../../../1.2.3', '%2e%2e%2f1.2.3').for(:version)
+      end
+    end
+  end
+
+  describe '.with_nuget_version_or_normalized_version' do
+    let_it_be(:nuget_package) { create(:nuget_package, :with_metadatum, version: '1.0.7+r3456') }
+
+    subject { described_class.with_nuget_version_or_normalized_version(version, with_normalized: with_normalized) }
+
+    where(:version, :with_normalized, :expected) do
+      '1.0.7'       | true  | [ref(:nuget_package)]
+      '1.0.7'       | false | []
+      '1.0.7+r3456' | true  | [ref(:nuget_package)]
+      '1.0.7+r3456' | false | [ref(:nuget_package)]
+    end
+
+    with_them do
+      it { is_expected.to match_array(expected) }
+    end
+  end
+
+  describe '.without_nuget_temporary_name' do
+    let!(:package1) { create(:nuget_package) }
+    let!(:package2) { create(:nuget_package, name: Packages::Nuget::TEMPORARY_PACKAGE_NAME) }
+
+    subject(:result) { described_class.without_nuget_temporary_name }
+
+    it 'does not include nuget temporary packages' do
+      expect(result).to eq([package1])
+    end
+  end
+
+  describe '.including_dependency_links_with_nuget_metadatum' do
+    let_it_be(:package) { create(:nuget_package) }
+    let_it_be(:packages_dependency_link) { create(:packages_dependency_link, :with_nuget_metadatum, package: package) }
+
+    subject(:result) { described_class.including_dependency_links_with_nuget_metadatum }
+
+    it 'preloads associations', :aggregate_failures do
+      package = result.first
+      dependency_link = package.dependency_links.first
+
+      expect(package.association(:dependency_links)).to be_loaded
+      expect(dependency_link.association(:dependency)).to be_loaded
+      expect(dependency_link.association(:nuget_metadatum)).to be_loaded
+    end
+  end
+
+  describe '.preload_nuget_metadatum' do
+    let_it_be(:package) { create(:nuget_package, :with_metadatum) }
+
+    subject(:result) { described_class.preload_nuget_metadatum }
+
+    it 'preloads nuget metadatum' do
+      expect(result.first.association(:nuget_metadatum)).to be_loaded
+    end
+  end
+
+  describe '.preload_nuget_files' do
+    let_it_be(:package) { create(:nuget_package) }
+
+    subject(:result) { described_class.preload_nuget_files }
+
+    it 'preloads installable nuget files' do
+      expect(result.first.association(:installable_nuget_package_files)).to be_loaded
+    end
+  end
+
+  describe '#normalized_nuget_version' do
+    let_it_be(:package) { create(:nuget_package, :with_metadatum, version: '1.0') }
+
+    let(:normalized_version) { '1.0.0' }
+
+    subject { package.normalized_nuget_version }
+
+    it { is_expected.to eq(normalized_version) }
+  end
+end
diff --git a/spec/models/packages/nuget/symbol_spec.rb b/spec/models/packages/nuget/symbol_spec.rb
index b9623bae537..2b6b2bac4d9 100644
--- a/spec/models/packages/nuget/symbol_spec.rb
+++ b/spec/models/packages/nuget/symbol_spec.rb
@@ -10,11 +10,33 @@ RSpec.describe Packages::Nuget::Symbol, type: :model, feature_category: :package
   it { is_expected.to be_a Packages::Destructible }
 
   describe 'relationships' do
-    it { is_expected.to belong_to(:package).inverse_of(:nuget_symbols) }
+    it { is_expected.to belong_to(:package).class_name('Packages::Nuget::Package').inverse_of(:nuget_symbols) }
     it { is_expected.to belong_to(:project) }
+
+    # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+    it 'belongs legacy_package' do
+      is_expected.to belong_to(:legacy_package).conditions(package_type: :nuget).class_name('Packages::Package')
+        .inverse_of(:nuget_symbols).with_foreign_key(:package_id)
+    end
   end
 
   describe 'validations' do
+    it { is_expected.to validate_presence_of(:package) }
+
+    # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
+    it { is_expected.not_to validate_presence_of(:legacy_package) }
+
+    context 'when nuget_extract_nuget_package_model is disabled' do
+      before do
+        stub_feature_flags(nuget_extract_nuget_package_model: false)
+      end
+
+      it { is_expected.to validate_presence_of(:legacy_package) }
+      it { is_expected.not_to validate_presence_of(:package) }
+    end
+
     it { is_expected.to validate_presence_of(:file) }
     it { is_expected.to validate_presence_of(:file_path) }
     it { is_expected.to validate_presence_of(:signature) }
@@ -27,6 +49,15 @@ RSpec.describe Packages::Nuget::Symbol, type: :model, feature_category: :package
   describe 'delegations' do
     it { is_expected.to delegate_method(:project_id).to(:package) }
     it { is_expected.to delegate_method(:project).to(:package) }
+
+    context 'when nuget_extract_nuget_package_model is disabled' do
+      before do
+        stub_feature_flags(nuget_extract_nuget_package_model: false)
+      end
+
+      it { is_expected.to delegate_method(:project_id).to(:legacy_package) }
+      it { is_expected.to delegate_method(:project).to(:legacy_package) }
+    end
   end
 
   describe 'scopes' do
diff --git a/spec/models/packages/package_spec.rb b/spec/models/packages/package_spec.rb
index e3d7f916f0f..f73e8be06b4 100644
--- a/spec/models/packages/package_spec.rb
+++ b/spec/models/packages/package_spec.rb
@@ -17,10 +17,16 @@ RSpec.describe Packages::Package, type: :model, feature_category: :package_regis
     it { is_expected.to have_many(:dependency_links).inverse_of(:package) }
     it { is_expected.to have_many(:tags).inverse_of(:package) }
     it { is_expected.to have_many(:build_infos).inverse_of(:package) }
+    # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
     it { is_expected.to have_many(:installable_nuget_package_files).inverse_of(:package) }
     it { is_expected.to have_one(:maven_metadatum).inverse_of(:package) }
+    # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
     it { is_expected.to have_one(:nuget_metadatum).inverse_of(:package) }
     it { is_expected.to have_one(:npm_metadatum).inverse_of(:package) }
+    # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
     it { is_expected.to have_many(:nuget_symbols).inverse_of(:package) }
     it { is_expected.to have_many(:matching_package_protection_rules).through(:project).source(:package_protection_rules) }
   end
@@ -111,6 +117,8 @@ RSpec.describe Packages::Package, type: :model, feature_category: :package_regis
       it { is_expected.to allow_value("my.app-11.07.2018").for(:name) }
       it { is_expected.not_to allow_value("my(dom$$$ain)com.my-app").for(:name) }
 
+      # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+      # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
       context 'nuget package' do
         subject { build_stubbed(:nuget_package) }
 
@@ -170,6 +178,8 @@ RSpec.describe Packages::Package, type: :model, feature_category: :package_regis
 
       it_behaves_like 'validating version to be SemVer compliant for', :npm_package
 
+      # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+      # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
       context 'nuget package' do
         subject { build_stubbed(:nuget_package) }
 
@@ -485,6 +495,8 @@ RSpec.describe Packages::Package, type: :model, feature_category: :package_regis
     it { is_expected.to contain_exactly(package1) }
   end
 
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   describe '.without_nuget_temporary_name' do
     let!(:package1) { create(:nuget_package) }
     let!(:package2) { create(:nuget_package, name: Packages::Nuget::TEMPORARY_PACKAGE_NAME) }
@@ -576,6 +588,8 @@ RSpec.describe Packages::Package, type: :model, feature_category: :package_regis
       it { is_expected.to match_array([nuget_package]) }
     end
 
+    # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
     describe '.with_nuget_version_or_normalized_version' do
       let_it_be(:nuget_package) { create(:nuget_package, :with_metadatum, version: '1.0.7+r3456') }
 
@@ -991,6 +1005,8 @@ RSpec.describe Packages::Package, type: :model, feature_category: :package_regis
     end
   end
 
+  # TODO: Remove with the rollout of the FF nuget_extract_nuget_package_model
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/499602
   describe '#normalized_nuget_version' do
     let_it_be(:package) { create(:nuget_package, :with_metadatum, version: '1.0') }
     let(:normalized_version) { '1.0.0' }
@@ -1054,5 +1070,19 @@ RSpec.describe Packages::Package, type: :model, feature_category: :package_regis
         end
       end
     end
+
+    context 'when nuget_extract_nuget_package_model is disabled' do
+      before do
+        stub_feature_flags(nuget_extract_nuget_package_model: false)
+      end
+
+      context 'for package format nuget' do
+        let(:format) { :nuget }
+
+        it 'maps to Packages::Package' do
+          is_expected.to eq(described_class)
+        end
+      end
+    end
   end
 end
diff --git a/spec/requests/api/doorkeeper_access_spec.rb b/spec/requests/api/doorkeeper_access_spec.rb
index 8a21abf02e2..110aadea561 100644
--- a/spec/requests/api/doorkeeper_access_spec.rb
+++ b/spec/requests/api/doorkeeper_access_spec.rb
@@ -3,9 +3,10 @@
 require 'spec_helper'
 
 RSpec.describe 'doorkeeper access', feature_category: :system_access do
+  let_it_be(:organization) { create(:organization) }
   let!(:user) { create(:user) }
   let!(:application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
-  let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api" }
+  let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api", organization_id: organization.id }
 
   describe "unauthenticated" do
     it "returns authentication success" do
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index e25ec71041c..666407fc5ac 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -12,6 +12,7 @@ RSpec.describe API::Users, :aggregate_failures, feature_category: :user_manageme
   let_it_be(:key) { create(:key, user: user) }
   let_it_be(:gpg_key) { create(:gpg_key, user: user) }
   let_it_be(:email) { create(:email, user: user) }
+  let_it_be(:organization) { create(:organization) }
 
   let(:blocked_user) { create(:user, :blocked) }
   let(:omniauth_user) { create(:omniauth_user) }
diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb
index 3ca39eab8cc..dc3d686b210 100644
--- a/spec/requests/git_http_spec.rb
+++ b/spec/requests/git_http_spec.rb
@@ -619,13 +619,15 @@ RSpec.describe 'Git HTTP requests', feature_category: :source_code_management do
               end
 
               context "when an oauth token is provided" do
+                let_it_be(:organization) { create(:organization) }
+
                 context "when oauth token has ai_workflows scope" do
                   let(:path) { "#{project.full_path}.git" }
                   let(:env) { { user: 'oauth2', password: @token.token } }
 
                   before do
                     application = Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user)
-                    @token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: "ai_workflows")
+                    @token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: "ai_workflows", organization_id: organization.id)
                   end
 
                   it_behaves_like 'pulls are allowed'
@@ -638,7 +640,7 @@ RSpec.describe 'Git HTTP requests', feature_category: :source_code_management do
 
                   before do
                     application = Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user)
-                    @token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: "api")
+                    @token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: "api", organization_id: organization.id)
                   end
 
                   it_behaves_like 'pulls are allowed'
@@ -651,7 +653,7 @@ RSpec.describe 'Git HTTP requests', feature_category: :source_code_management do
 
                   before do
                     application = Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user)
-                    @token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: "write_repository")
+                    @token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: "write_repository", organization_id: organization.id)
                   end
 
                   it_behaves_like 'pulls are allowed'
diff --git a/spec/services/packages/nuget/search_service_spec.rb b/spec/services/packages/nuget/search_service_spec.rb
index 8133c967178..097e89e65c0 100644
--- a/spec/services/packages/nuget/search_service_spec.rb
+++ b/spec/services/packages/nuget/search_service_spec.rb
@@ -7,12 +7,6 @@ RSpec.describe Packages::Nuget::SearchService, feature_category: :package_regist
   let_it_be(:group) { create(:group) }
   let_it_be(:subgroup) { create(:group, parent: group) }
   let_it_be(:project) { create(:project, namespace: subgroup) }
-  let_it_be_with_refind(:package_a) { create(:nuget_package, project: project, name: 'DummyPackageA') }
-  let_it_be(:packages_b) { create_list(:nuget_package, 5, project: project, name: 'DummyPackageB') }
-  let_it_be(:packages_c) { create_list(:nuget_package, 5, project: project, name: 'DummyPackageC') }
-  let_it_be(:package_d) { create(:nuget_package, project: project, name: 'FooBarD') }
-  let_it_be(:other_package_a) { create(:nuget_package, name: 'DummyPackageA') }
-  let_it_be(:other_package_b) { create(:nuget_package, name: 'DummyPackageB') }
 
   let(:search_term) { 'ummy' }
   let(:per_page) { 5 }
@@ -23,7 +17,7 @@ RSpec.describe Packages::Nuget::SearchService, feature_category: :package_regist
   describe '#execute' do
     subject { described_class.new(user, target, search_term, options).execute }
 
-    shared_examples 'handling all the conditions' do
+    shared_examples 'handling all the conditions' do |factory: :nuget_package|
       it { expect_search_results 3, package_a, packages_b, packages_c }
 
       context 'with a smaller per page count' do
@@ -104,7 +98,7 @@ RSpec.describe Packages::Nuget::SearchService, feature_category: :package_regist
 
       context 'with pre release packages' do
         let_it_be(:package_e) do
-          create(:nuget_package, project: project, name: 'DummyPackageE', version: '3.2.1-alpha')
+          create(factory, project: project, name: 'DummyPackageE', version: '3.2.1-alpha')
         end
 
         context 'when including them' do
@@ -118,7 +112,7 @@ RSpec.describe Packages::Nuget::SearchService, feature_category: :package_regist
 
           context 'when mixed with release versions' do
             let_it_be(:package_e_release) do
-              create(:nuget_package, project: project, name: 'DummyPackageE', version: '3.2.1')
+              create(factory, project: project, name: 'DummyPackageE', version: '3.2.1')
             end
 
             it { expect_search_results 4, package_a, packages_b, packages_c, package_e_release }
@@ -127,52 +121,123 @@ RSpec.describe Packages::Nuget::SearchService, feature_category: :package_regist
       end
     end
 
-    context 'with project' do
-      let(:target) { project }
+    context 'when nuget_extract_nuget_package_model is enabled' do
+      let_it_be_with_refind(:package_a) { create(:nuget_package, project: project, name: 'DummyPackageA') }
+      let_it_be(:packages_b) { create_list(:nuget_package, 5, project: project, name: 'DummyPackageB') }
+      let_it_be(:packages_c) { create_list(:nuget_package, 5, project: project, name: 'DummyPackageC') }
+      let_it_be(:package_d) { create(:nuget_package, project: project, name: 'FooBarD') }
+      let_it_be(:other_package_a) { create(:nuget_package, name: 'DummyPackageA') }
+      let_it_be(:other_package_b) { create(:nuget_package, name: 'DummyPackageB') }
 
-      before_all do
-        project.add_developer(user)
-      end
+      context 'with project' do
+        let(:target) { project }
 
-      it_behaves_like 'handling all the conditions'
-    end
-
-    context 'with subgroup' do
-      let(:target) { subgroup }
-
-      before_all do
-        subgroup.add_developer(user)
-      end
-
-      it_behaves_like 'handling all the conditions'
-    end
-
-    context 'with group' do
-      let(:target) { group }
-
-      context 'when user is a group member' do
         before_all do
-          group.add_developer(user)
+          project.add_developer(user)
         end
 
         it_behaves_like 'handling all the conditions'
       end
 
-      context 'when user is not a group member' do
-        context 'with public registry in private group' do
-          before_all do
-            [subgroup, group, project].each do |entity|
-              entity.update_column(:visibility_level, Gitlab::VisibilityLevel.const_get(:PRIVATE, false))
-            end
-            project.project_feature.update!(package_registry_access_level: ::ProjectFeature::PUBLIC)
-          end
+      context 'with subgroup' do
+        let(:target) { subgroup }
 
-          before do
-            stub_application_setting(package_registry_allow_anyone_to_pull_option: true)
+        before_all do
+          subgroup.add_developer(user)
+        end
+
+        it_behaves_like 'handling all the conditions'
+      end
+
+      context 'with group' do
+        let(:target) { group }
+
+        context 'when user is a group member' do
+          before_all do
+            group.add_developer(user)
           end
 
           it_behaves_like 'handling all the conditions'
         end
+
+        context 'when user is not a group member' do
+          context 'with public registry in private group' do
+            before_all do
+              [subgroup, group, project].each do |entity|
+                entity.reload.update_column(:visibility_level, Gitlab::VisibilityLevel.const_get(:PRIVATE, false))
+              end
+              project.project_feature.update!(package_registry_access_level: ::ProjectFeature::PUBLIC)
+            end
+
+            before do
+              stub_application_setting(package_registry_allow_anyone_to_pull_option: true)
+            end
+
+            it_behaves_like 'handling all the conditions'
+          end
+        end
+      end
+    end
+
+    context 'when nuget_extract_nuget_package_model is disabled' do
+      let_it_be_with_refind(:package_a) { create(:nuget_package_legacy, project: project, name: 'DummyPackageA') }
+      let_it_be(:packages_b) { create_list(:nuget_package_legacy, 5, project: project, name: 'DummyPackageB') }
+      let_it_be(:packages_c) { create_list(:nuget_package_legacy, 5, project: project, name: 'DummyPackageC') }
+      let_it_be(:package_d) { create(:nuget_package_legacy, project: project, name: 'FooBarD') }
+      let_it_be(:other_package_a) { create(:nuget_package_legacy, name: 'DummyPackageA') }
+      let_it_be(:other_package_b) { create(:nuget_package_legacy, name: 'DummyPackageB') }
+
+      before do
+        stub_feature_flags(nuget_extract_nuget_package_model: false)
+      end
+
+      context 'with project' do
+        let(:target) { project }
+
+        before_all do
+          project.add_developer(user)
+        end
+
+        it_behaves_like 'handling all the conditions', factory: :nuget_package_legacy
+      end
+
+      context 'with subgroup' do
+        let(:target) { subgroup }
+
+        before_all do
+          subgroup.add_developer(user)
+        end
+
+        it_behaves_like 'handling all the conditions', factory: :nuget_package_legacy
+      end
+
+      context 'with group' do
+        let(:target) { group }
+
+        context 'when user is a group member' do
+          before_all do
+            group.add_developer(user)
+          end
+
+          it_behaves_like 'handling all the conditions', factory: :nuget_package_legacy
+        end
+
+        context 'when user is not a group member' do
+          context 'with public registry in private group' do
+            before_all do
+              [subgroup, group, project].each do |entity|
+                entity.reload.update_column(:visibility_level, Gitlab::VisibilityLevel.const_get(:PRIVATE, false))
+              end
+              project.project_feature.update!(package_registry_access_level: ::ProjectFeature::PUBLIC)
+            end
+
+            before do
+              stub_application_setting(package_registry_allow_anyone_to_pull_option: true)
+            end
+
+            it_behaves_like 'handling all the conditions', factory: :nuget_package_legacy
+          end
+        end
       end
     end
 
diff --git a/spec/services/packages/nuget/update_package_from_metadata_service_spec.rb b/spec/services/packages/nuget/update_package_from_metadata_service_spec.rb
index 0e19f2ac3f9..eb621c8db1d 100644
--- a/spec/services/packages/nuget/update_package_from_metadata_service_spec.rb
+++ b/spec/services/packages/nuget/update_package_from_metadata_service_spec.rb
@@ -6,7 +6,8 @@ RSpec.describe Packages::Nuget::UpdatePackageFromMetadataService, :clean_gitlab_
   include ExclusiveLeaseHelpers
 
   let!(:package) { create(:nuget_package, :processing, :with_symbol_package, :with_build) }
-  let(:package_file) { package.package_files.first }
+  # Reload factory to reset associations cache for package files
+  let(:package_file) { package.reload.package_files.first }
   let(:package_zip_file) { Zip::File.new(package_file.file) }
   let(:service) { described_class.new(package_file, package_zip_file) }
   let(:package_name) { 'DummyProject.DummyPackage' }
@@ -236,7 +237,8 @@ RSpec.describe Packages::Nuget::UpdatePackageFromMetadataService, :clean_gitlab_
     end
 
     context 'with a symbol package' do
-      let(:package_file) { package.package_files.last }
+      # Reload factory to reset associations cache for package files
+      let(:package_file) { package.reload.package_files.last }
       let(:package_file_name) { 'dummyproject.dummypackage.1.0.0.snupkg' }
 
       context 'with no existing package' do
diff --git a/spec/support/shared_examples/requests/api/read_user_shared_examples.rb b/spec/support/shared_examples/requests/api/read_user_shared_examples.rb
index b9fd997bd2c..a20e694528e 100644
--- a/spec/support/shared_examples/requests/api/read_user_shared_examples.rb
+++ b/spec/support/shared_examples/requests/api/read_user_shared_examples.rb
@@ -55,7 +55,9 @@ RSpec.shared_examples 'allows the "read_user" scope' do |api_version|
     let!(:application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
 
     context 'when the requesting token has the "api" scope' do
-      let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api" }
+      let!(:token) do
+        Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api", organization_id: user.namespace.organization.id
+      end
 
       it 'returns a "200" response on get request' do
         get api_call.call(path, user, oauth_access_token: token)
@@ -71,7 +73,7 @@ RSpec.shared_examples 'allows the "read_user" scope' do |api_version|
     end
 
     context 'when the requesting token has the "read_user" scope' do
-      let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "read_user" }
+      let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "read_user", organization_id: user.namespace.organization.id }
 
       it 'returns a "200" response on get request' do
         get api_call.call(path, user, oauth_access_token: token)
@@ -87,7 +89,7 @@ RSpec.shared_examples 'allows the "read_user" scope' do |api_version|
     end
 
     context 'when the requesting token does not have any required scope' do
-      let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "invalid" }
+      let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "invalid", organization_id: user.namespace.organization.id }
 
       it 'returns a "403" response' do
         get api_call.call(path, user, oauth_access_token: token)