diff --git a/labs/deployment-compliance/scripts/post-deploy.sh b/labs/deployment-compliance/scripts/post-deploy.sh
index 74d1cac26..b15c6b81d 100755
--- a/labs/deployment-compliance/scripts/post-deploy.sh
+++ b/labs/deployment-compliance/scripts/post-deploy.sh
@@ -188,7 +188,7 @@ echo -e "\n${YELLOW}[4/7] Configuring Azure access and incident platform...${NC}
 SUBSCRIPTION_ID=$(az account show --query id -o tsv)
 AGENT_NAME=$(az resource list --resource-group "$RESOURCE_GROUP" --resource-type "Microsoft.App/agents" --query "[0].name" -o tsv)
 AGENT_RESOURCE_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.App/agents/${AGENT_NAME}"
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 
 # The agent queries LAW using built-in Azure observability tools (no ADX connector needed).
 # Activity Logs flow to LAW via diagnostic settings (Step 2).
@@ -386,28 +386,17 @@ rm -f /tmp/task-body.json
 # ---- Step 8: GitHub connector + code repo ----
 echo -e "\n${YELLOW}[8/8] Configuring GitHub connector and code repository...${NC}"
 
-# Create GitHub OAuth connector via data plane API (PUT is idempotent)
-TOKEN=$(get_agent_token)
-GITHUB_RESULT=$(curl -s -o /dev/null -w "%{http_code}" \
-  -X PUT "${AGENT_ENDPOINT}/api/v2/extendedAgent/connectors/github" \
-  -H "Authorization: Bearer ${TOKEN}" \
-  -H "Content-Type: application/json" \
-  -d '{"name":"github","type":"AgentConnector","properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}')
-if [ "$GITHUB_RESULT" = "200" ] || [ "$GITHUB_RESULT" = "201" ]; then
-  echo -e "${GREEN}  ✓ GitHub OAuth connector created (data plane).${NC}"
+# Create the GitHub OAuth connector through the stable ARM child resource.
+echo "   Creating GitHub connector through ARM..."
+if az rest --method PUT \
+  --url "https://management.azure.com${AGENT_RESOURCE_ID}/connectors/github?api-version=${API_VERSION}" \
+  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
+  --output none 2>/dev/null; then
+  echo -e "${GREEN}  ✓ GitHub connector created through ARM.${NC}"
 else
-  echo -e "${YELLOW}  GitHub connector returned HTTP ${GITHUB_RESULT}. May need manual setup.${NC}"
+  echo -e "${YELLOW}  GitHub connector creation failed.${NC}"
 fi
 
-# Also create at ARM level so it's visible in the portal Full Setup page
-echo "   Creating GitHub connector at ARM level..."
-az rest --method PUT \
-  --url "https://management.azure.com${AGENT_RESOURCE_ID}/DataConnectors/github?api-version=${API_VERSION}" \
-  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
-  --output none 2>/dev/null \
-  && echo -e "${GREEN}  ✓ GitHub connector created at ARM level.${NC}" \
-  || echo -e "${YELLOW}  ⚠️  ARM-level connector creation failed (non-critical — data plane connector is active).${NC}"
-
 # Get the OAuth login URL
 TOKEN=$(get_agent_token)
 OAUTH_URL=$(curl -s "${AGENT_ENDPOINT}/api/v1/github/config" \
@@ -463,7 +452,7 @@ TOKEN=$(get_agent_token)
 VERIFY_PASS=0
 VERIFY_FAIL=0
 
-# Check connectors via data plane API
+# Check connectors
 echo -e "\n  ${YELLOW}Connectors:${NC}"
 
 # Check LAW access (built-in, verified by diagnostic settings + role assignment in steps 2-3)
@@ -475,16 +464,11 @@ else
   VERIFY_FAIL=$((VERIFY_FAIL + 1))
 fi
 
-# Check GitHub connector
-GITHUB_CHECK=$(curl -s "${AGENT_ENDPOINT}/api/v2/extendedAgent/connectors/github" \
-  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
-import sys,json
-try:
-    d=json.load(sys.stdin)
-    print('ok' if d.get('name')=='github' else 'missing')
-except: print('missing')
-" 2>/dev/null)
-if [ "$GITHUB_CHECK" = "ok" ]; then
+# Check the GitHub connector through the stable ARM resource.
+GITHUB_CHECK=$(az rest --method GET \
+  --url "https://management.azure.com${AGENT_RESOURCE_ID}/connectors/github?api-version=${API_VERSION}" \
+  --query "name" -o tsv 2>/dev/null || echo "")
+if [[ "$GITHUB_CHECK" == "github" || "$GITHUB_CHECK" == */github ]]; then
   echo -e "    ${GREEN}✓ GitHub connector: Connected${NC}"
   VERIFY_PASS=$((VERIFY_PASS + 1))
 else
diff --git a/labs/starter-lab/scripts/post-provision.sh b/labs/starter-lab/scripts/post-provision.sh
index 419f65ceb..c774769fd 100755
--- a/labs/starter-lab/scripts/post-provision.sh
+++ b/labs/starter-lab/scripts/post-provision.sh
@@ -340,7 +340,7 @@ echo ""
 echo "🚨 Step 3/5: Enabling Azure Monitor incident platform..."
 SUBSCRIPTION_ID=$(az account show --query id -o tsv 2>/dev/null)
 AGENT_RESOURCE_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.App/agents/${AGENT_NAME}"
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 
 # Enable Azure Monitor as the incident platform (ARM PATCH)
   if az rest --method PATCH \
@@ -398,18 +398,15 @@ echo ""
 if [ -n "$GITHUB_REPO" ]; then
 echo "🔗 Step 4/5: GitHub integration..."
 
-# Create GitHub OAuth connector via data plane API (no PAT needed)
-echo "   Creating GitHub OAuth connector..."
-TOKEN=$(get_token)
-RESULT=$(curl -s -o /dev/null -w "%{http_code}" \
-  -X PUT "${AGENT_ENDPOINT}/api/v2/extendedAgent/connectors/github" \
-  -H "Authorization: Bearer ${TOKEN}" \
-  -H "Content-Type: application/json" \
-  -d '{"name":"github","type":"AgentConnector","properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}')
-if [ "$RESULT" = "200" ] || [ "$RESULT" = "201" ]; then
-  echo "   ✅ GitHub OAuth connector created"
+# Create the GitHub OAuth connector through the stable ARM child resource.
+echo "   Creating GitHub OAuth connector through ARM..."
+if az rest --method PUT \
+  --url "https://management.azure.com${AGENT_RESOURCE_ID}/connectors/github?api-version=${API_VERSION}" \
+  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
+  --output none 2>/dev/null; then
+  echo "   ✅ GitHub OAuth connector created through ARM"
 else
-  echo "   ⚠️  GitHub connector returned HTTP ${RESULT}"
+  echo "   ⚠️  GitHub connector creation failed"
 fi
 
 # Get OAuth login URL for user to authorize
@@ -423,15 +420,6 @@ try:
 except: print('')
 " 2>/dev/null)
 
-# Create GitHub OAuth connector via ARM (needed for OAuth flow to fully work)
-echo "   Creating GitHub OAuth connector via ARM..."
-TOKEN=$(get_token)
-ARM_RESULT=$(az rest --method PUT \
-  --url "https://management.azure.com${AGENT_RESOURCE_ID}/DataConnectors/github?api-version=${API_VERSION}" \
-  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
-  -o none 2>&1 || true)
-echo "   ✅ GitHub OAuth connector (ARM)"
-
 # Upload triage runbook
 TOKEN=$(get_token)
 curl -s -o /dev/null \
diff --git a/labs/starter-lab/scripts/setup-github.sh b/labs/starter-lab/scripts/setup-github.sh
index 8435d734d..920f823b8 100755
--- a/labs/starter-lab/scripts/setup-github.sh
+++ b/labs/starter-lab/scripts/setup-github.sh
@@ -48,7 +48,7 @@ if [ -z "$AGENT_ENDPOINT" ] || [ -z "$AGENT_NAME" ]; then
 fi
 
 AGENT_RESOURCE_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.App/agents/${AGENT_NAME}"
-API_VERSION="2025-05-01-preview"
+API_VERSION="2025-05-01-preview"  # Stable API does not support subagent child resources.
 
 get_token() {
   az account get-access-token --resource https://azuresre.dev --query accessToken -o tsv 2>/dev/null
diff --git a/labs/vm-cosmosdb/scripts/post-deploy.sh b/labs/vm-cosmosdb/scripts/post-deploy.sh
index 6468e9f38..c7c422c1d 100644
--- a/labs/vm-cosmosdb/scripts/post-deploy.sh
+++ b/labs/vm-cosmosdb/scripts/post-deploy.sh
@@ -232,7 +232,7 @@ fi
 
 # ---- Step 4: Configure Azure Monitor as incident platform ----
 echo -e "\n${YELLOW}[4/7] Configuring Azure Monitor as incident platform...${NC}"
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 AGENT_RESOURCE_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.App/agents/${AGENT_NAME}"
 
 az rest --method patch \
@@ -286,16 +286,17 @@ if [ -z "$GITHUB_USER" ]; then
 else
 GITHUB_REPO="${GITHUB_USER}/sre-agent"
 
-# Create GitHub OAuth connector (dataplane)
-TOKEN=$(get_agent_token)
-curl -s -o /dev/null -w "" \
-  -X PUT "${AGENT_ENDPOINT}/api/v2/extendedAgent/connectors/github" \
-  -H "Authorization: Bearer ${TOKEN}" \
-  -H "Content-Type: application/json" \
-  -d '{"name":"github","type":"AgentConnector","properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}'
-echo -e "${GREEN}  ✓ GitHub OAuth connector created${NC}"
+# Create the GitHub OAuth connector through the stable ARM child resource.
+if az rest --method PUT \
+  --url "https://management.azure.com${AGENT_RESOURCE_ID}/connectors/github?api-version=${API_VERSION}" \
+  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
+  --output none 2>/dev/null; then
+  echo -e "${GREEN}  ✓ GitHub OAuth connector created through ARM${NC}"
+else
+  echo -e "${YELLOW}  GitHub connector creation failed${NC}"
+fi
 
-# Get OAuth URL — fetch BEFORE ARM connector creation
+# Get the OAuth URL generated for the connector.
 TOKEN=$(get_agent_token)
 GITHUB_CONFIG=$(curl -s "${AGENT_ENDPOINT}/api/v1/github/config" -H "Authorization: Bearer ${TOKEN}" 2>/dev/null)
 OAUTH_URL=$(echo "$GITHUB_CONFIG" | $PYTHON -c "
@@ -306,13 +307,6 @@ try:
 except: print('')
 " 2>/dev/null)
 
-# Create GitHub OAuth connector via ARM
-az rest --method PUT \
-  --url "https://management.azure.com${AGENT_RESOURCE_ID}/DataConnectors/github?api-version=${API_VERSION}" \
-  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
-  --output none 2>/dev/null || true
-echo -e "${GREEN}  ✓ GitHub OAuth connector (ARM)${NC}"
-
 # Show OAuth URL — always show even if parsing failed
 if [ -z "$OAUTH_URL" ]; then
   # Try extracting directly with grep
diff --git a/labs/zava-aks-postgres/scripts/_aks-helpers.ps1 b/labs/zava-aks-postgres/scripts/_aks-helpers.ps1
index 29c4ae9f0..9902bd90d 100644
--- a/labs/zava-aks-postgres/scripts/_aks-helpers.ps1
+++ b/labs/zava-aks-postgres/scripts/_aks-helpers.ps1
@@ -43,7 +43,7 @@ function Invoke-AksCommandViaRest {
     if (-not $clusterToken) { throw "Failed to acquire AKS cluster token." }
 
     $body = @{ command = $Command; clusterToken = $clusterToken } | ConvertTo-Json -Compress
-    $uri = "https://management.azure.com/subscriptions/$sub/resourceGroups/$ResourceGroup/providers/Microsoft.ContainerService/managedClusters/$ClusterName/runCommand?api-version=2024-09-01"
+    $uri = "https://management.azure.com/subscriptions/$sub/resourceGroups/$ResourceGroup/providers/Microsoft.ContainerService/managedClusters/$ClusterName/runCommand?api-version=2026-06-01"
     $headers = @{ Authorization = "Bearer $armToken"; 'Content-Type' = 'application/json' }
 
     $resp = Invoke-WebRequest -Method Post -Uri $uri -Headers $headers -Body $body -SkipHttpErrorCheck
@@ -227,7 +227,7 @@ function Reset-DemoAlertRule {
     if (-not $token) { throw "Could not acquire an Azure Resource Manager token. Run 'az login'." }
     $headers = @{ Authorization = "Bearer $token" }
 
-    $url = "https://management.azure.com/subscriptions/$sub/providers/Microsoft.AlertsManagement/alerts?api-version=2019-05-05-preview&timeRange=30d&pageCount=250"
+    $url = "https://management.azure.com/subscriptions/$sub/providers/Microsoft.AlertsManagement/alerts?api-version=2019-03-01&timeRange=30d&pageCount=250"
     $response = Invoke-RestMethod -Method Get -Uri $url -Headers $headers
     $alerts = @($response.value | Where-Object {
         $essentials = $_.properties.essentials
@@ -249,7 +249,7 @@ function Reset-DemoAlertRule {
 
     if ($essentials.alertState -ne 'Closed') {
         $alertId = [string]$latest.id
-        $changeStateUrl = "https://management.azure.com${alertId}/changestate?api-version=2018-05-05&newState=Closed"
+        $changeStateUrl = "https://management.azure.com${alertId}/changestate?api-version=2019-03-01&newState=Closed"
         try {
             Invoke-RestMethod -Method Post -Uri $changeStateUrl -Headers $headers | Out-Null
         } catch {
diff --git a/labs/zava-aks-postgres/scripts/setup-sre-agent.ps1 b/labs/zava-aks-postgres/scripts/setup-sre-agent.ps1
index 708ccd165..25e09862e 100644
--- a/labs/zava-aks-postgres/scripts/setup-sre-agent.ps1
+++ b/labs/zava-aks-postgres/scripts/setup-sre-agent.ps1
@@ -55,7 +55,7 @@ if (-not $SubscriptionId) {
     $SubscriptionId = az account show --query id -o tsv
 }
 $agentArmId = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.App/agents/$AgentName"
-$apiVersion = "2025-05-01-preview"
+$apiVersion = "2026-01-01"
 
 # --- Step 0: Verify agent exists -------------------------------------------
 Write-Host "Step 0: Verifying agent exists..." -ForegroundColor Yellow
diff --git a/labs/zava-learning/scripts/configure-agent.mjs b/labs/zava-learning/scripts/configure-agent.mjs
index 81c09f2db..13e95f567 100644
--- a/labs/zava-learning/scripts/configure-agent.mjs
+++ b/labs/zava-learning/scripts/configure-agent.mjs
@@ -227,7 +227,7 @@ function applyToolsSkillsAndAgentsWithSrectl() {
 // configured as ARM child resources / properties. The azmcp `incidents plans_create`
 // targets a data-plane route that is read-only on current agent builds (HTTP 405),
 // so we apply these two pieces declaratively over ARM instead.
-const API_VERSION = "2025-05-01-preview";
+const API_VERSION = "2026-01-01";
 const ARM = "https://management.azure.com";
 const DATAPLANE_AUDIENCE = "https://azuresre.ai";
 const AZ = os.platform() === "win32" ? "az.cmd" : "az";
diff --git a/labs/zava-learning/simulator/demo.py b/labs/zava-learning/simulator/demo.py
index 987d76653..6eede232d 100644
--- a/labs/zava-learning/simulator/demo.py
+++ b/labs/zava-learning/simulator/demo.py
@@ -401,7 +401,7 @@ def poll_azmon_alert(sub: str, rule_name: str, since: datetime) -> bool:
     if not sub:
         return False
     url = (f"https://management.azure.com/subscriptions/{sub}/providers/"
-           f"Microsoft.AlertsManagement/alerts?api-version=2019-05-05-preview"
+           f"Microsoft.AlertsManagement/alerts?api-version=2019-03-01"
            f"&timeRange=1h")
     out = _az(f'az rest --method GET --url "{url}"')
     if not out:
@@ -496,7 +496,7 @@ def _agent_dataplane_endpoint(cfg: dict):
     ep = None
     if sub and rg and name:
         arm = (f"https://management.azure.com/subscriptions/{sub}/resourceGroups/{rg}"
-               f"/providers/Microsoft.App/agents/{name}?api-version=2025-05-01-preview")
+               f"/providers/Microsoft.App/agents/{name}?api-version=2026-01-01")
         out = _az(f'az rest --method GET --url "{arm}"')
         if out:
             try:
diff --git a/sreagent-templates/bicep/Apply-Extras.ps1 b/sreagent-templates/bicep/Apply-Extras.ps1
index 2ef05d34f..db208d2fb 100644
--- a/sreagent-templates/bicep/Apply-Extras.ps1
+++ b/sreagent-templates/bicep/Apply-Extras.ps1
@@ -97,7 +97,7 @@ if (-not (Test-Path $ExtrasFile)) {
 # many optional keys on $extras that may be absent for minimal recipes.
 Set-StrictMode -Off
 
-$ApiVersion = "2025-05-01-preview"
+$ApiVersion = "2026-01-01"
 $ArmBase = "https://management.azure.com/subscriptions/$Subscription/resourceGroups/$ResourceGroup/providers/Microsoft.App/agents/$AgentName"
 
 # ── Resolve agent endpoint and UAMI ────────────────────────────────────────
@@ -156,29 +156,6 @@ function Get-DpToken {
     return $tok
 }
 
-# ── Helper: ARM PUT sub-resource with base64-encoded value envelope ─────────
-# Used for incidentFilters, scheduledTasks, commonPrompts.
-function Arm-PutSubresource {
-    param([string]$Type, [string]$Name, [string]$SpecJson)
-    $url = "$ArmBase/$Type/$Name`?api-version=$ApiVersion"
-    $encoded = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($SpecJson))
-    $body = @{ properties = @{ value = $encoded } } | ConvertTo-Json -Compress -Depth 10
-    $tmp = [System.IO.Path]::GetTempFileName()
-    try {
-        Set-Content -Path $tmp -Value $body -NoNewline
-        Write-Host "  ARM PUT $Type/$Name"
-        $result = az rest -m PUT --url $url --body "@$tmp" --headers "Content-Type=application/json" -o json 2>&1
-        if ($LASTEXITCODE -eq 0) {
-            Write-Host "    ok"
-        } else {
-            $msg = ($result | Out-String) -replace '(?s).*"message":"([^"]*)".*', '$1'
-            Write-Host "    FAILED - $msg"
-        }
-    } finally {
-        Remove-Item $tmp -ErrorAction SilentlyContinue
-    }
-}
-
 # ── Helper: ARM PUT connector sub-resource (native properties, no base64) ──
 function Arm-PutConnector {
     param([string]$Name, [string]$BodyJson)
diff --git a/sreagent-templates/bicep/apply-extras.sh b/sreagent-templates/bicep/apply-extras.sh
index c76a4a04e..3c16cb3aa 100755
--- a/sreagent-templates/bicep/apply-extras.sh
+++ b/sreagent-templates/bicep/apply-extras.sh
@@ -57,7 +57,7 @@ command -v jq    >/dev/null || { echo "jq is required"    >&2; exit 1; }
 command -v tar   >/dev/null || { echo "tar is required"   >&2; exit 1; }
 command -v curl  >/dev/null || { echo "curl is required"  >&2; exit 1; }
 
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 ARM_BASE="https://management.azure.com/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.App/agents/${AGENT}"
 
 # Look up the data-plane endpoint and the agent's user-assigned MI (we use it
@@ -86,30 +86,6 @@ else
   echo "                To apply later: az login --scope \"https://azuresre.dev/.default\" && re-run"
 fi
 
-# ---------------------------------------------------------------------------
-# Helper: PUT an ARM sub-resource with base64-encoded value envelope.
-# Used for incidentFilters, scheduledTasks, commonPrompts.
-# Body: { properties: { value: "<base64 of JSON spec>" } }
-# ---------------------------------------------------------------------------
-arm_put_subresource() {
-  local type="$1" name="$2" spec_json="$3"
-  local url="${ARM_BASE}/${type}/${name}?api-version=${API_VERSION}"
-  local encoded
-  encoded=$(printf '%s' "$spec_json" | base64)
-  local tmp
-  tmp=$(mktemp)
-  printf '{"properties":{"value":"%s"}}' "$encoded" > "$tmp"
-  echo "  ARM PUT ${type}/${name}"
-  local result
-  result=$(az rest -m PUT --url "$url" --body "@${tmp}" \
-       --headers "Content-Type=application/json" -o json 2>&1) && {
-    echo "    ok"
-  } || {
-    echo "    FAILED — $(echo "$result" | grep -o '"message":"[^"]*"' | head -1 | cut -d'"' -f4)"
-  }
-  rm -f "$tmp"
-}
-
 # ---------------------------------------------------------------------------
 # Helper: PUT an ARM connector sub-resource (native properties, no base64).
 # Used for MCP connectors, KnowledgeFile connectors.
diff --git a/sreagent-templates/bin/clone-agent.sh b/sreagent-templates/bin/clone-agent.sh
index f60630db9..f65fcfac7 100755
--- a/sreagent-templates/bin/clone-agent.sh
+++ b/sreagent-templates/bin/clone-agent.sh
@@ -217,7 +217,7 @@ else
 fi
 
 # 2d. Check if agent already exists in target
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 EXISTING=$(az rest -m GET \
   --url "https://management.azure.com/subscriptions/${NEW_SUB}/resourceGroups/${NEW_RG}/providers/Microsoft.App/agents/${NEW_AGENT}?api-version=${API_VERSION}" \
   -o json 2>/dev/null || echo "null")
diff --git a/sreagent-templates/bin/deploy.sh b/sreagent-templates/bin/deploy.sh
index b8ee8dcb5..fa75ae075 100755
--- a/sreagent-templates/bin/deploy.sh
+++ b/sreagent-templates/bin/deploy.sh
@@ -300,7 +300,7 @@ fi
 # ── Connector health check (reused in multiple paths) ──
 check_connector_health() {
   local sub="$1" rg="$2" ag="$3"
-  local api_url="https://management.azure.com/subscriptions/${sub}/resourceGroups/${rg}/providers/Microsoft.App/agents/${ag}/connectors?api-version=2025-05-01-preview"
+  local api_url="https://management.azure.com/subscriptions/${sub}/resourceGroups/${rg}/providers/Microsoft.App/agents/${ag}/connectors?api-version=2026-01-01"
   local conn_json
   conn_json=$(az rest --method GET --url "$api_url" 2>/dev/null || true)
   local count
diff --git a/sreagent-templates/bin/diff-agent.sh b/sreagent-templates/bin/diff-agent.sh
index 099dd9ce0..4c0c12162 100755
--- a/sreagent-templates/bin/diff-agent.sh
+++ b/sreagent-templates/bin/diff-agent.sh
@@ -19,7 +19,7 @@ RG="${2:?resource-group required}"
 AGENT="${3:?agent-name required}"
 CONFIG_DIR="${4:?config-directory required}"
 
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 ARM_BASE="https://management.azure.com/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.App/agents/${AGENT}"
 
 # Check if agent exists
diff --git a/sreagent-templates/bin/export-agent.sh b/sreagent-templates/bin/export-agent.sh
index efa56e56f..7bde69c08 100755
--- a/sreagent-templates/bin/export-agent.sh
+++ b/sreagent-templates/bin/export-agent.sh
@@ -96,7 +96,12 @@ else
   echo "Error: python3 or python is required" >&2; exit 1
 fi
 
-API_VERSION="2025-05-01-preview"
+if ! "$PYTHON" -c "import yaml" 2>/dev/null; then
+  echo "Error: PyYAML is required for $PYTHON — install it with: $PYTHON -m pip install pyyaml" >&2
+  exit 1
+fi
+
+API_VERSION="2026-01-01"
 ARM_BASE="https://management.azure.com/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.App/agents/${AGENT}"
 
 # ─────────────────────────── Helpers ───────────────────────────
@@ -307,25 +312,26 @@ RAW_CONNECTORS=$(arm_list "connectors")
 CONNECTOR_COUNT=$(echo "$RAW_CONNECTORS" | jq 'length')
 _log "  Found ${CONNECTOR_COUNT} connector(s) from ARM"
 
-# Also read connectors from data-plane (has full extendedProperties including secrets)
-DP_CONNECTORS=$(dp_get "/api/v2/extendedAgent/connectors" | jq -c '.value // []' 2>/dev/null || echo '[]')
-DP_COUNT=$(echo "$DP_CONNECTORS" | jq 'length')
-_log "  Found ${DP_COUNT} connector(s) from data-plane"
+# Read unredacted connector properties through the stable, read-only ARM action.
+FULL_CONNECTORS=$(az rest -m POST \
+  --url "${ARM_BASE}/listConnectorsWithSecrets?api-version=${API_VERSION}" \
+  --query 'value' -o json 2>/dev/null || echo '[]')
+FULL_CONNECTOR_COUNT=$(echo "$FULL_CONNECTORS" | jq 'length')
+_log "  Found ${FULL_CONNECTOR_COUNT} connector(s) with details from ARM"
 
-# Normalize connectors — prefer data-plane for ALL connectors (ARM redacts secrets and nulls resource IDs)
-CONNECTORS=$(echo "$RAW_CONNECTORS" | jq -c --argjson dp "$DP_CONNECTORS" '[.[] | 
+# Normalize connectors, preferring the control-plane action results where available.
+CONNECTORS=$(echo "$RAW_CONNECTORS" | jq -c --argjson full "$FULL_CONNECTORS" '[.[] |
   . as $arm |
   ($arm.name | split("/") | last) as $cname |
   ($arm.properties.dataConnectorType) as $ctype |
-  # Try data-plane first (has full properties), fall back to ARM
-  ([$dp[] | select(.name == $cname)] | first) as $dpconn |
-  if $dpconn then {
+  ([$full[] | select((.name | split("/") | last) == $cname)] | first) as $fullconn |
+  if $fullconn then {
     name: $cname,
     properties: {
-      dataConnectorType: ($dpconn.properties.dataConnectorType // $ctype),
-      dataSource: ($dpconn.properties.dataSource // $arm.properties.dataSource // ""),
-      extendedProperties: ($dpconn.properties.extendedProperties // $arm.properties.extendedProperties // {}),
-      identity: ($dpconn.properties.identity // $arm.properties.identity // "system")
+      dataConnectorType: ($fullconn.properties.dataConnectorType // $ctype),
+      dataSource: ($fullconn.properties.dataSource // $arm.properties.dataSource // ""),
+      extendedProperties: ($fullconn.properties.extendedProperties // $arm.properties.extendedProperties // {}),
+      identity: ($fullconn.properties.identity // $arm.properties.identity // "system")
     }
   } else {
     name: $cname,
@@ -768,10 +774,9 @@ fi
 # (not converted to AgentMemory .md uploads) so they appear under Knowledge Sources.
 if [[ "$INCLUDE_KNOWLEDGE_ITEMS" == "true" ]]; then
   _log "Reading knowledge items from connectors API..."
-  RAW_KNOWLEDGE_ITEMS=$(dp_get "/api/v2/extendedAgent/connectors")
-  if [[ "$RAW_KNOWLEDGE_ITEMS" != "null" ]]; then
-    KNOWLEDGE_ITEMS=$(echo "$RAW_KNOWLEDGE_ITEMS" | jq -c '[
-      (.value // . // [])[] |
+  if [[ "$FULL_CONNECTORS" != "null" ]]; then
+    KNOWLEDGE_ITEMS=$(echo "$FULL_CONNECTORS" | jq -c '[
+      .[] |
       select(.properties.dataConnectorType // "" | test("^Knowledge")) |
       {
         name: .name,
diff --git a/sreagent-templates/bin/ps/Diff-Agent.ps1 b/sreagent-templates/bin/ps/Diff-Agent.ps1
index f330bbfe8..a507f023c 100644
--- a/sreagent-templates/bin/ps/Diff-Agent.ps1
+++ b/sreagent-templates/bin/ps/Diff-Agent.ps1
@@ -72,7 +72,7 @@ if (Test-Path $PrereqScript) {
 
 # ─────────────────────────── ARM setup ───────────────────────────
 
-$API_VERSION = '2025-05-01-preview'
+$API_VERSION = '2026-01-01'
 $ARM_BASE    = "https://management.azure.com/subscriptions/${Subscription}/resourceGroups/${ResourceGroup}/providers/Microsoft.App/agents/${AgentName}"
 
 # ─────────────────────────── Check if agent exists ───────────────────────────
diff --git a/sreagent-templates/bin/ps/Export-Agent.ps1 b/sreagent-templates/bin/ps/Export-Agent.ps1
index 7191c6bcb..f23013614 100644
--- a/sreagent-templates/bin/ps/Export-Agent.ps1
+++ b/sreagent-templates/bin/ps/Export-Agent.ps1
@@ -130,7 +130,7 @@ if ($null -ne $Set) {
     }
 }
 
-$API_VERSION = '2025-05-01-preview'
+$API_VERSION = '2026-01-01'
 $ARM_BASE    = "https://management.azure.com/subscriptions/${Subscription}/resourceGroups/${ResourceGroup}/providers/Microsoft.App/agents/${AgentName}"
 
 # ─────────────────────────── Prerequisites ───────────────────────────
@@ -435,26 +435,26 @@ $RAW_CONNECTORS = Invoke-ArmList 'connectors'
 $CONNECTOR_COUNT = ($RAW_CONNECTORS | jq 'length') -as [int]
 _log "  Found ${CONNECTOR_COUNT} connector(s) from ARM"
 
-$DP_CONNECTORS = Invoke-DpGet '/api/v2/extendedAgent/connectors' | Invoke-Jq -Compact -Filter '.value // []'
-if (-not $DP_CONNECTORS -or $DP_CONNECTORS -eq 'null') { $DP_CONNECTORS = '[]' }
-$DP_COUNT = ($DP_CONNECTORS | jq 'length') -as [int]
-_log "  Found ${DP_COUNT} connector(s) from data-plane"
+$FULL_CONNECTORS = (az rest -m POST --url "${ARM_BASE}/listConnectorsWithSecrets?api-version=${API_VERSION}" --query 'value' -o json 2>$null) -join "`n"
+if ($LASTEXITCODE -ne 0 -or -not $FULL_CONNECTORS) { $FULL_CONNECTORS = '[]' }
+$FULL_CONNECTOR_COUNT = ($FULL_CONNECTORS | jq 'length') -as [int]
+_log "  Found ${FULL_CONNECTOR_COUNT} connector(s) with details from ARM"
 
-# Prefer data-plane connectors (ARM redacts secrets)
-$dpTmpFile = [System.IO.Path]::GetTempFileName()
-$DP_CONNECTORS | Set-Content -Path $dpTmpFile -Encoding utf8 -NoNewline
+# Prefer the stable control-plane action results where available.
+$fullTmpFile = [System.IO.Path]::GetTempFileName()
+$FULL_CONNECTORS | Set-Content -Path $fullTmpFile -Encoding utf8 -NoNewline
 $CONNECTORS = $RAW_CONNECTORS | Invoke-Jq -Compact -Filter '[.[] |
     . as $arm |
     ($arm.name | split("/") | last) as $cname |
     ($arm.properties.dataConnectorType) as $ctype |
-    ([$dp[0][] | select(.name == $cname)] | first) as $dpconn |
-    if $dpconn then {
+    ([$full[0][] | select((.name | split("/") | last) == $cname)] | first) as $fullconn |
+    if $fullconn then {
         name: $cname,
         properties: {
-            dataConnectorType: ($dpconn.properties.dataConnectorType // $ctype),
-            dataSource: ($dpconn.properties.dataSource // $arm.properties.dataSource // ""),
-            extendedProperties: ($dpconn.properties.extendedProperties // $arm.properties.extendedProperties // {}),
-            identity: ($dpconn.properties.identity // $arm.properties.identity // "system")
+            dataConnectorType: ($fullconn.properties.dataConnectorType // $ctype),
+            dataSource: ($fullconn.properties.dataSource // $arm.properties.dataSource // ""),
+            extendedProperties: ($fullconn.properties.extendedProperties // $arm.properties.extendedProperties // {}),
+            identity: ($fullconn.properties.identity // $arm.properties.identity // "system")
         }
     } else {
         name: $cname,
@@ -465,8 +465,8 @@ $CONNECTORS = $RAW_CONNECTORS | Invoke-Jq -Compact -Filter '[.[] |
             identity: ($arm.properties.identity // "system")
         }
     } end
-]' -ExtraArgs @('--slurpfile', 'dp', $dpTmpFile)
-Remove-Item $dpTmpFile -Force -ErrorAction SilentlyContinue
+]' -ExtraArgs @('--slurpfile', 'full', $fullTmpFile)
+Remove-Item $fullTmpFile -Force -ErrorAction SilentlyContinue
 $CONNECTORS = Invoke-Sanitize $CONNECTORS
 
 # ── Tools (opaque; data-plane fallback for 3P tenants) ──
@@ -912,10 +912,9 @@ if ($INCLUDE_KNOWLEDGE) {
 # 2. Knowledge items (via connectors API) — preserved as knowledgeItems for data-plane deploy
 if ($INCLUDE_KNOWLEDGE_ITEMS) {
     _log 'Reading knowledge items from connectors API...'
-    $RAW_KNOWLEDGE_ITEMS = Invoke-DpGet '/api/v2/extendedAgent/connectors'
-    if ($RAW_KNOWLEDGE_ITEMS -ne 'null') {
-        $KNOWLEDGE_ITEMS = $RAW_KNOWLEDGE_ITEMS | Invoke-Jq -Compact -Filter '[
-            (.value // . // [])[] |
+    if ($FULL_CONNECTORS -ne 'null') {
+        $KNOWLEDGE_ITEMS = $FULL_CONNECTORS | Invoke-Jq -Compact -Filter '[
+            .[] |
             select(.properties.dataConnectorType // "" | test("^Knowledge")) |
             {
                 name: .name,
diff --git a/sreagent-templates/bin/ps/New-Agent.ps1 b/sreagent-templates/bin/ps/New-Agent.ps1
index ebb3bd464..66c05b865 100644
--- a/sreagent-templates/bin/ps/New-Agent.ps1
+++ b/sreagent-templates/bin/ps/New-Agent.ps1
@@ -387,7 +387,7 @@ foreach ($d in $configDirs) {
 
 $automationsDir = Join-Path $Output "automations"
 if (Test-Path $automationsDir -PathType Container) {
-    $hasFiles = (Get-ChildItem -Path $automationsDir -Recurse -File -ErrorAction SilentlyContinue).Count -gt 0
+    $hasFiles = @(Get-ChildItem -Path $automationsDir -Recurse -File -ErrorAction SilentlyContinue).Count -gt 0
     if ($hasFiles) {
         Write-Host "    automations/"
         foreach ($d in @("scheduled-tasks", "incident-filters", "http-triggers", "incident-platforms")) {
diff --git a/sreagent-templates/bin/ps/Verify-Agent.ps1 b/sreagent-templates/bin/ps/Verify-Agent.ps1
index 6785d36eb..b781d7c76 100644
--- a/sreagent-templates/bin/ps/Verify-Agent.ps1
+++ b/sreagent-templates/bin/ps/Verify-Agent.ps1
@@ -94,7 +94,7 @@ function Get-ExpList {
 
 # ─────────────────────────── ARM + Data-plane setup ───────────────────────────
 
-$API_VERSION = '2025-05-01-preview'
+$API_VERSION = '2026-01-01'
 $ARM_BASE    = "https://management.azure.com/subscriptions/${Subscription}/resourceGroups/${ResourceGroup}/providers/Microsoft.App/agents/${AgentName}"
 
 $AgentJson = (az rest -m GET --url "${ARM_BASE}?api-version=${API_VERSION}" -o json 2>$null) -join "`n"
diff --git a/sreagent-templates/bin/verify-agent.sh b/sreagent-templates/bin/verify-agent.sh
index 5d8107ec2..63a68cbf2 100755
--- a/sreagent-templates/bin/verify-agent.sh
+++ b/sreagent-templates/bin/verify-agent.sh
@@ -51,7 +51,7 @@ exp_list() {
   fi
 }
 
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 ARM_BASE="https://management.azure.com/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.App/agents/${AGENT}"
 
 # Resolve agent endpoint