diff --git a/.github/mergify.yml b/.github/mergify.yml
index 525594cc..43353ea4 100644
--- a/.github/mergify.yml
+++ b/.github/mergify.yml
@@ -1,4 +1,34 @@
 # yaml-language-server: $schema=https://docs.mergify.com/mergify-configuration-schema.json
 extends: mergify
 merge_protections_settings:
   reporting_method: check-runs
+
+pull_request_rules:
+  - name: Flag product T-ID format violation in PR title or commit messages
+    description: >
+      Product-repo convention: the PR title AND every commit's first line must
+      match `T<digits>: <text>` (optional `scope: ` prefix). The title is always
+      checked; the per-commit check is exempted when a maintainer applies the
+      `legacy` label — an escape hatch for grandfathered PRs whose commit history
+      cannot be rewritten (repos that squash-merge AND block force-push, e.g.
+      vyos.vyos enforces `non_fast_forward` on ~ALL branches with zero bypass).
+      New PRs are still nudged toward the convention; `legacy` is the deliberate,
+      maintainer-controlled opt-out. Relocated from the central config (T8966)
+      so the convention is opt-in per product repo. Name is intentionally
+      distinct from any central rule name so this stays additive (not an
+      `extends:` override). Legacy-label escape added 2026-06-08 (T8966).
+    conditions:
+      - '-closed'
+      - '-merged'
+      - '-author~=\[bot\]$'
+      - 'author!=copilot-swe-agent'
+      - 'author!=vyosbot'
+      - or:
+          - '-title~=^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*'
+          - and:
+              - 'label!=legacy'
+              - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*'
+    actions:
+      label:
+        toggle:
+          - invalid-task-id
diff --git a/.github/workflows/codecoverage.yml b/.github/workflows/codecoverage.yml
index 8ce3af36..ee71e179 100644
--- a/.github/workflows/codecoverage.yml
+++ b/.github/workflows/codecoverage.yml
@@ -1,71 +1,71 @@
 ---
 name: Code Coverage
 # cloned from ansible-network/github_actions/.github/workflows/coverage_network_devices.yml@main
 # in order to deal with token issue in codecov
 
 on: # yamllint disable-line rule:truthy
   push:
   pull_request:
     branches: [main]
 jobs:
   codecoverage:
     env:
       PY_COLORS: "1"
       source_directory: "./source"
       python_version: "3.10"
       ansible_version: "latest"
       os: "ubuntu-latest"
       collection_pre_install: >-
         git+https://github.com/ansible-collections/ansible.utils.git
         git+https://github.com/ansible-collections/ansible.netcommon.git
     runs-on: ubuntu-latest
     name: "Code Coverage | Python 3.10"
     steps:
       - name: Checkout the collection repository
         uses: ansible-network/github_actions/.github/actions/checkout_dependency@main
         with:
           path: ${{ env.source_directory }}
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: "0"
 
       - name: Set up Python ${{ env.python_version }}
         uses: actions/setup-python@v6
         with:
           python-version: ${{ env.python_version }}
 
       - name: Install ansible-core (${{ env.ansible-version }})
         run: python3 -m pip install ansible-core pytest pytest-cov pytest-ansible-units pytest-forked pytest-xdist
 
       - name: Read collection metadata from galaxy.yml
         id: identify
         uses: ansible-network/github_actions/.github/actions/identify_collection@main
         with:
           source_path: ${{ env.source_directory }}
 
       - name: Build and install the collection
         uses: ansible-network/github_actions/.github/actions/build_install_collection@main
         with:
           install_python_dependencies: true
           source_path: ${{ env.source_directory }}
           collection_path: ${{ steps.identify.outputs.collection_path }}
           tar_file: ${{ steps.identify.outputs.tar_file }}
 
       - name: Print the ansible version
         run: ansible --version
 
       - name: Print the python dependencies
         run: python3 -m pip list
 
       - name: Run Coverage tests
         run: |
           pytest tests/unit -v --cov-report xml --cov=./
         working-directory: ${{ steps.identify.outputs.collection_path }}
 
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           directory: ${{ steps.identify.outputs.collection_path }}
           fail_ci_if_error: false
           token: ${{ secrets.CODECOV_TOKEN }}
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}