diff --git a/src/Ruleset.php b/src/Ruleset.php
index 34795889b6..2c243c0c9e 100644
--- a/src/Ruleset.php
+++ b/src/Ruleset.php
@@ -123,6 +123,14 @@ class Ruleset
      */
     private $config = null;
 
+    /**
+     * The `<config>` directives which have been applied.
+     *
+     * @var array<string, int> Key is the name of the config. Value is the ruleset depth
+     *                         at which this config was applied (if not overruled from the CLI).
+     */
+    private $configDirectivesApplied = [];
+
     /**
      * An array of the names of sniffs which have been marked as deprecated.
      *
@@ -574,17 +582,36 @@ public function processRuleset($rulesetPath, $depth=0)
         }//end foreach
 
         // Process custom sniff config settings.
+        // Processing rules:
+        // - Highest level ruleset take precedence.
+        // - If the same config is being set from two rulesets at the same level, *last* one "wins".
         foreach ($ruleset->{'config'} as $config) {
             if ($this->shouldProcessElement($config) === false) {
                 continue;
             }
 
-            $this->config->setConfigData((string) $config['name'], (string) $config['value'], true);
-            if (PHP_CODESNIFFER_VERBOSITY > 1) {
+            $name = (string) $config['name'];
+
+            if (isset($this->configDirectivesApplied[$name]) === true
+                && $this->configDirectivesApplied[$name] < $depth
+            ) {
+                // Ignore this config. A higher level ruleset has already set a value for this directive.
+                if (PHP_CODESNIFFER_VERBOSITY > 1) {
+                    echo str_repeat("\t", $depth);
+                    echo "\t=> ignoring config value ".$name.': '.(string) $config['value'].' => already changed by a higher level ruleset '.PHP_EOL;
+                }
+
+                continue;
+            }
+
+            $this->configDirectivesApplied[$name] = $depth;
+
+            $applied = $this->config->setConfigData($name, (string) $config['value'], true);
+            if ($applied === true && PHP_CODESNIFFER_VERBOSITY > 1) {
                 echo str_repeat("\t", $depth);
-                echo "\t=> set config value ".(string) $config['name'].': '.(string) $config['value'].PHP_EOL;
+                echo "\t=> set config value ".$name.': '.(string) $config['value'].PHP_EOL;
             }
-        }
+        }//end foreach
 
         foreach ($ruleset->rule as $rule) {
             if (isset($rule['ref']) === false
diff --git a/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesATest.xml b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesATest.xml
new file mode 100644
index 0000000000..d97a9e7e40
--- /dev/null
+++ b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesATest.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="ProcessRulesetConfigDirectivesTest" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/PHPCSStandards/PHP_CodeSniffer/master/phpcs.xsd">
+
+    <!-- This ruleset sets two config directives.
+         All included rulesets will try to override these and should fail.
+         Whether the config is set before, or after, the sub-rulesets are included, should be irrelevant.
+    -->
+    <config name="expectValueFromParentATestSetBeforeIncludes" value="parent A"/>
+
+    <!-- Include the overrides. -->
+    <rule ref="./ProcessRulesetConfigDirectivesIncludeATest.xml"/>
+    <rule ref="./ProcessRulesetConfigDirectivesIncludeBTest.xml"/>
+
+    <config name="expectValueFromParentATestSetAfterIncludes" value="parent A"/>
+
+    <!-- This directive should not be applied. Last included ruleset (parent B) should win. -->
+    <config name="expectValueFromParentBTest" value="parent A"/>
+
+    <!-- Prevent a "no sniffs were registered" error. -->
+    <rule ref="Generic.PHP.BacktickOperator"/>
+</ruleset>
diff --git a/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesBTest.xml b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesBTest.xml
new file mode 100644
index 0000000000..cac6030ea1
--- /dev/null
+++ b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesBTest.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="ProcessRulesetConfigDirectivesTest" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/PHPCSStandards/PHP_CodeSniffer/master/phpcs.xsd">
+
+    <!-- For this config directive, this is the "highest" level, but the directive is also set in the "parent A"
+         ruleset, which is at the same "level".
+         In that case, the value which "wins" is determined by the order in which the rulesets are included.
+         In this case, that means that "parent B" should win as "parent A" is included _before_ parent B (via the CLI args),
+         so the value from "parent B" overwrites the value from the earlier read "parent A".
+    -->
+    <config name="expectValueFromParentBTest" value="parent B"/>
+
+    <!-- For this config directive, this is the "highest" level, but the directive is also set in the "grandchild B" ruleset.
+         Highest level should win, independently of whether the grandchild is a child of this ruleset, or of another ruleset.
+    -->
+    <config name="expectValueFromParentBTestAlsoInGrandChildB" value="parent B"/>
+
+</ruleset>
diff --git a/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesIncludeATest.xml b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesIncludeATest.xml
new file mode 100644
index 0000000000..b336d3b96c
--- /dev/null
+++ b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesIncludeATest.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="ProcessRulesetConfigDirectivesTest" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/PHPCSStandards/PHP_CodeSniffer/master/phpcs.xsd">
+
+    <!-- This config directive should not be applied. Root should win. -->
+    <config name="expectValueFromParentATestSetBeforeIncludes" value="child A"/>
+
+    <!-- For this config directive, this is the "highest" level, so this one should be applied.
+         The included (grand)child ruleset will try to override this.
+    -->
+    <config name="expectValueFromChildATestSetBeforeIncludes" value="child A"/>
+
+    <!-- This directive should not be applied. Last included ruleset (child B) should win. -->
+    <config name="expectValueFromChildBTestInChildAAndChildB" value="child A"/>
+
+    <!-- Include the overrides. -->
+    <rule ref="./ProcessRulesetConfigDirectivesSubIncludeATest.xml"/>
+    <rule ref="./ProcessRulesetConfigDirectivesSubIncludeBTest.xml"/>
+
+    <!-- For this config directive, this is the "highest" level, so this one should be applied.
+         The included (grand)child ruleset will try to override this.
+    -->
+    <config name="expectValueFromChildATestSetAfterIncludes" value="child A"/>
+
+    <!-- This config directive should not be applied. Root should win. -->
+    <config name="expectValueFromParentATestSetAfterIncludes" value="child A"/>
+
+</ruleset>
diff --git a/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesIncludeBTest.xml b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesIncludeBTest.xml
new file mode 100644
index 0000000000..39a1e3f059
--- /dev/null
+++ b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesIncludeBTest.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="ProcessRulesetConfigDirectivesTest" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/PHPCSStandards/PHP_CodeSniffer/master/phpcs.xsd">
+
+    <!-- These config directives should not be applied. Root should win. -->
+    <config name="expectValueFromParentATestSetBeforeIncludes" value="child B"/>
+    <config name="expectValueFromParentATestSetAfterIncludes" value="child B"/>
+
+    <!-- For this config directive, this is the "highest" level, but the directive is also set in the "child A"
+         ruleset, which is at the same "level".
+         In that case, the value which "wins" is determined by the order in which the rulesets are included.
+         In this case, that means that "child B" should win as "child A" is included _before_ child B (from the root ruleset),
+         so the value from "child B" overwrites the value from the earlier read "child A".
+    -->
+    <config name="expectValueFromChildBTestInChildAAndChildB" value="child B"/>
+
+    <!-- For this config directive, this is the "highest" level, but the directive is also set in the "grandchild A" ruleset.
+         Highest level should win, independently of whether the grandchild is a child of this ruleset, or of another ruleset.
+    -->
+    <config name="expectValueFromChildBTestAlsoInGrandChildA" value="child B"/>
+
+    <!-- This directive is only set in this ruleset, so should be applied. -->
+    <config name="expectValueFromChildBTest" value="child B"/>
+
+</ruleset>
diff --git a/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesSubIncludeATest.xml b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesSubIncludeATest.xml
new file mode 100644
index 0000000000..4a606dca8c
--- /dev/null
+++ b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesSubIncludeATest.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="ProcessRulesetConfigDirectivesTest" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/PHPCSStandards/PHP_CodeSniffer/master/phpcs.xsd">
+
+    <!-- These config directives should not be applied. Root should win. -->
+    <config name="expectValueFromParentATestSetBeforeIncludes" value="grandchild A"/>
+    <config name="expectValueFromParentATestSetAfterIncludes" value="grandchild A"/>
+
+    <!-- This directive should not be applied. Child A should win. -->
+    <config name="expectValueFromChildATestSetBeforeIncludes" value="grandchild A"/>
+
+    <!-- This directive should not be applied. Child B should win. -->
+    <config name="expectValueFromChildBTestAlsoInGrandChildA" value="grandchild A"/>
+
+    <!-- This directive is only set in this ruleset, so should be applied. -->
+    <config name="expectValueFromGrandChildATest" value="grandchild A"/>
+
+</ruleset>
diff --git a/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesSubIncludeBTest.xml b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesSubIncludeBTest.xml
new file mode 100644
index 0000000000..d03b92c1a0
--- /dev/null
+++ b/tests/Core/Ruleset/Fixtures/ProcessRulesetConfigDirectivesTest/ProcessRulesetConfigDirectivesSubIncludeBTest.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="ProcessRulesetConfigDirectivesTest" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/PHPCSStandards/PHP_CodeSniffer/master/phpcs.xsd">
+
+    <!-- These config directives should not be applied. Root should win. -->
+    <config name="expectValueFromParentATestSetBeforeIncludes" value="grandchild B"/>
+    <config name="expectValueFromParentATestSetAfterIncludes" value="grandchild B"/>
+
+    <!-- This directive should not be applied. Child A should win. -->
+    <config name="expectValueFromChildATestSetAfterIncludes" value="grandchild B"/>
+
+    <!-- This directive should not be applied. Parent B should win. -->
+    <config name="expectValueFromParentBTestAlsoInGrandChildB" value="grandchild B"/>
+
+    <!-- This directive is only set in this ruleset, so should be applied. -->
+    <config name="expectValueFromGrandChildBTest" value="grandchild B"/>
+
+</ruleset>
diff --git a/tests/Core/Ruleset/ProcessRulesetConfigDirectivesTest.php b/tests/Core/Ruleset/ProcessRulesetConfigDirectivesTest.php
new file mode 100644
index 0000000000..b98ec63112
--- /dev/null
+++ b/tests/Core/Ruleset/ProcessRulesetConfigDirectivesTest.php
@@ -0,0 +1,153 @@
+<?php
+/**
+ * Tests for the \PHP_CodeSniffer\Ruleset class.
+ *
+ * @copyright 2025 PHPCSStandards and contributors
+ * @license   https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/master/licence.txt BSD Licence
+ */
+
+namespace PHP_CodeSniffer\Tests\Core\Ruleset;
+
+use PHP_CodeSniffer\Ruleset;
+use PHP_CodeSniffer\Tests\ConfigDouble;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Tests for the \PHP_CodeSniffer\Ruleset class.
+ *
+ * @covers \PHP_CodeSniffer\Ruleset::processRuleset
+ */
+final class ProcessRulesetConfigDirectivesTest extends TestCase
+{
+
+    /**
+     * Directory in which the XML fixtures for this test can be found (without trailing slash).
+     *
+     * @var string
+     */
+    private const FIXTURE_DIR = __DIR__.'/Fixtures/ProcessRulesetConfigDirectivesTest';
+
+    /**
+     * The Config object.
+     *
+     * @var \PHP_CodeSniffer\Config
+     */
+    private static $config;
+
+
+    /**
+     * Initialize the config and ruleset objects for this test only once (but do allow recording code coverage).
+     *
+     * @return void
+     */
+    protected function setUp(): void
+    {
+        if (isset(self::$config) === false) {
+            // Set up the ruleset.
+            $standardA    = self::FIXTURE_DIR.'/ProcessRulesetConfigDirectivesATest.xml';
+            $standardB    = self::FIXTURE_DIR.'/ProcessRulesetConfigDirectivesBTest.xml';
+            self::$config = new ConfigDouble(["--standard=$standardA,$standardB"]);
+            new Ruleset(self::$config);
+        }
+
+    }//end setUp()
+
+
+    /**
+     * Make sure the Config object is destroyed.
+     *
+     * @return void
+     */
+    public static function tearDownAfterClass(): void
+    {
+        // Explicitly trigger __destruct() on the ConfigDouble to reset the Config statics.
+        // The explicit method call prevents potential stray test-local references to the $config object
+        // preventing the destructor from running the clean up (which without stray references would be
+        // automagically triggered when this object is destroyed, but we can't definitively rely on that).
+        if (isset(self::$config) === true) {
+            self::$config->__destruct();
+        }
+
+    }//end tearDownAfterClass()
+
+
+    /**
+     * Verify the config directives are set based on the nesting level of the ruleset.
+     *
+     * - Highest level ruleset (root) should win over lower level (included) ruleset.
+     * - When two rulesets at the same "level" both set the same config, last included ruleset should win.
+     * - But if no higher level ruleset sets the value, the values from lowel levels should be applied.
+     * - The order of includes versus config directives in a ruleset file is deliberately irrelevant.
+     *
+     * @param string $name     The name of the config setting we're checking.
+     * @param string $expected The expected value for that config setting.
+     *
+     * @dataProvider dataConfigDirectives
+     *
+     * @return void
+     */
+    public function testConfigDirectives($name, $expected)
+    {
+        $this->assertSame($expected, self::$config->getConfigData($name));
+
+    }//end testConfigDirectives()
+
+
+    /**
+     * Data provider.
+     *
+     * @return array<string, array<string, string>>
+     */
+    public static function dataConfigDirectives()
+    {
+        return [
+            'Config set in parent A before includes; all includes try to overrule; parent A should win'           => [
+                'name'     => 'expectValueFromParentATestSetBeforeIncludes',
+                'expected' => 'parent A',
+            ],
+            'Config set in parent A after includes; all includes try to overrule; parent A should win'            => [
+                'name'     => 'expectValueFromParentATestSetAfterIncludes',
+                'expected' => 'parent A',
+            ],
+            'Config set in both parent A and parent B; B is included last via CLI; parent B should win'           => [
+                'name'     => 'expectValueFromParentBTest',
+                'expected' => 'parent B',
+            ],
+            'Config set in parent B; also set in non-direct grandchild B; parent B should win'                    => [
+                'name'     => 'expectValueFromParentBTestAlsoInGrandChildB',
+                'expected' => 'parent B',
+            ],
+            'Config set in child A before includes; also set in grandchild A; child A should win'                 => [
+                'name'     => 'expectValueFromChildATestSetBeforeIncludes',
+                'expected' => 'child A',
+            ],
+            'Config set in child A after includes; also set in grandchild B; child A should win'                  => [
+                'name'     => 'expectValueFromChildATestSetAfterIncludes',
+                'expected' => 'child A',
+            ],
+            'Config set in both child A and child B; B is included last via ruleset includes; child B should win' => [
+                'name'     => 'expectValueFromChildBTestInChildAAndChildB',
+                'expected' => 'child B',
+            ],
+            'Config set in child B; also set in non-direct grandchild A, child B should win'                      => [
+                'name'     => 'expectValueFromChildBTestAlsoInGrandChildA',
+                'expected' => 'child B',
+            ],
+            'Config set in child B - no overrules'                                                                => [
+                'name'     => 'expectValueFromChildBTest',
+                'expected' => 'child B',
+            ],
+            'Config set in grandchild A ruleset - no overrules'                                                   => [
+                'name'     => 'expectValueFromGrandChildATest',
+                'expected' => 'grandchild A',
+            ],
+            'Config set in grandchild B ruleset - no overrules'                                                   => [
+                'name'     => 'expectValueFromGrandChildBTest',
+                'expected' => 'grandchild B',
+            ],
+        ];
+
+    }//end dataConfigDirectives()
+
+
+}//end class