diff --git a/.github/workflows/ai-tests.yml b/.github/workflows/ai-tests.yml
index 7594f14fa9412..f8db88a83dcf3 100644
--- a/.github/workflows/ai-tests.yml
+++ b/.github/workflows/ai-tests.yml
@@ -32,7 +32,7 @@ jobs:
         working-directory: ./packages/ai-commands
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/authorize-vercel-deploys.yml b/.github/workflows/authorize-vercel-deploys.yml
index 2fce600a211bc..747cddbf5d947 100644
--- a/.github/workflows/authorize-vercel-deploys.yml
+++ b/.github/workflows/authorize-vercel-deploys.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
       # Checkout the master branch from the supabase repo and run that script to authorize Vercel deploys
       - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: master
diff --git a/.github/workflows/autofix_linters.yml b/.github/workflows/autofix_linters.yml
index 5f3e16d81f5a9..4ddc87ba5629d 100644
--- a/.github/workflows/autofix_linters.yml
+++ b/.github/workflows/autofix_linters.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Calculate number of commits
         run: echo "PR_FETCH_DEPTH=$(( ${{ github.event.pull_request.commits }} + 1 ))" >> "${GITHUB_ENV}"
 
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.sha }}
@@ -87,7 +87,7 @@ jobs:
           private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
           permission-contents: write
 
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
diff --git a/.github/workflows/avoid-typos.yml b/.github/workflows/avoid-typos.yml
index 1102aedef595d..8d171f231b05d 100644
--- a/.github/workflows/avoid-typos.yml
+++ b/.github/workflows/avoid-typos.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Check out code.
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: misspell
diff --git a/.github/workflows/braintrust-evals.yml b/.github/workflows/braintrust-evals.yml
index 02c443fce5481..dc903993293f7 100644
--- a/.github/workflows/braintrust-evals.yml
+++ b/.github/workflows/braintrust-evals.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -62,7 +62,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/braintrust-preview-scorers-cleanup.yml b/.github/workflows/braintrust-preview-scorers-cleanup.yml
index abe53efb2d497..f7c28d18e86e0 100644
--- a/.github/workflows/braintrust-preview-scorers-cleanup.yml
+++ b/.github/workflows/braintrust-preview-scorers-cleanup.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
@@ -43,7 +43,7 @@ jobs:
           done
 
       - name: Post cleanup comment
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const prNumber = context.payload.pull_request.number
diff --git a/.github/workflows/braintrust-preview-scorers-deploy.yml b/.github/workflows/braintrust-preview-scorers-deploy.yml
index ca3de102b5cbc..94c6ab8517938 100644
--- a/.github/workflows/braintrust-preview-scorers-deploy.yml
+++ b/.github/workflows/braintrust-preview-scorers-deploy.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -77,7 +77,7 @@ jobs:
 
       - name: Post PR comment
         if: steps.changed.outputs.skip != 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           BRAINTRUST_STAGING_PROJECT_ID: ${{ secrets.BRAINTRUST_STAGING_PROJECT_ID }}
           SCORER_SLUGS: ${{ steps.push.outputs.slugs }}
diff --git a/.github/workflows/braintrust-scorers-deploy.yml b/.github/workflows/braintrust-scorers-deploy.yml
index 79aec9b7448f4..8298ba28f917d 100644
--- a/.github/workflows/braintrust-scorers-deploy.yml
+++ b/.github/workflows/braintrust-scorers-deploy.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/dashboard-pr-reminder.yml b/.github/workflows/dashboard-pr-reminder.yml
index d259f80d0d959..0ea53f030ebe4 100644
--- a/.github/workflows/dashboard-pr-reminder.yml
+++ b/.github/workflows/dashboard-pr-reminder.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/docs-js-libs-update.yml b/.github/workflows/docs-js-libs-update.yml
index c2f5b64be5c35..a423b46502b67 100644
--- a/.github/workflows/docs-js-libs-update.yml
+++ b/.github/workflows/docs-js-libs-update.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: master
diff --git a/.github/workflows/docs-last-changed.yml b/.github/workflows/docs-last-changed.yml
index 7975c1ce591e7..3e138de62b3d0 100644
--- a/.github/workflows/docs-last-changed.yml
+++ b/.github/workflows/docs-last-changed.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/docs-lint-v2-comment.yml b/.github/workflows/docs-lint-v2-comment.yml
index 7c4561d36950b..56b6d0ed183ac 100644
--- a/.github/workflows/docs-lint-v2-comment.yml
+++ b/.github/workflows/docs-lint-v2-comment.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
       - id: download_artifact
         name: 'Download artifact'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -53,7 +53,7 @@ jobs:
         run: unzip lint_results.zip
       - name: 'Comment on PR'
         if: steps.download_artifact.outputs.contains_results == 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/docs-lint-v2-scheduled.yml b/.github/workflows/docs-lint-v2-scheduled.yml
index 6ba2b37e3712d..16ca6e7596d0f 100644
--- a/.github/workflows/docs-lint-v2-scheduled.yml
+++ b/.github/workflows/docs-lint-v2-scheduled.yml
@@ -15,7 +15,7 @@ jobs:
   lint-all:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: true
diff --git a/.github/workflows/docs-lint-v2.yml b/.github/workflows/docs-lint-v2.yml
index 96e1411447190..6f78808236c46 100644
--- a/.github/workflows/docs-lint-v2.yml
+++ b/.github/workflows/docs-lint-v2.yml
@@ -28,7 +28,7 @@ jobs:
     name: supa-mdx-lint
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/docs-mgmt-api-update.yml b/.github/workflows/docs-mgmt-api-update.yml
index 087bff77fef0b..a455e489a03d8 100644
--- a/.github/workflows/docs-mgmt-api-update.yml
+++ b/.github/workflows/docs-mgmt-api-update.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: master
diff --git a/.github/workflows/docs-sync-auto-troubleshooting.yml b/.github/workflows/docs-sync-auto-troubleshooting.yml
index 0b01322a16166..3e6ada03f6f2f 100644
--- a/.github/workflows/docs-sync-auto-troubleshooting.yml
+++ b/.github/workflows/docs-sync-auto-troubleshooting.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout supabase/supabase
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: true
 
@@ -45,7 +45,7 @@ jobs:
           permission-contents: read
 
       - name: Checkout supabase/troubleshooting
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/docs-sync-troubleshooting.yml b/.github/workflows/docs-sync-troubleshooting.yml
index 43bd118c0f4e3..468b0f3fce138 100644
--- a/.github/workflows/docs-sync-troubleshooting.yml
+++ b/.github/workflows/docs-sync-troubleshooting.yml
@@ -24,7 +24,7 @@ jobs:
       SUPABASE_SECRET_KEY: ${{ secrets.SEARCH_SUPABASE_SERVICE_ROLE_KEY }}
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/docs-sync.yml b/.github/workflows/docs-sync.yml
index 2adb6ea8b9b6f..3c8f90a05c995 100644
--- a/.github/workflows/docs-sync.yml
+++ b/.github/workflows/docs-sync.yml
@@ -26,7 +26,7 @@ jobs:
       SUPABASE_SECRET_KEY: ${{ secrets.SEARCH_SUPABASE_SERVICE_ROLE_KEY }}
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/docs-tests-smoke.yml b/.github/workflows/docs-tests-smoke.yml
index 3a85c188ea973..2fc1579b41632 100644
--- a/.github/workflows/docs-tests-smoke.yml
+++ b/.github/workflows/docs-tests-smoke.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/docs-tests.yml b/.github/workflows/docs-tests.yml
index bbaddc5fb274d..5acd99674a21e 100644
--- a/.github/workflows/docs-tests.yml
+++ b/.github/workflows/docs-tests.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/external-pr-comment.yml b/.github/workflows/external-pr-comment.yml
index d330ad18b97c9..ea0819f76c603 100644
--- a/.github/workflows/external-pr-comment.yml
+++ b/.github/workflows/external-pr-comment.yml
@@ -13,7 +13,7 @@ jobs:
     if: github.event.pull_request.head.repo.full_name != github.repository
     steps:
       - name: Comment on PR
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const commentBody = `
diff --git a/.github/workflows/fix-typos.yml b/.github/workflows/fix-typos.yml
index ae2f45cf87daf..08cdde4198055 100644
--- a/.github/workflows/fix-typos.yml
+++ b/.github/workflows/fix-typos.yml
@@ -16,7 +16,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: master
diff --git a/.github/workflows/og_images.yml b/.github/workflows/og_images.yml
index 99c88ddaed552..7ba7045f52998 100644
--- a/.github/workflows/og_images.yml
+++ b/.github/workflows/og_images.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pg-meta-tests.yml b/.github/workflows/pg-meta-tests.yml
index 1119cd57f9890..f46c0360cd1d3 100644
--- a/.github/workflows/pg-meta-tests.yml
+++ b/.github/workflows/pg-meta-tests.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/prettier.yml b/.github/workflows/prettier.yml
index 3e74a745d2cb4..6b8a5b6e4ed7a 100644
--- a/.github/workflows/prettier.yml
+++ b/.github/workflows/prettier.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/publish_image.yml b/.github/workflows/publish_image.yml
index 817541de8d35c..e40a023c52ccb 100644
--- a/.github/workflows/publish_image.yml
+++ b/.github/workflows/publish_image.yml
@@ -72,7 +72,7 @@ jobs:
     outputs:
       image_digest: ${{ steps.build.outputs.digest }}
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - id: meta
diff --git a/.github/workflows/search.yml b/.github/workflows/search.yml
index f75392eb7da70..be8a466334b42 100644
--- a/.github/workflows/search.yml
+++ b/.github/workflows/search.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/self-host-tests-smoke.yml b/.github/workflows/self-host-tests-smoke.yml
index 983a182d52d4e..455d68c81fe56 100644
--- a/.github/workflows/self-host-tests-smoke.yml
+++ b/.github/workflows/self-host-tests-smoke.yml
@@ -23,7 +23,7 @@ jobs:
         config: [default, logs, envoy, rustfs, envoy-rustfs]
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/studio-docker-build.yml b/.github/workflows/studio-docker-build.yml
index 221ee2a9252a1..409d2b9edbdd1 100644
--- a/.github/workflows/studio-docker-build.yml
+++ b/.github/workflows/studio-docker-build.yml
@@ -18,7 +18,7 @@ jobs:
     name: 'Studio Docker Build'
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
diff --git a/.github/workflows/studio-e2e-test.yml b/.github/workflows/studio-e2e-test.yml
index 6ba15479c180d..7840b6e618150 100644
--- a/.github/workflows/studio-e2e-test.yml
+++ b/.github/workflows/studio-e2e-test.yml
@@ -35,7 +35,7 @@ jobs:
       STUDIO_FRAMEWORK: ${{ matrix.framework }}
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -156,7 +156,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Use Node.js
diff --git a/.github/workflows/studio-lint-ratchet-decrease.yml b/.github/workflows/studio-lint-ratchet-decrease.yml
index 136d778569a80..937d25ed4b88a 100644
--- a/.github/workflows/studio-lint-ratchet-decrease.yml
+++ b/.github/workflows/studio-lint-ratchet-decrease.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/studio-lint-ratchet.yml b/.github/workflows/studio-lint-ratchet.yml
index 16b0553b9d359..51657bade07b2 100644
--- a/.github/workflows/studio-lint-ratchet.yml
+++ b/.github/workflows/studio-lint-ratchet.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/studio-unit-tests.yml b/.github/workflows/studio-unit-tests.yml
index e5571f957fa6d..d499d32112c48 100644
--- a/.github/workflows/studio-unit-tests.yml
+++ b/.github/workflows/studio-unit-tests.yml
@@ -31,7 +31,7 @@ jobs:
       tests_ran: ${{ steps.filter.outputs.relevant }}
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -82,7 +82,7 @@ jobs:
     continue-on-error: true
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index e6faaa8066146..538d6eb3c2806 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/ui-patterns-tests.yml b/.github/workflows/ui-patterns-tests.yml
index c1a20d90fa932..be38c2332d827 100644
--- a/.github/workflows/ui-patterns-tests.yml
+++ b/.github/workflows/ui-patterns-tests.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml
index 524a6642a2fd8..aff844ce3d13f 100644
--- a/.github/workflows/ui-tests.yml
+++ b/.github/workflows/ui-tests.yml
@@ -28,7 +28,7 @@ jobs:
           filters: |
             relevant:
               - 'packages/ui/**'
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: steps.filter.outputs.relevant == 'true'
         with:
           persist-credentials: false
@@ -71,7 +71,7 @@ jobs:
     continue-on-error: true
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/update-js-libs.yml b/.github/workflows/update-js-libs.yml
index d36c1549203fa..c0a59cc1fb56a 100644
--- a/.github/workflows/update-js-libs.yml
+++ b/.github/workflows/update-js-libs.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: master
diff --git a/.github/workflows/update-ssr.yml b/.github/workflows/update-ssr.yml
index 09cb1a9b289f4..542b8c041d1c5 100644
--- a/.github/workflows/update-ssr.yml
+++ b/.github/workflows/update-ssr.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: master
diff --git a/.github/workflows/www-tests.yml b/.github/workflows/www-tests.yml
index 95410006eeb2d..bbc838989e421 100644
--- a/.github/workflows/www-tests.yml
+++ b/.github/workflows/www-tests.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index f6df8c9d8fd05..328eade145bca 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/apps/docs/content/guides/auth/auth-hooks/before-user-created-hook.mdx b/apps/docs/content/guides/auth/auth-hooks/before-user-created-hook.mdx
index c76f9deadf8eb..5d9b56bcbef06 100644
--- a/apps/docs/content/guides/auth/auth-hooks/before-user-created-hook.mdx
+++ b/apps/docs/content/guides/auth/auth-hooks/before-user-created-hook.mdx
@@ -404,7 +404,7 @@ begin
   -- Step 1: Check for explicit allow
   select count(*) into allow_count
   from public.signup_networks
-  where type = 'allow' and ip::inet << cidr;
+  where type = 'allow' and ip <<= cidr;
 
   if allow_count > 0 then
     -- If explicitly allowed, allow signup
@@ -414,7 +414,7 @@ begin
   -- Step 2: Check for explicit deny
   select count(*) into deny_count
   from public.signup_networks
-  where type = 'deny' and ip::inet << cidr;
+  where type = 'deny' and ip <<= cidr;
 
   if deny_count > 0 then
     return jsonb_build_object(
diff --git a/apps/docs/public/humans.txt b/apps/docs/public/humans.txt
index 6c1c610fc0b05..2399351a9598a 100644
--- a/apps/docs/public/humans.txt
+++ b/apps/docs/public/humans.txt
@@ -268,6 +268,7 @@ Shane Adams
 Shane E
 Shreekar Shetty
 Sreyas Udayavarman
+Stephanie Jackson (stejacks)
 Stephen Morgan
 Steve Chavez
 Steven Eubank
diff --git a/apps/studio/components/interfaces/App/CommandMenu/ApiKeys.tsx b/apps/studio/components/interfaces/App/CommandMenu/ApiKeys.tsx
index 82fe7b2cbb21e..d8ad22c076374 100644
--- a/apps/studio/components/interfaces/App/CommandMenu/ApiKeys.tsx
+++ b/apps/studio/components/interfaces/App/CommandMenu/ApiKeys.tsx
@@ -160,4 +160,17 @@ export function useApiKeysCommands() {
       sectionMeta: { priority: 3 },
     }
   )
+
+  useRegisterCommands(
+    COMMAND_MENU_SECTIONS.NAVIGATE,
+    [
+      {
+        id: 'nav-api-keys',
+        name: 'Go to API Keys',
+        route: `/project/${ref}/settings/api-keys`,
+        icon: () => <Key />,
+      },
+    ],
+    { enabled: !!project }
+  )
 }
diff --git a/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.tsx b/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.tsx
index 8333ec6445a5c..9233c5e4edb6e 100644
--- a/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.tsx
+++ b/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.tsx
@@ -204,7 +204,7 @@ export const EdgeFunctionRecentErrors = ({
           <div className="flex flex-col gap-6">
             <PageSectionMeta>
               <PageSectionSummary>
-                <PageSectionTitle>Errors since last deploy</PageSectionTitle>
+                <PageSectionTitle>Errors in the last 24h</PageSectionTitle>
               </PageSectionSummary>
               <PageSectionAside>
                 <Button
diff --git a/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.utils.test.ts b/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.utils.test.ts
index 6486cd69e1b24..dc3d35d9df410 100644
--- a/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.utils.test.ts
+++ b/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.utils.test.ts
@@ -107,6 +107,13 @@ limit 25`)
     })
 
     expect(getSinceLastDeployLogRange()).toEqual({})
+
+    expect(getSinceLastDeployLogRange('2026-03-18T00:00:00.000Z')).toEqual({
+      isoTimestampStart: '2026-03-19T12:00:00.000Z',
+      isoTimestampEnd: '2026-03-20T12:00:00.000Z',
+    })
+
+    vi.useRealTimers()
   })
 
   it('builds the since-deploy invocation count query and empty-state message', () => {
diff --git a/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.utils.ts b/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.utils.ts
index a52fa09cdb428..4fe81af6f92a4 100644
--- a/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.utils.ts
+++ b/apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.utils.ts
@@ -127,17 +127,21 @@ export const toIsoTimestamp = (value?: string | number) => {
   return Number.isNaN(date.valueOf()) ? undefined : date.toISOString()
 }
 
+export const SINCE_LAST_DEPLOY_MAX_RANGE_MS = 24 * 60 * 60 * 1000
+
 export const getSinceLastDeployLogRange = (updatedAt?: string | number, now: Date = new Date()) => {
   const isoTimestampStart = toIsoTimestamp(updatedAt)
   if (!isoTimestampStart) return {}
 
   const startDate = new Date(isoTimestampStart)
   const normalizedNow = new Date(now)
-  const endDate = Number.isNaN(normalizedNow.valueOf()) ? new Date() : normalizedNow
+  const nowDate = Number.isNaN(normalizedNow.valueOf()) ? new Date() : normalizedNow
+  const endDate = new Date(Math.max(startDate.valueOf(), nowDate.valueOf()))
+  const earliestAllowedStart = endDate.valueOf() - SINCE_LAST_DEPLOY_MAX_RANGE_MS
 
   return {
-    isoTimestampStart,
-    isoTimestampEnd: new Date(Math.max(startDate.valueOf(), endDate.valueOf())).toISOString(),
+    isoTimestampStart: new Date(Math.max(startDate.valueOf(), earliestAllowedStart)).toISOString(),
+    isoTimestampEnd: endDate.toISOString(),
   }
 }
 
diff --git a/apps/studio/components/interfaces/SQLEditor/SQLEditor.tsx b/apps/studio/components/interfaces/SQLEditor/SQLEditor.tsx
index 20156f9480a78..aa10baf4cf820 100644
--- a/apps/studio/components/interfaces/SQLEditor/SQLEditor.tsx
+++ b/apps/studio/components/interfaces/SQLEditor/SQLEditor.tsx
@@ -2,50 +2,30 @@ import { acceptUntrustedSql, untrustedSql, type UntrustedSqlFragment } from '@su
 import { LOCAL_STORAGE_KEYS, useFlag, useParams } from 'common'
 import { Loader2 } from 'lucide-react'
 import dynamic from 'next/dynamic'
-import { useRouter } from 'next/router'
 import { useCallback, useEffect, useEffectEvent, useState } from 'react'
-import { toast } from 'sonner'
 import { cn, ResizableHandle, ResizablePanel, ResizablePanelGroup } from 'ui'
 
 import { useSqlEditorDiff, useSqlEditorPrompt } from './hooks'
 import { RunQueryWarningModal } from './RunQueryWarningModal'
-import { sqlAiDisclaimerComment } from './SQLEditor.constants'
-import { DiffType } from './SQLEditor.types'
-import {
-  appendEnableRLSStatements,
-  assembleCompletionDiff,
-  buildDebugPromptText,
-  createSqlSnippetSkeletonV2,
-} from './SQLEditor.utils'
+import { appendEnableRLSStatements } from './SQLEditor.utils'
 import { SQLEditorProvider, useSQLEditorContext } from './SQLEditorContext'
 import { useAddDefinitions } from './useAddDefinitions'
 import { useEditorMount } from './useEditorMount'
 import { usePrettifyQuery } from './usePrettifyQuery'
 import { useSnippetIdentity } from './useSnippetIdentity'
 import { useSnippetTitleGenerator } from './useSnippetTitleGenerator'
+import { useSqlEditorAi } from './useSqlEditorAi'
 import { useSqlEditorExecution } from './useSqlEditorExecution'
 import { useSqlEditorExplain } from './useSqlEditorExplain'
+import { useSqlEditorShortcuts } from './useSqlEditorShortcuts'
 import { UtilityActions } from './UtilityPanel/UtilityActions'
 import { UtilityPanel } from './UtilityPanel/UtilityPanel'
-import { SIDEBAR_KEYS } from '@/components/layouts/ProjectLayout/LayoutSidebar/LayoutSidebarProvider'
 import ResizableAIWidget from '@/components/ui/AIEditor/ResizableAIWidget'
-import { constructHeaders, isValidConnString } from '@/data/fetchers'
+import { isValidConnString } from '@/data/fetchers'
 import { useReadReplicasQuery } from '@/data/read-replicas/replicas-query'
-import { isError } from '@/data/utils/error-check'
-import { useSelectedOrganizationQuery } from '@/hooks/misc/useSelectedOrganization'
 import { useSelectedProjectQuery } from '@/hooks/misc/useSelectedProject'
-import { BASE_PATH } from '@/lib/constants'
-import { formatSql } from '@/lib/formatSql'
 import { detectOS } from '@/lib/helpers'
-import { useProfile } from '@/lib/profile'
-import { useTrack } from '@/lib/telemetry/track'
-import { useAiAssistantStateSnapshot } from '@/state/ai-assistant-state'
 import { useDatabaseSelectorStateSnapshot } from '@/state/database-selector'
-import { SHORTCUT_IDS } from '@/state/shortcuts/registry'
-import { useShortcut } from '@/state/shortcuts/useShortcut'
-import { useSidebarManagerSnapshot } from '@/state/sidebar-manager-state'
-import { useSqlEditorDiffRequestSnapshot } from '@/state/sql-editor/sql-editor-diff-request'
-import { useSqlEditorSessionSnapshot } from '@/state/sql-editor/sql-editor-session-state'
 import {
   getSqlEditorV2StateSnapshot,
   useSqlEditorV2StateSnapshot,
@@ -75,59 +55,25 @@ const SQLEditorContent = () => {
   } = useSQLEditorContext()
 
   const os = detectOS()
-  const router = useRouter()
   const { ref } = useParams()
 
-  const { profile } = useProfile()
   const { data: project } = useSelectedProjectQuery()
-  const { data: org } = useSelectedOrganizationQuery()
 
   const tabs = useTabsStateSnapshot()
-  const aiSnap = useAiAssistantStateSnapshot()
-  const { openSidebar } = useSidebarManagerSnapshot()
   const snapV2 = useSqlEditorV2StateSnapshot()
-  const sessionSnap = useSqlEditorSessionSnapshot()
-  const diffRequest = useSqlEditorDiffRequestSnapshot()
   const databaseSelectorState = useDatabaseSelectorStateSnapshot()
 
   // [Ali] Kill switch to hide the SQL Editor Explain tab and its entry points
   const disablePrettyExplain = useFlag('DisablePrettyExplainOnSqlEditor')
 
-  const {
-    sourceSqlDiff,
-    setSourceSqlDiff,
-    selectedDiffType,
-    setSelectedDiffType,
-    setIsAcceptDiffLoading,
-    isDiffOpen,
-    defaultSqlDiff,
-    closeDiff,
-  } = useSqlEditorDiff()
-  const { promptState, setPromptState, promptInput, setPromptInput, resetPrompt } =
-    useSqlEditorPrompt()
+  const diff = useSqlEditorDiff()
+  const { isDiffOpen, defaultSqlDiff } = diff
+  const prompt = useSqlEditorPrompt()
+  const { promptState, setPromptState, promptInput, setPromptInput, resetPrompt } = prompt
 
   const [hasSelection, setHasSelection] = useState<boolean>(false)
-  const [isDiffEditorMounted, setIsDiffEditorMounted] = useState(false)
-
-  const [showWidget, setShowWidget] = useState(false)
   const [activeUtilityTab, setActiveUtilityTab] = useState<string>('results')
 
-  useShortcut(SHORTCUT_IDS.SQL_EDITOR_FOCUS_EDITOR, refocusEditor, {
-    registerInCommandMenu: true,
-  })
-
-  const openNewSnippet = useCallback(() => {
-    if (!ref) return
-    // skip=true bypasses the "load last visited snippet" redirect on /sql/new.
-    // Without it, the effect in pages/project/[ref]/sql/[id].tsx bounces back
-    // to the previous snippet.
-    router.push(`/project/${ref}/sql/new?skip=true`)
-  }, [ref, router])
-
-  useShortcut(SHORTCUT_IDS.SQL_EDITOR_NEW_SNIPPET, openNewSnippet, {
-    registerInCommandMenu: true,
-  })
-
   const { id, urlId, generatedNewSnippetName, isLoading } = useSnippetIdentity()
   const { onMount, editorMountCount } = useEditorMount({ id })
 
@@ -140,19 +86,14 @@ const SQLEditorContent = () => {
     { enabled: isValidConnString(project?.connectionString) }
   )
 
-  const { generateSqlTitle, setAiTitle } = useSnippetTitleGenerator()
-  const track = useTrack()
+  const { setAiTitle } = useSnippetTitleGenerator()
 
   const prettifyQuery = usePrettifyQuery({ id, isDiffOpen })
 
-  useShortcut(SHORTCUT_IDS.SQL_EDITOR_FORMAT, prettifyQuery, {
-    registerInCommandMenu: true,
-  })
-
   // Reads the SQL to run from the editor as an UntrustedSqlFragment. The
-  // untrusted→safe promotion (acceptUntrustedSql) happens in the small run /
-  // explain gesture handlers below — never inside the longer execute* helpers,
-  // which by construction only accept already-reviewed SafeSqlFragments.
+  // untrusted→safe promotion (acceptUntrustedSql) happens in the run / explain
+  // gesture + warning-modal handlers below — as close to the user action as
+  // possible — before the SQL reaches the execute* pipelines.
   const readEditorSql = useCallback((): UntrustedSqlFragment | undefined => {
     const snippet = getSqlEditorV2StateSnapshot().snippets[id]
     return getEditorSqlFromEditor(snippet?.snippet.content?.unchecked_sql)
@@ -195,218 +136,30 @@ const SQLEditorContent = () => {
     if (sql !== undefined) void executeExplainQuery(acceptUntrustedSql(sql))
   }, [executeExplainQuery, readEditorSql])
 
-  useShortcut(SHORTCUT_IDS.SQL_EDITOR_EXPLAIN, handleRunExplain, {
-    enabled: !disablePrettyExplain,
-    registerInCommandMenu: true,
+  const {
+    handlePrompt,
+    acceptAiHandler,
+    discardAiHandler,
+    onDebug,
+    buildDebugPrompt,
+    handleDiffEditorMount,
+    isCompletionLoading,
+    showWidget,
+  } = useSqlEditorAi({ id, editorMountCount, diff, prompt })
+
+  useSqlEditorShortcuts({
+    isDiffOpen,
+    isPromptOpen: promptState.isOpen,
+    disablePrettyExplain,
+    prettifyQuery,
+    runExplain: handleRunExplain,
+    acceptAiHandler,
+    discardAiHandler,
+    resetPrompt,
   })
 
-  const handleNewQuery = useCallback(
-    async (sql: string, name: string) => {
-      if (!ref) return console.error('Project ref is required')
-      if (!profile) return console.error('Profile is required')
-      if (!project) return console.error('Project is required')
-
-      try {
-        const snippet = createSqlSnippetSkeletonV2({
-          name,
-          sql,
-          owner_id: profile.id,
-          project_id: project.id,
-        })
-        snapV2.addSnippet({ projectRef: ref, snippet })
-        snapV2.addNeedsSaving(snippet.id!)
-        router.push(`/project/${ref}/sql/${snippet.id}`)
-      } catch (error: any) {
-        toast.error(`Failed to create new query: ${error.message}`)
-      }
-    },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [profile?.id, project?.id, ref, router, snapV2]
-  )
-
-  const buildDebugPrompt = useCallback(() => {
-    const snippet = snapV2.snippets[id]
-    const result = sessionSnap.results[id]?.[0]
-    const sql = (snippet?.snippet.content?.unchecked_sql ?? '')
-      .replace(sqlAiDisclaimerComment, '')
-      .trim()
-    const errorMessage = result?.error?.message ?? 'Unknown error'
-
-    return buildDebugPromptText(sql, errorMessage)
-  }, [id, sessionSnap.results, snapV2.snippets])
-
-  const onDebug = useCallback(async () => {
-    try {
-      const snippet = snapV2.snippets[id]
-      const result = sessionSnap.results[id]?.[0]
-      openSidebar(SIDEBAR_KEYS.AI_ASSISTANT)
-      aiSnap.newChat({
-        name: 'Debug SQL snippet',
-        sqlSnippets: [
-          (snippet.snippet.content?.unchecked_sql ?? '').replace(sqlAiDisclaimerComment, '').trim(),
-        ],
-        initialInput: `Help me to debug the attached sql snippet which gives the following error: \n\n${result.error.message}`,
-      })
-    } catch (error: unknown) {
-      // [Joshen] There's a tendency for the SQL debug to chuck a lengthy error message
-      // that's not relevant for the user - so we prettify it here by avoiding to return the
-      // entire error body from the assistant
-      if (isError(error)) {
-        toast.error(
-          `Sorry, the assistant failed to debug your query! Please try again with a different one.`
-        )
-      }
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [id, sessionSnap.results, snapV2.snippets])
-
-  const acceptAiHandler = useCallback(async () => {
-    try {
-      setIsAcceptDiffLoading(true)
-
-      // TODO: show error if undefined
-      if (!sourceSqlDiff || !editorRef.current || !diffEditorRef.current) return
-
-      const editorModel = editorRef.current.getModel()
-      const diffModel = diffEditorRef.current.getModel()
-
-      if (!editorModel || !diffModel) return
-
-      const sql = diffModel.modified.getValue()
-
-      if (selectedDiffType === DiffType.NewSnippet) {
-        const { title } = await generateSqlTitle({ sql })
-        await handleNewQuery(sql, title)
-      } else {
-        editorRef.current.executeEdits('apply-ai-edit', [
-          {
-            text: sql,
-            range: editorModel.getFullModelRange(),
-          },
-        ])
-      }
-
-      track('assistant_sql_diff_handler_evaluated', { handlerAccepted: true })
-
-      setSelectedDiffType(DiffType.Modification)
-      resetPrompt()
-      closeDiff()
-    } finally {
-      setIsAcceptDiffLoading(false)
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [sourceSqlDiff, selectedDiffType, handleNewQuery, generateSqlTitle, router, id, snapV2, track])
-
-  const discardAiHandler = useCallback(() => {
-    track('assistant_sql_diff_handler_evaluated', { handlerAccepted: false })
-    resetPrompt()
-    closeDiff()
-  }, [closeDiff, resetPrompt, track])
-
-  const [isCompletionLoading, setIsCompletionLoading] = useState<boolean>(false)
-
-  const complete = useCallback(
-    async (
-      _prompt: string,
-      options?: {
-        headers?: Record<string, string>
-        body?: { completionMetadata?: any }
-      }
-    ) => {
-      try {
-        setIsCompletionLoading(true)
-
-        const response = await fetch(`${BASE_PATH}/api/ai/code/complete`, {
-          method: 'POST',
-          headers: {
-            'Content-Type': 'application/json',
-            ...(options?.headers ?? {}),
-          },
-          body: JSON.stringify({
-            projectRef: project?.ref,
-            connectionString: project?.connectionString,
-            language: 'sql',
-            orgSlug: org?.slug,
-            ...(options?.body ?? {}),
-          }),
-        })
-
-        if (!response.ok) {
-          const errorText = await response.text()
-          throw new Error(errorText || 'Failed to generate completion')
-        }
-
-        // API returns a JSON-encoded string
-        const text: string = await response.json()
-
-        const meta = options?.body?.completionMetadata ?? {}
-        const { original, modified } = assembleCompletionDiff(meta, text)
-
-        const formattedModified = formatSql(modified)
-        setSourceSqlDiff({ original, modified: formattedModified })
-        setSelectedDiffType(DiffType.Modification)
-        setPromptState((prev) => ({ ...prev, isLoading: false }))
-        setIsCompletionLoading(false)
-      } catch (error: any) {
-        toast.error(`Failed to generate SQL: ${error?.message ?? 'Unknown error'}`)
-        setIsCompletionLoading(false)
-        throw error
-      }
-    },
-    [
-      org?.slug,
-      project?.connectionString,
-      project?.ref,
-      setPromptState,
-      setSelectedDiffType,
-      setSourceSqlDiff,
-    ]
-  )
-
-  const handlePrompt = async (
-    prompt: string,
-    context: {
-      beforeSelection: string
-      selection: string
-      afterSelection: string
-    }
-  ) => {
-    try {
-      setPromptState((prev) => ({
-        ...prev,
-        selection: context.selection,
-        beforeSelection: context.beforeSelection,
-        afterSelection: context.afterSelection,
-      }))
-      const headerData = await constructHeaders()
-
-      const authorizationHeader = headerData.get('Authorization')
-
-      await complete(prompt, {
-        ...(authorizationHeader ? { headers: { Authorization: authorizationHeader } } : undefined),
-        body: {
-          completionMetadata: {
-            textBeforeCursor: context.beforeSelection,
-            textAfterCursor: context.afterSelection,
-            language: 'pgsql',
-            prompt,
-            selection: context.selection,
-          },
-        },
-      })
-    } catch (error) {
-      setPromptState((prev) => ({ ...prev, isLoading: false }))
-    }
-  }
-
   /** All useEffects are at the bottom before returning the TSX */
 
-  const resetDiff = useEffectEvent(() => {
-    if (id) {
-      closeDiff()
-      setPromptState((prev) => ({ ...prev, isOpen: false }))
-    }
-  })
   const saveScrollPosition = useEffectEvent((snippetId: string) => {
     if (ref) {
       const tabId = createTabId('sql', { id: snippetId })
@@ -414,58 +167,12 @@ const SQLEditorContent = () => {
     }
   })
   useEffect(() => {
-    resetDiff()
+    // Save the departing snippet's scroll position on unmount / snippet switch.
     return () => saveScrollPosition(id)
     // Temporary until we update eslint to ignore useEffectEvent
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [id])
 
-  useEffect(() => {
-    const handler = (e: KeyboardEvent) => {
-      if (!isDiffOpen && !promptState.isOpen) return
-
-      switch (e.key) {
-        case 'Enter':
-          if ((os === 'macos' ? e.metaKey : e.ctrlKey) && isDiffOpen) {
-            acceptAiHandler()
-            resetPrompt()
-          }
-          return
-        case 'Escape':
-          if (isDiffOpen) discardAiHandler()
-          resetPrompt()
-          editorRef.current?.focus()
-          return
-      }
-    }
-    window.addEventListener('keydown', handler)
-    return () => window.removeEventListener('keydown', handler)
-  }, [
-    editorRef,
-    os,
-    isDiffOpen,
-    promptState.isOpen,
-    acceptAiHandler,
-    discardAiHandler,
-    resetPrompt,
-  ])
-
-  useEffect(() => {
-    if (isDiffOpen) {
-      const diffEditor = diffEditorRef.current
-      const model = diffEditor?.getModel()
-      if (model && model.original && model.modified) {
-        model.original.setValue(defaultSqlDiff.original)
-        model.modified.setValue(defaultSqlDiff.modified)
-        // scroll to the start line of the modification
-        const modifiedEditor = diffEditor!.getModifiedEditor()
-        const startLine = promptState.startLineNumber
-        modifiedEditor.revealLineInCenter(startLine)
-      }
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [selectedDiffType, sourceSqlDiff])
-
   useEffect(() => {
     if (isSuccessReadReplicas) {
       const primaryDatabase = databases.find((db) => db.identifier === ref)
@@ -474,53 +181,6 @@ const SQLEditorContent = () => {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [isSuccessReadReplicas, databases, ref])
 
-  const drainDiffRequest = useEffectEvent(() => {
-    const request = diffRequest.pending
-    if (request === undefined) return
-
-    const editorModel = editorRef.current?.getModel()
-    // Editor isn't ready yet; leave the request pending. editorMountCount bumps
-    // on mount and re-runs this effect, so the request applies once mounted.
-    if (!editorModel) return
-
-    const { diffType, sql } = request
-    const existingValue = editorRef.current?.getValue() ?? ''
-    if (existingValue.length === 0) {
-      // if the editor is empty, just copy over the code
-      editorRef.current?.executeEdits('apply-ai-message', [
-        {
-          text: `${sql}`,
-          range: editorModel.getFullModelRange(),
-        },
-      ])
-    } else {
-      const currentSql = editorRef.current?.getValue()
-      const diff = { original: currentSql || '', modified: sql }
-      setSourceSqlDiff(diff)
-      setSelectedDiffType(diffType)
-    }
-
-    // One-shot: drain the request so it can't re-apply to a later editor or session.
-    diffRequest.consumeDiffRequest()
-  })
-  useEffect(() => {
-    drainDiffRequest()
-    // until we can upgrade eslint to ignore useEffectEvent
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [diffRequest.pending, editorMountCount])
-
-  // We want to check if the diff editor is mounted and if it is, we want to show the widget
-  // We also want to cleanup the widget when the diff editor is closed
-  useEffect(() => {
-    if (!isDiffOpen) {
-      setIsDiffEditorMounted(false)
-      setShowWidget(false)
-    } else if (diffEditorRef.current && isDiffEditorMounted) {
-      setShowWidget(true)
-      return () => setShowWidget(false)
-    }
-  }, [diffEditorRef, isDiffOpen, isDiffEditorMounted])
-
   return (
     <>
       <RunQueryWarningModal
@@ -582,10 +242,7 @@ const SQLEditorContent = () => {
                         language="pgsql"
                         original={defaultSqlDiff.original}
                         modified={defaultSqlDiff.modified}
-                        onMount={(editor) => {
-                          diffEditorRef.current = editor
-                          setIsDiffEditorMounted(true)
-                        }}
+                        onMount={handleDiffEditorMount}
                       />
                       {showWidget && (
                         <ResizableAIWidget
diff --git a/apps/studio/components/interfaces/SQLEditor/useSqlEditorAi.ts b/apps/studio/components/interfaces/SQLEditor/useSqlEditorAi.ts
new file mode 100644
index 0000000000000..d49d4fa036c4e
--- /dev/null
+++ b/apps/studio/components/interfaces/SQLEditor/useSqlEditorAi.ts
@@ -0,0 +1,373 @@
+import { useParams } from 'common'
+import { useRouter } from 'next/router'
+import { useCallback, useEffect, useEffectEvent, useState } from 'react'
+import { toast } from 'sonner'
+
+import type { useSqlEditorDiff, useSqlEditorPrompt } from './hooks'
+import { sqlAiDisclaimerComment } from './SQLEditor.constants'
+import { DiffType, type IStandaloneDiffEditor } from './SQLEditor.types'
+import {
+  assembleCompletionDiff,
+  buildDebugPromptText,
+  createSqlSnippetSkeletonV2,
+} from './SQLEditor.utils'
+import { useSQLEditorContext } from './SQLEditorContext'
+import { useSnippetTitleGenerator } from './useSnippetTitleGenerator'
+import { SIDEBAR_KEYS } from '@/components/layouts/ProjectLayout/LayoutSidebar/LayoutSidebarProvider'
+import { constructHeaders } from '@/data/fetchers'
+import { isError } from '@/data/utils/error-check'
+import { useSelectedOrganizationQuery } from '@/hooks/misc/useSelectedOrganization'
+import { useSelectedProjectQuery } from '@/hooks/misc/useSelectedProject'
+import { BASE_PATH } from '@/lib/constants'
+import { formatSql } from '@/lib/formatSql'
+import { useProfile } from '@/lib/profile'
+import { useTrack } from '@/lib/telemetry/track'
+import { useAiAssistantStateSnapshot } from '@/state/ai-assistant-state'
+import { useSidebarManagerSnapshot } from '@/state/sidebar-manager-state'
+import { useSqlEditorDiffRequestSnapshot } from '@/state/sql-editor/sql-editor-diff-request'
+import { useSqlEditorSessionSnapshot } from '@/state/sql-editor/sql-editor-session-state'
+import { useSqlEditorV2StateSnapshot } from '@/state/sql-editor/sql-editor-state'
+
+type UseSqlEditorAiArgs = {
+  id: string
+  /** Bumped on every editor mount; drives one-shot draining of a pending diff request. */
+  editorMountCount: number
+  diff: ReturnType<typeof useSqlEditorDiff>
+  prompt: ReturnType<typeof useSqlEditorPrompt>
+}
+
+/**
+ * Owns the Assistant / diff cluster: SQL completion, the ask-AI prompt flow, the
+ * accept/discard diff handlers, the debug-prompt helpers, and the fragile diff
+ * lifecycle effects (one-shot diff-request drain, diff-editor value sync, and the
+ * ask-AI widget visibility).
+ */
+export function useSqlEditorAi({ id, editorMountCount, diff, prompt }: UseSqlEditorAiArgs) {
+  const {
+    sourceSqlDiff,
+    setSourceSqlDiff,
+    selectedDiffType,
+    setSelectedDiffType,
+    setIsAcceptDiffLoading,
+    isDiffOpen,
+    defaultSqlDiff,
+    closeDiff,
+  } = diff
+  const { promptState, setPromptState, resetPrompt } = prompt
+
+  const { editorRef, diffEditorRef } = useSQLEditorContext()
+
+  const router = useRouter()
+  const { ref } = useParams()
+  const { profile } = useProfile()
+  const { data: project } = useSelectedProjectQuery()
+  const { data: org } = useSelectedOrganizationQuery()
+  const track = useTrack()
+  const snapV2 = useSqlEditorV2StateSnapshot()
+  const sessionSnap = useSqlEditorSessionSnapshot()
+  const aiSnap = useAiAssistantStateSnapshot()
+  const { openSidebar } = useSidebarManagerSnapshot()
+  const diffRequest = useSqlEditorDiffRequestSnapshot()
+  const { generateSqlTitle } = useSnippetTitleGenerator()
+
+  const [isCompletionLoading, setIsCompletionLoading] = useState<boolean>(false)
+  const [isDiffEditorMounted, setIsDiffEditorMounted] = useState(false)
+  const [showWidget, setShowWidget] = useState(false)
+
+  const handleNewQuery = useCallback(
+    async (sql: string, name: string) => {
+      if (!ref) return console.error('Project ref is required')
+      if (!profile) return console.error('Profile is required')
+      if (!project) return console.error('Project is required')
+
+      try {
+        const snippet = createSqlSnippetSkeletonV2({
+          name,
+          sql,
+          owner_id: profile.id,
+          project_id: project.id,
+        })
+        snapV2.addSnippet({ projectRef: ref, snippet })
+        snapV2.addNeedsSaving(snippet.id!)
+        router.push(`/project/${ref}/sql/${snippet.id}`)
+      } catch (error: any) {
+        toast.error(`Failed to create new query: ${error.message}`)
+      }
+    },
+    [profile, project, ref, router, snapV2]
+  )
+
+  const buildDebugPrompt = useCallback(() => {
+    const snippet = snapV2.snippets[id]
+    const result = sessionSnap.results[id]?.[0]
+    const sql = (snippet?.snippet.content?.unchecked_sql ?? '')
+      .replace(sqlAiDisclaimerComment, '')
+      .trim()
+    const errorMessage = result?.error?.message ?? 'Unknown error'
+
+    return buildDebugPromptText(sql, errorMessage)
+  }, [id, sessionSnap.results, snapV2.snippets])
+
+  const onDebug = useCallback(async () => {
+    try {
+      const snippet = snapV2.snippets[id]
+      const result = sessionSnap.results[id]?.[0]
+      openSidebar(SIDEBAR_KEYS.AI_ASSISTANT)
+      aiSnap.newChat({
+        name: 'Debug SQL snippet',
+        sqlSnippets: [
+          (snippet.snippet.content?.unchecked_sql ?? '').replace(sqlAiDisclaimerComment, '').trim(),
+        ],
+        initialInput: `Help me to debug the attached sql snippet which gives the following error: \n\n${result.error.message}`,
+      })
+    } catch (error: unknown) {
+      // [Joshen] There's a tendency for the SQL debug to chuck a lengthy error message
+      // that's not relevant for the user - so we prettify it here by avoiding to return the
+      // entire error body from the assistant
+      if (isError(error)) {
+        toast.error(
+          `Sorry, the assistant failed to debug your query! Please try again with a different one.`
+        )
+      }
+    }
+  }, [id, sessionSnap.results, snapV2.snippets, aiSnap, openSidebar])
+
+  const acceptAiHandler = useCallback(async () => {
+    try {
+      setIsAcceptDiffLoading(true)
+
+      // TODO: show error if undefined
+      if (!sourceSqlDiff || !editorRef.current || !diffEditorRef.current) return
+
+      const editorModel = editorRef.current.getModel()
+      const diffModel = diffEditorRef.current.getModel()
+
+      if (!editorModel || !diffModel) return
+
+      const sql = diffModel.modified.getValue()
+
+      if (selectedDiffType === DiffType.NewSnippet) {
+        const { title } = await generateSqlTitle({ sql })
+        await handleNewQuery(sql, title)
+      } else {
+        editorRef.current.executeEdits('apply-ai-edit', [
+          {
+            text: sql,
+            range: editorModel.getFullModelRange(),
+          },
+        ])
+      }
+
+      track('assistant_sql_diff_handler_evaluated', { handlerAccepted: true })
+
+      setSelectedDiffType(DiffType.Modification)
+      resetPrompt()
+      closeDiff()
+    } finally {
+      setIsAcceptDiffLoading(false)
+    }
+  }, [
+    editorRef,
+    diffEditorRef,
+    sourceSqlDiff,
+    selectedDiffType,
+    generateSqlTitle,
+    handleNewQuery,
+    track,
+    setIsAcceptDiffLoading,
+    setSelectedDiffType,
+    resetPrompt,
+    closeDiff,
+  ])
+
+  const discardAiHandler = useCallback(() => {
+    track('assistant_sql_diff_handler_evaluated', { handlerAccepted: false })
+    resetPrompt()
+    closeDiff()
+  }, [closeDiff, resetPrompt, track])
+
+  const complete = useCallback(
+    async (
+      _prompt: string,
+      options?: {
+        headers?: Record<string, string>
+        body?: { completionMetadata?: any }
+      }
+    ) => {
+      try {
+        setIsCompletionLoading(true)
+
+        const response = await fetch(`${BASE_PATH}/api/ai/code/complete`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            ...(options?.headers ?? {}),
+          },
+          body: JSON.stringify({
+            projectRef: project?.ref,
+            connectionString: project?.connectionString,
+            language: 'sql',
+            orgSlug: org?.slug,
+            ...(options?.body ?? {}),
+          }),
+        })
+
+        if (!response.ok) {
+          const errorText = await response.text()
+          throw new Error(errorText || 'Failed to generate completion')
+        }
+
+        // API returns a JSON-encoded string
+        const text: string = await response.json()
+
+        const meta = options?.body?.completionMetadata ?? {}
+        const { original, modified } = assembleCompletionDiff(meta, text)
+
+        const formattedModified = formatSql(modified)
+        setSourceSqlDiff({ original, modified: formattedModified })
+        setSelectedDiffType(DiffType.Modification)
+        setPromptState((prev) => ({ ...prev, isLoading: false }))
+        setIsCompletionLoading(false)
+      } catch (error: any) {
+        toast.error(`Failed to generate SQL: ${error?.message ?? 'Unknown error'}`)
+        setIsCompletionLoading(false)
+        throw error
+      }
+    },
+    [
+      org?.slug,
+      project?.connectionString,
+      project?.ref,
+      setPromptState,
+      setSelectedDiffType,
+      setSourceSqlDiff,
+    ]
+  )
+
+  const handlePrompt = async (
+    prompt: string,
+    context: {
+      beforeSelection: string
+      selection: string
+      afterSelection: string
+    }
+  ) => {
+    try {
+      setPromptState((prev) => ({
+        ...prev,
+        selection: context.selection,
+        beforeSelection: context.beforeSelection,
+        afterSelection: context.afterSelection,
+      }))
+      const headerData = await constructHeaders()
+
+      const authorizationHeader = headerData.get('Authorization')
+
+      await complete(prompt, {
+        ...(authorizationHeader ? { headers: { Authorization: authorizationHeader } } : undefined),
+        body: {
+          completionMetadata: {
+            textBeforeCursor: context.beforeSelection,
+            textAfterCursor: context.afterSelection,
+            language: 'pgsql',
+            prompt,
+            selection: context.selection,
+          },
+        },
+      })
+    } catch (error) {
+      setPromptState((prev) => ({ ...prev, isLoading: false }))
+    }
+  }
+
+  const handleDiffEditorMount = (editor: IStandaloneDiffEditor) => {
+    diffEditorRef.current = editor
+    setIsDiffEditorMounted(true)
+  }
+
+  const resetDiff = useEffectEvent(() => {
+    if (id) {
+      closeDiff()
+      setPromptState((prev) => ({ ...prev, isOpen: false }))
+    }
+  })
+  useEffect(() => {
+    resetDiff()
+    // Temporary until we update eslint to ignore useEffectEvent
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [id])
+
+  useEffect(() => {
+    if (isDiffOpen) {
+      const diffEditor = diffEditorRef.current
+      const model = diffEditor?.getModel()
+      if (model && model.original && model.modified) {
+        model.original.setValue(defaultSqlDiff.original)
+        model.modified.setValue(defaultSqlDiff.modified)
+        // scroll to the start line of the modification
+        const modifiedEditor = diffEditor!.getModifiedEditor()
+        const startLine = promptState.startLineNumber
+        modifiedEditor.revealLineInCenter(startLine)
+      }
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [selectedDiffType, sourceSqlDiff])
+
+  const drainDiffRequest = useEffectEvent(() => {
+    const request = diffRequest.pending
+    if (request === undefined) return
+
+    const editorModel = editorRef.current?.getModel()
+    // Editor isn't ready yet; leave the request pending. editorMountCount bumps
+    // on mount and re-runs this effect, so the request applies once mounted.
+    if (!editorModel) return
+
+    const { diffType, sql } = request
+    const existingValue = editorRef.current?.getValue() ?? ''
+    if (existingValue.length === 0) {
+      // if the editor is empty, just copy over the code
+      editorRef.current?.executeEdits('apply-ai-message', [
+        {
+          text: `${sql}`,
+          range: editorModel.getFullModelRange(),
+        },
+      ])
+    } else {
+      const currentSql = editorRef.current?.getValue()
+      const diff = { original: currentSql || '', modified: sql }
+      setSourceSqlDiff(diff)
+      setSelectedDiffType(diffType)
+    }
+
+    // One-shot: drain the request so it can't re-apply to a later editor or session.
+    diffRequest.consumeDiffRequest()
+  })
+  useEffect(() => {
+    drainDiffRequest()
+    // until we can upgrade eslint to ignore useEffectEvent
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [diffRequest.pending, editorMountCount])
+
+  // We want to check if the diff editor is mounted and if it is, we want to show the widget
+  // We also want to cleanup the widget when the diff editor is closed
+  useEffect(() => {
+    if (!isDiffOpen) {
+      setIsDiffEditorMounted(false)
+      setShowWidget(false)
+    } else if (diffEditorRef.current && isDiffEditorMounted) {
+      setShowWidget(true)
+      return () => setShowWidget(false)
+    }
+  }, [diffEditorRef, isDiffOpen, isDiffEditorMounted])
+
+  return {
+    handlePrompt,
+    acceptAiHandler,
+    discardAiHandler,
+    onDebug,
+    buildDebugPrompt,
+    handleDiffEditorMount,
+    isCompletionLoading,
+    showWidget,
+  }
+}
diff --git a/apps/studio/components/interfaces/SQLEditor/useSqlEditorShortcuts.ts b/apps/studio/components/interfaces/SQLEditor/useSqlEditorShortcuts.ts
new file mode 100644
index 0000000000000..4f119980d36ef
--- /dev/null
+++ b/apps/studio/components/interfaces/SQLEditor/useSqlEditorShortcuts.ts
@@ -0,0 +1,87 @@
+import { useParams } from 'common'
+import { useRouter } from 'next/router'
+import { useCallback, useEffect } from 'react'
+
+import { useSQLEditorContext } from './SQLEditorContext'
+import { detectOS } from '@/lib/helpers'
+import { SHORTCUT_IDS } from '@/state/shortcuts/registry'
+import { useShortcut } from '@/state/shortcuts/useShortcut'
+
+type UseSqlEditorShortcutsArgs = {
+  isDiffOpen: boolean
+  isPromptOpen: boolean
+  disablePrettyExplain: boolean
+  prettifyQuery: () => void
+  runExplain: () => void
+  acceptAiHandler: () => void
+  discardAiHandler: () => void
+  resetPrompt: () => void
+}
+
+/**
+ * Registers the SQL editor's keyboard shortcuts (focus editor, new snippet,
+ * format, explain) plus the window keydown that accepts/discards an open AI diff
+ * or dismisses the prompt.
+ */
+export function useSqlEditorShortcuts({
+  isDiffOpen,
+  isPromptOpen,
+  disablePrettyExplain,
+  prettifyQuery,
+  runExplain,
+  acceptAiHandler,
+  discardAiHandler,
+  resetPrompt,
+}: UseSqlEditorShortcutsArgs) {
+  const os = detectOS()
+  const router = useRouter()
+  const { ref } = useParams()
+  const { editorRef, refocusEditor } = useSQLEditorContext()
+
+  const openNewSnippet = useCallback(() => {
+    if (!ref) return
+    // skip=true bypasses the "load last visited snippet" redirect on /sql/new.
+    // Without it, the effect in pages/project/[ref]/sql/[id].tsx bounces back
+    // to the previous snippet.
+    router.push(`/project/${ref}/sql/new?skip=true`)
+  }, [ref, router])
+
+  useShortcut(SHORTCUT_IDS.SQL_EDITOR_FOCUS_EDITOR, refocusEditor, {
+    registerInCommandMenu: true,
+  })
+
+  useShortcut(SHORTCUT_IDS.SQL_EDITOR_NEW_SNIPPET, openNewSnippet, {
+    registerInCommandMenu: true,
+  })
+
+  useShortcut(SHORTCUT_IDS.SQL_EDITOR_FORMAT, prettifyQuery, {
+    registerInCommandMenu: true,
+  })
+
+  useShortcut(SHORTCUT_IDS.SQL_EDITOR_EXPLAIN, runExplain, {
+    enabled: !disablePrettyExplain,
+    registerInCommandMenu: true,
+  })
+
+  useEffect(() => {
+    const handler = (e: KeyboardEvent) => {
+      if (!isDiffOpen && !isPromptOpen) return
+
+      switch (e.key) {
+        case 'Enter':
+          if ((os === 'macos' ? e.metaKey : e.ctrlKey) && isDiffOpen) {
+            acceptAiHandler()
+            resetPrompt()
+          }
+          return
+        case 'Escape':
+          if (isDiffOpen) discardAiHandler()
+          resetPrompt()
+          editorRef.current?.focus()
+          return
+      }
+    }
+    window.addEventListener('keydown', handler)
+    return () => window.removeEventListener('keydown', handler)
+  }, [editorRef, os, isDiffOpen, isPromptOpen, acceptAiHandler, discardAiHandler, resetPrompt])
+}
diff --git a/apps/studio/tests/components/SQLEditor/SQLEditor.test.tsx b/apps/studio/tests/components/SQLEditor/SQLEditor.test.tsx
index 8a90205a360be..bb7b7ae1bac78 100644
--- a/apps/studio/tests/components/SQLEditor/SQLEditor.test.tsx
+++ b/apps/studio/tests/components/SQLEditor/SQLEditor.test.tsx
@@ -429,11 +429,12 @@ describe('SQLEditor characterization', () => {
     sqlEditorDiffRequestState.requestDiff('select 42;', DiffType.Modification)
 
     await renderEditor()
-    await screen.findByTestId('diff-editor')
+    // The queued request drains on mount and opens a diff, which disables Run.
+    // (Assert via the run button rather than the dynamically-imported diff editor.)
+    await waitFor(() => expect(screen.getByTestId('run-button')).toBeDisabled())
 
     const addResult = vi.spyOn(sqlEditorSessionState, 'addResult')
     // The run button is disabled while diffing; clicking should not execute.
-    expect(screen.getByTestId('run-button')).toBeDisabled()
     fireEvent.click(screen.getByTestId('run-button'))
     // Give any async work a chance to (not) happen.
     await new Promise((r) => setTimeout(r, 20))