diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics.yaml b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-main.yaml
similarity index 96%
rename from config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics.yaml
rename to config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-main.yaml
index 0bd3bf596392..86dd40b4c19e 100644
--- a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics.yaml
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-main.yaml
@@ -1,3 +1,4 @@
+# Code generated by cluster-api's prowjob-gen. DO NOT EDIT.
 periodics:
 - name: periodic-cluster-api-provider-aws-e2e
   cluster: eks-prow-build-cluster
@@ -22,7 +23,7 @@ periodics:
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
   spec:
     containers:
-    - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+    - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
       command:
         - "runner.sh"
         - "./scripts/ci-e2e.sh"
@@ -71,7 +72,7 @@ periodics:
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
   spec:
     containers:
-    - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+    - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
       command:
         - "runner.sh"
         - "./scripts/ci-e2e.sh"
@@ -119,7 +120,7 @@ periodics:
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
   spec:
     containers:
-    - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+    - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
       command:
         - "runner.sh"
         - "./scripts/ci-e2e-eks.sh"
@@ -165,7 +166,7 @@ periodics:
       path_alias: "sigs.k8s.io/cluster-api-provider-aws"
   spec:
     containers:
-      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
         command:
           - "runner.sh"
           - "./scripts/ci-conformance.sh"
@@ -223,7 +224,7 @@ periodics:
       path_alias: k8s.io/kubernetes
   spec:
     containers:
-      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
         env:
           - name: BOSKOS_HOST
             value: "boskos.test-pods.svc.cluster.local"
@@ -274,7 +275,7 @@ periodics:
       path_alias: k8s.io/test-infra
   spec:
     containers:
-      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
         command:
           - runner.sh
           - bash
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.7.yaml b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.7.yaml
index 3f7e0c9b84fe..3f8aa50766a4 100644
--- a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.7.yaml
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.7.yaml
@@ -1,9 +1,14 @@
+# Code generated by cluster-api's prowjob-gen. DO NOT EDIT.
 periodics:
 - name: periodic-cluster-api-provider-aws-e2e-release-2-7
   cluster: eks-prow-build-cluster
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   labels:
     preset-dind-enabled: "true"
@@ -49,6 +54,10 @@ periodics:
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   labels:
     preset-dind-enabled: "true"
@@ -93,6 +102,10 @@ periodics:
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   labels:
     preset-dind-enabled: "true"
@@ -135,6 +148,10 @@ periodics:
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   labels:
     preset-dind-enabled: "true"
@@ -187,6 +204,10 @@ periodics:
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   extra_refs:
     - org: kubernetes-sigs
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.8.yaml b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.8.yaml
index cd671827c0ab..bdef1292822f 100644
--- a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.8.yaml
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.8.yaml
@@ -1,9 +1,14 @@
+# Code generated by cluster-api's prowjob-gen. DO NOT EDIT.
 periodics:
 - name: periodic-cluster-api-provider-aws-e2e-release-2-8
   cluster: eks-prow-build-cluster
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   labels:
     preset-dind-enabled: "true"
@@ -49,6 +54,10 @@ periodics:
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   labels:
     preset-dind-enabled: "true"
@@ -93,6 +102,10 @@ periodics:
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   labels:
     preset-dind-enabled: "true"
@@ -135,6 +148,10 @@ periodics:
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   labels:
     preset-dind-enabled: "true"
@@ -187,6 +204,10 @@ periodics:
   decorate: true
   decoration_config:
     timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
   interval: 12h
   extra_refs:
     - org: kubernetes-sigs
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.9.yaml b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.9.yaml
new file mode 100644
index 000000000000..b27eeb29e207
--- /dev/null
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-periodics-release-2.9.yaml
@@ -0,0 +1,257 @@
+# Code generated by cluster-api's prowjob-gen. DO NOT EDIT.
+periodics:
+- name: periodic-cluster-api-provider-aws-e2e-release-2-9
+  cluster: eks-prow-build-cluster
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  extra_refs:
+  - org: kubernetes-sigs
+    repo: cluster-api-provider-aws
+    base_ref: release-2.9
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+  spec:
+    containers:
+    - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+      command:
+        - "runner.sh"
+        - "./scripts/ci-e2e.sh"
+      env:
+      - name: BOSKOS_HOST
+        value: "boskos.test-pods.svc.cluster.local"
+      - name: AWS_REGION
+        value: "us-west-2"
+      # Parallelize tests
+      - name: GINKGO_ARGS
+        value: "-nodes 20 -skip='\\[ClusterClass\\]'"
+      securityContext:
+        privileged: true
+      resources:
+        requests:
+          cpu: 2
+          memory: "9Gi"
+        limits:
+          cpu: 2
+          memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+    testgrid-tab-name: periodic-e2e-release-2-9
+    testgrid-alert-email: sig-cluster-lifecycle-cluster-api-aws-alerts@kubernetes.io
+    testgrid-num-failures-to-alert: "2"
+- name: periodic-cluster-api-provider-aws-e2e-eks-canary-release-2-9
+  cluster: eks-prow-build-cluster
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  extra_refs:
+  - org: kubernetes-sigs
+    repo: cluster-api-provider-aws
+    base_ref: release-2.9
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+  spec:
+    containers:
+    - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+      command:
+        - "runner.sh"
+        - "./scripts/ci-e2e.sh"
+      env:
+      - name: BOSKOS_HOST
+        value: "boskos.test-pods.svc.cluster.local"
+      - name: AWS_REGION
+        value: "us-west-2"
+      # Parallelize tests
+      - name: GINKGO_ARGS
+        value: "-nodes 20 -skip='\\[ClusterClass\\]'"
+      securityContext:
+        privileged: true
+      resources:
+        limits:
+          cpu: 2
+          memory: "9Gi"
+        requests:
+          cpu: 2
+          memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-k8s-infra-canaries
+    testgrid-tab-name: periodic-aws-e2e-release-2-9-canary
+    testgrid-num-columns-recent: "6"
+- name: periodic-cluster-api-provider-aws-eks-e2e-release-2-9
+  cluster: eks-prow-build-cluster
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  extra_refs:
+  - org: kubernetes-sigs
+    repo: cluster-api-provider-aws
+    base_ref: release-2.9
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+  spec:
+    containers:
+    - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+      command:
+        - "runner.sh"
+        - "./scripts/ci-e2e-eks.sh"
+      env:
+      - name: BOSKOS_HOST
+        value: "boskos.test-pods.svc.cluster.local"
+      - name: AWS_REGION
+        value: "us-west-2"
+      securityContext:
+        privileged: true
+      resources:
+        requests:
+          cpu: 2
+          memory: "9Gi"
+        limits:
+          cpu: 2
+          memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+    testgrid-tab-name: periodic-eks-e2e-release-2-9
+    testgrid-alert-email: sig-cluster-lifecycle-cluster-api-aws-alerts@kubernetes.io
+    testgrid-num-failures-to-alert: "2"
+- name: periodic-cluster-api-provider-aws-e2e-conformance-release-2-9
+  cluster: eks-prow-build-cluster
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  extra_refs:
+    - org: kubernetes-sigs
+      repo: cluster-api-provider-aws
+      base_ref: release-2.9
+      path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+  spec:
+    containers:
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+        command:
+          - "runner.sh"
+          - "./scripts/ci-conformance.sh"
+        env:
+          - name: BOSKOS_HOST
+            value: "boskos.test-pods.svc.cluster.local"
+          - name: AWS_REGION
+            value: "us-west-2"
+          # Parallelize tests
+          - name: GINKGO_ARGS
+            value: "-nodes 20"
+        securityContext:
+          privileged: true
+        resources:
+          requests:
+            cpu: 2
+            memory: "9Gi"
+          limits:
+            cpu: 2
+            memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+    testgrid-tab-name: periodic-conformance-release-2-9
+    testgrid-alert-email: sig-cluster-lifecycle-cluster-api-aws-alerts@kubernetes.io
+    testgrid-num-failures-to-alert: "2"
+- name: periodic-cluster-api-provider-aws-e2e-conformance-with-k8s-ci-artifacts-release-2-9
+  cluster: eks-prow-build-cluster
+  max_concurrency: 1
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  extra_refs:
+    - org: kubernetes-sigs
+      repo: cluster-api-provider-aws
+      base_ref: release-2.9
+      path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    - org: kubernetes-sigs
+      repo: image-builder
+      base_ref: main
+      path_alias: "sigs.k8s.io/image-builder"
+    - org: kubernetes
+      repo: kubernetes
+      base_ref: master
+      path_alias: k8s.io/kubernetes
+  spec:
+    containers:
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+        env:
+          - name: BOSKOS_HOST
+            value: "boskos.test-pods.svc.cluster.local"
+          - name: AWS_REGION
+            value: "us-west-2"
+          - name: E2E_ARGS
+            value: "-kubetest.use-ci-artifacts"
+          # Parallelize tests
+          - name: GINKGO_ARGS
+            value: "-nodes 20"
+        command:
+          - "runner.sh"
+          - "./scripts/ci-conformance.sh"
+        # we need privileged mode in order to do docker in docker
+        securityContext:
+          privileged: true
+        resources:
+          requests:
+            # these are both a bit below peak usage during build
+            # this is mostly for building kubernetes
+            memory: "9Gi"
+            cpu: 2
+          limits:
+            cpu: 2
+            memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+    testgrid-tab-name: periodic-conformance-release-2-9-k8s-main
+    testgrid-num-columns-recent: '20'
+    testgrid-alert-email: release-team@kubernetes.io, sig-cluster-lifecycle-cluster-api-aws-alerts@kubernetes.io
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits.yaml b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-main.yaml
similarity index 94%
rename from config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits.yaml
rename to config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-main.yaml
index 74b59dac600a..47afbb744e25 100644
--- a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits.yaml
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-main.yaml
@@ -1,9 +1,9 @@
+# Code generated by cluster-api's prowjob-gen. DO NOT EDIT.
 presubmits:
   kubernetes-sigs/cluster-api-provider-aws:
   - name: pull-cluster-api-provider-aws-test
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^main$
     always_run: true
     optional: false
@@ -15,7 +15,7 @@ presubmits:
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     spec:
       containers:
-      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
         command:
         - "./scripts/ci-test.sh"
         resources:
@@ -41,14 +41,13 @@ presubmits:
     labels:
       preset-service-account: "true"
     branches:
-    # The script this job runs is not in all branches.
     - ^main$
     spec:
       containers:
       - command:
         - runner.sh
         - ./scripts/ci-apidiff.sh
-        image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+        image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
         resources:
           requests:
             cpu: 7300m
@@ -65,9 +64,11 @@ presubmits:
     optional: false
     decorate: true
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    branches:
+    - ^main$
     spec:
       containers:
-      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
         command:
         - "./scripts/ci-build.sh"
         resources:
@@ -93,9 +94,11 @@ presubmits:
         - org: kubernetes-sigs
           slug: cluster-api-provider-aws-maintainers
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    branches:
+    - ^main$
     spec:
       containers:
-      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
         command:
         - runner.sh
         args:
@@ -117,14 +120,13 @@ presubmits:
     cluster: eks-prow-build-cluster
     always_run: true
     branches:
-    # The script this job runs is not in all branches.
     - ^main$
     optional: false
     decorate: true
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     spec:
       containers:
-      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
         command:
         - "runner.sh"
         - "make"
@@ -148,7 +150,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-conformance
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^main$
     labels:
       preset-dind-enabled: "true"
@@ -178,7 +179,7 @@ presubmits:
       path_alias: k8s.io/kubernetes
     spec:
       containers:
-        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
           command:
             - "runner.sh"
             - "./scripts/ci-conformance.sh"
@@ -207,7 +208,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-conformance-with-ci-artifacts
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^main$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
@@ -228,7 +228,7 @@ presubmits:
       preset-aws-credential: "true"
     spec:
       containers:
-        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
           command:
             - "runner.sh"
             - "./scripts/ci-conformance.sh"
@@ -255,8 +255,7 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-blocking
     cluster: eks-prow-build-cluster
     branches:
-      # The script this job runs is not in all branches.
-      - ^main$
+    - ^main$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     #run_if_changed: '^((api|bootstrap|cmd|config|controllers|controlplane|exp|feature|hack|pkg|test|util)/|main\.go|go\.mod|go\.sum|Dockerfile|Makefile)'
     always_run: true
@@ -277,7 +276,7 @@ presubmits:
       preset-aws-credential: "true"
     spec:
       containers:
-        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
           command:
             - "runner.sh"
             - "./scripts/ci-e2e.sh"
@@ -307,7 +306,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^main$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
@@ -328,7 +326,7 @@ presubmits:
       preset-aws-credential: "true"
     spec:
       containers:
-        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
           command:
             - "runner.sh"
             - "./scripts/ci-e2e.sh"
@@ -353,7 +351,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-eks
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^main$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
@@ -374,7 +371,7 @@ presubmits:
       preset-aws-credential: "true"
     spec:
       containers:
-        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
           command:
             - "runner.sh"
             - "./scripts/ci-e2e-eks.sh"
@@ -399,7 +396,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-eks-gc
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^main$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
@@ -420,7 +416,7 @@ presubmits:
       preset-aws-credential: "true"
     spec:
       containers:
-        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
           command:
             - "runner.sh"
             - "./scripts/ci-e2e-eks-gc.sh"
@@ -445,7 +441,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-eks-testing
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^main$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
@@ -466,7 +461,7 @@ presubmits:
       preset-aws-credential: "true"
     spec:
       containers:
-        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33
           command:
             - "runner.sh"
             - "./scripts/ci-e2e-eks.sh"
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.7.yaml b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.7.yaml
index e2afbae951a9..37f936322e90 100644
--- a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.7.yaml
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.7.yaml
@@ -1,13 +1,17 @@
+# Code generated by cluster-api's prowjob-gen. DO NOT EDIT.
 presubmits:
   kubernetes-sigs/cluster-api-provider-aws:
   - name: pull-cluster-api-provider-aws-test-release-2-7
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     always_run: true
     optional: false
     decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     spec:
       containers:
@@ -27,13 +31,16 @@ presubmits:
   - name: pull-cluster-api-provider-aws-apidiff-release-2-7
     cluster: eks-prow-build-cluster
     decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     path_alias: sigs.k8s.io/cluster-api-provider-aws
     always_run: true
     optional: true
     labels:
       preset-service-account: "true"
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     spec:
       containers:
@@ -58,7 +65,6 @@ presubmits:
     decorate: true
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     spec:
       containers:
@@ -83,9 +89,12 @@ presubmits:
     always_run: true
     optional: false
     decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     spec:
       containers:
@@ -103,7 +112,7 @@ presubmits:
             memory: "8Gi"
         # docker-in-docker needs privileged mode
         securityContext:
-            privileged: true
+          privileged: true
     annotations:
       testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
       testgrid-tab-name: pr-build-docker-release-2-7
@@ -111,7 +120,6 @@ presubmits:
     cluster: eks-prow-build-cluster
     always_run: true
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     optional: false
     decorate: true
@@ -142,7 +150,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-conformance-release-2-7
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     labels:
       preset-dind-enabled: "true"
@@ -156,6 +163,10 @@ presubmits:
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     extra_refs:
     - org: kubernetes-sigs
@@ -196,8 +207,7 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-blocking-release-2-7
     cluster: eks-prow-build-cluster
     branches:
-      # The script this job runs is not in all branches.
-      - ^release-2.7$
+    - ^release-2.7$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     #run_if_changed: '^((api|bootstrap|cmd|config|controllers|controlplane|exp|feature|hack|pkg|test|util)/|main\.go|go\.mod|go\.sum|Dockerfile|Makefile)'
     always_run: false
@@ -205,6 +215,10 @@ presubmits:
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
@@ -244,7 +258,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-release-2-7
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
@@ -252,6 +265,10 @@ presubmits:
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
@@ -286,7 +303,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-eks-release-2-7
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
@@ -294,6 +310,10 @@ presubmits:
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
@@ -328,7 +348,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-eks-gc-release-2-7
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
@@ -336,6 +355,10 @@ presubmits:
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
@@ -370,7 +393,6 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-eks-testing-release-2-7
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
     - ^release-2.7$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
@@ -378,6 +400,10 @@ presubmits:
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.8.yaml b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.8.yaml
index 93eb0fd7bd96..188d0c14c52e 100644
--- a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.8.yaml
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.8.yaml
@@ -1,13 +1,17 @@
+# Code generated by cluster-api's prowjob-gen. DO NOT EDIT.
 presubmits:
   kubernetes-sigs/cluster-api-provider-aws:
   - name: pull-cluster-api-provider-aws-test-release-2-8
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     always_run: true
     optional: false
     decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     spec:
       containers:
@@ -27,14 +31,17 @@ presubmits:
   - name: pull-cluster-api-provider-aws-apidiff-release-2-8
     cluster: eks-prow-build-cluster
     decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     path_alias: sigs.k8s.io/cluster-api-provider-aws
     always_run: true
     optional: true
     labels:
       preset-service-account: "true"
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     spec:
       containers:
       - command:
@@ -58,8 +65,7 @@ presubmits:
     decorate: true
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     spec:
       containers:
       - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
@@ -83,10 +89,13 @@ presubmits:
     always_run: true
     optional: false
     decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     spec:
       containers:
       - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30
@@ -103,7 +112,7 @@ presubmits:
             memory: "8Gi"
         # docker-in-docker needs privileged mode
         securityContext:
-            privileged: true
+          privileged: true
     annotations:
       testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
       testgrid-tab-name: pr-build-docker-release-2-8
@@ -111,8 +120,7 @@ presubmits:
     cluster: eks-prow-build-cluster
     always_run: true
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     optional: false
     decorate: true
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
@@ -142,8 +150,7 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-conformance-release-2-8
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     labels:
       preset-dind-enabled: "true"
       preset-kind-volume-mounts: "true"
@@ -156,6 +163,10 @@ presubmits:
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     extra_refs:
     - org: kubernetes-sigs
@@ -197,14 +208,17 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-conformance-with-ci-artifacts-release-2-8
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
     optional: true
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
@@ -241,8 +255,7 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-blocking-release-2-8
     cluster: eks-prow-build-cluster
     branches:
-      # The script this job runs is not in all branches.
-      - ^release-2-8$
+    - ^release-2.8$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     #run_if_changed: '^((api|bootstrap|cmd|config|controllers|controlplane|exp|feature|hack|pkg|test|util)/|main\.go|go\.mod|go\.sum|Dockerfile|Makefile)'
     always_run: false
@@ -250,6 +263,10 @@ presubmits:
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
@@ -289,14 +306,17 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-release-2-8
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
     optional: true
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
@@ -331,14 +351,17 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-eks-release-2-8
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
     optional: true
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
@@ -373,14 +396,17 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-eks-gc-release-2-8
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
     optional: true
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
@@ -415,14 +441,17 @@ presubmits:
   - name: pull-cluster-api-provider-aws-e2e-eks-testing-release-2-8
     cluster: eks-prow-build-cluster
     branches:
-    # The script this job runs is not in all branches.
-    - ^release-2-8$
+    - ^release-2.8$
     path_alias: "sigs.k8s.io/cluster-api-provider-aws"
     always_run: false
     optional: true
     decorate: true
     decoration_config:
       timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
     max_concurrency: 1
     labels:
       preset-dind-enabled: "true"
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.9.yaml b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.9.yaml
new file mode 100644
index 000000000000..eeec65e7321c
--- /dev/null
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-presubmits-release-2.9.yaml
@@ -0,0 +1,487 @@
+# Code generated by cluster-api's prowjob-gen. DO NOT EDIT.
+presubmits:
+  kubernetes-sigs/cluster-api-provider-aws:
+  - name: pull-cluster-api-provider-aws-test-release-2-9
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^release-2.9$
+    always_run: true
+    optional: false
+    decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    spec:
+      containers:
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+        command:
+        - "./scripts/ci-test.sh"
+        resources:
+          requests:
+            cpu: "8"
+            memory: "16Gi"
+          limits:
+            cpu: "8"
+            memory: "16Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-test-release-2-9
+  - name: pull-cluster-api-provider-aws-apidiff-release-2-9
+    cluster: eks-prow-build-cluster
+    decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    path_alias: sigs.k8s.io/cluster-api-provider-aws
+    always_run: true
+    optional: true
+    labels:
+      preset-service-account: "true"
+    branches:
+    - ^release-2.9$
+    spec:
+      containers:
+      - command:
+        - runner.sh
+        - ./scripts/ci-apidiff.sh
+        image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+        resources:
+          requests:
+            cpu: 7300m
+            memory: 9Gi
+          limits:
+            cpu: 7300m
+            memory: 9Gi
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-apidiff-release-2-9
+  - name: pull-cluster-api-provider-aws-build-release-2-9
+    cluster: eks-prow-build-cluster
+    always_run: true
+    optional: false
+    decorate: true
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    branches:
+    - ^release-2.9$
+    spec:
+      containers:
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+        command:
+        - "./scripts/ci-build.sh"
+        resources:
+          requests:
+            cpu: "4"
+            memory: "8Gi"
+          limits:
+            cpu: "4"
+            memory: "8Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-build-release-2-9
+  - name: pull-cluster-api-provider-aws-build-docker-release-2-9
+    cluster: eks-prow-build-cluster
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+    always_run: true
+    optional: false
+    decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    branches:
+    - ^release-2.9$
+    spec:
+      containers:
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+        command:
+        - runner.sh
+        args:
+        - ./scripts/ci-docker-build.sh
+        resources:
+          requests:
+            cpu: "4"
+            memory: "8Gi"
+          limits:
+            cpu: "4"
+            memory: "8Gi"
+        # docker-in-docker needs privileged mode
+        securityContext:
+          privileged: true
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-build-docker-release-2-9
+  - name: pull-cluster-api-provider-aws-verify-release-2-9
+    cluster: eks-prow-build-cluster
+    always_run: true
+    branches:
+    - ^release-2.9$
+    optional: false
+    decorate: true
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    spec:
+      containers:
+      - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+        command:
+        - "runner.sh"
+        - "make"
+        - "verify"
+        resources:
+          requests:
+            cpu: "4"
+            memory: "8Gi"
+          limits:
+            cpu: "4"
+            memory: "8Gi"
+        # docker-in-docker needs privileged mode
+        securityContext:
+            privileged: true
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-verify-release-2-9
+    labels:
+      preset-dind-enabled: "true"
+  # conformance test
+  - name: pull-cluster-api-provider-aws-e2e-conformance-release-2-9
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^release-2.9$
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 1
+    extra_refs:
+    - org: kubernetes-sigs
+      repo: image-builder
+      base_ref: main
+      path_alias: "sigs.k8s.io/image-builder"
+    - org: kubernetes
+      repo: kubernetes
+      base_ref: master
+      path_alias: k8s.io/kubernetes
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+          command:
+            - "runner.sh"
+            - "./scripts/ci-conformance.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+          # we need privileged mode in order to do docker in docker
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              # these are both a bit below peak usage during build
+              # this is mostly for building kubernetes
+              memory: "9Gi"
+              cpu: 2
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-conformance-release-2-9
+      testgrid-num-columns-recent: '20'
+  # conformance test against kubernetes main branch with `kind` + cluster-api-provider-aws
+  - name: pull-cluster-api-provider-aws-e2e-conformance-with-ci-artifacts-release-2-9
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^release-2.9$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 1
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+          command:
+            - "runner.sh"
+            - "./scripts/ci-conformance.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+            - name: E2E_ARGS
+              value: "-kubetest.use-ci-artifacts"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-conformance-release-2-9-k8s-main
+      testgrid-num-columns-recent: '20'
+  - name: pull-cluster-api-provider-aws-e2e-blocking-release-2-9
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^release-2.9$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    #run_if_changed: '^((api|bootstrap|cmd|config|controllers|controlplane|exp|feature|hack|pkg|test|util)/|main\.go|go\.mod|go\.sum|Dockerfile|Makefile)'
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 2h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 3
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e.sh"
+          env:
+            - name: GINKGO_FOCUS
+              value: "\\[PR-Blocking\\]"
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+            # Parallelize tests
+            - name: GINKGO_ARGS
+              value: "-nodes 20"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-quick-e2e-release-2-9
+      testgrid-num-columns-recent: '20'
+  - name: pull-cluster-api-provider-aws-e2e-release-2-9
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^release-2.9$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 2
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-e2e-release-2-9
+      testgrid-num-columns-recent: '20'
+  - name: pull-cluster-api-provider-aws-e2e-eks-release-2-9
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^release-2.9$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 2
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e-eks.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-e2e-eks-release-2-9
+      testgrid-num-columns-recent: '20'
+  - name: pull-cluster-api-provider-aws-e2e-eks-gc-release-2-9
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^release-2.9$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 1
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e-eks-gc.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+          securityContext:
+            privileged: true
+          resources:
+            limits:
+              cpu: 2
+              memory: "9Gi"
+            requests:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-e2e-eks-gc-release-2-9
+      testgrid-num-columns-recent: '20'
+  - name: pull-cluster-api-provider-aws-e2e-eks-testing-release-2-9
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^release-2.9$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 1
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e-eks.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+            - name: GINKGO_ARGS
+              value: "-nodes 2"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-e2e-eks-release-2-9-testing
+      testgrid-num-columns-recent: '20'
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-prowjob-gen.yaml b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-prowjob-gen.yaml
new file mode 100644
index 000000000000..ec49d4b8e165
--- /dev/null
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/cluster-api-provider-aws-prowjob-gen.yaml
@@ -0,0 +1,26 @@
+# This is the configuration file for cluster-apis prowjob-generator which is located
+# at: https://github.com/kubernetes-sigs/cluster-api/blob/main/hack/tools/prowjob-generator/
+# This configuration is used to generate the presubmits and periodics for cluster-api-provider-vsphere.
+
+# prow_ignored is a well known, unparsed field where non-Prow fields can
+# be defined without conflicting with unknown field validation.
+prow_ignored:
+  # Branch specific configuration: for each configured branch the generator will create two
+  # prowjob configuration files (presubmits, periodics)
+  branches:
+    main:
+      testImage: "gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.33"
+    release-2.9:
+      testImage: "gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250904-c89b045f57-1.32"
+    release-2.8:
+      testImage: "gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30"
+    release-2.7:
+      testImage: "gcr.io/k8s-staging-test-infra/kubekins-e2e:v20250714-70266d743a-1.30"
+
+  # The generator will run each template per branch and use a the name template
+  # to generate the target filename.
+  templates:
+  - name: "cluster-api-provider-aws-periodics.yaml.tpl"
+    template: 'cluster-api-provider-aws-periodics-{{ .branch }}.yaml'
+  - name: "cluster-api-provider-aws-presubmits.yaml.tpl"
+    template: 'cluster-api-provider-aws-presubmits-{{ .branch }}.yaml'
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/templates/cluster-api-provider-aws-periodics.yaml.tpl b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/templates/cluster-api-provider-aws-periodics.yaml.tpl
new file mode 100644
index 000000000000..2534f8964164
--- /dev/null
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/templates/cluster-api-provider-aws-periodics.yaml.tpl
@@ -0,0 +1,303 @@
+periodics:
+- name: periodic-cluster-api-provider-aws-e2e{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+  cluster: eks-prow-build-cluster
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  extra_refs:
+  - org: kubernetes-sigs
+    repo: cluster-api-provider-aws
+    base_ref: {{ $.branch }}
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+  spec:
+    containers:
+    - image: {{ $.config.TestImage }}
+      command:
+        - "runner.sh"
+        - "./scripts/ci-e2e.sh"
+      env:
+      - name: BOSKOS_HOST
+        value: "boskos.test-pods.svc.cluster.local"
+      - name: AWS_REGION
+        value: "us-west-2"
+      # Parallelize tests
+      - name: GINKGO_ARGS
+        value: "-nodes 20 -skip='\\[ClusterClass\\]'"
+      securityContext:
+        privileged: true
+      resources:
+        requests:
+          cpu: 2
+          memory: "9Gi"
+        limits:
+          cpu: 2
+          memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+    testgrid-tab-name: periodic-e2e-{{ ReplaceAll $.branch "." "-" }}
+    testgrid-alert-email: sig-cluster-lifecycle-cluster-api-aws-alerts@kubernetes.io
+    testgrid-num-failures-to-alert: "2"
+- name: periodic-cluster-api-provider-aws-e2e-eks-canary{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+  cluster: eks-prow-build-cluster
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  extra_refs:
+  - org: kubernetes-sigs
+    repo: cluster-api-provider-aws
+    base_ref: {{ $.branch }}
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+  spec:
+    containers:
+    - image: {{ $.config.TestImage }}
+      command:
+        - "runner.sh"
+        - "./scripts/ci-e2e.sh"
+      env:
+      - name: BOSKOS_HOST
+        value: "boskos.test-pods.svc.cluster.local"
+      - name: AWS_REGION
+        value: "us-west-2"
+      # Parallelize tests
+      - name: GINKGO_ARGS
+        value: "-nodes 20 -skip='\\[ClusterClass\\]'"
+      securityContext:
+        privileged: true
+      resources:
+        limits:
+          cpu: 2
+          memory: "9Gi"
+        requests:
+          cpu: 2
+          memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-k8s-infra-canaries
+    testgrid-tab-name: periodic-aws-e2e-{{ ReplaceAll $.branch "." "-" }}-canary
+    testgrid-num-columns-recent: "6"
+- name: periodic-cluster-api-provider-aws-eks-e2e{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+  cluster: eks-prow-build-cluster
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  extra_refs:
+  - org: kubernetes-sigs
+    repo: cluster-api-provider-aws
+    base_ref: {{ $.branch }}
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+  spec:
+    containers:
+    - image: {{ $.config.TestImage }}
+      command:
+        - "runner.sh"
+        - "./scripts/ci-e2e-eks.sh"
+      env:
+      - name: BOSKOS_HOST
+        value: "boskos.test-pods.svc.cluster.local"
+      - name: AWS_REGION
+        value: "us-west-2"
+      securityContext:
+        privileged: true
+      resources:
+        requests:
+          cpu: 2
+          memory: "9Gi"
+        limits:
+          cpu: 2
+          memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+    testgrid-tab-name: periodic-eks-e2e-{{ ReplaceAll $.branch "." "-" }}
+    testgrid-alert-email: sig-cluster-lifecycle-cluster-api-aws-alerts@kubernetes.io
+    testgrid-num-failures-to-alert: "2"
+- name: periodic-cluster-api-provider-aws-e2e-conformance{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+  cluster: eks-prow-build-cluster
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  extra_refs:
+    - org: kubernetes-sigs
+      repo: cluster-api-provider-aws
+      base_ref: {{ $.branch }}
+      path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+  spec:
+    containers:
+      - image: {{ $.config.TestImage }}
+        command:
+          - "runner.sh"
+          - "./scripts/ci-conformance.sh"
+        env:
+          - name: BOSKOS_HOST
+            value: "boskos.test-pods.svc.cluster.local"
+          - name: AWS_REGION
+            value: "us-west-2"
+          # Parallelize tests
+          - name: GINKGO_ARGS
+            value: "-nodes 20"
+        securityContext:
+          privileged: true
+        resources:
+          requests:
+            cpu: 2
+            memory: "9Gi"
+          limits:
+            cpu: 2
+            memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+    testgrid-tab-name: periodic-conformance-{{ ReplaceAll $.branch "." "-" }}
+    testgrid-alert-email: sig-cluster-lifecycle-cluster-api-aws-alerts@kubernetes.io
+    testgrid-num-failures-to-alert: "2"
+- name: periodic-cluster-api-provider-aws-e2e-conformance-with-k8s-ci-artifacts{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+  cluster: eks-prow-build-cluster
+  max_concurrency: 1
+  labels:
+    preset-dind-enabled: "true"
+    preset-kind-volume-mounts: "true"
+    preset-service-account: "true"
+    preset-aws-ssh: "true"
+    preset-aws-credential: "true"
+  decorate: true
+  decoration_config:
+    timeout: 5h
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  interval: 12h
+  extra_refs:
+    - org: kubernetes-sigs
+      repo: cluster-api-provider-aws
+      base_ref: {{ $.branch }}
+      path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    - org: kubernetes-sigs
+      repo: image-builder
+      base_ref: main
+      path_alias: "sigs.k8s.io/image-builder"
+    - org: kubernetes
+      repo: kubernetes
+      base_ref: master
+      path_alias: k8s.io/kubernetes
+  spec:
+    containers:
+      - image: {{ $.config.TestImage }}
+        env:
+          - name: BOSKOS_HOST
+            value: "boskos.test-pods.svc.cluster.local"
+          - name: AWS_REGION
+            value: "us-west-2"
+          - name: E2E_ARGS
+            value: "-kubetest.use-ci-artifacts"
+          # Parallelize tests
+          - name: GINKGO_ARGS
+            value: "-nodes 20"
+        command:
+          - "runner.sh"
+          - "./scripts/ci-conformance.sh"
+        # we need privileged mode in order to do docker in docker
+        securityContext:
+          privileged: true
+        resources:
+          requests:
+            # these are both a bit below peak usage during build
+            # this is mostly for building kubernetes
+            memory: "9Gi"
+            cpu: 2
+          limits:
+            cpu: 2
+            memory: "9Gi"
+  annotations:
+    testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+    testgrid-tab-name: periodic-conformance-{{ ReplaceAll $.branch "." "-" }}-k8s-main
+    testgrid-num-columns-recent: '20'
+    testgrid-alert-email: release-team@kubernetes.io, sig-cluster-lifecycle-cluster-api-aws-alerts@kubernetes.io
+{{- if eq $.branch "main" }}
+- name: periodic-cluster-api-provider-aws-coverage
+  cluster: eks-prow-build-cluster
+  interval: 24h
+  decorate: true
+  rerun_auth_config:
+    github_team_slugs:
+      - org: kubernetes-sigs
+        slug: cluster-api-provider-aws-maintainers
+  path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+  extra_refs:
+    - org: kubernetes-sigs
+      repo: cluster-api-provider-aws
+      base_ref: {{ $.branch }}
+      path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    - org: kubernetes
+      repo: test-infra
+      base_ref: master
+      path_alias: k8s.io/test-infra
+  spec:
+    containers:
+      - image: {{ $.config.TestImage }}
+        command:
+          - runner.sh
+          - bash
+        args:
+          - -c
+          - |
+            result=0
+            ./scripts/ci-test-coverage.sh || result=$?
+            cp coverage.* ${ARTIFACTS}
+            cd ../../k8s.io/test-infra/gopherage
+            GO111MODULE=on go build .
+            ./gopherage filter --exclude-path="zz_generated,generated\.go" "${ARTIFACTS}/coverage.out" > "${ARTIFACTS}/filtered.cov" || result=$?
+            ./gopherage html "${ARTIFACTS}/filtered.cov" > "${ARTIFACTS}/coverage.html" || result=$?
+            ./gopherage junit --threshold 0 "${ARTIFACTS}/filtered.cov" > "${ARTIFACTS}/junit_coverage.xml" || result=$?
+            exit $result
+        resources:
+          requests:
+            cpu: "8"
+            memory: "16Gi"
+          limits:
+            cpu: "8"
+            memory: "16Gi"
+        securityContext:
+          privileged: true
+{{- end }}
diff --git a/config/jobs/kubernetes-sigs/cluster-api-provider-aws/templates/cluster-api-provider-aws-presubmits.yaml.tpl b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/templates/cluster-api-provider-aws-presubmits.yaml.tpl
new file mode 100644
index 000000000000..396a1e48bbff
--- /dev/null
+++ b/config/jobs/kubernetes-sigs/cluster-api-provider-aws/templates/cluster-api-provider-aws-presubmits.yaml.tpl
@@ -0,0 +1,488 @@
+presubmits:
+  kubernetes-sigs/cluster-api-provider-aws:
+  - name: pull-cluster-api-provider-aws-test{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^{{ $.branch }}$
+    always_run: true
+    optional: false
+    decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    spec:
+      containers:
+      - image: {{ $.config.TestImage }}
+        command:
+        - "./scripts/ci-test.sh"
+        resources:
+          requests:
+            cpu: "8"
+            memory: "16Gi"
+          limits:
+            cpu: "8"
+            memory: "16Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-test{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+  - name: pull-cluster-api-provider-aws-apidiff-{{ ReplaceAll $.branch "." "-" }}
+    cluster: eks-prow-build-cluster
+    decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    path_alias: sigs.k8s.io/cluster-api-provider-aws
+    always_run: true
+    optional: true
+    labels:
+      preset-service-account: "true"
+    branches:
+    - ^{{ $.branch }}$
+    spec:
+      containers:
+      - command:
+        - runner.sh
+        - ./scripts/ci-apidiff.sh
+        image: {{ $.config.TestImage }}
+        resources:
+          requests:
+            cpu: 7300m
+            memory: 9Gi
+          limits:
+            cpu: 7300m
+            memory: 9Gi
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-apidiff-{{ ReplaceAll $.branch "." "-" }}
+  - name: pull-cluster-api-provider-aws-build{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    always_run: true
+    optional: false
+    decorate: true
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    branches:
+    - ^{{ $.branch }}$
+    spec:
+      containers:
+      - image: {{ $.config.TestImage }}
+        command:
+        - "./scripts/ci-build.sh"
+        resources:
+          requests:
+            cpu: "4"
+            memory: "8Gi"
+          limits:
+            cpu: "4"
+            memory: "8Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-build{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+  - name: pull-cluster-api-provider-aws-build-docker{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+    always_run: true
+    optional: false
+    decorate: true
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    branches:
+    - ^{{ $.branch }}$
+    spec:
+      containers:
+      - image: {{ $.config.TestImage }}
+        command:
+        - runner.sh
+        args:
+        - ./scripts/ci-docker-build.sh
+        resources:
+          requests:
+            cpu: "4"
+            memory: "8Gi"
+          limits:
+            cpu: "4"
+            memory: "8Gi"
+        # docker-in-docker needs privileged mode
+        securityContext:
+          privileged: true
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-build-docker{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+  - name: pull-cluster-api-provider-aws-verify{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    always_run: true
+    branches:
+    - ^{{ $.branch }}$
+    optional: false
+    decorate: true
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    spec:
+      containers:
+      - image: {{ $.config.TestImage }}
+        command:
+        - "runner.sh"
+        - "make"
+        - "verify"
+        resources:
+          requests:
+            cpu: "4"
+            memory: "8Gi"
+          limits:
+            cpu: "4"
+            memory: "8Gi"
+        # docker-in-docker needs privileged mode
+        securityContext:
+            privileged: true
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-verify{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    labels:
+      preset-dind-enabled: "true"
+  # conformance test
+  - name: pull-cluster-api-provider-aws-e2e-conformance{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^{{ $.branch }}$
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 1
+    extra_refs:
+    - org: kubernetes-sigs
+      repo: image-builder
+      base_ref: main
+      path_alias: "sigs.k8s.io/image-builder"
+    - org: kubernetes
+      repo: kubernetes
+      base_ref: master
+      path_alias: k8s.io/kubernetes
+    spec:
+      containers:
+        - image: {{ $.config.TestImage }}
+          command:
+            - "runner.sh"
+            - "./scripts/ci-conformance.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+          # we need privileged mode in order to do docker in docker
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              # these are both a bit below peak usage during build
+              # this is mostly for building kubernetes
+              memory: "9Gi"
+              cpu: 2
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-conformance{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+      testgrid-num-columns-recent: '20'
+  {{- if ne $.branch "release-2.7" }}
+  # conformance test against kubernetes main branch with `kind` + cluster-api-provider-aws
+  - name: pull-cluster-api-provider-aws-e2e-conformance-with-ci-artifacts{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^{{ $.branch }}$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 1
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: {{ $.config.TestImage }}
+          command:
+            - "runner.sh"
+            - "./scripts/ci-conformance.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+            - name: E2E_ARGS
+              value: "-kubetest.use-ci-artifacts"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-conformance-{{ ReplaceAll $.branch "." "-" }}-k8s-main
+      testgrid-num-columns-recent: '20'
+{{- end }}
+  - name: pull-cluster-api-provider-aws-e2e-blocking{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^{{ $.branch }}$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    #run_if_changed: '^((api|bootstrap|cmd|config|controllers|controlplane|exp|feature|hack|pkg|test|util)/|main\.go|go\.mod|go\.sum|Dockerfile|Makefile)'
+    always_run: {{ eq $.branch "main" }}
+    optional: {{ not (eq $.branch "main") }}
+    decorate: true
+    decoration_config:
+      timeout: {{ if has $.branch (list "release-2.8" "release-2.7") }}5h{{ else }}2h{{ end }}
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: {{ if has $.branch (list "release-2.8" "release-2.7") }}1{{ else }}3{{ end }}
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: {{ $.config.TestImage }}
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e.sh"
+          env:
+            - name: GINKGO_FOCUS
+              value: "\\[PR-Blocking\\]"
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+            # Parallelize tests
+            - name: GINKGO_ARGS
+              value: "-nodes 20"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-quick-e2e-{{ ReplaceAll $.branch "." "-" }}
+      testgrid-num-columns-recent: '20'
+  - name: pull-cluster-api-provider-aws-e2e{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^{{ $.branch }}$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: {{ if has $.branch (list "release-2.8" "release-2.7") }}1{{ else }}2{{ end }}
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: {{ $.config.TestImage }}
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-e2e-{{ ReplaceAll $.branch "." "-" }}
+      testgrid-num-columns-recent: '20'
+  - name: pull-cluster-api-provider-aws-e2e-eks{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^{{ $.branch }}$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: {{ if has $.branch (list "release-2.8" "release-2.7") }}1{{ else }}2{{ end }}
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: {{ $.config.TestImage }}
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e-eks.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-e2e-eks-{{ ReplaceAll $.branch "." "-" }}
+      testgrid-num-columns-recent: '20'
+  - name: pull-cluster-api-provider-aws-e2e-eks-gc{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^{{ $.branch }}$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 1
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: {{ $.config.TestImage }}
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e-eks-gc.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+          securityContext:
+            privileged: true
+          resources:
+            limits:
+              cpu: 2
+              memory: "9Gi"
+            requests:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-e2e-eks-gc-{{ ReplaceAll $.branch "." "-" }}
+      testgrid-num-columns-recent: '20'
+  - name: pull-cluster-api-provider-aws-e2e-eks-testing{{ if ne $.branch "main" }}-{{ ReplaceAll $.branch "." "-" }}{{ end }}
+    cluster: eks-prow-build-cluster
+    branches:
+    - ^{{ $.branch }}$
+    path_alias: "sigs.k8s.io/cluster-api-provider-aws"
+    always_run: false
+    optional: true
+    decorate: true
+    decoration_config:
+      timeout: 5h
+    rerun_auth_config:
+      github_team_slugs:
+        - org: kubernetes-sigs
+          slug: cluster-api-provider-aws-maintainers
+    max_concurrency: 1
+    labels:
+      preset-dind-enabled: "true"
+      preset-kind-volume-mounts: "true"
+      preset-service-account: "true"
+      preset-aws-ssh: "true"
+      preset-aws-credential: "true"
+    spec:
+      containers:
+        - image: {{ $.config.TestImage }}
+          command:
+            - "runner.sh"
+            - "./scripts/ci-e2e-eks.sh"
+          env:
+            - name: BOSKOS_HOST
+              value: "boskos.test-pods.svc.cluster.local"
+            - name: AWS_REGION
+              value: "us-west-2"
+            - name: GINKGO_ARGS
+              value: "-nodes 2"
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: 2
+              memory: "9Gi"
+            limits:
+              cpu: 2
+              memory: "9Gi"
+    annotations:
+      testgrid-dashboards: sig-cluster-lifecycle-cluster-api-provider-aws
+      testgrid-tab-name: pr-e2e-eks-{{ ReplaceAll $.branch "." "-" }}-testing
+      testgrid-num-columns-recent: '20'