diff --git a/charms/garm-configurator/tests/unit/test_charm.py b/charms/garm-configurator/tests/unit/test_charm.py
index 9b253dd2..cdb518d8 100644
--- a/charms/garm-configurator/tests/unit/test_charm.py
+++ b/charms/garm-configurator/tests/unit/test_charm.py
@@ -658,6 +658,7 @@ def test_reconcile_writes_optional_scaleset_fields_to_garm_relation():
     )
     assert "repo" not in garm_out.local_unit_data
 
+
 @pytest.mark.parametrize(
     "config_key, bad_value, expected_fragment",
     [
diff --git a/charms/garm-configurator/tox.toml b/charms/garm-configurator/tox.toml
index 869a0eee..bea7ce20 100644
--- a/charms/garm-configurator/tox.toml
+++ b/charms/garm-configurator/tox.toml
@@ -40,7 +40,7 @@ commands = [
 
 [env.unit]
 description = "Run unit tests"
-deps = ["pytest", "coverage[toml]", "ops-scenario==8.8.1", "-r requirements.txt"]
+deps = ["pytest", "coverage[toml]", "ops-scenario==8.8.2", "-r requirements.txt"]
 commands = [
   [
     "coverage",
diff --git a/charms/garm/src/charm.py b/charms/garm/src/charm.py
index 8edcac2a..bdcef044 100755
--- a/charms/garm/src/charm.py
+++ b/charms/garm/src/charm.py
@@ -37,7 +37,7 @@
     GithubReconciler,
 )
 from resource_cleanup import GarmCleanupError, GarmResourceCleanup
-from scaleset_reconciler import ScalesetReconciler, ScalesetSpec
+from scaleset_reconciler import Handover, ScalesetProgress, ScalesetReconciler, ScalesetSpec
 
 logger = logging.getLogger(__name__)
 
@@ -52,6 +52,14 @@
 GARM_LOCAL_API_BASE_URL: typing.Final[str] = f"http://127.0.0.1:{GARM_PORT}/api/v1"
 GARM_LISTEN_ADDRESS: typing.Final[str] = "0.0.0.0"
 _DB_PASSPHRASE_LENGTH: typing.Final[int] = 32
+# Juju truncates long statuses; name a couple of scalesets and count the rest.
+_MAX_DRAINING_IN_STATUS: typing.Final[int] = 2
+# The phases a scaleset replacement passes through, in order. Named here rather than
+# spelled inline so the status vocabulary is greppable; not an enum, because the
+# draining phase carries the runner count and so is formatted, not selected.
+_PHASE_CREATING: typing.Final[str] = "creating replacement"
+_PHASE_RETIRING: typing.Final[str] = "retiring predecessor"
+_PHASE_AWAITING_DELETION: typing.Final[str] = "awaiting deletion"
 
 GARM_CONFIG_VERSION: typing.Final[str] = "1"
 
@@ -792,8 +800,21 @@ def _reconcile_runners(self) -> None:
             GithubReconciler(auth_client).reconcile(self._build_desired_credentials())
             EntityReconciler(auth_client).reconcile(charm_state.desired_entities)
             template_id = _apply_garm_template(auth_client, charm_state.ssh_debug_connections)
-            ScalesetReconciler(auth_client).reconcile(self._build_desired_scalesets(template_id))
-            self.update_app_and_unit_status(ops.ActiveStatus())
+            replacing = ScalesetReconciler(auth_client).reconcile(
+                self._build_desired_scalesets(template_id)
+            )
+            # A label change recreates the scaleset and drains the old one, which
+            # outlives this hook: report progress and let update-status converge it.
+            # Active, not maintenance: every label is served throughout the drain, by
+            # the replacement or the predecessor, so nothing is degraded. A drain can
+            # run to DRAIN_DEADLINE, and blocking `juju wait-for` on hours of healthy
+            # background convergence would be wrong.
+            if replacing:
+                self.update_app_and_unit_status(
+                    ops.ActiveStatus(_scaleset_replacement_status(replacing))
+                )
+            else:
+                self.update_app_and_unit_status(ops.ActiveStatus())
         except CharmedTemplateError as exc:
             logger.warning("GARM charmed template error during reconcile: %s", exc)
             self.update_app_and_unit_status(ops.WaitingStatus(str(exc)))
@@ -819,5 +840,59 @@ def _ensure_controller_urls(self, auth_client: GarmAuthenticatedClient) -> None:
         )
 
 
+def _scaleset_replacement_status(replacing: list[ScalesetProgress]) -> str:
+    """Summarise in-progress scaleset replacements for the unit status.
+
+    Args:
+        replacing: Scaleset replacements still in flight, one entry per generation
+            being replaced.
+
+    Returns:
+        A status message naming at most two scalesets, so it stays readable when
+        several are replaced at once. Each is named by the logical name the operator
+        configured — the live names carry a label hash the operator never chose — and
+        the live names are logged in full by the reconciler. A scaleset draining two
+        generations at once is named once, so it cannot push the others out of the
+        message with a repeated line.
+    """
+    by_scaleset: dict[str, list[ScalesetProgress]] = {}
+    for progress in replacing:
+        by_scaleset.setdefault(progress.logical_name, []).append(progress)
+    shown = [
+        f"{logical_name} -> {entries[0].replacement_name} ({_scaleset_replacement_phase(entries)})"
+        for logical_name, entries in list(by_scaleset.items())[:_MAX_DRAINING_IN_STATUS]
+    ]
+    remainder = len(by_scaleset) - len(shown)
+    if remainder > 0:
+        shown.append(f"+{remainder} more")
+    return f"Replacing scaleset {', '.join(shown)}"
+
+
+def _scaleset_replacement_phase(entries: list[ScalesetProgress]) -> str:
+    """Describe where one scaleset's replacement has got to.
+
+    Args:
+        entries: Every generation of one scaleset still being replaced. A label change
+            during an earlier drain leaves several predecessors handing over to the same
+            replacement; to the operator that is one changeover, so they collapse into
+            one phase — the least advanced, with the runner counts summed.
+
+    Returns:
+        The phase, in the operator's terms. The runner count is only reported once
+        the labels have been handed over, since before that nothing is draining yet;
+        with the count at zero the scaleset has drained and GARM has yet to accept
+        its deletion, which is a distinct thing to be waiting on.
+    """
+    handovers = {entry.handover for entry in entries}
+    if Handover.PENDING in handovers:
+        return _PHASE_CREATING
+    if Handover.FAILED in handovers:
+        return _PHASE_RETIRING
+    runners = sum(entry.remaining_runners for entry in entries)
+    if not runners:
+        return _PHASE_AWAITING_DELETION
+    return f"draining {runners} runner{'' if runners == 1 else 's'}"
+
+
 if __name__ == "__main__":
     ops.main(GarmCharm)
diff --git a/charms/garm/src/scaleset_reconciler.py b/charms/garm/src/scaleset_reconciler.py
index 73b4f96d..84450ac9 100644
--- a/charms/garm/src/scaleset_reconciler.py
+++ b/charms/garm/src/scaleset_reconciler.py
@@ -5,7 +5,10 @@
 """Scaleset reconciler: diffs desired vs observed GARM scalesets and applies changes."""
 
 import base64
+import enum
+import hashlib
 import logging
+import re
 from dataclasses import dataclass, field
 from datetime import datetime, timedelta, timezone
 
@@ -13,6 +16,7 @@
 from garm_api import (
     GarmApiError,
     GarmAuthenticatedClient,
+    GarmConnectionError,
     GarmNotFoundError,
     GarmUnauthorizedError,
 )
@@ -70,6 +74,47 @@
 # legitimate job, which costs more than leaving a scaleset around for longer.
 MAX_JOB_RUNTIME = timedelta(days=5)
 
+LABEL_HASH_LENGTH = 8
+
+# A conservative bound on the generated name: the operator-supplied part is truncated to
+# fit, never the hash. GARM validates only that the name is non-empty, and the tighter
+# ceiling that used to apply is gone — GARM derived the OpenStack `garm-pool-id` tag from
+# the scale set name, so anything over 10 characters overran Nova's 60-character tag limit
+# until the pinned GARM bump replaced it with a fixed-length UUID. What remains is
+# GitHub's own limit on the System label GARM registers the scale set under.
+MAX_SCALESET_NAME_LENGTH = 64
+
+# Past GitHub's 6h job cap a remaining runner is stuck, not busy: stop gating on the
+# count and retry the delete, which GARM rejects while runners are active.
+DRAIN_DEADLINE = timedelta(hours=7)
+
+
+class Handover(enum.Enum):
+    """How far the routing hand-over from a replaced generation has got.
+
+    Attributes:
+        PENDING: The replacement is not up yet, so the predecessor must stay enabled.
+        FAILED: GARM refused to disable the predecessor; the next reconcile retries.
+        DONE: The predecessor is disabled and the replacement holds their shared labels.
+    """
+
+    # Both unfinished states leave the predecessor enabled and serving jobs, so nothing
+    # is draining yet and the runner count reported alongside them is 0.
+    PENDING = "pending"
+    FAILED = "failed"
+    DONE = "done"
+
+
+@dataclass(frozen=True)
+class ScalesetProgress:
+    """A scaleset replacement still in flight: the generation it replaced is not gone yet."""
+
+    logical_name: str
+    retiring_name: str
+    replacement_name: str
+    remaining_runners: int
+    handover: Handover = Handover.DONE
+
 
 @dataclass
 class ScalesetSpec:
@@ -103,7 +148,7 @@ def __init__(self, client: GarmAuthenticatedClient) -> None:
         """
         self._client = client
 
-    def reconcile(self, desired: list[ScalesetSpec]) -> None:
+    def reconcile(self, desired: list[ScalesetSpec]) -> list[ScalesetProgress]:
         """Sync GARM scalesets to match *desired*.
 
         Performs the minimum set of CREATE / UPDATE / DELETE operations, and
@@ -112,9 +157,26 @@ def reconcile(self, desired: list[ScalesetSpec]) -> None:
         (org/repo) is not registered in GARM, that spec is skipped silently
         (deferred creation) — no error state is set.
 
+        A label change is applied by creating a replacement scaleset and draining
+        the old one (see ``_retire_replaced``), which spans several reconciles.
+
+        A spec that fails against the GARM API does not abort the pass: the
+        remaining specs and the orphan sweep still run, and the first failure is
+        re-raised at the end so the charm still reports the sync as failed. A
+        connection error is not contained that way — GARM is down, so retrying
+        every remaining spec would only stall the hook.
+
         Args:
             desired: The full desired set of scalesets.
+
+        Returns:
+            One entry per replacement still in flight; empty once converged.
+
+        Raises:
+            GarmApiError: If any spec failed to reconcile, re-raised once the rest
+                of the pass has completed.
         """
+        desired = self._dedupe(desired)
         providers = {provider.name for provider in self._client.list_providers()}
         observed: dict[str, ScaleSet] = {}
         for scaleset in self._client.list_scalesets():
@@ -124,15 +186,92 @@ def reconcile(self, desired: list[ScalesetSpec]) -> None:
             observed[scaleset.name] = scaleset
 
         templates = self._load_templates(desired, observed)
-        all_desired_names: set[str] = {spec.name for spec in desired}
-
+        families = self._resolve_families(desired, observed)
+        # Covers in-flight replacements and draining predecessors, so the orphan pass
+        # can't delete one mid-changeover. Built before the provider/entity gates.
+        claimed: set[str] = set()
+        for family in families.values():
+            claimed.update(family)
+
+        progress: list[ScalesetProgress] = []
+        failure: GarmApiError | None = None
         for spec in desired:
-            self._reconcile_one(spec, providers, observed, templates)
+            try:
+                progress.extend(
+                    self._reconcile_one(
+                        spec, providers, observed, templates, families.get(spec.name, [])
+                    )
+                )
+            except GarmConnectionError:
+                raise
+            except GarmApiError as exc:
+                logger.warning("Failed to reconcile scaleset %s: %s", spec.name, exc)
+                failure = failure or exc
 
         for name, scaleset in observed.items():
-            if name not in all_desired_names:
-                self._delete_orphaned(scaleset)
+            if name not in claimed and self._delete_orphaned(scaleset):
                 self._delete_custom_template(name, templates)
+        if failure is not None:
+            raise failure
+        return progress
+
+    @staticmethod
+    def _dedupe(desired: list[ScalesetSpec]) -> list[ScalesetSpec]:
+        """Drop specs repeating a logical name already claimed by an earlier one.
+
+        Args:
+            desired: The full desired set of scalesets.
+
+        Returns:
+            The specs with duplicate names removed, first occurrence winning. Two
+            specs sharing a name would each own the other's live scaleset and retire
+            it on every reconcile, so they would replace each other forever.
+        """
+        unique: dict[str, ScalesetSpec] = {}
+        for spec in desired:
+            existing = unique.get(spec.name)
+            if existing is not None:
+                # Only a conflicting duplicate is worth a warning: the scaleset config is
+                # app-level, so every configurator unit's databag yields the same spec and
+                # a multi-unit configurator would otherwise warn on every hook.
+                if existing != spec:
+                    logger.warning(
+                        "Ignoring duplicate desired scaleset %s: a logical name must"
+                        " identify exactly one scaleset",
+                        spec.name,
+                    )
+                continue
+            unique[spec.name] = spec
+        return list(unique.values())
+
+    @staticmethod
+    def _resolve_families(
+        desired: list[ScalesetSpec], observed: dict[str, ScaleSet]
+    ) -> dict[str, list[str]]:
+        """Group the live scalesets by the desired spec that owns them.
+
+        Args:
+            desired: The full desired set of scalesets.
+            observed: Observed scalesets keyed by name.
+
+        Returns:
+            Per logical name, every live generation it owns plus its target name
+            (which may not exist yet). A live name that is another spec's own or
+            target name is never claimed, so ``foo`` can't swallow a separate
+            scaleset that happens to be named ``foo-1a2b3c4d``.
+        """
+        targets = {spec.name: target_scaleset_name(spec.name, spec.labels) for spec in desired}
+        reserved = set(targets) | set(targets.values())
+        families: dict[str, list[str]] = {}
+        for spec in desired:
+            others = reserved - {spec.name, targets[spec.name]}
+            family = [
+                name
+                for name in observed
+                if name not in others and _is_family_member(name, spec.name)
+            ]
+            families[spec.name] = sorted({*family, targets[spec.name]})
+        return families
 
     def _load_templates(
         self, desired: list[ScalesetSpec], observed: dict[str, ScaleSet]
@@ -166,7 +305,8 @@ def _reconcile_one(
         providers: set[str | None],
         observed: dict[str, ScaleSet],
         templates: dict[str, Template],
-    ) -> None:
+        family: list[str],
+    ) -> list[ScalesetProgress]:
         """Reconcile a single desired scaleset: validate, create or update, and sync its template.
 
         Args:
@@ -174,12 +314,20 @@ def _reconcile_one(
             providers: Names of providers currently registered in GARM.
             observed: Observed scalesets keyed by name.
             templates: Observed templates keyed by name.
+            family: Every live generation of this spec, plus its target name.
+
+        Returns:
+            One entry per replaced generation of this spec still draining.
         """
+        active_name = _resolve_active_name(spec, observed)
         try:
-            create_params = self._to_create_params(spec)
+            create_params = self._to_create_params(spec, active_name)
         except Exception as exc:
-            logger.warning("Skipping scaleset %s: spec validation failed: %s", spec.name, exc)
-            return
+            # Error, not warning: unlike the provider/entity gates below this does not
+            # resolve on its own — the spec is malformed and will fail every pass until
+            # the operator changes it.
+            logger.error("Skipping scaleset %s: spec validation failed: %s", spec.name, exc)
+            return []
 
         if spec.provider_name not in providers:
             logger.warning(
@@ -187,7 +335,7 @@ def _reconcile_one(
                 spec.name,
                 spec.provider_name,
             )
-            return
+            return []
 
         entity_id = self._resolve_entity_id(spec)
         if entity_id is None:
@@ -197,34 +345,263 @@ def _reconcile_one(
                 spec.entity_type,
                 spec.entity_name,
             )
-            return
+            return []
 
-        template_id = self._ensure_template(spec, templates)
+        template_id = self._ensure_template(spec, active_name, templates)
 
-        if spec.name in observed:
-            self._maybe_update(observed[spec.name], spec, template_id)
+        if active_name in observed:
+            self._maybe_update(observed[active_name], spec, template_id)
         else:
-            self._create(spec, entity_id, create_params, template_id)
+            self._create(spec, active_name, entity_id, create_params, template_id)
 
         if not spec.runner_config.has_config():
             # Runner options were cleared (or the system template is
             # unavailable): the scaleset has been reverted to the default
             # template above, so drop any now-unreferenced custom template.
-            self._delete_custom_template(spec.name, templates)
+            self._delete_custom_template(active_name, templates)
+
+        return self._retire_replaced(spec, active_name, observed, templates, family)
+
+    def _retire_replaced(
+        self,
+        spec: ScalesetSpec,
+        active_name: str,
+        observed: dict[str, ScaleSet],
+        templates: dict[str, Template],
+        family: list[str],
+    ) -> list[ScalesetProgress]:
+        """Hand routing over to the current generation and drain the ones it replaced.
+
+        Workloads route by label, not by scaleset name, and GitHub only assigns jobs to
+        a scaleset holding a live listener session. So the replacement is brought up
+        first and only then is the old one disabled, which closes its session and leaves
+        the replacement as the sole holder of the labels they share. Any label carried by
+        both is served throughout — by one scaleset or the other, both fully functional —
+        so the changeover has no queue gap, and runners already mid-job are left to
+        finish rather than being killed.
+
+        Args:
+            spec: The desired scaleset.
+            active_name: The generation that should serve *spec*.
+            observed: Observed scalesets keyed by name.
+            templates: Observed templates keyed by name.
+            family: Every live generation of this spec, plus its target name.
+
+        Returns:
+            One entry per replaced generation not yet gone.
+        """
+        # Close the old session only once the replacement exists: disabling any
+        # earlier leaves the labels unserved if the charm dies in between.
+        replacement_live = active_name in observed and observed[active_name].enabled is True
+
+        progress: list[ScalesetProgress] = []
+        for name in family:
+            old = observed.get(name)
+            if name == active_name or old is None:
+                continue
+            if not replacement_live:
+                progress.append(
+                    ScalesetProgress(spec.name, name, active_name, 0, Handover.PENDING)
+                )
+                continue
+            entry = self._advance_retirement(spec, active_name, name, old, templates)
+            if entry is not None:
+                progress.append(entry)
+        return progress
+
+    def _advance_retirement(
+        self,
+        spec: ScalesetSpec,
+        active_name: str,
+        name: str,
+        old: ScaleSet,
+        templates: dict[str, Template],
+    ) -> ScalesetProgress | None:
+        """Move one replaced generation a step closer to being gone.
+
+        Args:
+            spec: The desired scaleset.
+            active_name: The generation that should serve *spec*.
+            name: Name of the replaced generation.
+            old: The replaced generation, as GARM reports it.
+            templates: Observed templates keyed by name.
+
+        Returns:
+            What to report for this generation, or None once it is gone and there is
+            nothing left to report.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable — see ``_remaining_runners``.
+        """
+        # Truthy, not `is not False`: GARM tags Enabled `omitempty`, so a disabled
+        # scaleset comes back with no `enabled` key at all and the client reads None.
+        if old.enabled:
+            if not self._retire(old):
+                # It is still enabled, so its session is still open and nothing is
+                # draining: report the stalled hand-over rather than a runner count,
+                # which would read as a changeover that is quietly making progress.
+                return ScalesetProgress(spec.name, name, active_name, 0, Handover.FAILED)
+            return ScalesetProgress(spec.name, name, active_name, self._remaining_runners(old))
+        remaining = self._remaining_runners(old)
+        if remaining and not _drain_deadline_passed(old):
+            return ScalesetProgress(spec.name, name, active_name, remaining)
+        if remaining:
+            logger.warning(
+                "Scaleset %s still reports %d runner(s) after %s of draining;"
+                " attempting deletion anyway. GARM rejects the delete while runners"
+                " are genuinely active, so no in-flight job is cut short.",
+                name,
+                remaining,
+                DRAIN_DEADLINE,
+            )
+        if not self._delete_drained(old, templates):
+            # Keep reporting it: a scaleset GARM refused to delete is still on
+            # GitHub, so the replacement has not actually converged yet.
+            return ScalesetProgress(spec.name, name, active_name, remaining)
+        return None
+
+    def _retire(self, scaleset: ScaleSet) -> bool:
+        """Disable a replaced scaleset and stop it launching runners.
+
+        Disabling closes its listener session, handing the shared labels to the
+        replacement. GARM's handleScaleDown then reaps idle runners but skips
+        RunnerActive, so a runner mid-job finishes instead of being killed. The
+        second call is defensive: GARM rejects max_runners=0 on create only.
+
+        Args:
+            scaleset: The replaced scaleset.
+
+        Returns:
+            Whether the scaleset is now disabled. False leaves both generations
+            enabled and their min_idle_runners doubled, so the caller must report the
+            changeover as stalled rather than as a drain in progress.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable — see ``_remaining_runners``.
+        """
+        if scaleset.id is None:
+            logger.warning("Scaleset %s has no id; cannot retire it", scaleset.name)
+            return False
+        logger.info("Retiring replaced scaleset %s (id=%s)", scaleset.name, scaleset.id)
+        try:
+            self._client.update_scaleset(
+                scaleset.id,
+                UpdateScaleSetParams(enabled=False, min_idle_runners=0, max_runners=0),
+            )
+            return True
+        except GarmConnectionError:
+            raise
+        except GarmApiError as exc:
+            logger.warning(
+                "Could not zero runner counts on scaleset %s; disabling only: %s",
+                scaleset.name,
+                exc,
+            )
+        try:
+            self._client.update_scaleset(
+                scaleset.id, UpdateScaleSetParams(enabled=False, min_idle_runners=0)
+            )
+        except GarmConnectionError:
+            raise
+        except GarmApiError as exc:
+            logger.warning(
+                "Could not disable scaleset %s (will retry on next reconcile): %s",
+                scaleset.name,
+                exc,
+            )
+            return False
+        return True
+
+    def _remaining_runners(self, scaleset: ScaleSet) -> int:
+        """Return how many runners a scaleset still has.
+
+        Args:
+            scaleset: The scaleset to inspect.
+
+        Returns:
+            The instance count, or 1 when it cannot be read — an unknown count must
+            never be mistaken for a drained scaleset and delete live runners.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable. Contained failures are
+                per-scaleset; an outage is not, and must reach the charm's status
+                rather than be reported as drain progress.
+        """
+        if scaleset.id is None:
+            return 0
+        try:
+            return len(self._client.list_scale_set_instances(scaleset.id))
+        except GarmConnectionError:
+            raise
+        except GarmApiError as exc:
+            logger.warning(
+                "Could not count runners of scaleset %s; assuming still draining: %s",
+                scaleset.name,
+                exc,
+            )
+            return 1
+
+    def _delete_drained(self, scaleset: ScaleSet, templates: dict[str, Template]) -> bool:
+        """Delete a replaced scaleset that has finished draining, and its template.
+
+        Args:
+            scaleset: The drained scaleset.
+            templates: Observed templates keyed by name.
+
+        Returns:
+            Whether the caller can stop tracking it. False means GARM still holds the
+            scaleset, so the replacement has not converged yet. An id-less scaleset is
+            untouchable rather than gone, but reporting it forever would wedge the
+            status, so it reads as done — matching ``_remaining_runners``.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable — see ``_remaining_runners``.
+        """
+        if scaleset.id is None:
+            return True
+        logger.info("Deleting drained scaleset %s (id=%s)", scaleset.name, scaleset.id)
+        try:
+            self._client.delete_scaleset(scaleset.id)
+        except GarmConnectionError:
+            raise
+        except GarmApiError as exc:
+            logger.warning(
+                "Could not delete drained scaleset %s (will retry on next reconcile): %s",
+                scaleset.name,
+                exc,
+            )
+            return False
+        self._delete_custom_template(scaleset.name or "", templates)
+        return True
+
+    def _delete_orphaned(self, scaleset: ScaleSet) -> bool:
+        """Disable, drain, then delete a scaleset that is no longer in the desired set.
+
+        Args:
+            scaleset: The orphaned scaleset.
 
-    def _delete_orphaned(self, scaleset: ScaleSet) -> None:
-        """Disable, drain, then delete a scaleset that is no longer in the desired set."""
+        Returns:
+            Whether GARM no longer holds it, and so whether its runner template can go
+            too. A template is only ever deleted after the scaleset referencing it, so
+            a scaleset awaiting a retry keeps the runner config that retry relies on.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable — an outage is not a per-scaleset
+                failure and must reach the charm's status rather than read as a sweep
+                that found nothing left to do.
+        """
         name = scaleset.name or ""
         logger.info("Deleting orphaned scaleset %s (id=%s)", name, scaleset.id)
         if scaleset.id is None:
-            return
+            logger.warning("Scaleset %s has no id; skipping delete", name)
+            return False
         if not self._disable(scaleset.id, name):
             # GARM rejects the delete of a scaleset that is still enabled, so nothing
             # below can succeed this pass. Removing the runners of a scaleset that is
             # still enabled and sized up would only have GARM launch replacements —
             # churning instances on every pass instead of draining — so both the drain
             # and the delete wait for the next reconcile.
-            return
+            return False
         # GARM rejects the delete while the scaleset still owns runners (and, above,
         # while it is enabled), so the runners have to go first; anything left behind
         # is retried on the next pass.
@@ -234,9 +611,11 @@ def _delete_orphaned(self, scaleset: ScaleSet) -> None:
             # delete issued just above and still in flight, a runner left mid-job, or
             # one in a status GARM will not delete — makes this pass's delete a
             # certain 400, and it waits for the next reconcile instead.
-            return
+            return False
         try:
             self._client.delete_scaleset(scaleset.id)
+        except GarmConnectionError:
+            raise
         except GarmApiError as exc:
             # The scaleset was empty when its runners were listed, so this is either a
             # runner registered in the window since (the scaleset is disabled, so only
@@ -246,6 +625,8 @@ def _delete_orphaned(self, scaleset: ScaleSet) -> None:
                 name,
                 exc,
             )
+            return False
+        return True
 
     def _disable(self, scaleset_id: int, name: str) -> bool:
         """Stop a scaleset launching runners, before its existing ones are removed.
@@ -256,6 +637,9 @@ def _disable(self, scaleset_id: int, name: str) -> bool:
 
         Returns:
             Whether the scaleset is now disabled.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable — see ``_delete_orphaned``.
         """
         try:
             # Neither field is propagated to GitHub: GARM only calls GitHub from this
@@ -265,6 +649,8 @@ def _disable(self, scaleset_id: int, name: str) -> bool:
                 scaleset_id, UpdateScaleSetParams(enabled=False, min_idle_runners=0)
             )
             return True
+        except GarmConnectionError:
+            raise
         except GarmApiError as exc:
             logger.warning(
                 "Could not disable scaleset %s; deferring its delete, which GARM rejects while"
@@ -283,9 +669,14 @@ def _remove_runners(self, scaleset_id: int, name: str) -> bool:
 
         Returns:
             Whether the scaleset owns no runners, so GARM will accept its delete.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable — see ``_delete_orphaned``.
         """
         try:
             instances = self._client.list_scale_set_instances(scaleset_id)
+        except GarmConnectionError:
+            raise
         except GarmApiError as exc:
             logger.warning(
                 "Could not list runners of scaleset %s (will retry on next reconcile): %s",
@@ -422,7 +813,9 @@ def _resolve_entity_id(self, spec: ScalesetSpec) -> str | None:
         logger.warning("Unknown entity_type %r for scaleset %s", spec.entity_type, spec.name)
         return None
 
-    def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -> int:
+    def _ensure_template(
+        self, spec: ScalesetSpec, scaleset_name: str, templates: dict[str, Template]
+    ) -> int:
         """Ensure the scaleset's runner template reflects its runner options.
 
         Copies the system ``github_linux`` template, injects the runner options,
@@ -432,6 +825,9 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
 
         Args:
             spec: The desired scaleset.
+            scaleset_name: The live name of the scaleset the template belongs to. Each
+                generation owns its own template, so a draining predecessor keeps the
+                template its runners were built from until it is deleted.
             templates: Observed templates keyed by name.
 
         Returns:
@@ -440,7 +836,7 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
             is unavailable and no custom template already exists). Returning ``0``
             for a scaleset that previously had a custom template detaches it.
         """
-        custom_name = f"{SYSTEM_TEMPLATE_NAME}-{spec.name}"
+        custom_name = f"{SYSTEM_TEMPLATE_NAME}-{scaleset_name}"
         existing = templates.get(custom_name)
 
         if not spec.runner_config.has_config():
@@ -458,13 +854,13 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
                 logger.warning(
                     "System template %s not found; keeping existing custom template for %s",
                     SYSTEM_TEMPLATE_NAME,
-                    spec.name,
+                    scaleset_name,
                 )
                 return existing.id or 0
             logger.warning(
                 "System template %s not found; scaleset %s will use the default template",
                 SYSTEM_TEMPLATE_NAME,
-                spec.name,
+                scaleset_name,
             )
             return 0
 
@@ -474,7 +870,7 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
                 logger.warning(
                     "Runner template %s has no id; scaleset %s will use the default template",
                     custom_name,
-                    spec.name,
+                    scaleset_name,
                 )
                 return 0
             if self._template_bytes(existing) != new_data:
@@ -486,7 +882,7 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
         created = self._client.create_template(
             name=custom_name,
             data=new_data,
-            description=f"Runner template for scaleset {spec.name}",
+            description=f"Runner template for scaleset {scaleset_name}",
         )
         return created.id or 0
 
@@ -555,11 +951,12 @@ def _delete_custom_template(self, scaleset_name: str, templates: dict[str, Templ
                 )
 
     @staticmethod
-    def _to_create_params(spec: ScalesetSpec) -> CreateScaleSetParams:
+    def _to_create_params(spec: ScalesetSpec, scaleset_name: str) -> CreateScaleSetParams:
         """Build and validate CreateScaleSetParams from a ScalesetSpec.
 
         Args:
             spec: The desired scaleset specification.
+            scaleset_name: The live name to create the scaleset under.
 
         Returns:
             Validated CreateScaleSetParams ready for the GARM API.
@@ -569,7 +966,7 @@ def _to_create_params(spec: ScalesetSpec) -> CreateScaleSetParams:
         """
         return CreateScaleSetParams.model_validate(
             {
-                "name": spec.name,
+                "name": scaleset_name,
                 "provider_name": spec.provider_name,
                 "image": spec.image,
                 "flavor": spec.flavor,
@@ -588,29 +985,27 @@ def _to_create_params(spec: ScalesetSpec) -> CreateScaleSetParams:
     def _create(
         self,
         spec: ScalesetSpec,
+        scaleset_name: str,
         entity_id: str,
         params: CreateScaleSetParams,
         template_id: int,
     ) -> None:
         if template_id:
             params.template_id = template_id
-        logger.info("Creating scaleset %s under %s %s", spec.name, spec.entity_type, entity_id)
+        logger.info("Creating scaleset %s under %s %s", scaleset_name, spec.entity_type, entity_id)
         if spec.entity_type == "organization":
             self._client.create_org_scaleset(entity_id, params)
         else:
             self._client.create_repo_scaleset(entity_id, params)
 
     def _maybe_update(self, observed: ScaleSet, spec: ScalesetSpec, template_id: int) -> None:
-        observed_labels = sorted(t.name for t in (observed.tags or []) if t.name)
+        observed_labels = _observed_labels(observed)
         if observed_labels != sorted(spec.labels):
-            # UpdateScaleSetParams has no labels field; label changes require
-            # recreating the scaleset. To delete a scaleset, remove the
-            # garm-configurator relation for the corresponding unit.
             logger.warning(
-                "Scaleset %s labels changed (%s -> %s) but cannot be updated in place;"
-                " to apply label changes, remove and re-add the garm-configurator relation"
-                " for this unit",
-                spec.name,
+                "Scaleset %s carries labels %s but %s were expected; updating its other"
+                " fields anyway. Labels are immutable in GitHub — delete this scaleset"
+                " in GARM to let the charm recreate it with the expected labels.",
+                observed.name,
                 observed_labels,
                 sorted(spec.labels),
             )
@@ -620,12 +1015,12 @@ def _maybe_update(self, observed: ScaleSet, spec: ScalesetSpec, template_id: int
         # _needs_update already covers the template id (its last clause), so an
         # id change alone forces an update here.
         if not self._needs_update(observed, spec, template_id):
-            logger.debug("Scaleset %s is up to date", spec.name)
+            logger.debug("Scaleset %s is up to date", observed.name)
             return
 
         # UpdateScaleSetParams omits None fields (exclude_none), so None can only
         # leave extra_specs untouched, never clear them. Send an explicit empty
-        # dict when the desired specs are empty but the scaleset still carries
+        # dict when the desired extra specs are empty but the scaleset still carries
         # some (e.g. a proxy was unset) — otherwise a stale aproxy script would
         # persist and _needs_update would loop forever trying to converge.
         desired_extra = _effective_extra_specs(spec)
@@ -645,9 +1040,9 @@ def _maybe_update(self, observed: ScaleSet, spec: ScalesetSpec, template_id: int
         # unrelated update never spuriously sets the field.
         if template_id or observed_template_id:
             params.template_id = template_id
-        logger.info("Updating scaleset %s (id=%s)", spec.name, observed.id)
+        logger.info("Updating scaleset %s (id=%s)", observed.name, observed.id)
         if observed.id is None:
-            logger.warning("Scaleset %s has no id; skipping update", spec.name)
+            logger.warning("Scaleset %s has no id; skipping update", observed.name)
             return
         self._client.update_scaleset(observed.id, params)
 
@@ -672,6 +1067,110 @@ def _needs_update(observed: ScaleSet, spec: ScalesetSpec, template_id: int) -> b
         )
 
 
+def target_scaleset_name(logical_name: str, labels: list[str]) -> str:
+    """Return the live GARM name a spec's scaleset should have.
+
+    Args:
+        logical_name: The scaleset name the operator configured.
+        labels: The desired labels.
+
+    Returns:
+        ``<name>-<label hash>``. Only the labels feed the hash: every other spec
+        field is updatable in place and must not trigger a recreate.
+    """
+    digest = hashlib.sha256(",".join(sorted(labels)).encode("utf-8")).hexdigest()
+    return f"{_name_base(logical_name)}-{digest[:LABEL_HASH_LENGTH]}"
+
+
+def _name_base(logical_name: str) -> str:
+    """Return the part of a live scaleset name that precedes the label hash.
+
+    Args:
+        logical_name: The scaleset name the operator configured.
+
+    Returns:
+        The name itself when it fits, else a truncation ending in a hash of the full
+        name — two long names sharing a prefix would otherwise collapse onto one live
+        scaleset and fight over it on every reconcile.
+    """
+    limit = MAX_SCALESET_NAME_LENGTH - LABEL_HASH_LENGTH - 1
+    if len(logical_name) <= limit:
+        return logical_name
+    digest = hashlib.sha256(logical_name.encode("utf-8")).hexdigest()[:LABEL_HASH_LENGTH]
+    return f"{logical_name[: limit - LABEL_HASH_LENGTH - 1]}-{digest}"
+
+
+def _is_family_member(observed_name: str, logical_name: str) -> bool:
+    """Return whether a live scaleset is a generation of *logical_name*.
+
+    Args:
+        observed_name: The live scaleset name.
+        logical_name: The configured scaleset name.
+
+    Returns:
+        True for a hash-suffixed generation, and for the bare *logical_name* itself —
+        scalesets created before label-hashed naming carry the un-suffixed name.
+    """
+    if observed_name == logical_name:
+        return True
+    return bool(_family_pattern(logical_name).match(observed_name))
+
+
+def _family_pattern(logical_name: str) -> re.Pattern[str]:
+    """Return the regex matching every generation of *logical_name*."""
+    return re.compile(rf"^{re.escape(_name_base(logical_name))}-[0-9a-f]{{{LABEL_HASH_LENGTH}}}$")
+
+
+def _resolve_active_name(spec: ScalesetSpec, observed: dict[str, ScaleSet]) -> str:
+    """Return the live name of the generation that should serve *spec*.
+
+    Args:
+        spec: The desired scaleset.
+        observed: Observed scalesets keyed by name.
+
+    Returns:
+        The label-hashed target name, except when that name does not exist yet and a
+        legacy un-suffixed scaleset already carries exactly the desired labels — that
+        one is adopted in place, so upgrading the charm doesn't recreate scalesets
+        that are already correct.
+    """
+    target = target_scaleset_name(spec.name, spec.labels)
+    if target in observed:
+        return target
+    legacy = observed.get(spec.name)
+    if legacy is not None and _observed_labels(legacy) == sorted(spec.labels):
+        return spec.name
+    return target
+
+
+def _observed_labels(scaleset: ScaleSet) -> list[str]:
+    """Return a scaleset's labels, sorted, for comparison against a spec."""
+    return sorted(tag.name for tag in (scaleset.tags or []) if tag.name)
+
+
+def _drain_deadline_passed(scaleset: ScaleSet) -> bool:
+    """Return whether a retired scaleset has been draining longer than any job can last.
+
+    Args:
+        scaleset: The retired scaleset.
+
+    Returns:
+        True once ``DRAIN_DEADLINE`` has elapsed since GARM last wrote the scaleset —
+        which, for a retired one, is the moment it was disabled: the only writes to that
+        row while it drains would come from the listener's message handler
+        (``SetScaleSetLastMessageID`` / ``SetScaleSetDesiredRunnerCount``), and disabling
+        stopped the listener. ``handleAutoScale`` keeps running but writes instances, a
+        separate table. False when GARM reports no timestamp: an unknown drain age must
+        never read as an expired one.
+    """
+    retired_at = scaleset.updated_at
+    if retired_at is None:
+        return False
+    if retired_at.tzinfo is None:
+        retired_at = retired_at.replace(tzinfo=timezone.utc)
+    return datetime.now(timezone.utc) - retired_at > DRAIN_DEADLINE
+
+
 def _is_running_job(instance: Instance) -> bool:
     """Return whether a runner is currently executing a workflow job.
 
diff --git a/charms/garm/tests/unit/test_charm.py b/charms/garm/tests/unit/test_charm.py
index 0922a4cf..615853e6 100644
--- a/charms/garm/tests/unit/test_charm.py
+++ b/charms/garm/tests/unit/test_charm.py
@@ -39,6 +39,7 @@
     MANAGED_CREDENTIAL_DESCRIPTION,
     CredentialSpec,
 )
+from scaleset_reconciler import Handover, ScalesetProgress
 
 MODEL_NAME = "garm-model"
 CONTAINER_NAME = "app"
@@ -144,6 +145,8 @@ def garm_api_fixture() -> typing.Iterator[_GarmApiMocks]:
         patch("charm._apply_garm_template", return_value=_TEMPLATE_ID) as apply_template,
     ):
         auth_client = auth_cls.from_login.return_value
+        # No scaleset is mid-replacement by default, so the charm reports active.
+        scaleset_cls.return_value.reconcile.return_value = []
         calls = MagicMock()
         calls.attach_mock(auth_client.update_controller, "controller")
         calls.attach_mock(github_cls.return_value.reconcile, "github")
@@ -642,6 +645,151 @@ def test_missing_configurator_relation_refreshes_stale_app_status(
     assert out.app_status == ops.WaitingStatus("Waiting for garm-configurator relation")
 
 
+# --- Scaleset replacement progress --------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "progress, expected",
+    [
+        (
+            ScalesetProgress("my-scaleset", "my-scaleset-1a2b3c4d", "my-scaleset-5e6f7a8b", 3),
+            "Replacing scaleset my-scaleset -> my-scaleset-5e6f7a8b (draining 3 runners)",
+        ),
+        (
+            ScalesetProgress("my-scaleset", "my-scaleset-1a2b3c4d", "my-scaleset-5e6f7a8b", 1),
+            "Replacing scaleset my-scaleset -> my-scaleset-5e6f7a8b (draining 1 runner)",
+        ),
+        (
+            ScalesetProgress(
+                "my-scaleset",
+                "my-scaleset-1a2b3c4d",
+                "my-scaleset-5e6f7a8b",
+                0,
+                Handover.PENDING,
+            ),
+            "Replacing scaleset my-scaleset -> my-scaleset-5e6f7a8b (creating replacement)",
+        ),
+        (
+            ScalesetProgress(
+                "my-scaleset",
+                "my-scaleset-1a2b3c4d",
+                "my-scaleset-5e6f7a8b",
+                0,
+                Handover.FAILED,
+            ),
+            "Replacing scaleset my-scaleset -> my-scaleset-5e6f7a8b (retiring predecessor)",
+        ),
+        (
+            ScalesetProgress("my-scaleset", "my-scaleset-1a2b3c4d", "my-scaleset-5e6f7a8b", 0),
+            "Replacing scaleset my-scaleset -> my-scaleset-5e6f7a8b (awaiting deletion)",
+        ),
+    ],
+    ids=[
+        "draining",
+        "single-runner",
+        "before-handover",
+        "failed-handover",
+        "drained-not-yet-deleted",
+    ],
+)
+def test_scaleset_being_replaced_is_reported_in_the_status(
+    ctx: Context, garm_api: _GarmApiMocks, progress: ScalesetProgress, expected: str
+):
+    """
+    arrange: A ready charm whose scaleset reconcile reports a replacement in flight, at each
+        phase it can be in.
+    act: Run update-status.
+    assert: The unit names the scaleset by the name the operator configured and reports the
+        phase, so a long drain can be told apart from a stuck charm — and a replacement that
+        has not been created yet does not read as a finished drain. The status stays active
+        throughout: every label is served during the drain, so nothing waiting on the model
+        should block on it.
+    """
+    garm_api.scaleset.return_value.reconcile.return_value = [progress]
+
+    out = ctx.run(ctx.on.update_status(), _state())
+
+    assert out.unit_status == ops.ActiveStatus(expected)
+
+
+def test_many_scalesets_being_replaced_are_summarised(ctx: Context, garm_api: _GarmApiMocks):
+    """
+    arrange: A ready charm replacing four scalesets at once.
+    act: Run update-status.
+    assert: Only the first two are named and the rest are counted, so Juju does not truncate
+        the status into uselessness.
+    """
+    garm_api.scaleset.return_value.reconcile.return_value = [
+        ScalesetProgress(f"scaleset-{index}", f"old-{index}", f"new-{index}", index)
+        for index in range(1, 5)
+    ]
+
+    out = ctx.run(ctx.on.update_status(), _state())
+
+    assert out.unit_status == ops.ActiveStatus(
+        "Replacing scaleset scaleset-1 -> new-1 (draining 1 runner),"
+        " scaleset-2 -> new-2 (draining 2 runners), +2 more"
+    )
+
+
+def test_two_generations_of_one_scaleset_are_reported_as_one_replacement(
+    ctx: Context, garm_api: _GarmApiMocks
+):
+    """
+    arrange: A ready charm where one scaleset is draining two predecessors at once (its labels
+        changed again mid-drain) while a second scaleset is also being replaced.
+    act: Run update-status.
+    assert: The doubly-draining scaleset is named once, with its runner counts summed, so it
+        cannot repeat itself and push the other scaleset behind "+N more".
+    """
+    garm_api.scaleset.return_value.reconcile.return_value = [
+        ScalesetProgress("scaleset-a", "old-a1", "new-a", 2),
+        ScalesetProgress("scaleset-a", "old-a2", "new-a", 1),
+        ScalesetProgress("scaleset-b", "old-b", "new-b", 1),
+    ]
+
+    out = ctx.run(ctx.on.update_status(), _state())
+
+    assert out.unit_status == ops.ActiveStatus(
+        "Replacing scaleset scaleset-a -> new-a (draining 3 runners),"
+        " scaleset-b -> new-b (draining 1 runner)"
+    )
+
+
+def test_a_scaleset_reports_its_least_advanced_generation(ctx: Context, garm_api: _GarmApiMocks):
+    """
+    arrange: A ready charm where one scaleset has one drained predecessor and one whose
+        hand-over has not happened yet.
+    act: Run update-status.
+    assert: The unfinished hand-over is what is reported: the changeover is only as far along
+        as its least advanced generation, and a summed runner count of zero would otherwise
+        read as fully drained.
+    """
+    garm_api.scaleset.return_value.reconcile.return_value = [
+        ScalesetProgress("scaleset-a", "old-a1", "new-a", 0),
+        ScalesetProgress("scaleset-a", "old-a2", "new-a", 0, Handover.PENDING),
+    ]
+
+    out = ctx.run(ctx.on.update_status(), _state())
+
+    assert out.unit_status == ops.ActiveStatus(
+        "Replacing scaleset scaleset-a -> new-a (creating replacement)"
+    )
+
+
+def test_status_returns_to_active_once_the_replacement_is_complete(
+    ctx: Context, garm_api: _GarmApiMocks
+):
+    """
+    arrange: A ready charm whose scaleset reconcile reports nothing draining.
+    act: Run update-status.
+    assert: The unit is active — the replacement converged without operator intervention.
+    """
+    out = ctx.run(ctx.on.update_status(), _state())
+
+    assert out.unit_status == ops.ActiveStatus()
+
+
 # --- First-run initialisation -------------------------------------------------------------
 
 
diff --git a/charms/garm/tests/unit/test_scaleset_reconciler.py b/charms/garm/tests/unit/test_scaleset_reconciler.py
index 0274e5fa..b0d95faf 100644
--- a/charms/garm/tests/unit/test_scaleset_reconciler.py
+++ b/charms/garm/tests/unit/test_scaleset_reconciler.py
@@ -13,7 +13,16 @@
 from garm_api import GarmApiError, GarmConnectionError, GarmNotFoundError, GarmUnauthorizedError
 from garm_client.models.template import Template
 from runner_template import build_template_data
-from scaleset_reconciler import ScalesetReconciler, ScalesetSpec, _effective_extra_specs
+from scaleset_reconciler import (
+    DRAIN_DEADLINE,
+    MAX_SCALESET_NAME_LENGTH,
+    Handover,
+    ScalesetProgress,
+    ScalesetReconciler,
+    ScalesetSpec,
+    _effective_extra_specs,
+    target_scaleset_name,
+)
 
 
 class _FakeProvider:
@@ -40,6 +49,7 @@ def __init__(
         tags=None,
         template_id=None,
         enabled=True,
+        updated_at=None,
     ):
         self.name = name
         self.id = sid
@@ -51,7 +61,14 @@ def __init__(
         self.extra_specs = extra_specs or {}
         self.tags = [_FakeTag(t) for t in (tags or [])]
         self.template_id = template_id
-        self.enabled = enabled
+        # GARM tags Enabled `omitempty` and has no custom marshaller, so a disabled
+        # scaleset arrives with no `enabled` key at all and the generated client reads
+        # it back as None — `False` is a shape the API never returns. Model the wire,
+        # or the whole retirement half of this suite passes against a fiction.
+        self.enabled = True if enabled else None
+        # GARM stamps this on every write, so for a retired scaleset it is the
+        # moment it was disabled — which is what the drain deadline measures from.
+        self.updated_at = updated_at or datetime.now(timezone.utc)
 
 
 class _FakeJob:
@@ -81,6 +98,21 @@ def __init__(
         self.job = _FakeJob(job_status, job_updated_at) if job_status is not None else None
 
 
+def _fake_instances(names):
+    """Build the fake runner instances a scaleset owns.
+
+    Args:
+        names: Either a count, for runners whose identity the test does not care
+            about, or one name or kwargs dict per runner.
+
+    Returns:
+        The fake instances.
+    """
+    if isinstance(names, int):
+        return [_FakeInstance(f"runner-{i}") for i in range(names)]
+    return [_FakeInstance(**i) if isinstance(i, dict) else _FakeInstance(i) for i in names]
+
+
 class FakeGarmClient:
     """In-memory fake for GarmAuthenticatedClient.
 
@@ -95,6 +127,7 @@ def __init__(
         org_id="org-uuid",
         repo_id=None,
         instances=None,
+        reject_zero_max_runners=False,
         delete_instance_error=None,
         bypass_delete_error=None,
         update_scaleset_error=None,
@@ -113,15 +146,16 @@ def __init__(
                 tags=ss.get("tags", []),
                 template_id=ss.get("template_id", None),
                 enabled=ss.get("enabled", True),
+                updated_at=ss.get("updated_at", None),
             )
             for ss in (scalesets or [])
         ]
         self._org_id = org_id
         self._repo_id = repo_id
-        self._instances = {
-            sid: [_FakeInstance(**i) if isinstance(i, dict) else _FakeInstance(i) for i in names]
-            for sid, names in (instances or {}).items()
-        }
+        # Runners per scaleset id, so a draining scaleset can be modelled. An int
+        # stands for that many runners whose identity the test does not care about.
+        self._instances = {sid: _fake_instances(names) for sid, names in (instances or {}).items()}
+        self.reject_zero_max_runners = reject_zero_max_runners
         self._delete_instance_error = delete_instance_error
         self._bypass_delete_error = bypass_delete_error
         self._update_scaleset_error = update_scaleset_error
@@ -149,6 +183,10 @@ def create_repo_scaleset(self, repo_id, params):
         self.created.append(("repo", repo_id, params))
 
     def update_scaleset(self, scaleset_id, params):
+        # Models a GARM that rejects max_runners=0 on update. Today's GARM does not
+        # (see _retire), so this only exercises the reconciler's defensive fallback.
+        if self.reject_zero_max_runners and params.max_runners == 0:
+            raise GarmApiError("max_runners must be greater than 0")
         if self._update_scaleset_error is not None:
             raise self._update_scaleset_error
         self.updated.append((scaleset_id, params))
@@ -185,6 +223,10 @@ def delete_template(self, template_id):
         pass
 
 
+# The custom runner template of the scaleset `_existing_scaleset()` builds.
+_DEFAULT_TEMPLATE_NAME = f"github_linux-{target_scaleset_name('my-scaleset', [])}"
+
+
 def _spec(
     name="my-scaleset",
     provider_name="openstack-demo",
@@ -220,7 +262,7 @@ def _spec(
 
 
 def _reconcile(client, desired):
-    ScalesetReconciler(client).reconcile(desired)
+    return ScalesetReconciler(client).reconcile(desired)
 
 
 @pytest.mark.parametrize(
@@ -249,7 +291,7 @@ def test_create_scaleset(entity_type, entity_name, create_key, expected_entity_i
     kind, entity_id, params = client.created[0]
     assert kind == create_key
     assert entity_id == expected_entity_id
-    assert params.name == "my-scaleset"
+    assert params.name == target_scaleset_name("my-scaleset", [])
     assert params.image == "ubuntu-22.04"
     assert params.flavor == "m1.small"
     assert params.enabled is True
@@ -280,8 +322,19 @@ def test_create_deferred_when_dependency_missing(providers, org_id):
 
 
 def _existing_scaleset(**overrides):
+    """Build a live scaleset of the current, label-hashed generation.
+
+    Args:
+        overrides: Fields to set instead of the defaults. Pass the bare logical name
+            to model a scaleset created before label-hashed naming.
+
+    Returns:
+        The fake scaleset.
+    """
     base = dict(
-        name="my-scaleset",
+        # The name the default `_spec()` targets, so a default pairing exercises the
+        # current generation rather than the legacy-adoption path.
+        name=target_scaleset_name("my-scaleset", []),
         id=1,
         image="ubuntu-22.04",
         flavor="m1.small",
@@ -381,6 +434,54 @@ def test_delete_orphaned_scaleset():
     assert client.deleted == [42]
 
 
+def test_orphan_template_outlives_a_failed_orphan_delete():
+    """
+    arrange: An orphaned scaleset with a custom template, whose deletion GARM rejects.
+    act: Reconcile a different desired scaleset.
+    assert: Its template is kept — the scaleset still exists and its runners were built
+        from that template, and the next reconcile's retry still needs it.
+    """
+
+    class _DeleteFailingClient(_TemplateTrackingClient):
+        def delete_scaleset(self, scaleset_id):
+            raise GarmApiError("scaleset still has runners")
+
+    client = _DeleteFailingClient(
+        providers=["openstack-demo"],
+        scalesets=[_existing_scaleset(name="stale-scaleset", id=42, template_id=2)],
+        templates=[
+            _SYSTEM_TEMPLATE,
+            _FakeTemplate("github_linux-stale-scaleset", tid=2, data=b"x"),
+        ],
+    )
+
+    _reconcile(client, [_spec(name="new-scaleset")])
+
+    assert client.deleted == []
+    assert client.deleted_templates == []
+
+
+def test_a_connection_error_during_the_orphan_sweep_is_not_reported_as_converged():
+    """
+    arrange: An orphaned scaleset and a GARM that has become unreachable.
+    act: Reconcile a different desired scaleset.
+    assert: The error propagates rather than being contained per-scaleset, so the charm
+        reports the outage instead of an orphan sweep that appears to have finished.
+    """
+
+    class _UnreachableClient(FakeGarmClient):
+        def update_scaleset(self, scaleset_id, params):
+            raise GarmConnectionError("connection refused")
+
+    client = _UnreachableClient(
+        providers=["openstack-demo"],
+        scalesets=[_existing_scaleset(name="stale-scaleset", id=42)],
+    )
+
+    with pytest.raises(GarmConnectionError):
+        _reconcile(client, [_spec(name="new-scaleset")])
+
+
 @pytest.mark.parametrize(
     "error",
     [GarmApiError("500 Server error"), GarmUnauthorizedError("401 Unauthorized")],
@@ -1156,7 +1257,7 @@ def test_template_created_when_runner_config_set():
 
     assert len(client.created_templates) == 1
     name, data, _ = client.created_templates[0]
-    assert name == "github_linux-my-scaleset"
+    assert name == f"github_linux-{target_scaleset_name('my-scaleset', [])}"
     assert b"registry-mirrors" in data
     assert len(client.created) == 1
     _, _, params = client.created[0]
@@ -1237,7 +1338,7 @@ def test_template_updated_when_runner_config_changes():
 
     old_config = RunnerConfig(dockerhub_mirror="https://old.example.com")
     custom_template = _FakeTemplate(
-        "github_linux-my-scaleset",
+        _DEFAULT_TEMPLATE_NAME,
         tid=2,
         data=build_template_data(b"#!/bin/bash\nset -e\necho base\n", old_config),
     )
@@ -1271,9 +1372,7 @@ def test_template_detached_when_runner_config_cleared():
         scalesets=[_existing_scaleset(template_id=2)],
         templates=[
             _SYSTEM_TEMPLATE,
-            _FakeTemplate(
-                "github_linux-my-scaleset", tid=2, data=b"#!/bin/bash\nset -e\necho x\n"
-            ),
+            _FakeTemplate(_DEFAULT_TEMPLATE_NAME, tid=2, data=b"#!/bin/bash\nset -e\necho x\n"),
         ],
     )
     _reconcile(client, [_spec()])
@@ -1294,9 +1393,7 @@ def test_template_kept_when_system_template_missing():
         providers=["openstack-demo"],
         scalesets=[_existing_scaleset(template_id=2)],
         templates=[
-            _FakeTemplate(
-                "github_linux-my-scaleset", tid=2, data=b"#!/bin/bash\nset -e\necho x\n"
-            ),
+            _FakeTemplate(_DEFAULT_TEMPLATE_NAME, tid=2, data=b"#!/bin/bash\nset -e\necho x\n"),
         ],
     )
     _reconcile(
@@ -1320,7 +1417,7 @@ def test_template_with_missing_id_is_not_updated():
         scalesets=[_existing_scaleset(template_id=2)],
         templates=[
             _SYSTEM_TEMPLATE,
-            _FakeTemplate("github_linux-my-scaleset", tid=None, data=b"stale"),
+            _FakeTemplate(_DEFAULT_TEMPLATE_NAME, tid=None, data=b"stale"),
         ],
     )
     _reconcile(
@@ -1365,3 +1462,662 @@ def test_delete_custom_template_skips_missing_id_and_api_errors():
         templates=[_FakeTemplate("github_linux-stale", tid=7, data=b"x")],
     )
     _reconcile(failing_client, [])
+
+
+# A label change is applied by replacement (docs/adr/003); "generation" below means
+# one live scaleset of a logical spec.
+_LABELS_OLD = ["jammy", "x64"]
+_LABELS_NEW = ["jammy", "arm64"]
+_OLD_NAME = target_scaleset_name("my-scaleset", _LABELS_OLD)
+_NEW_NAME = target_scaleset_name("my-scaleset", _LABELS_NEW)
+
+
+def _generation(labels, **overrides):
+    """An existing scaleset named and tagged as the reconciler would have created it."""
+    base = _existing_scaleset(
+        name=target_scaleset_name("my-scaleset", labels), tags=sorted(labels)
+    )
+    base.update(overrides)
+    return base
+
+
+def test_create_uses_label_hashed_name():
+    """
+    arrange: FakeGarmClient with the provider registered and no existing scalesets.
+    act: Reconcile a spec carrying labels.
+    assert: The scaleset is created under the label-hashed name, so a later label change
+        resolves to a different name and can be applied by replacement.
+    """
+    client = FakeGarmClient(providers=["openstack-demo"], scalesets=[])
+
+    _reconcile(client, [_spec(labels=_LABELS_OLD)])
+
+    assert len(client.created) == 1
+    _, _, params = client.created[0]
+    assert params.name == _OLD_NAME
+    assert params.labels == sorted(_LABELS_OLD)
+
+
+def test_legacy_unsuffixed_scaleset_adopted_when_labels_match():
+    """
+    arrange: A scaleset carrying the pre-hash un-suffixed name, with the desired labels.
+    act: Reconcile the matching spec.
+    assert: It is adopted in place — upgrading the charm must not churn scalesets that
+        are already serving the right labels.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_existing_scaleset(name="my-scaleset", tags=sorted(_LABELS_OLD))],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_OLD)])
+
+    assert client.created == []
+    assert client.deleted == []
+    assert progress == []
+
+
+def test_label_change_creates_replacement_without_disabling_the_old_one():
+    """
+    arrange: One live scaleset serving the old labels.
+    act: Reconcile a spec whose labels changed.
+    assert: The replacement is created and the old scaleset is left enabled, so jobs keep
+        being served until the replacement actually exists.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1)],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert len(client.created) == 1
+    _, _, params = client.created[0]
+    assert params.name == _NEW_NAME
+    assert client.updated == []
+    assert client.deleted == []
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 0, Handover.PENDING)]
+
+
+def test_cutover_disables_and_zeroes_the_old_scaleset():
+    """
+    arrange: Both generations live, the replacement already enabled.
+    act: Reconcile.
+    assert: Only the old scaleset is disabled and zeroed — disabling closes its listener
+        session, which is what hands the shared labels to the replacement.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1), _generation(_LABELS_NEW, id=2)],
+        instances={1: 3},
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.created == []
+    assert client.deleted == []
+    assert len(client.updated) == 1
+    scaleset_id, params = client.updated[0]
+    assert scaleset_id == 1
+    assert params.enabled is False
+    assert params.min_idle_runners == 0
+    assert params.max_runners == 0
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 3)]
+
+
+def test_cutover_falls_back_when_zeroing_max_runners_is_rejected():
+    """
+    arrange: Both generations live and a hypothetical GARM refuses max_runners=0 on
+        update, which today's GARM accepts.
+    act: Reconcile.
+    assert: The scaleset is still disabled, so the handover happens even though the
+        runner counts could not be zeroed.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1), _generation(_LABELS_NEW, id=2)],
+        reject_zero_max_runners=True,
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert len(client.updated) == 1
+    scaleset_id, params = client.updated[0]
+    assert scaleset_id == 1
+    assert params.enabled is False
+    assert params.max_runners is None
+
+
+def test_a_refused_cutover_is_not_reported_as_a_drain():
+    """
+    arrange: Both generations live, and GARM refuses to disable the old one.
+    act: Reconcile.
+    assert: The stalled hand-over is reported instead of a runner count: the predecessor
+        is still enabled, so nothing is draining and a plausible "draining N runners"
+        would hide a changeover that is not advancing (and is running both generations'
+        idle runners meanwhile).
+    """
+
+    class _DisableFailsClient(FakeGarmClient):
+        def update_scaleset(self, scaleset_id, params):
+            raise GarmApiError("scaleset is locked")
+
+    client = _DisableFailsClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1), _generation(_LABELS_NEW, id=2)],
+        instances={1: 3},
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 0, Handover.FAILED)]
+
+
+def test_draining_scaleset_is_not_deleted_while_runners_remain():
+    """
+    arrange: The old generation is already disabled and still has runners.
+    act: Reconcile.
+    assert: It is not deleted, so jobs already running on it can finish; the remaining
+        count is reported so the charm can show progress.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        instances={1: 2},
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 2)]
+
+
+def test_drained_scaleset_is_deleted_with_its_template():
+    """
+    arrange: The old generation is disabled with no runners left, and owns a template.
+    act: Reconcile.
+    assert: Both the scaleset and its template are deleted and nothing is left draining,
+        so no idle scaleset lingers on GitHub.
+    """
+    client = _TemplateTrackingClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False, template_id=2),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        templates=[_SYSTEM_TEMPLATE, _FakeTemplate(f"github_linux-{_OLD_NAME}", tid=2, data=b"x")],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == [1]
+    assert client.deleted_templates == [2]
+    assert progress == []
+
+
+def test_retiring_generation_is_not_treated_as_an_orphan():
+    """
+    arrange: Both generations live while the spec still exists.
+    act: Reconcile.
+    assert: The old generation is disabled rather than deleted outright — the orphan pass
+        must not shortcut the drain and kill runners mid-job.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1), _generation(_LABELS_NEW, id=2)],
+        instances={1: 1},
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+
+
+def test_every_generation_is_deleted_when_the_spec_is_removed():
+    """
+    arrange: Two generations live and no desired specs at all.
+    act: Reconcile.
+    assert: Both are disabled and deleted — removing the relation must not leave a
+        generation behind.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1), _generation(_LABELS_NEW, id=2)],
+    )
+
+    _reconcile(client, [])
+
+    assert sorted(client.deleted) == [1, 2]
+
+
+def test_label_revert_re_adopts_the_draining_scaleset():
+    """
+    arrange: The old generation is disabled and draining, the new one is live.
+    act: Reconcile a spec whose labels are reverted to the old ones.
+    assert: The disabled scaleset is re-enabled and no third scaleset is created — its
+        name is again the target name, so it is simply adopted back.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_OLD)])
+
+    assert client.created == []
+    scaleset_id, params = client.updated[0]
+    assert scaleset_id == 1
+    assert params.enabled is True
+
+
+def test_two_label_changes_retire_both_older_generations():
+    """
+    arrange: Three generations live: two superseded ones and the current one.
+    act: Reconcile the spec for the newest labels.
+    assert: Both older generations are disabled independently — a second label change
+        mid-drain must not strand the first one.
+    """
+    labels_newest = ["jammy", "s390x"]
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1),
+            _generation(_LABELS_NEW, id=2),
+            _generation(labels_newest, id=3),
+        ],
+        instances={1: 1, 2: 1},
+    )
+
+    progress = _reconcile(client, [_spec(labels=labels_newest)])
+
+    assert sorted(scaleset_id for scaleset_id, _ in client.updated) == [1, 2]
+    assert all(params.enabled is False for _, params in client.updated)
+    assert len(progress) == 2
+
+
+def test_a_similarly_named_scaleset_is_not_claimed_as_a_generation():
+    """
+    arrange: Two specs whose names differ only by something that looks like a hash suffix.
+    act: Reconcile both.
+    assert: Neither scaleset is disabled or deleted, so one spec cannot retire the other's
+        scaleset just because the names overlap.
+    """
+    sibling = "my-scaleset-1a2b3c4d"
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _existing_scaleset(name=target_scaleset_name("my-scaleset", []), id=1),
+            _existing_scaleset(name=target_scaleset_name(sibling, []), id=2),
+        ],
+    )
+
+    progress = _reconcile(client, [_spec(), _spec(name=sibling)])
+
+    assert client.created == []
+    assert client.deleted == []
+    assert progress == []
+
+
+def test_unexpected_labels_do_not_freeze_the_other_fields():
+    """
+    arrange: The target-named scaleset exists but carries labels that don't match the spec
+        (GARM normalised the tags, a hash collision, or a hand-edited scaleset), and its
+        image is stale.
+    act: Reconcile a spec that needs an image update.
+    assert: The image is still updated — labels cannot be fixed by an update, so refusing
+        to update would freeze every unrelated field for as long as the mismatch lasts.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _existing_scaleset(
+                name=target_scaleset_name("my-scaleset", _LABELS_NEW),
+                tags=["something", "else"],
+                image="ubuntu-20.04",
+            )
+        ],
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert len(client.updated) == 1
+    assert client.updated[0][1].image == "ubuntu-22.04"
+
+
+def test_long_names_sharing_a_prefix_get_distinct_scalesets():
+    """
+    arrange: Two specs whose names are too long for a scaleset name and share a prefix,
+        with identical labels.
+    act: Reconcile both.
+    assert: Two scalesets are created under distinct names — truncating to a shared prefix
+        would collapse them onto one scaleset that both specs then fight over.
+    """
+    prefix = "a" * MAX_SCALESET_NAME_LENGTH
+    client = FakeGarmClient(providers=["openstack-demo"], scalesets=[])
+
+    _reconcile(client, [_spec(name=f"{prefix}-one"), _spec(name=f"{prefix}-two")])
+
+    created_names = [params.name for _, _, params in client.created]
+    assert len(set(created_names)) == 2
+    assert all(len(name) <= MAX_SCALESET_NAME_LENGTH for name in created_names)
+
+
+def test_drained_scaleset_survives_an_unreadable_runner_count():
+    """
+    arrange: The old generation is disabled and its instance listing fails.
+    act: Reconcile.
+    assert: It is not deleted — an unknown runner count must never be mistaken for a
+        drained scaleset and take live runners down with it.
+    """
+
+    class _InstanceListingFailsClient(FakeGarmClient):
+        def list_scale_set_instances(self, scaleset_id):
+            raise GarmApiError("boom")
+
+    client = _InstanceListingFailsClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 1)]
+
+
+def test_template_outlives_a_failed_scaleset_delete():
+    """
+    arrange: The old generation is drained but GARM rejects its deletion.
+    act: Reconcile.
+    assert: Its template is kept — deleting the template of a scaleset that still exists
+        would strip the runner config the next delete attempt still relies on.
+    """
+
+    class _DeleteFailingClient(_TemplateTrackingClient):
+        def delete_scaleset(self, scaleset_id):
+            raise GarmApiError("scaleset still has runners")
+
+    client = _DeleteFailingClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False, template_id=2),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        templates=[_SYSTEM_TEMPLATE, _FakeTemplate(f"github_linux-{_OLD_NAME}", tid=2, data=b"x")],
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+    assert client.deleted_templates == []
+
+
+def test_failed_delete_keeps_the_replacement_reported_as_unfinished():
+    """
+    arrange: The old generation is drained but GARM rejects its deletion.
+    act: Reconcile.
+    assert: It is still reported as in flight — a scaleset GARM refused to delete is
+        still on GitHub, so reporting the charm as converged would hide it.
+    """
+
+    class _DeleteFailingClient(FakeGarmClient):
+        def delete_scaleset(self, scaleset_id):
+            raise GarmApiError("scaleset still has runners")
+
+    client = _DeleteFailingClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 0)]
+
+
+def test_drain_past_the_deadline_stops_waiting_on_the_runner_count():
+    """
+    arrange: The old generation was disabled longer ago than any job can run, and still
+        reports a runner (one stuck in a provider-side failure GARM never reaped).
+    act: Reconcile.
+    assert: The delete is attempted anyway, so a permanently faulted instance cannot pin
+        a dead scaleset on GitHub forever; GARM itself rejects the call while runners are
+        genuinely active, so no in-flight job is cut short.
+    """
+    long_ago = datetime.now(timezone.utc) - DRAIN_DEADLINE * 2
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False, updated_at=long_ago),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        instances={1: 1},
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == [1]
+    assert progress == []
+
+
+def test_drain_within_the_deadline_still_waits_for_the_runners():
+    """
+    arrange: The old generation was disabled recently and still has a runner.
+    act: Reconcile.
+    assert: It is not deleted — the deadline is a backstop for stuck instances, and must
+        not shorten a normal drain and cut a running job short.
+    """
+    recently = datetime.now(timezone.utc) - DRAIN_DEADLINE / 2
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False, updated_at=recently),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        instances={1: 1},
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 1)]
+
+
+@pytest.mark.parametrize(
+    "updated_at",
+    [
+        None,
+        # Naive, and far enough back that no timezone offset can bring it inside the
+        # deadline — the point is that it is read as a timestamp at all, not crashed on.
+        datetime.now() - timedelta(days=30),
+    ],
+    ids=["no-timestamp", "naive-timestamp"],
+)
+def test_drain_deadline_handles_an_unusable_timestamp(updated_at):
+    """
+    arrange: The old generation is draining and GARM reports no update timestamp, or a
+        naive one (no timezone).
+    act: Reconcile.
+    assert: Neither crashes: a missing timestamp keeps waiting rather than reading as an
+        expired deadline, and a naive one is read as UTC.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        instances={1: 1},
+    )
+    client._scalesets[0].updated_at = updated_at
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == ([] if updated_at is None else [1])
+
+
+def test_a_failing_spec_does_not_wedge_the_others():
+    """
+    arrange: Two specs, the first of which GARM refuses to create.
+    act: Reconcile.
+    assert: The second is still created and the failure is re-raised, so one bad spec
+        cannot freeze every other scaleset while the charm still reports the sync failed.
+    """
+
+    class _FirstCreateFailsClient(FakeGarmClient):
+        def create_org_scaleset(self, org_id, params):
+            if params.name.startswith("bad-"):
+                raise GarmApiError("labels rejected")
+            super().create_org_scaleset(org_id, params)
+
+    client = _FirstCreateFailsClient(providers=["openstack-demo"], scalesets=[])
+
+    with pytest.raises(GarmApiError):
+        _reconcile(client, [_spec(name="bad-scaleset"), _spec(name="good-scaleset")])
+
+    assert [params.name for _, _, params in client.created] == [
+        target_scaleset_name("good-scaleset", [])
+    ]
+
+
+def test_a_failing_spec_does_not_hand_its_scalesets_to_the_orphan_pass():
+    """
+    arrange: A spec whose update GARM rejects, with its scaleset already live.
+    act: Reconcile.
+    assert: The scaleset is not deleted — a transient API failure must never be read as
+        "this scaleset is no longer wanted".
+    """
+
+    class _UpdateFailsClient(FakeGarmClient):
+        def update_scaleset(self, scaleset_id, params):
+            raise GarmApiError("boom")
+
+    client = _UpdateFailsClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1, image="ubuntu-20.04")],
+    )
+
+    with pytest.raises(GarmApiError):
+        _reconcile(client, [_spec(labels=_LABELS_OLD)])
+
+    assert client.deleted == []
+
+
+def test_a_connection_error_aborts_the_pass_immediately():
+    """
+    arrange: Two specs and a GARM that is unreachable.
+    act: Reconcile.
+    assert: The error propagates without attempting the second spec — GARM is down, so
+        retrying every remaining spec would only stall the hook.
+    """
+
+    class _UnreachableClient(FakeGarmClient):
+        def __init__(self, **kwargs):
+            super().__init__(**kwargs)
+            self.attempts = 0
+
+        def create_org_scaleset(self, org_id, params):
+            self.attempts += 1
+            raise GarmConnectionError("connection refused")
+
+    client = _UnreachableClient(providers=["openstack-demo"], scalesets=[])
+
+    with pytest.raises(GarmConnectionError):
+        _reconcile(client, [_spec(name="one"), _spec(name="two")])
+
+    assert client.attempts == 1
+
+
+class _UnreachableWhenRetiring(FakeGarmClient):
+    def update_scaleset(self, scaleset_id, params):
+        raise GarmConnectionError("connection refused")
+
+
+class _UnreachableWhenCounting(FakeGarmClient):
+    def list_scale_set_instances(self, scaleset_id):
+        raise GarmConnectionError("connection refused")
+
+
+class _UnreachableWhenDeleting(FakeGarmClient):
+    def delete_scaleset(self, scaleset_id):
+        raise GarmConnectionError("connection refused")
+
+
+@pytest.mark.parametrize(
+    "client_class, old_enabled",
+    [
+        (_UnreachableWhenRetiring, True),
+        (_UnreachableWhenCounting, False),
+        (_UnreachableWhenDeleting, False),
+    ],
+    ids=["retiring", "counting-runners", "deleting"],
+)
+def test_a_connection_error_during_a_drain_is_not_reported_as_progress(client_class, old_enabled):
+    """
+    arrange: A generation being retired or already draining, and a GARM that is unreachable
+        at each of the three calls the drain makes.
+    act: Reconcile.
+    assert: The error propagates rather than being contained as a per-scaleset failure, so
+        the charm reports the outage instead of a drain that is not actually advancing.
+        GarmConnectionError subclasses GarmApiError, so the containing handlers would
+        otherwise swallow it and report progress.
+    """
+    client = client_class(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=old_enabled),
+            _generation(_LABELS_NEW, id=2),
+        ],
+    )
+
+    with pytest.raises(GarmConnectionError):
+        _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+
+def test_duplicate_desired_names_are_ignored(caplog):
+    """
+    arrange: Two specs sharing a logical name but carrying different labels.
+    act: Reconcile.
+    assert: Only the first is applied, and the conflict is warned about — both would own
+        the other's scaleset and retire it on every reconcile, replacing each other forever.
+    """
+    client = FakeGarmClient(providers=["openstack-demo"], scalesets=[])
+
+    with caplog.at_level(logging.WARNING):
+        progress = _reconcile(
+            client,
+            [_spec(labels=_LABELS_OLD), _spec(labels=_LABELS_NEW)],
+        )
+
+    assert [params.name for _, _, params in client.created] == [_OLD_NAME]
+    assert progress == []
+    assert "duplicate desired scaleset my-scaleset" in caplog.text
+
+
+def test_identical_duplicate_specs_are_not_warned_about(caplog):
+    """
+    arrange: Two identical specs, as a multi-unit garm-configurator produces — the scaleset
+        config is app-level, so every unit's databag yields the same spec.
+    act: Reconcile.
+    assert: One scaleset is created and nothing is warned about: the duplicate is the
+        expected shape of a scaled configurator, not an operator misconfiguration, and
+        warning on it would fire on every hook.
+    """
+    client = FakeGarmClient(providers=["openstack-demo"], scalesets=[])
+
+    with caplog.at_level(logging.WARNING):
+        _reconcile(client, [_spec(labels=_LABELS_OLD), _spec(labels=_LABELS_OLD)])
+
+    assert [params.name for _, _, params in client.created] == [_OLD_NAME]
+    assert "duplicate" not in caplog.text
diff --git a/charms/garm/tox.toml b/charms/garm/tox.toml
index 6b75a278..8363a5fc 100644
--- a/charms/garm/tox.toml
+++ b/charms/garm/tox.toml
@@ -40,7 +40,7 @@ description = "Run unit tests"
 deps = [
   "pytest",
   "coverage[toml]",
-  "ops-scenario==8.8.1",
+  "ops-scenario==8.8.2",
   "tomli; python_version < '3.11'",
   "-r requirements.txt",
 ]
diff --git a/charms/tests/integration/test_garm.py b/charms/tests/integration/test_garm.py
index 8a67a08e..c82288d7 100644
--- a/charms/tests/integration/test_garm.py
+++ b/charms/tests/integration/test_garm.py
@@ -6,6 +6,7 @@
 import base64
 import json
 import logging
+import re
 import secrets
 import urllib.request
 
@@ -40,6 +41,9 @@
 # uppercase (A), lowercase (dmin + hex), digit (1 + hex), symbols (-, !).
 _GARM_ADMIN_PASSWORD = f"Admin-{secrets.token_hex(8)}-X1!"
 _SCALESET_TEST_NAME = "test-scaleset"
+# Live scalesets are named "<configured name>-<label hash>", so match a generation
+# rather than the configured name (mirrors target_scaleset_name in the charm).
+_SCALESET_GENERATION_SUFFIX = r"-[0-9a-f]{8}"
 # Credential name the GARM charm derives from the configurator's github-app-id +
 # installation id (12345 / 67890).
 _SYNCED_CREDENTIAL_NAME = "app-12345-67890"
@@ -388,7 +392,13 @@ def test_charm_reconciles_org_and_scaleset(
     )
 
     scaleset = _wait_for_scaleset(base_url, token, _SCALESET_TEST_NAME)
-    assert scaleset["name"] == _SCALESET_TEST_NAME
+    assert re.fullmatch(
+        rf"{re.escape(_SCALESET_TEST_NAME)}{_SCALESET_GENERATION_SUFFIX}",
+        scaleset["name"],
+    ), (
+        f"Expected a label-hashed generation of {_SCALESET_TEST_NAME!r}, "
+        f"got {scaleset['name']!r}"
+    )
     assert scaleset["max_runners"] == 10
 
     templates = _list_templates(address, token)
@@ -425,6 +435,87 @@ def _wait_for_config_applied(
     )
 
 
+def test_label_change_replaces_the_scaleset_and_removes_the_predecessor(
+    juju: jubilant.Juju,
+    configurator_garm: str,
+    configurator_with_image: str,
+    fake_github_api_url: str,
+):
+    """
+    arrange: The charm has converged a scaleset against the mock GitHub API (the preceding
+        test leaves github.com repointed), and update-status is driven fast enough to let
+        the multi-reconcile changeover advance within the test.
+    act: Change the configured labels, which GitHub offers no API to update in place.
+    assert: One enabled generation remains, under a different label-hashed name, and the
+        predecessor is gone entirely — exercising the create/hand-over/drain/delete path
+        end to end. The unit fixtures cannot cover this: they cannot reproduce how GARM
+        reports a disabled scaleset, which is where the changeover previously wedged.
+    """
+    address = _get_garm_address(juju, configurator_garm)
+    base_url = _garm_api_base_url(address)
+    token = _garm_first_run(juju, address)
+
+    before = _wait_for_scaleset(base_url, token, _SCALESET_TEST_NAME)
+
+    # No VMs are involved — the OpenStack provider binary is only checked for presence, so
+    # the generations carry zero instances and the drain completes as fast as the charm is
+    # asked to reconcile. The changeover spans three reconciles by design, so drive
+    # update-status rather than waiting out the model's default interval.
+    original_interval = juju.cli("model-config", "update-status-hook-interval").strip()
+    juju.cli("model-config", "update-status-hook-interval=10s")
+    try:
+        juju.config(configurator_with_image, values={"labels": "jammy,x64"})
+        _wait_for_config_applied(juju, configurator_garm, configurator_with_image)
+        _wait_for_single_generation(base_url, token, _SCALESET_TEST_NAME, before["name"])
+    finally:
+        juju.cli("model-config", f"update-status-hook-interval={original_interval}")
+
+
+@retry(
+    retry=retry_if_exception_type(
+        (AssertionError, requests.exceptions.RequestException)
+    ),
+    wait=wait_exponential(multiplier=1, min=5, max=20),
+    stop=stop_after_attempt(30),
+)
+def _wait_for_single_generation(
+    base_url: str, token: str, name: str, previous_name: str
+) -> dict:
+    """Wait until only the replacement generation of *name* is left.
+
+    Retries until the whole changeover has run: the replacement is created, the
+    predecessor is disabled, and the predecessor is finally deleted. Asserting on the
+    end state rather than on each phase keeps the test independent of how many
+    update-status ticks the model happens to deliver.
+
+    Args:
+        base_url: GARM API base URL.
+        token: JWT token for authentication.
+        name: Logical scaleset name whose generations are matched.
+        previous_name: Name of the generation expected to be gone.
+
+    Returns:
+        The single surviving generation.
+    """
+    generation = re.compile(rf"^{re.escape(name)}({_SCALESET_GENERATION_SUFFIX})?$")
+    matching = [
+        scaleset
+        for scaleset in _list_scalesets(base_url, token)
+        if generation.match(scaleset.get("name") or "")
+    ]
+    names = [scaleset.get("name") for scaleset in matching]
+    assert previous_name not in names, (
+        f"Expected the predecessor {previous_name!r} to be deleted once drained, "
+        f"still present among {names!r}"
+    )
+    assert len(matching) == 1, (
+        f"Expected exactly one generation of {name!r} after the changeover, got {names!r}"
+    )
+    assert matching[0].get("enabled") is True, (
+        f"Expected the replacement {names[0]!r} to be serving, got {matching[0]!r}"
+    )
+    return matching[0]
+
 def _list_templates(address: str, token: str) -> list[dict]:
     """List all runner install templates from the GARM API.
 
@@ -722,9 +813,25 @@ def _list_scalesets(base_url: str, token: str) -> list[dict]:
 
 
 def _find_scaleset(scalesets: list[dict], name: str) -> dict | None:
-    """Return the first scaleset with the requested name."""
+    """Return the live scaleset serving a configured name, whatever generation it is on.
+
+    The live name carries a label hash, so an exact match on the configured name
+    would find nothing. A superseded generation lingers, disabled, until it has
+    drained, so only an enabled scaleset counts as the one currently serving.
+
+    GARM tags Enabled ``omitempty``, so a disabled scaleset comes back with no
+    ``enabled`` key at all: test for the key being true, not for it being false,
+    or every draining predecessor reads as still serving.
+    """
+    generation = re.compile(rf"^{re.escape(name)}({_SCALESET_GENERATION_SUFFIX})?$")
     return next(
-        (scaleset for scaleset in scalesets if scaleset.get("name") == name), None
+        (
+            scaleset
+            for scaleset in scalesets
+            if generation.match(scaleset.get("name") or "")
+            and scaleset.get("enabled") is True
+        ),
+        None,
     )
 
 
diff --git a/docs/adr/003_scaleset_label_change_by_replacement.md b/docs/adr/003_scaleset_label_change_by_replacement.md
new file mode 100644
index 00000000..c752c410
--- /dev/null
+++ b/docs/adr/003_scaleset_label_change_by_replacement.md
@@ -0,0 +1,83 @@
+---
+title: ADR-003 - scale set label changes by replacement
+author: Andrew Liaw (andrew.liaw@canonical.com)
+date: 2026/08/14
+domain: architecture
+replaced-by:
+---
+
+# Scale set label changes by replacement
+
+GitHub assigns a scale set's labels at creation and provides no API to change them.
+The GARM charm applies a label change by creating a replacement scale set and draining its predecessor, deriving both names from a hash of their labels.
+
+## Context
+
+`UpdateScaleSetParams` exposes no labels field.
+A drain lasts as long as its longest in-flight job, up to GitHub's six-hour limit, exceeding any hook's execution budget.
+
+## Decision
+
+A live scale set is named `<configured name>-<first 8 characters of the SHA-256 digest of its sorted labels>`.
+Only labels feed the digest; all other fields are updated in place.
+
+Each reconcile advances the changeover by one step:
+
+1. Create the replacement under its label-hashed name. The predecessor remains enabled.
+2. When the replacement is observed enabled, set the predecessor to `enabled=false`, `min_idle_runners=0`, `max_runners=0`.
+3. While the predecessor reports runners, report progress and take no action.
+4. When it reports no runners, delete it and its runner template.
+
+Disabling closes the predecessor's listener session: `listener.Stop()` calls `DeleteMessageSession`, so the session is deleted GitHub-side rather than dropped locally, and `keepListenerAlive` does not restart it while the scale set is disabled.
+Labels common to both generations are served by one scale set or the other for the duration, subject to the open question recorded below.
+The charm reports an active status naming the configured scale set and its phase, and drops the phase from the status once the predecessor is deleted.
+
+The design depends on five behaviors, verified against the GitHub API and the GARM source:
+
+- GitHub enforces uniqueness on `name` within a runner group. A duplicate name returns `400 RunnerScaleSetExistsException`; overlapping and identical label sets under distinct names return `200`.
+- `handleScaleDown` skips instances whose `RunnerStatus` is `RunnerActive` or `RunnerTerminated`, so an instance executing a job is not removed. `handleScaleUp` returns when `Enabled` is false.
+- `handleAutoScale` runs on a five-second ticker and is not gated on `Enabled`. `handleScaleSetUpdateOperation` retains the worker; only `handleScaleSetDeleteOperation` stops it. Disabling stops the listener alone.
+- `targetRunners` evaluates `min(MinIdleRunners + DesiredRunnerCount, MaxRunners)`, which is 0 when `max_runners` is 0. `UpdateScaleSetByID` validates only `min_idle_runners <= max_runners`; the `max_runners != 0` constraint applies to `CreateScaleSetParams.Validate` alone.
+- Nothing writes the `scale_sets` row while a disabled scale set drains, so its `updated_at` is the moment it was disabled — which is what the drain deadline below measures from. The only writes to that row outside an API update are `SetScaleSetLastMessageID` and `SetScaleSetDesiredRunnerCount`, both called from the listener's message handler, and the listener is stopped. `handleAutoScale` keeps running but writes instances, a separate table.
+
+One behavior is not established by either source.
+Deleting the message session stops GARM receiving job assignments; whether GitHub stops assigning jobs to a scale set that still exists with the same labels in the same runner group is undocumented, and the GARM source cannot answer it.
+If GitHub does continue to assign, a job routed to the predecessor after the disable is not delivered, because GARM does not reopen the session to resume from `last_message_id`; the job waits until the predecessor is deleted, bounded by the seven-hour drain deadline below.
+Both generations carry the shared labels for the whole drain, so this would not be a rare case.
+Confirming it requires an observed run rather than a source reference.
+
+## Alternatives considered
+
+Deleting and recreating the scale set under one name was rejected: it terminates in-flight jobs and leaves an interval in which no scale set carries the labels.
+
+A monotonic suffix such as `-v1` and `-v2` was rejected: deriving the next suffix requires the current one, reintroducing persisted state.
+A digest also maps a reverted label set back onto the name that generation already holds, so a draining predecessor is re-adopted rather than a third scale set created.
+
+Recording the changeover in peer relation data or on disk was rejected: it establishes a second source of truth alongside GARM and requires its own cleanup.
+
+Blocking the hook until the drain completes was rejected: the drain can exceed six hours.
+
+## Consequences
+
+Live names carry a hash suffix, so `garm-cli scaleset list` reports `my-scaleset-1a2b3c4d`.
+The configured name remains the operator-facing identity and is what the unit status reports.
+Names are capped at 64 characters; a longer configured name is truncated and suffixed with a digest of its full value, so names sharing a prefix resolve to distinct scale sets.
+The cap is the charm's own conservative bound on the System label GitHub registers the scale set under: GARM validates only that the name is non-empty.
+It could not have been this generous before the GARM bump recorded in the changelog for 2026-09-04 — GARM built the OpenStack `garm-pool-id` instance tag from the scale set name, so a name over 10 characters overran Nova's 60-character tag limit and failed every instance creation.
+GARM now derives that tag from a fixed-length UUID, so the name no longer feeds it.
+
+A changeover spans three reconciles, so at the default update-status interval a label change with no in-flight jobs completes in approximately 15 minutes.
+The unit stays active throughout, carrying the phase as its status message.
+Maintenance was rejected: the service is fully functional for the whole drain, and a drain reaching the deadline below would otherwise block `juju wait-for` and integration tests on hours of healthy background convergence.
+
+Both generations carry the full `min_idle_runners` until the predecessor is deleted, so the idle runner count doubles for the duration of the drain.
+Against a fixed OpenStack quota the replacement may be unable to spawn runners at all, which stalls the changeover it is meant to complete.
+Operators should size the quota for twice the configured idle count.
+
+Each generation owns a runner template named after its live scale set, so a draining predecessor retains the template its runners were built from.
+
+An instance GARM does not remove would block deletion indefinitely, so after seven hours the charm stops gating on its runner count and attempts deletion on each reconcile.
+GARM rejects that request while the scale set has active runners, which bounds the effect.
+
+The 32-bit digest can collide, leaving a scale set whose labels do not match its spec.
+The charm logs both label sets and applies the remaining fields, rather than blocking updates to image, flavor, and runner counts while the mismatch persists.
diff --git a/docs/changelog.md b/docs/changelog.md
index 11755131..c25c2045 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 Each revision is versioned by the date of the revision.
 
+## 2026-09-07
+
+- `garm`: apply scaleset label changes automatically. Labels are immutable once a GitHub scale set exists, so changing them in the `garm-configurator` relation data previously did nothing but log a warning telling the operator to remove and re-add the relation. The charm now applies a label change by creating a replacement scale set and retiring the one it replaces. Both generations run concurrently until the retired one has drained, so the idle runner count doubles for the duration; size the OpenStack quota accordingly. The unit stays active throughout and reports the changeover phase in its status.
+
 ## 2026-09-04
 
 - `garm`: bump the pinned GARM commit to pick up a fix for the scale set pseudo pool ID. GARM previously tagged OpenStack instances with a pool ID built from the scale set name, so a name over 10 characters produced a `garm-pool-id` server tag exceeding Nova's 60-character limit, failing every instance creation ([cloudbase/garm-provider-openstack#34](https://github.com/cloudbase/garm-provider-openstack/issues/34)). GARM now derives a fixed-length UUID for the pool ID instead, so scale set name length no longer affects the tag. The bump also required updating how the entrypoint launches GARM, to match a config-flag syntax change in the newer GARM version.