diff --git a/charms/garm/src/charm.py b/charms/garm/src/charm.py
index 855c3b58..07b83b99 100755
--- a/charms/garm/src/charm.py
+++ b/charms/garm/src/charm.py
@@ -34,7 +34,7 @@
     CredentialSpec,
     GithubReconciler,
 )
-from scaleset_reconciler import ScalesetReconciler, ScalesetSpec
+from scaleset_reconciler import ScalesetProgress, ScalesetReconciler, ScalesetSpec
 
 logger = logging.getLogger(__name__)
 
@@ -48,6 +48,13 @@
 GARM_PORT: typing.Final[int] = 8080
 GARM_LISTEN_ADDRESS: typing.Final[str] = "0.0.0.0"
 _DB_PASSPHRASE_LENGTH: typing.Final[int] = 32
+# Juju truncates long statuses; name a couple of scalesets and count the rest.
+_MAX_DRAINING_IN_STATUS: typing.Final[int] = 2
+# The phases a scaleset replacement passes through, in order. Named here rather than
+# spelled inline so the status vocabulary is greppable; not an enum, because the
+# draining phase carries the runner count and so is formatted, not selected.
+_PHASE_CREATING: typing.Final[str] = "creating replacement"
+_PHASE_AWAITING_DELETION: typing.Final[str] = "awaiting deletion"
 
 GARM_CONFIG_VERSION: typing.Final[str] = "1"
 
@@ -116,6 +123,49 @@ def _parse_pre_install_scripts(raw: str) -> dict[str, str]:
     return {}
 
 
+def _scaleset_replacement_phase(progress: ScalesetProgress) -> str:
+    """Describe where one scaleset replacement has got to.
+
+    Args:
+        progress: A replacement still in flight.
+
+    Returns:
+        The phase, in the operator's terms. The runner count is only reported once
+        the labels have been handed over, since before that nothing is draining yet;
+        with the count at zero the scaleset has drained and GARM has yet to accept
+        its deletion, which is a distinct thing to be waiting on.
+    """
+    if not progress.handed_over:
+        return _PHASE_CREATING
+    runners = progress.remaining_runners
+    if not runners:
+        return _PHASE_AWAITING_DELETION
+    return f"draining {runners} runner{'' if runners == 1 else 's'}"
+
+
+def _scaleset_replacement_status(replacing: list[ScalesetProgress]) -> str:
+    """Summarise in-progress scaleset replacements for the unit status.
+
+    Args:
+        replacing: Scaleset replacements still in flight.
+
+    Returns:
+        A status message naming at most two scalesets, so it stays readable when
+        several are replaced at once. Each is named by the logical name the operator
+        configured — the live names carry a label hash the operator never chose — and
+        the live names are logged in full by the reconciler.
+    """
+    shown = [
+        f"{progress.logical_name} -> {progress.replacement_name}"
+        f" ({_scaleset_replacement_phase(progress)})"
+        for progress in replacing[:_MAX_DRAINING_IN_STATUS]
+    ]
+    remainder = len(replacing) - len(shown)
+    if remainder > 0:
+        shown.append(f"+{remainder} more")
+    return f"Replacing scaleset {', '.join(shown)}"
+
+
 class GarmCharm(paas_charm.go.Charm):
     """GARM charm — manages the GARM service via Pebble."""
 
@@ -459,8 +509,7 @@ def _get_configurator_provider_configs(
             )
 
         logger.info(
-            "GARM configurator provider data: relation_unit_count=%d "
-            "configured_provider_count=%d",
+            "GARM configurator provider data: relation_unit_count=%d configured_provider_count=%d",
             len(relation.units),
             len(configs),
         )
@@ -694,8 +743,21 @@ def _reconcile_runners(self) -> None:
             GithubReconciler(auth_client).reconcile(self._build_desired_credentials())
             EntityReconciler(auth_client).reconcile(charm_state.desired_entities)
             template_id = _apply_garm_template(auth_client, charm_state.ssh_debug_connections)
-            ScalesetReconciler(auth_client).reconcile(self._build_desired_scalesets(template_id))
-            self.update_app_and_unit_status(ops.ActiveStatus())
+            replacing = ScalesetReconciler(auth_client).reconcile(
+                self._build_desired_scalesets(template_id)
+            )
+            # A label change recreates the scaleset and drains the old one, which
+            # outlives this hook: report progress and let update-status converge it.
+            # Active, not maintenance: every label is served throughout the drain, by
+            # the replacement or the predecessor, so nothing is degraded. A drain can
+            # run to DRAIN_DEADLINE, and blocking `juju wait-for` on hours of healthy
+            # background convergence would be wrong.
+            if replacing:
+                self.update_app_and_unit_status(
+                    ops.ActiveStatus(_scaleset_replacement_status(replacing))
+                )
+            else:
+                self.update_app_and_unit_status(ops.ActiveStatus())
         except CharmedTemplateError as exc:
             logger.warning("GARM charmed template error during reconcile: %s", exc)
             self.update_app_and_unit_status(ops.WaitingStatus(str(exc)))
diff --git a/charms/garm/src/garm_api.py b/charms/garm/src/garm_api.py
index d321864b..2dd6c7e5 100644
--- a/charms/garm/src/garm_api.py
+++ b/charms/garm/src/garm_api.py
@@ -14,6 +14,7 @@
 from garm_client.api.controller_info_api import ControllerInfoApi
 from garm_client.api.credentials_api import CredentialsApi
 from garm_client.api.first_run_api import FirstRunApi
+from garm_client.api.instances_api import InstancesApi
 from garm_client.api.login_api import LoginApi
 from garm_client.api.organizations_api import OrganizationsApi
 from garm_client.api.providers_api import ProvidersApi
@@ -29,6 +30,7 @@
 from garm_client.models.create_scale_set_params import CreateScaleSetParams
 from garm_client.models.create_template_params import CreateTemplateParams
 from garm_client.models.forge_credentials import ForgeCredentials
+from garm_client.models.instance import Instance
 from garm_client.models.new_user_params import NewUserParams
 from garm_client.models.organization import Organization
 from garm_client.models.password_login_params import PasswordLoginParams
@@ -529,6 +531,35 @@ def list_scalesets(self) -> list[ScaleSet]:
             except urllib3.exceptions.HTTPError as exc:
                 raise GarmConnectionError(f"GARM connection error: {exc}") from exc
 
+    def list_scaleset_instances(self, scaleset_id: int) -> list[Instance]:
+        """List the runner instances currently backing a scaleset.
+
+        Args:
+            scaleset_id: GARM scaleset id.
+
+        Returns:
+            List of Instance model objects, empty when the scaleset has no runners.
+
+        Raises:
+            GarmApiError: On API error.
+        """
+        with self._api_client() as client:
+            try:
+                return (
+                    InstancesApi(api_client=client).list_scale_set_instances(
+                        scaleset_id=str(scaleset_id),
+                        _request_timeout=_REQUEST_TIMEOUT,
+                    )
+                    or []
+                )
+            except ApiException as exc:
+                raise GarmApiError(
+                    f"Failed to list instances for scaleset {scaleset_id} "
+                    f"({exc.status}): {exc.body}"
+                ) from exc
+            except urllib3.exceptions.HTTPError as exc:
+                raise GarmConnectionError(f"GARM connection error: {exc}") from exc
+
     def find_org_id(self, org_name: str) -> str | None:
         """Find a GARM organization's UUID by name.
 
diff --git a/charms/garm/src/garm_client_README.md b/charms/garm/src/garm_client_README.md
index d6156ebd..d570d381 100644
--- a/charms/garm/src/garm_client_README.md
+++ b/charms/garm/src/garm_client_README.md
@@ -29,16 +29,13 @@ In your own code, to use this library to connect and interact with garm-client,
 you can run the following:
 
 ```python
-
 import garm_client
 from garm_client.rest import ApiException
 from pprint import pprint
 
 # Defining the host is optional and defaults to /api/v1
 # See configuration.py for a list of all supported configuration parameters.
-configuration = garm_client.Configuration(
-    host = "/api/v1"
-)
+configuration = garm_client.Configuration(host="/api/v1")
 
 # The client must configure the authentication and authorization parameters
 # in accordance with the API server security policy.
@@ -46,7 +43,7 @@ configuration = garm_client.Configuration(
 # satisfies your auth use case.
 
 # Configure API key authorization: Bearer
-configuration.api_key['Bearer'] = os.environ["API_KEY"]
+configuration.api_key["Bearer"] = os.environ["API_KEY"]
 
 # Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
 # configuration.api_key_prefix['Bearer'] = 'Bearer'
@@ -64,7 +61,6 @@ with garm_client.ApiClient(configuration) as api_client:
         pprint(api_response)
     except ApiException as e:
         print("Exception when calling ControllerApi->force_tools_sync: %s\n" % e)
-
 ```
 
 ## Documentation for API Endpoints
diff --git a/charms/garm/src/scaleset_reconciler.py b/charms/garm/src/scaleset_reconciler.py
index 2f616d60..d484d95b 100644
--- a/charms/garm/src/scaleset_reconciler.py
+++ b/charms/garm/src/scaleset_reconciler.py
@@ -5,11 +5,14 @@
 """Scaleset reconciler: diffs desired vs observed GARM scalesets and applies changes."""
 
 import base64
+import datetime
+import hashlib
 import logging
+import re
 from dataclasses import dataclass, field
 
 from charm_state import RunnerConfig
-from garm_api import GarmApiError, GarmAuthenticatedClient
+from garm_api import GarmApiError, GarmAuthenticatedClient, GarmConnectionError
 from garm_client.models.create_scale_set_params import CreateScaleSetParams
 from garm_client.models.scale_set import ScaleSet
 from garm_client.models.template import Template
@@ -27,6 +30,27 @@
 # operator-supplied script runs.
 APROXY_SCRIPT_NAME = "00-aproxy"
 
+LABEL_HASH_LENGTH = 8
+
+# GitHub rejects over-long scale set names; keep the generated name inside a
+# conservative bound by truncating the operator-supplied part, never the hash.
+MAX_SCALESET_NAME_LENGTH = 64
+
+# Past GitHub's 6h job cap a remaining runner is stuck, not busy: stop gating on the
+# count and retry the delete, which GARM rejects while runners are active.
+DRAIN_DEADLINE = datetime.timedelta(hours=7)
+
+
+@dataclass(frozen=True)
+class ScalesetProgress:
+    """A scaleset replacement still in flight: the generation it replaced is not gone yet."""
+
+    logical_name: str
+    retiring_name: str
+    replacement_name: str
+    remaining_runners: int
+    handed_over: bool = True
+
 
 @dataclass
 class ScalesetSpec:
@@ -49,6 +73,107 @@ class ScalesetSpec:
     runner_config: RunnerConfig = field(default_factory=RunnerConfig)
 
 
+def _name_base(logical_name: str) -> str:
+    """Return the part of a live scaleset name that precedes the label hash.
+
+    Args:
+        logical_name: The scaleset name the operator configured.
+
+    Returns:
+        The name itself when it fits, else a truncation ending in a hash of the full
+        name — two long names sharing a prefix would otherwise collapse onto one live
+        scaleset and fight over it on every reconcile.
+    """
+    limit = MAX_SCALESET_NAME_LENGTH - LABEL_HASH_LENGTH - 1
+    if len(logical_name) <= limit:
+        return logical_name
+    digest = hashlib.sha256(logical_name.encode("utf-8")).hexdigest()[:LABEL_HASH_LENGTH]
+    return f"{logical_name[: limit - LABEL_HASH_LENGTH - 1]}-{digest}"
+
+
+def target_scaleset_name(logical_name: str, labels: list[str]) -> str:
+    """Return the live GARM name a spec's scaleset should have.
+
+    Args:
+        logical_name: The scaleset name the operator configured.
+        labels: The desired labels.
+
+    Returns:
+        ``<name>-<label hash>``. Only the labels feed the hash: every other spec
+        field is updatable in place and must not trigger a recreate.
+    """
+    digest = hashlib.sha256(",".join(sorted(labels)).encode("utf-8")).hexdigest()
+    return f"{_name_base(logical_name)}-{digest[:LABEL_HASH_LENGTH]}"
+
+
+def _family_pattern(logical_name: str) -> re.Pattern[str]:
+    """Return the regex matching every generation of *logical_name*."""
+    return re.compile(rf"^{re.escape(_name_base(logical_name))}-[0-9a-f]{{{LABEL_HASH_LENGTH}}}$")
+
+
+def _is_family_member(observed_name: str, logical_name: str) -> bool:
+    """Return whether a live scaleset is a generation of *logical_name*.
+
+    Args:
+        observed_name: The live scaleset name.
+        logical_name: The configured scaleset name.
+
+    Returns:
+        True for a hash-suffixed generation, and for the bare *logical_name* itself —
+        scalesets created before label-hashed naming carry the un-suffixed name.
+    """
+    if observed_name == logical_name:
+        return True
+    return bool(_family_pattern(logical_name).match(observed_name))
+
+
+def _observed_labels(scaleset: ScaleSet) -> list[str]:
+    """Return a scaleset's labels, sorted, for comparison against a spec."""
+    return sorted(tag.name for tag in (scaleset.tags or []) if tag.name)
+
+
+def _drain_deadline_passed(scaleset: ScaleSet) -> bool:
+    """Return whether a retired scaleset has been draining longer than any job can last.
+
+    Args:
+        scaleset: The retired scaleset.
+
+    Returns:
+        True once ``DRAIN_DEADLINE`` has elapsed since GARM last wrote the scaleset —
+        which, for a retired one, is the moment it was disabled, since nothing updates
+        it afterwards. False when GARM reports no timestamp: an unknown drain age must
+        never read as an expired one.
+    """
+    retired_at = scaleset.updated_at
+    if retired_at is None:
+        return False
+    if retired_at.tzinfo is None:
+        retired_at = retired_at.replace(tzinfo=datetime.timezone.utc)
+    return datetime.datetime.now(datetime.timezone.utc) - retired_at > DRAIN_DEADLINE
+
+
+def _resolve_active_name(spec: ScalesetSpec, observed: dict[str, ScaleSet]) -> str:
+    """Return the live name of the generation that should serve *spec*.
+
+    Args:
+        spec: The desired scaleset.
+        observed: Observed scalesets keyed by name.
+
+    Returns:
+        The label-hashed target name, except when that name does not exist yet and a
+        legacy un-suffixed scaleset already carries exactly the desired labels — that
+        one is adopted in place, so upgrading the charm doesn't recreate scalesets
+        that are already correct.
+    """
+    target = target_scaleset_name(spec.name, spec.labels)
+    if target in observed:
+        return target
+    legacy = observed.get(spec.name)
+    if legacy is not None and _observed_labels(legacy) == sorted(spec.labels):
+        return spec.name
+    return target
+
+
 class ScalesetReconciler:
     """Reconciles GARM scalesets against a desired spec list."""
 
@@ -60,7 +185,7 @@ def __init__(self, client: GarmAuthenticatedClient) -> None:
         """
         self._client = client
 
-    def reconcile(self, desired: list[ScalesetSpec]) -> None:
+    def reconcile(self, desired: list[ScalesetSpec]) -> list[ScalesetProgress]:
         """Sync GARM scalesets to match *desired*.
 
         Performs the minimum set of CREATE / UPDATE / DELETE operations, and
@@ -69,9 +194,26 @@ def reconcile(self, desired: list[ScalesetSpec]) -> None:
         (org/repo) is not registered in GARM, that spec is skipped silently
         (deferred creation) — no error state is set.
 
+        A label change is applied by creating a replacement scaleset and draining
+        the old one (see ``_retire_replaced``), which spans several reconciles.
+
+        A spec that fails against the GARM API does not abort the pass: the
+        remaining specs and the orphan sweep still run, and the first failure is
+        re-raised at the end so the charm still reports the sync as failed. A
+        connection error is not contained that way — GARM is down, so retrying
+        every remaining spec would only stall the hook.
+
         Args:
             desired: The full desired set of scalesets.
+
+        Returns:
+            One entry per replacement still in flight; empty once converged.
+
+        Raises:
+            GarmApiError: If any spec failed to reconcile, re-raised once the rest
+                of the pass has completed.
         """
+        desired = self._dedupe(desired)
         providers = {provider.name for provider in self._client.list_providers()}
         observed: dict[str, ScaleSet] = {}
         for scaleset in self._client.list_scalesets():
@@ -81,15 +223,88 @@ def reconcile(self, desired: list[ScalesetSpec]) -> None:
             observed[scaleset.name] = scaleset
 
         templates = self._load_templates(desired, observed)
-        all_desired_names: set[str] = {spec.name for spec in desired}
-
+        families = self._resolve_families(desired, observed)
+        # Covers in-flight replacements and draining predecessors, so the orphan pass
+        # can't delete one mid-changeover. Built before the provider/entity gates.
+        claimed: set[str] = set()
+        for family in families.values():
+            claimed.update(family)
+
+        progress: list[ScalesetProgress] = []
+        failure: GarmApiError | None = None
         for spec in desired:
-            self._reconcile_one(spec, providers, observed, templates)
+            try:
+                progress.extend(
+                    self._reconcile_one(
+                        spec, providers, observed, templates, families.get(spec.name, [])
+                    )
+                )
+            except GarmConnectionError:
+                raise
+            except GarmApiError as exc:
+                logger.warning("Failed to reconcile scaleset %s: %s", spec.name, exc)
+                failure = failure or exc
 
         for name, scaleset in observed.items():
-            if name not in all_desired_names:
+            if name not in claimed:
                 self._delete_orphaned(scaleset)
                 self._delete_custom_template(name, templates)
+        if failure is not None:
+            raise failure
+        return progress
+
+    @staticmethod
+    def _dedupe(desired: list[ScalesetSpec]) -> list[ScalesetSpec]:
+        """Drop specs repeating a logical name already claimed by an earlier one.
+
+        Args:
+            desired: The full desired set of scalesets.
+
+        Returns:
+            The specs with duplicate names removed, first occurrence winning. Two
+            specs sharing a name would each own the other's live scaleset and retire
+            it on every reconcile, so they would replace each other forever.
+        """
+        unique: dict[str, ScalesetSpec] = {}
+        for spec in desired:
+            if spec.name in unique:
+                logger.warning(
+                    "Ignoring duplicate desired scaleset %s: a logical name must"
+                    " identify exactly one scaleset",
+                    spec.name,
+                )
+                continue
+            unique[spec.name] = spec
+        return list(unique.values())
+
+    @staticmethod
+    def _resolve_families(
+        desired: list[ScalesetSpec], observed: dict[str, ScaleSet]
+    ) -> dict[str, list[str]]:
+        """Group the live scalesets by the desired spec that owns them.
+
+        Args:
+            desired: The full desired set of scalesets.
+            observed: Observed scalesets keyed by name.
+
+        Returns:
+            Per logical name, every live generation it owns plus its target name
+            (which may not exist yet). A live name that is another spec's own or
+            target name is never claimed, so ``foo`` can't swallow a separate
+            scaleset that happens to be named ``foo-1a2b3c4d``.
+        """
+        targets = {spec.name: target_scaleset_name(spec.name, spec.labels) for spec in desired}
+        reserved = set(targets) | set(targets.values())
+        families: dict[str, list[str]] = {}
+        for spec in desired:
+            others = reserved - {spec.name, targets[spec.name]}
+            family = [
+                name
+                for name in observed
+                if name not in others and _is_family_member(name, spec.name)
+            ]
+            families[spec.name] = sorted({*family, targets[spec.name]})
+        return families
 
     def _load_templates(
         self, desired: list[ScalesetSpec], observed: dict[str, ScaleSet]
@@ -123,7 +338,8 @@ def _reconcile_one(
         providers: set[str | None],
         observed: dict[str, ScaleSet],
         templates: dict[str, Template],
-    ) -> None:
+        family: list[str],
+    ) -> list[ScalesetProgress]:
         """Reconcile a single desired scaleset: validate, create or update, and sync its template.
 
         Args:
@@ -131,12 +347,20 @@ def _reconcile_one(
             providers: Names of providers currently registered in GARM.
             observed: Observed scalesets keyed by name.
             templates: Observed templates keyed by name.
+            family: Every live generation of this spec, plus its target name.
+
+        Returns:
+            One entry per replaced generation of this spec still draining.
         """
+        active_name = _resolve_active_name(spec, observed)
         try:
-            create_params = self._to_create_params(spec)
+            create_params = self._to_create_params(spec, active_name)
         except Exception as exc:
-            logger.warning("Skipping scaleset %s: spec validation failed: %s", spec.name, exc)
-            return
+            # Error, not warning: unlike the provider/entity gates below this does not
+            # resolve on its own — the spec is malformed and will fail every pass until
+            # the operator changes it.
+            logger.error("Skipping scaleset %s: spec validation failed: %s", spec.name, exc)
+            return []
 
         if spec.provider_name not in providers:
             logger.warning(
@@ -144,7 +368,7 @@ def _reconcile_one(
                 spec.name,
                 spec.provider_name,
             )
-            return
+            return []
 
         entity_id = self._resolve_entity_id(spec)
         if entity_id is None:
@@ -154,20 +378,197 @@ def _reconcile_one(
                 spec.entity_type,
                 spec.entity_name,
             )
-            return
+            return []
 
-        template_id = self._ensure_template(spec, templates)
+        template_id = self._ensure_template(spec, active_name, templates)
 
-        if spec.name in observed:
-            self._maybe_update(observed[spec.name], spec, template_id)
+        if active_name in observed:
+            self._maybe_update(observed[active_name], spec, template_id)
         else:
-            self._create(spec, entity_id, create_params, template_id)
+            self._create(spec, active_name, entity_id, create_params, template_id)
 
         if not spec.runner_config.has_config():
             # Runner options were cleared (or the system template is
             # unavailable): the scaleset has been reverted to the default
             # template above, so drop any now-unreferenced custom template.
-            self._delete_custom_template(spec.name, templates)
+            self._delete_custom_template(active_name, templates)
+
+        return self._retire_replaced(spec, active_name, observed, templates, family)
+
+    def _retire_replaced(
+        self,
+        spec: ScalesetSpec,
+        active_name: str,
+        observed: dict[str, ScaleSet],
+        templates: dict[str, Template],
+        family: list[str],
+    ) -> list[ScalesetProgress]:
+        """Hand routing over to the current generation and drain the ones it replaced.
+
+        Workloads route by label, not by scaleset name, and GitHub only assigns jobs to
+        a scaleset holding a live listener session. So the replacement is brought up
+        first and only then is the old one disabled, which closes its session and leaves
+        the replacement as the sole holder of the labels they share. Any label carried by
+        both is served throughout — by one scaleset or the other, both fully functional —
+        so the changeover has no queue gap, and runners already mid-job are left to
+        finish rather than being killed.
+
+        Args:
+            spec: The desired scaleset.
+            active_name: The generation that should serve *spec*.
+            observed: Observed scalesets keyed by name.
+            templates: Observed templates keyed by name.
+            family: Every live generation of this spec, plus its target name.
+
+        Returns:
+            One entry per replaced generation not yet gone.
+        """
+        # Close the old session only once the replacement exists: disabling any
+        # earlier leaves the labels unserved if the charm dies in between.
+        replacement_live = active_name in observed and observed[active_name].enabled is True
+
+        progress: list[ScalesetProgress] = []
+        for name in family:
+            old = observed.get(name)
+            if name == active_name or old is None:
+                continue
+            if not replacement_live:
+                progress.append(
+                    ScalesetProgress(spec.name, name, active_name, 0, handed_over=False)
+                )
+                continue
+            # Truthy, not `is not False`: GARM tags Enabled `omitempty`, so a disabled
+            # scaleset comes back with no `enabled` key at all and the client reads None.
+            if old.enabled:
+                self._retire(old)
+                progress.append(
+                    ScalesetProgress(spec.name, name, active_name, self._remaining_runners(old))
+                )
+                continue
+            remaining = self._remaining_runners(old)
+            if remaining and not _drain_deadline_passed(old):
+                progress.append(ScalesetProgress(spec.name, name, active_name, remaining))
+                continue
+            if remaining:
+                logger.warning(
+                    "Scaleset %s still reports %d runner(s) after %s of draining;"
+                    " attempting deletion anyway. GARM rejects the delete while runners"
+                    " are genuinely active, so no in-flight job is cut short.",
+                    name,
+                    remaining,
+                    DRAIN_DEADLINE,
+                )
+            if not self._delete_drained(old, templates):
+                # Keep reporting it: a scaleset GARM refused to delete is still on
+                # GitHub, so the replacement has not actually converged yet.
+                progress.append(ScalesetProgress(spec.name, name, active_name, remaining))
+        return progress
+
+    def _retire(self, scaleset: ScaleSet) -> None:
+        """Disable a replaced scaleset and stop it launching runners.
+
+        Disabling closes its listener session, handing the shared labels to the
+        replacement. GARM's handleScaleDown then reaps idle runners but skips
+        RunnerActive, so a runner mid-job finishes instead of being killed. The
+        second call is defensive: GARM rejects max_runners=0 on create only.
+
+        Args:
+            scaleset: The replaced scaleset.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable — see ``_remaining_runners``.
+        """
+        if scaleset.id is None:
+            return
+        logger.info("Retiring replaced scaleset %s (id=%s)", scaleset.name, scaleset.id)
+        try:
+            self._client.update_scaleset(
+                scaleset.id,
+                UpdateScaleSetParams(enabled=False, min_idle_runners=0, max_runners=0),
+            )
+            return
+        except GarmConnectionError:
+            raise
+        except GarmApiError as exc:
+            logger.warning(
+                "Could not zero runner counts on scaleset %s; disabling only: %s",
+                scaleset.name,
+                exc,
+            )
+        try:
+            self._client.update_scaleset(
+                scaleset.id, UpdateScaleSetParams(enabled=False, min_idle_runners=0)
+            )
+        except GarmConnectionError:
+            raise
+        except GarmApiError as exc:
+            logger.warning(
+                "Could not disable scaleset %s (will retry on next reconcile): %s",
+                scaleset.name,
+                exc,
+            )
+
+    def _remaining_runners(self, scaleset: ScaleSet) -> int:
+        """Return how many runners a scaleset still has.
+
+        Args:
+            scaleset: The scaleset to inspect.
+
+        Returns:
+            The instance count, or 1 when it cannot be read — an unknown count must
+            never be mistaken for a drained scaleset and delete live runners.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable. Contained failures are
+                per-scaleset; an outage is not, and must reach the charm's status
+                rather than be reported as drain progress.
+        """
+        if scaleset.id is None:
+            return 0
+        try:
+            return len(self._client.list_scaleset_instances(scaleset.id))
+        except GarmConnectionError:
+            raise
+        except GarmApiError as exc:
+            logger.warning(
+                "Could not count runners of scaleset %s; assuming still draining: %s",
+                scaleset.name,
+                exc,
+            )
+            return 1
+
+    def _delete_drained(self, scaleset: ScaleSet, templates: dict[str, Template]) -> bool:
+        """Delete a replaced scaleset that has finished draining, and its template.
+
+        Args:
+            scaleset: The drained scaleset.
+            templates: Observed templates keyed by name.
+
+        Returns:
+            Whether the caller can stop tracking it. False means GARM still holds the
+            scaleset, so the replacement has not converged yet. An id-less scaleset is
+            untouchable rather than gone, but reporting it forever would wedge the
+            status, so it reads as done — matching ``_remaining_runners``.
+
+        Raises:
+            GarmConnectionError: If GARM is unreachable — see ``_remaining_runners``.
+        """
+        if scaleset.id is None:
+            return True
+        logger.info("Deleting drained scaleset %s (id=%s)", scaleset.name, scaleset.id)
+        try:
+            self._client.delete_scaleset(scaleset.id)
+        except GarmConnectionError:
+            raise
+        except GarmApiError as exc:
+            logger.warning(
+                "Could not delete drained scaleset %s (will retry on next reconcile): %s",
+                scaleset.name,
+                exc,
+            )
+            return False
+        self._delete_custom_template(scaleset.name or "", templates)
+        return True
 
     def _delete_orphaned(self, scaleset: ScaleSet) -> None:
         """Disable then delete a scaleset that is no longer in the desired set."""
@@ -205,7 +606,9 @@ def _resolve_entity_id(self, spec: ScalesetSpec) -> str | None:
         logger.warning("Unknown entity_type %r for scaleset %s", spec.entity_type, spec.name)
         return None
 
-    def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -> int:
+    def _ensure_template(
+        self, spec: ScalesetSpec, scaleset_name: str, templates: dict[str, Template]
+    ) -> int:
         """Ensure the scaleset's runner template reflects its runner options.
 
         Copies the system ``github_linux`` template, injects the runner options,
@@ -215,6 +618,9 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
 
         Args:
             spec: The desired scaleset.
+            scaleset_name: The live name of the scaleset the template belongs to. Each
+                generation owns its own template, so a draining predecessor keeps the
+                template its runners were built from until it is deleted.
             templates: Observed templates keyed by name.
 
         Returns:
@@ -223,7 +629,7 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
             is unavailable and no custom template already exists). Returning ``0``
             for a scaleset that previously had a custom template detaches it.
         """
-        custom_name = f"{SYSTEM_TEMPLATE_NAME}-{spec.name}"
+        custom_name = f"{SYSTEM_TEMPLATE_NAME}-{scaleset_name}"
         existing = templates.get(custom_name)
 
         if not spec.runner_config.has_config():
@@ -241,13 +647,13 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
                 logger.warning(
                     "System template %s not found; keeping existing custom template for %s",
                     SYSTEM_TEMPLATE_NAME,
-                    spec.name,
+                    scaleset_name,
                 )
                 return existing.id or 0
             logger.warning(
                 "System template %s not found; scaleset %s will use the default template",
                 SYSTEM_TEMPLATE_NAME,
-                spec.name,
+                scaleset_name,
             )
             return 0
 
@@ -257,7 +663,7 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
                 logger.warning(
                     "Runner template %s has no id; scaleset %s will use the default template",
                     custom_name,
-                    spec.name,
+                    scaleset_name,
                 )
                 return 0
             if self._template_bytes(existing) != new_data:
@@ -269,7 +675,7 @@ def _ensure_template(self, spec: ScalesetSpec, templates: dict[str, Template]) -
         created = self._client.create_template(
             name=custom_name,
             data=new_data,
-            description=f"Runner template for scaleset {spec.name}",
+            description=f"Runner template for scaleset {scaleset_name}",
         )
         return created.id or 0
 
@@ -338,11 +744,12 @@ def _delete_custom_template(self, scaleset_name: str, templates: dict[str, Templ
                 )
 
     @staticmethod
-    def _to_create_params(spec: ScalesetSpec) -> CreateScaleSetParams:
+    def _to_create_params(spec: ScalesetSpec, scaleset_name: str) -> CreateScaleSetParams:
         """Build and validate CreateScaleSetParams from a ScalesetSpec.
 
         Args:
             spec: The desired scaleset specification.
+            scaleset_name: The live name to create the scaleset under.
 
         Returns:
             Validated CreateScaleSetParams ready for the GARM API.
@@ -352,7 +759,7 @@ def _to_create_params(spec: ScalesetSpec) -> CreateScaleSetParams:
         """
         return CreateScaleSetParams.model_validate(
             {
-                "name": spec.name,
+                "name": scaleset_name,
                 "provider_name": spec.provider_name,
                 "image": spec.image,
                 "flavor": spec.flavor,
@@ -371,29 +778,27 @@ def _to_create_params(spec: ScalesetSpec) -> CreateScaleSetParams:
     def _create(
         self,
         spec: ScalesetSpec,
+        scaleset_name: str,
         entity_id: str,
         params: CreateScaleSetParams,
         template_id: int,
     ) -> None:
         if template_id:
             params.template_id = template_id
-        logger.info("Creating scaleset %s under %s %s", spec.name, spec.entity_type, entity_id)
+        logger.info("Creating scaleset %s under %s %s", scaleset_name, spec.entity_type, entity_id)
         if spec.entity_type == "organization":
             self._client.create_org_scaleset(entity_id, params)
         else:
             self._client.create_repo_scaleset(entity_id, params)
 
     def _maybe_update(self, observed: ScaleSet, spec: ScalesetSpec, template_id: int) -> None:
-        observed_labels = sorted(t.name for t in (observed.tags or []) if t.name)
+        observed_labels = _observed_labels(observed)
         if observed_labels != sorted(spec.labels):
-            # UpdateScaleSetParams has no labels field; label changes require
-            # recreating the scaleset. To delete a scaleset, remove the
-            # garm-configurator relation for the corresponding unit.
             logger.warning(
-                "Scaleset %s labels changed (%s -> %s) but cannot be updated in place;"
-                " to apply label changes, remove and re-add the garm-configurator relation"
-                " for this unit",
-                spec.name,
+                "Scaleset %s carries labels %s but %s were expected; updating its other"
+                " fields anyway. Labels are immutable in GitHub — delete this scaleset"
+                " in GARM to let the charm recreate it with the expected labels.",
+                observed.name,
                 observed_labels,
                 sorted(spec.labels),
             )
@@ -403,12 +808,12 @@ def _maybe_update(self, observed: ScaleSet, spec: ScalesetSpec, template_id: int
         # _needs_update already covers the template id (its last clause), so an
         # id change alone forces an update here.
         if not self._needs_update(observed, spec, template_id):
-            logger.debug("Scaleset %s is up to date", spec.name)
+            logger.debug("Scaleset %s is up to date", observed.name)
             return
 
         # UpdateScaleSetParams omits None fields (exclude_none), so None can only
         # leave extra_specs untouched, never clear them. Send an explicit empty
-        # dict when the desired specs are empty but the scaleset still carries
+        # dict when the desired extra specs are empty but the scaleset still carries
         # some (e.g. a proxy was unset) — otherwise a stale aproxy script would
         # persist and _needs_update would loop forever trying to converge.
         desired_extra = _effective_extra_specs(spec)
@@ -428,9 +833,9 @@ def _maybe_update(self, observed: ScaleSet, spec: ScalesetSpec, template_id: int
         # unrelated update never spuriously sets the field.
         if template_id or observed_template_id:
             params.template_id = template_id
-        logger.info("Updating scaleset %s (id=%s)", spec.name, observed.id)
+        logger.info("Updating scaleset %s (id=%s)", observed.name, observed.id)
         if observed.id is None:
-            logger.warning("Scaleset %s has no id; skipping update", spec.name)
+            logger.warning("Scaleset %s has no id; skipping update", observed.name)
             return
         self._client.update_scaleset(observed.id, params)
 
diff --git a/charms/garm/tests/unit/test_charm.py b/charms/garm/tests/unit/test_charm.py
index 281226a6..39ef1bdd 100644
--- a/charms/garm/tests/unit/test_charm.py
+++ b/charms/garm/tests/unit/test_charm.py
@@ -39,6 +39,7 @@
     MANAGED_CREDENTIAL_DESCRIPTION,
     CredentialSpec,
 )
+from scaleset_reconciler import ScalesetProgress
 
 MODEL_NAME = "garm-model"
 CONTAINER_NAME = "app"
@@ -144,6 +145,8 @@ def garm_api_fixture() -> typing.Iterator[_GarmApiMocks]:
         patch("charm._apply_garm_template", return_value=_TEMPLATE_ID) as apply_template,
     ):
         auth_client = auth_cls.from_login.return_value
+        # No scaleset is mid-replacement by default, so the charm reports active.
+        scaleset_cls.return_value.reconcile.return_value = []
         calls = MagicMock()
         calls.attach_mock(auth_client.update_controller, "controller")
         calls.attach_mock(github_cls.return_value.reconcile, "github")
@@ -535,6 +538,90 @@ def test_missing_configurator_relation_refreshes_stale_app_status(
     assert out.app_status == ops.WaitingStatus("Waiting for garm-configurator relation")
 
 
+# --- Scaleset replacement progress --------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "progress, expected",
+    [
+        (
+            ScalesetProgress("my-scaleset", "my-scaleset-1a2b3c4d", "my-scaleset-5e6f7a8b", 3),
+            "Replacing scaleset my-scaleset -> my-scaleset-5e6f7a8b (draining 3 runners)",
+        ),
+        (
+            ScalesetProgress("my-scaleset", "my-scaleset-1a2b3c4d", "my-scaleset-5e6f7a8b", 1),
+            "Replacing scaleset my-scaleset -> my-scaleset-5e6f7a8b (draining 1 runner)",
+        ),
+        (
+            ScalesetProgress(
+                "my-scaleset",
+                "my-scaleset-1a2b3c4d",
+                "my-scaleset-5e6f7a8b",
+                0,
+                handed_over=False,
+            ),
+            "Replacing scaleset my-scaleset -> my-scaleset-5e6f7a8b (creating replacement)",
+        ),
+        (
+            ScalesetProgress("my-scaleset", "my-scaleset-1a2b3c4d", "my-scaleset-5e6f7a8b", 0),
+            "Replacing scaleset my-scaleset -> my-scaleset-5e6f7a8b (awaiting deletion)",
+        ),
+    ],
+    ids=["draining", "single-runner", "before-handover", "drained-not-yet-deleted"],
+)
+def test_scaleset_being_replaced_is_reported_in_the_status(
+    ctx: Context, garm_api: _GarmApiMocks, progress: ScalesetProgress, expected: str
+):
+    """
+    arrange: A ready charm whose scaleset reconcile reports a replacement in flight, at each
+        phase it can be in.
+    act: Run update-status.
+    assert: The unit names the scaleset by the name the operator configured and reports the
+        phase, so a long drain can be told apart from a stuck charm — and a replacement that
+        has not been created yet does not read as a finished drain. The status stays active
+        throughout: every label is served during the drain, so nothing waiting on the model
+        should block on it.
+    """
+    garm_api.scaleset.return_value.reconcile.return_value = [progress]
+
+    out = ctx.run(ctx.on.update_status(), _state())
+
+    assert out.unit_status == ops.ActiveStatus(expected)
+
+
+def test_many_scalesets_being_replaced_are_summarised(ctx: Context, garm_api: _GarmApiMocks):
+    """
+    arrange: A ready charm replacing four scalesets at once.
+    act: Run update-status.
+    assert: Only the first two are named and the rest are counted, so Juju does not truncate
+        the status into uselessness.
+    """
+    garm_api.scaleset.return_value.reconcile.return_value = [
+        ScalesetProgress(f"scaleset-{index}", f"old-{index}", f"new-{index}", index)
+        for index in range(1, 5)
+    ]
+
+    out = ctx.run(ctx.on.update_status(), _state())
+
+    assert out.unit_status == ops.ActiveStatus(
+        "Replacing scaleset scaleset-1 -> new-1 (draining 1 runner),"
+        " scaleset-2 -> new-2 (draining 2 runners), +2 more"
+    )
+
+
+def test_status_returns_to_active_once_the_replacement_is_complete(
+    ctx: Context, garm_api: _GarmApiMocks
+):
+    """
+    arrange: A ready charm whose scaleset reconcile reports nothing draining.
+    act: Run update-status.
+    assert: The unit is active — the replacement converged without operator intervention.
+    """
+    out = ctx.run(ctx.on.update_status(), _state())
+
+    assert out.unit_status == ops.ActiveStatus()
+
+
 # --- First-run initialisation -------------------------------------------------------------
 
 
diff --git a/charms/garm/tests/unit/test_garm_api.py b/charms/garm/tests/unit/test_garm_api.py
index 09df38c2..798b351e 100644
--- a/charms/garm/tests/unit/test_garm_api.py
+++ b/charms/garm/tests/unit/test_garm_api.py
@@ -254,6 +254,47 @@ def test_list_scalesets(api_response, expected_names):
     assert [ss.name for ss in result] == expected_names
 
 
+@pytest.mark.parametrize(
+    "api_response, expected_count",
+    [
+        ([MagicMock(), MagicMock()], 2),
+        ([], 0),
+        (None, 0),
+    ],
+    ids=["two-instances", "empty-list", "none-response"],
+)
+def test_list_scaleset_instances(api_response, expected_count):
+    """
+    arrange: GarmAuthenticatedClient with InstancesApi returning the parameterised response.
+    act: Call list_scaleset_instances(7).
+    assert: The runner count is reported, with a None response reading as empty — the
+        reconciler gates a scaleset's deletion on this count.
+    """
+    client = GarmAuthenticatedClient(BASE_URL, "token")
+    with _stub_api_client(client):
+        with patch("garm_api.InstancesApi") as MockApi:
+            MockApi.return_value.list_scale_set_instances.return_value = api_response
+            result = client.list_scaleset_instances(7)
+    assert len(result) == expected_count
+    MockApi.return_value.list_scale_set_instances.assert_called_once_with(
+        scaleset_id="7", _request_timeout=30
+    )
+
+
+def test_list_scaleset_instances_raises_on_api_error():
+    """
+    arrange: GarmAuthenticatedClient with InstancesApi raising ApiException(404).
+    act: Call list_scaleset_instances(99).
+    assert: GarmApiError is raised, so an unreadable count is never mistaken for zero.
+    """
+    client = GarmAuthenticatedClient(BASE_URL, "token")
+    with _stub_api_client(client):
+        with patch("garm_api.InstancesApi") as MockApi:
+            MockApi.return_value.list_scale_set_instances.side_effect = ApiException(status=404)
+            with pytest.raises(GarmApiError):
+                client.list_scaleset_instances(99)
+
+
 @pytest.mark.parametrize(
     "target, registered, expected",
     [
diff --git a/charms/garm/tests/unit/test_scaleset_reconciler.py b/charms/garm/tests/unit/test_scaleset_reconciler.py
index 9476957d..66d614bc 100644
--- a/charms/garm/tests/unit/test_scaleset_reconciler.py
+++ b/charms/garm/tests/unit/test_scaleset_reconciler.py
@@ -4,13 +4,23 @@
 """Unit tests for the scaleset reconciler."""
 
 import base64
+import datetime
 
 import pytest
 
 from charm_state import RunnerConfig
+from garm_api import GarmApiError, GarmConnectionError
 from garm_client.models.template import Template
 from runner_template import build_template_data
-from scaleset_reconciler import ScalesetReconciler, ScalesetSpec, _effective_extra_specs
+from scaleset_reconciler import (
+    DRAIN_DEADLINE,
+    MAX_SCALESET_NAME_LENGTH,
+    ScalesetProgress,
+    ScalesetReconciler,
+    ScalesetSpec,
+    _effective_extra_specs,
+    target_scaleset_name,
+)
 
 
 class _FakeProvider:
@@ -37,6 +47,7 @@ def __init__(
         tags=None,
         template_id=None,
         enabled=True,
+        updated_at=None,
     ):
         self.name = name
         self.id = sid
@@ -48,7 +59,14 @@ def __init__(
         self.extra_specs = extra_specs or {}
         self.tags = [_FakeTag(t) for t in (tags or [])]
         self.template_id = template_id
-        self.enabled = enabled
+        # GARM tags Enabled `omitempty` and has no custom marshaller, so a disabled
+        # scaleset arrives with no `enabled` key at all and the generated client reads
+        # it back as None — `False` is a shape the API never returns. Model the wire,
+        # or the whole retirement half of this suite passes against a fiction.
+        self.enabled = True if enabled else None
+        # GARM stamps this on every write, so for a retired scaleset it is the
+        # moment it was disabled — which is what the drain deadline measures from.
+        self.updated_at = updated_at or datetime.datetime.now(datetime.timezone.utc)
 
 
 class FakeGarmClient:
@@ -58,7 +76,15 @@ class FakeGarmClient:
     tests can assert on the resulting state rather than on mock call patterns.
     """
 
-    def __init__(self, providers=None, scalesets=None, org_id="org-uuid", repo_id=None):
+    def __init__(
+        self,
+        providers=None,
+        scalesets=None,
+        org_id="org-uuid",
+        repo_id=None,
+        instances=None,
+        reject_zero_max_runners=False,
+    ):
         self._providers = [_FakeProvider(n) for n in (providers or [])]
         self._scalesets = [
             _FakeScaleset(
@@ -73,11 +99,15 @@ def __init__(self, providers=None, scalesets=None, org_id="org-uuid", repo_id=No
                 tags=ss.get("tags", []),
                 template_id=ss.get("template_id", None),
                 enabled=ss.get("enabled", True),
+                updated_at=ss.get("updated_at", None),
             )
             for ss in (scalesets or [])
         ]
         self._org_id = org_id
         self._repo_id = repo_id
+        # Runner counts per scaleset id, so a draining scaleset can be modelled.
+        self._instances = instances or {}
+        self.reject_zero_max_runners = reject_zero_max_runners
         self.created: list[tuple[str, str, object]] = []
         self.updated: list[tuple[int, object]] = []
         self.deleted: list[int] = []
@@ -100,7 +130,14 @@ def create_org_scaleset(self, org_id, params):
     def create_repo_scaleset(self, repo_id, params):
         self.created.append(("repo", repo_id, params))
 
+    def list_scaleset_instances(self, scaleset_id):
+        return [object()] * self._instances.get(scaleset_id, 0)
+
     def update_scaleset(self, scaleset_id, params):
+        # Models a GARM that rejects max_runners=0 on update. Today's GARM does not
+        # (see _retire), so this only exercises the reconciler's defensive fallback.
+        if self.reject_zero_max_runners and params.max_runners == 0:
+            raise GarmApiError("max_runners must be greater than 0")
         self.updated.append((scaleset_id, params))
 
     def delete_scaleset(self, scaleset_id):
@@ -159,7 +196,7 @@ def _spec(
 
 
 def _reconcile(client, desired):
-    ScalesetReconciler(client).reconcile(desired)
+    return ScalesetReconciler(client).reconcile(desired)
 
 
 @pytest.mark.parametrize(
@@ -188,7 +225,7 @@ def test_create_scaleset(entity_type, entity_name, create_key, expected_entity_i
     kind, entity_id, params = client.created[0]
     assert kind == create_key
     assert entity_id == expected_entity_id
-    assert params.name == "my-scaleset"
+    assert params.name == target_scaleset_name("my-scaleset", [])
     assert params.image == "ubuntu-22.04"
     assert params.flavor == "m1.small"
     assert params.enabled is True
@@ -585,7 +622,7 @@ def test_template_created_when_runner_config_set():
 
     assert len(client.created_templates) == 1
     name, data, _ = client.created_templates[0]
-    assert name == "github_linux-my-scaleset"
+    assert name == f"github_linux-{target_scaleset_name('my-scaleset', [])}"
     assert b"registry-mirrors" in data
     assert len(client.created) == 1
     _, _, params = client.created[0]
@@ -794,3 +831,621 @@ def test_delete_custom_template_skips_missing_id_and_api_errors():
         templates=[_FakeTemplate("github_linux-stale", tid=7, data=b"x")],
     )
     _reconcile(failing_client, [])
+
+
+# A label change is applied by replacement (docs/adr/003); "generation" below means
+# one live scaleset of a logical spec.
+_LABELS_OLD = ["jammy", "x64"]
+_LABELS_NEW = ["jammy", "arm64"]
+_OLD_NAME = target_scaleset_name("my-scaleset", _LABELS_OLD)
+_NEW_NAME = target_scaleset_name("my-scaleset", _LABELS_NEW)
+
+
+def _generation(labels, **overrides):
+    """An existing scaleset named and tagged as the reconciler would have created it."""
+    base = _existing_scaleset(
+        name=target_scaleset_name("my-scaleset", labels), tags=sorted(labels)
+    )
+    base.update(overrides)
+    return base
+
+
+def test_create_uses_label_hashed_name():
+    """
+    arrange: FakeGarmClient with the provider registered and no existing scalesets.
+    act: Reconcile a spec carrying labels.
+    assert: The scaleset is created under the label-hashed name, so a later label change
+        resolves to a different name and can be applied by replacement.
+    """
+    client = FakeGarmClient(providers=["openstack-demo"], scalesets=[])
+
+    _reconcile(client, [_spec(labels=_LABELS_OLD)])
+
+    assert len(client.created) == 1
+    _, _, params = client.created[0]
+    assert params.name == _OLD_NAME
+    assert params.labels == sorted(_LABELS_OLD)
+
+
+def test_legacy_unsuffixed_scaleset_adopted_when_labels_match():
+    """
+    arrange: A scaleset carrying the pre-hash un-suffixed name, with the desired labels.
+    act: Reconcile the matching spec.
+    assert: It is adopted in place — upgrading the charm must not churn scalesets that
+        are already serving the right labels.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_existing_scaleset(name="my-scaleset", tags=sorted(_LABELS_OLD))],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_OLD)])
+
+    assert client.created == []
+    assert client.deleted == []
+    assert progress == []
+
+
+def test_label_change_creates_replacement_without_disabling_the_old_one():
+    """
+    arrange: One live scaleset serving the old labels.
+    act: Reconcile a spec whose labels changed.
+    assert: The replacement is created and the old scaleset is left enabled, so jobs keep
+        being served until the replacement actually exists.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1)],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert len(client.created) == 1
+    _, _, params = client.created[0]
+    assert params.name == _NEW_NAME
+    assert client.updated == []
+    assert client.deleted == []
+    assert progress == [
+        ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 0, handed_over=False)
+    ]
+
+
+def test_cutover_disables_and_zeroes_the_old_scaleset():
+    """
+    arrange: Both generations live, the replacement already enabled.
+    act: Reconcile.
+    assert: Only the old scaleset is disabled and zeroed — disabling closes its listener
+        session, which is what hands the shared labels to the replacement.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1), _generation(_LABELS_NEW, id=2)],
+        instances={1: 3},
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.created == []
+    assert client.deleted == []
+    assert len(client.updated) == 1
+    scaleset_id, params = client.updated[0]
+    assert scaleset_id == 1
+    assert params.enabled is False
+    assert params.min_idle_runners == 0
+    assert params.max_runners == 0
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 3)]
+
+
+def test_cutover_falls_back_when_zeroing_max_runners_is_rejected():
+    """
+    arrange: Both generations live and a hypothetical GARM refuses max_runners=0 on
+        update, which today's GARM accepts.
+    act: Reconcile.
+    assert: The scaleset is still disabled, so the handover happens even though the
+        runner counts could not be zeroed.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1), _generation(_LABELS_NEW, id=2)],
+        reject_zero_max_runners=True,
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert len(client.updated) == 1
+    scaleset_id, params = client.updated[0]
+    assert scaleset_id == 1
+    assert params.enabled is False
+    assert params.max_runners is None
+
+
+def test_draining_scaleset_is_not_deleted_while_runners_remain():
+    """
+    arrange: The old generation is already disabled and still has runners.
+    act: Reconcile.
+    assert: It is not deleted, so jobs already running on it can finish; the remaining
+        count is reported so the charm can show progress.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        instances={1: 2},
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 2)]
+
+
+def test_drained_scaleset_is_deleted_with_its_template():
+    """
+    arrange: The old generation is disabled with no runners left, and owns a template.
+    act: Reconcile.
+    assert: Both the scaleset and its template are deleted and nothing is left draining,
+        so no idle scaleset lingers on GitHub.
+    """
+    client = _TemplateTrackingClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False, template_id=2),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        templates=[_SYSTEM_TEMPLATE, _FakeTemplate(f"github_linux-{_OLD_NAME}", tid=2, data=b"x")],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == [1]
+    assert client.deleted_templates == [2]
+    assert progress == []
+
+
+def test_retiring_generation_is_not_treated_as_an_orphan():
+    """
+    arrange: Both generations live while the spec still exists.
+    act: Reconcile.
+    assert: The old generation is disabled rather than deleted outright — the orphan pass
+        must not shortcut the drain and kill runners mid-job.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1), _generation(_LABELS_NEW, id=2)],
+        instances={1: 1},
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+
+
+def test_every_generation_is_deleted_when_the_spec_is_removed():
+    """
+    arrange: Two generations live and no desired specs at all.
+    act: Reconcile.
+    assert: Both are disabled and deleted — removing the relation must not leave a
+        generation behind.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1), _generation(_LABELS_NEW, id=2)],
+    )
+
+    _reconcile(client, [])
+
+    assert sorted(client.deleted) == [1, 2]
+
+
+def test_label_revert_re_adopts_the_draining_scaleset():
+    """
+    arrange: The old generation is disabled and draining, the new one is live.
+    act: Reconcile a spec whose labels are reverted to the old ones.
+    assert: The disabled scaleset is re-enabled and no third scaleset is created — its
+        name is again the target name, so it is simply adopted back.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_OLD)])
+
+    assert client.created == []
+    scaleset_id, params = client.updated[0]
+    assert scaleset_id == 1
+    assert params.enabled is True
+
+
+def test_two_label_changes_retire_both_older_generations():
+    """
+    arrange: Three generations live: two superseded ones and the current one.
+    act: Reconcile the spec for the newest labels.
+    assert: Both older generations are disabled independently — a second label change
+        mid-drain must not strand the first one.
+    """
+    labels_newest = ["jammy", "s390x"]
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1),
+            _generation(_LABELS_NEW, id=2),
+            _generation(labels_newest, id=3),
+        ],
+        instances={1: 1, 2: 1},
+    )
+
+    progress = _reconcile(client, [_spec(labels=labels_newest)])
+
+    assert sorted(scaleset_id for scaleset_id, _ in client.updated) == [1, 2]
+    assert all(params.enabled is False for _, params in client.updated)
+    assert len(progress) == 2
+
+
+def test_a_similarly_named_scaleset_is_not_claimed_as_a_generation():
+    """
+    arrange: Two specs whose names differ only by something that looks like a hash suffix.
+    act: Reconcile both.
+    assert: Neither scaleset is disabled or deleted, so one spec cannot retire the other's
+        scaleset just because the names overlap.
+    """
+    sibling = "my-scaleset-1a2b3c4d"
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _existing_scaleset(name=target_scaleset_name("my-scaleset", []), id=1),
+            _existing_scaleset(name=target_scaleset_name(sibling, []), id=2),
+        ],
+    )
+
+    progress = _reconcile(client, [_spec(), _spec(name=sibling)])
+
+    assert client.created == []
+    assert client.deleted == []
+    assert progress == []
+
+
+def test_unexpected_labels_do_not_freeze_the_other_fields():
+    """
+    arrange: The target-named scaleset exists but carries labels that don't match the spec
+        (GARM normalised the tags, a hash collision, or a hand-edited scaleset), and its
+        image is stale.
+    act: Reconcile a spec that needs an image update.
+    assert: The image is still updated — labels cannot be fixed by an update, so refusing
+        to update would freeze every unrelated field for as long as the mismatch lasts.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _existing_scaleset(
+                name=target_scaleset_name("my-scaleset", _LABELS_NEW),
+                tags=["something", "else"],
+                image="ubuntu-20.04",
+            )
+        ],
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert len(client.updated) == 1
+    assert client.updated[0][1].image == "ubuntu-22.04"
+
+
+def test_long_names_sharing_a_prefix_get_distinct_scalesets():
+    """
+    arrange: Two specs whose names are too long for a scaleset name and share a prefix,
+        with identical labels.
+    act: Reconcile both.
+    assert: Two scalesets are created under distinct names — truncating to a shared prefix
+        would collapse them onto one scaleset that both specs then fight over.
+    """
+    prefix = "a" * MAX_SCALESET_NAME_LENGTH
+    client = FakeGarmClient(providers=["openstack-demo"], scalesets=[])
+
+    _reconcile(client, [_spec(name=f"{prefix}-one"), _spec(name=f"{prefix}-two")])
+
+    created_names = [params.name for _, _, params in client.created]
+    assert len(set(created_names)) == 2
+    assert all(len(name) <= MAX_SCALESET_NAME_LENGTH for name in created_names)
+
+
+def test_drained_scaleset_survives_an_unreadable_runner_count():
+    """
+    arrange: The old generation is disabled and its instance listing fails.
+    act: Reconcile.
+    assert: It is not deleted — an unknown runner count must never be mistaken for a
+        drained scaleset and take live runners down with it.
+    """
+
+    class _InstanceListingFailsClient(FakeGarmClient):
+        def list_scaleset_instances(self, scaleset_id):
+            raise GarmApiError("boom")
+
+    client = _InstanceListingFailsClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 1)]
+
+
+def test_template_outlives_a_failed_scaleset_delete():
+    """
+    arrange: The old generation is drained but GARM rejects its deletion.
+    act: Reconcile.
+    assert: Its template is kept — deleting the template of a scaleset that still exists
+        would strip the runner config the next delete attempt still relies on.
+    """
+
+    class _DeleteFailingClient(_TemplateTrackingClient):
+        def delete_scaleset(self, scaleset_id):
+            raise GarmApiError("scaleset still has runners")
+
+    client = _DeleteFailingClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False, template_id=2),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        templates=[_SYSTEM_TEMPLATE, _FakeTemplate(f"github_linux-{_OLD_NAME}", tid=2, data=b"x")],
+    )
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+    assert client.deleted_templates == []
+
+
+def test_failed_delete_keeps_the_replacement_reported_as_unfinished():
+    """
+    arrange: The old generation is drained but GARM rejects its deletion.
+    act: Reconcile.
+    assert: It is still reported as in flight — a scaleset GARM refused to delete is
+        still on GitHub, so reporting the charm as converged would hide it.
+    """
+
+    class _DeleteFailingClient(FakeGarmClient):
+        def delete_scaleset(self, scaleset_id):
+            raise GarmApiError("scaleset still has runners")
+
+    client = _DeleteFailingClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 0)]
+
+
+def test_drain_past_the_deadline_stops_waiting_on_the_runner_count():
+    """
+    arrange: The old generation was disabled longer ago than any job can run, and still
+        reports a runner (one stuck in a provider-side failure GARM never reaped).
+    act: Reconcile.
+    assert: The delete is attempted anyway, so a permanently faulted instance cannot pin
+        a dead scaleset on GitHub forever; GARM itself rejects the call while runners are
+        genuinely active, so no in-flight job is cut short.
+    """
+    long_ago = datetime.datetime.now(datetime.timezone.utc) - DRAIN_DEADLINE * 2
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False, updated_at=long_ago),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        instances={1: 1},
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == [1]
+    assert progress == []
+
+
+def test_drain_within_the_deadline_still_waits_for_the_runners():
+    """
+    arrange: The old generation was disabled recently and still has a runner.
+    act: Reconcile.
+    assert: It is not deleted — the deadline is a backstop for stuck instances, and must
+        not shorten a normal drain and cut a running job short.
+    """
+    recently = datetime.datetime.now(datetime.timezone.utc) - DRAIN_DEADLINE / 2
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False, updated_at=recently),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        instances={1: 1},
+    )
+
+    progress = _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == []
+    assert progress == [ScalesetProgress("my-scaleset", _OLD_NAME, _NEW_NAME, 1)]
+
+
+@pytest.mark.parametrize(
+    "updated_at",
+    [
+        None,
+        # Naive, and far enough back that no timezone offset can bring it inside the
+        # deadline — the point is that it is read as a timestamp at all, not crashed on.
+        datetime.datetime.now() - datetime.timedelta(days=30),
+    ],
+    ids=["no-timestamp", "naive-timestamp"],
+)
+def test_drain_deadline_handles_an_unusable_timestamp(updated_at):
+    """
+    arrange: The old generation is draining and GARM reports no update timestamp, or a
+        naive one (no timezone).
+    act: Reconcile.
+    assert: Neither crashes: a missing timestamp keeps waiting rather than reading as an
+        expired deadline, and a naive one is read as UTC.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=False),
+            _generation(_LABELS_NEW, id=2),
+        ],
+        instances={1: 1},
+    )
+    client._scalesets[0].updated_at = updated_at
+
+    _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+    assert client.deleted == ([] if updated_at is None else [1])
+
+
+def test_a_failing_spec_does_not_wedge_the_others():
+    """
+    arrange: Two specs, the first of which GARM refuses to create.
+    act: Reconcile.
+    assert: The second is still created and the failure is re-raised, so one bad spec
+        cannot freeze every other scaleset while the charm still reports the sync failed.
+    """
+
+    class _FirstCreateFailsClient(FakeGarmClient):
+        def create_org_scaleset(self, org_id, params):
+            if params.name.startswith("bad-"):
+                raise GarmApiError("labels rejected")
+            super().create_org_scaleset(org_id, params)
+
+    client = _FirstCreateFailsClient(providers=["openstack-demo"], scalesets=[])
+
+    with pytest.raises(GarmApiError):
+        _reconcile(client, [_spec(name="bad-scaleset"), _spec(name="good-scaleset")])
+
+    assert [params.name for _, _, params in client.created] == [
+        target_scaleset_name("good-scaleset", [])
+    ]
+
+
+def test_a_failing_spec_does_not_hand_its_scalesets_to_the_orphan_pass():
+    """
+    arrange: A spec whose update GARM rejects, with its scaleset already live.
+    act: Reconcile.
+    assert: The scaleset is not deleted — a transient API failure must never be read as
+        "this scaleset is no longer wanted".
+    """
+
+    class _UpdateFailsClient(FakeGarmClient):
+        def update_scaleset(self, scaleset_id, params):
+            raise GarmApiError("boom")
+
+    client = _UpdateFailsClient(
+        providers=["openstack-demo"],
+        scalesets=[_generation(_LABELS_OLD, id=1, image="ubuntu-20.04")],
+    )
+
+    with pytest.raises(GarmApiError):
+        _reconcile(client, [_spec(labels=_LABELS_OLD)])
+
+    assert client.deleted == []
+
+
+def test_a_connection_error_aborts_the_pass_immediately():
+    """
+    arrange: Two specs and a GARM that is unreachable.
+    act: Reconcile.
+    assert: The error propagates without attempting the second spec — GARM is down, so
+        retrying every remaining spec would only stall the hook.
+    """
+
+    class _UnreachableClient(FakeGarmClient):
+        def __init__(self, **kwargs):
+            super().__init__(**kwargs)
+            self.attempts = 0
+
+        def create_org_scaleset(self, org_id, params):
+            self.attempts += 1
+            raise GarmConnectionError("connection refused")
+
+    client = _UnreachableClient(providers=["openstack-demo"], scalesets=[])
+
+    with pytest.raises(GarmConnectionError):
+        _reconcile(client, [_spec(name="one"), _spec(name="two")])
+
+    assert client.attempts == 1
+
+
+class _UnreachableWhenRetiring(FakeGarmClient):
+    def update_scaleset(self, scaleset_id, params):
+        raise GarmConnectionError("connection refused")
+
+
+class _UnreachableWhenCounting(FakeGarmClient):
+    def list_scaleset_instances(self, scaleset_id):
+        raise GarmConnectionError("connection refused")
+
+
+class _UnreachableWhenDeleting(FakeGarmClient):
+    def delete_scaleset(self, scaleset_id):
+        raise GarmConnectionError("connection refused")
+
+
+@pytest.mark.parametrize(
+    "client_class, old_enabled",
+    [
+        (_UnreachableWhenRetiring, True),
+        (_UnreachableWhenCounting, False),
+        (_UnreachableWhenDeleting, False),
+    ],
+    ids=["retiring", "counting-runners", "deleting"],
+)
+def test_a_connection_error_during_a_drain_is_not_reported_as_progress(
+    client_class, old_enabled
+):
+    """
+    arrange: A generation being retired or already draining, and a GARM that is unreachable
+        at each of the three calls the drain makes.
+    act: Reconcile.
+    assert: The error propagates rather than being contained as a per-scaleset failure, so
+        the charm reports the outage instead of a drain that is not actually advancing.
+        GarmConnectionError subclasses GarmApiError, so the containing handlers would
+        otherwise swallow it and report progress.
+    """
+    client = client_class(
+        providers=["openstack-demo"],
+        scalesets=[
+            _generation(_LABELS_OLD, id=1, enabled=old_enabled),
+            _generation(_LABELS_NEW, id=2),
+        ],
+    )
+
+    with pytest.raises(GarmConnectionError):
+        _reconcile(client, [_spec(labels=_LABELS_NEW)])
+
+
+def test_duplicate_desired_names_are_ignored():
+    """
+    arrange: Two specs sharing a logical name but carrying different labels.
+    act: Reconcile.
+    assert: Only the first is applied — both would own the other's scaleset and retire it
+        on every reconcile, replacing each other forever.
+    """
+    client = FakeGarmClient(providers=["openstack-demo"], scalesets=[])
+
+    progress = _reconcile(
+        client,
+        [_spec(labels=_LABELS_OLD), _spec(labels=_LABELS_NEW)],
+    )
+
+    assert [params.name for _, _, params in client.created] == [_OLD_NAME]
+    assert progress == []
diff --git a/charms/tests/integration/test_garm.py b/charms/tests/integration/test_garm.py
index 624d524d..238ff495 100644
--- a/charms/tests/integration/test_garm.py
+++ b/charms/tests/integration/test_garm.py
@@ -6,6 +6,7 @@
 import base64
 import json
 import logging
+import re
 import secrets
 import urllib.request
 
@@ -40,6 +41,9 @@
 # uppercase (A), lowercase (dmin + hex), digit (1 + hex), symbols (-, !).
 _GARM_ADMIN_PASSWORD = f"Admin-{secrets.token_hex(8)}-X1!"
 _SCALESET_TEST_NAME = "test-scaleset"
+# Live scalesets are named "<configured name>-<label hash>", so match a generation
+# rather than the configured name (mirrors target_scaleset_name in the charm).
+_SCALESET_GENERATION_SUFFIX = r"-[0-9a-f]{8}"
 # Credential name the GARM charm derives from the configurator's github-app-id +
 # installation id (12345 / 67890).
 _SYNCED_CREDENTIAL_NAME = "app-12345-67890"
@@ -375,7 +379,13 @@ def test_charm_reconciles_org_and_scaleset(
     )
 
     scaleset = _wait_for_scaleset(base_url, token, _SCALESET_TEST_NAME)
-    assert scaleset["name"] == _SCALESET_TEST_NAME
+    assert re.fullmatch(
+        rf"{re.escape(_SCALESET_TEST_NAME)}{_SCALESET_GENERATION_SUFFIX}",
+        scaleset["name"],
+    ), (
+        f"Expected a label-hashed generation of {_SCALESET_TEST_NAME!r}, "
+        f"got {scaleset['name']!r}"
+    )
     assert scaleset["max_runners"] == 10
 
     templates = _list_templates(address, token)
@@ -391,6 +401,84 @@ def test_charm_reconciles_org_and_scaleset(
     )
 
 
+def test_label_change_replaces_the_scaleset_and_removes_the_predecessor(
+    juju: jubilant.Juju,
+    configurator_garm: str,
+    configurator_with_image: str,
+    fake_github_api_url: str,
+):
+    """
+    arrange: The charm has converged a scaleset against the mock GitHub API (the preceding
+        test leaves github.com repointed), and update-status is driven fast enough to let
+        the multi-reconcile changeover advance within the test.
+    act: Change the configured labels, which GitHub offers no API to update in place.
+    assert: One enabled generation remains, under a different label-hashed name, and the
+        predecessor is gone entirely — exercising the create/hand-over/drain/delete path
+        end to end. The unit fixtures cannot cover this: they cannot reproduce how GARM
+        reports a disabled scaleset, which is where the changeover previously wedged.
+    """
+    address = _get_garm_address(juju, configurator_garm)
+    base_url = _garm_api_base_url(address)
+    token = _garm_first_run(juju, address)
+
+    before = _wait_for_scaleset(base_url, token, _SCALESET_TEST_NAME)
+
+    # No VMs are involved — the OpenStack provider binary is only checked for presence, so
+    # the generations carry zero instances and the drain completes as fast as the charm is
+    # asked to reconcile. The changeover spans three reconciles by design, so drive
+    # update-status rather than waiting out the model's default interval.
+    original_interval = juju.cli("model-config", "update-status-hook-interval").strip()
+    juju.cli("model-config", "update-status-hook-interval=10s")
+    try:
+        juju.config(configurator_with_image, values={"labels": "jammy,x64"})
+        juju.wait(
+            lambda status: jubilant.all_active(status, configurator_with_image)
+            and jubilant.all_agents_idle(status, configurator_garm),
+            timeout=3 * 60,
+            delay=10,
+        )
+        _wait_for_single_generation(base_url, token, _SCALESET_TEST_NAME, before["name"])
+    finally:
+        juju.cli("model-config", f"update-status-hook-interval={original_interval}")
+
+
+@retry(
+    retry=retry_if_exception_type(
+        (AssertionError, requests.exceptions.RequestException)
+    ),
+    wait=wait_exponential(multiplier=1, min=5, max=20),
+    stop=stop_after_attempt(30),
+)
+def _wait_for_single_generation(
+    base_url: str, token: str, name: str, previous_name: str
+) -> dict:
+    """Wait until only the replacement generation of *name* is left.
+
+    Retries until the whole changeover has run: the replacement is created, the
+    predecessor is disabled, and the predecessor is finally deleted. Asserting on the
+    end state rather than on each phase keeps the test independent of how many
+    update-status ticks the model happens to deliver.
+    """
+    generation = re.compile(rf"^{re.escape(name)}({_SCALESET_GENERATION_SUFFIX})?$")
+    matching = [
+        scaleset
+        for scaleset in _list_scalesets(base_url, token)
+        if generation.match(scaleset.get("name") or "")
+    ]
+    names = [scaleset.get("name") for scaleset in matching]
+    assert previous_name not in names, (
+        f"Expected the predecessor {previous_name!r} to be deleted once drained, "
+        f"still present among {names!r}"
+    )
+    assert len(matching) == 1, (
+        f"Expected exactly one generation of {name!r} after the changeover, got {names!r}"
+    )
+    assert matching[0].get("enabled") is True, (
+        f"Expected the replacement {names[0]!r} to be serving, got {matching[0]!r}"
+    )
+    return matching[0]
+
+
 def _list_templates(address: str, token: str) -> list[dict]:
     """List all runner install templates from the GARM API.
 
@@ -624,9 +712,25 @@ def _list_scalesets(base_url: str, token: str) -> list[dict]:
 
 
 def _find_scaleset(scalesets: list[dict], name: str) -> dict | None:
-    """Return the first scaleset with the requested name."""
+    """Return the live scaleset serving a configured name, whatever generation it is on.
+
+    The live name carries a label hash, so an exact match on the configured name
+    would find nothing. A superseded generation lingers, disabled, until it has
+    drained, so only an enabled scaleset counts as the one currently serving.
+
+    GARM tags Enabled ``omitempty``, so a disabled scaleset comes back with no
+    ``enabled`` key at all: test for the key being true, not for it being false,
+    or every draining predecessor reads as still serving.
+    """
+    generation = re.compile(rf"^{re.escape(name)}({_SCALESET_GENERATION_SUFFIX})?$")
     return next(
-        (scaleset for scaleset in scalesets if scaleset.get("name") == name), None
+        (
+            scaleset
+            for scaleset in scalesets
+            if generation.match(scaleset.get("name") or "")
+            and scaleset.get("enabled") is True
+        ),
+        None,
     )
 
 
diff --git a/docs/adr/003_scaleset_label_change_by_replacement.md b/docs/adr/003_scaleset_label_change_by_replacement.md
new file mode 100644
index 00000000..aaa796eb
--- /dev/null
+++ b/docs/adr/003_scaleset_label_change_by_replacement.md
@@ -0,0 +1,79 @@
+---
+title: ADR-003 - scale set label changes by replacement
+author: Andrew Liaw (andrew.liaw@canonical.com)
+date: 2026/08/14
+domain: architecture
+replaced-by:
+---
+
+# Scale set label changes by replacement
+
+GitHub assigns a scale set's labels at creation and provides no API to change them.
+The GARM charm applies a label change by creating a replacement scale set and draining its predecessor, deriving both names from a hash of their labels.
+
+## Context
+
+`UpdateScaleSetParams` exposes no labels field.
+A drain lasts as long as its longest in-flight job, up to GitHub's six-hour limit, exceeding any hook's execution budget.
+
+## Decision
+
+A live scale set is named `<configured name>-<first 8 characters of the SHA-256 digest of its sorted labels>`.
+Only labels feed the digest; all other fields are updated in place.
+
+Each reconcile advances the changeover by one step:
+
+1. Create the replacement under its label-hashed name. The predecessor remains enabled.
+2. When the replacement is observed enabled, set the predecessor to `enabled=false`, `min_idle_runners=0`, `max_runners=0`.
+3. While the predecessor reports runners, report progress and take no action.
+4. When it reports no runners, delete it and its runner template.
+
+Disabling closes the predecessor's listener session: `listener.Stop()` calls `DeleteMessageSession`, so the session is deleted GitHub-side rather than dropped locally, and `keepListenerAlive` does not restart it while the scale set is disabled.
+Labels common to both generations are served by one scale set or the other for the duration, subject to the open question recorded below.
+The charm reports an active status naming the configured scale set and its phase, and drops the phase from the status once the predecessor is deleted.
+
+The design depends on four behaviors, verified against the GitHub API and the GARM source:
+
+- GitHub enforces uniqueness on `name` within a runner group. A duplicate name returns `400 RunnerScaleSetExistsException`; overlapping and identical label sets under distinct names return `200`.
+- `handleScaleDown` skips instances whose `RunnerStatus` is `RunnerActive` or `RunnerTerminated`, so an instance executing a job is not removed. `handleScaleUp` returns when `Enabled` is false.
+- `handleAutoScale` runs on a five-second ticker and is not gated on `Enabled`. `handleScaleSetUpdateOperation` retains the worker; only `handleScaleSetDeleteOperation` stops it. Disabling stops the listener alone.
+- `targetRunners` evaluates `min(MinIdleRunners + DesiredRunnerCount, MaxRunners)`, which is 0 when `max_runners` is 0. `UpdateScaleSetByID` validates only `min_idle_runners <= max_runners`; the `max_runners != 0` constraint applies to `CreateScaleSetParams.Validate` alone.
+
+One behavior is not established by either source.
+Deleting the message session stops GARM receiving job assignments; whether GitHub stops assigning jobs to a scale set that still exists with the same labels in the same runner group is undocumented, and the GARM source cannot answer it.
+If GitHub does continue to assign, a job routed to the predecessor after the disable is not delivered, because GARM does not reopen the session to resume from `last_message_id`; the job waits until the predecessor is deleted, bounded by the seven-hour drain deadline below.
+Both generations carry the shared labels for the whole drain, so this would not be a rare case.
+Confirming it requires an observed run rather than a source reference.
+
+## Alternatives considered
+
+Deleting and recreating the scale set under one name was rejected: it terminates in-flight jobs and leaves an interval in which no scale set carries the labels.
+
+A monotonic suffix such as `-v1` and `-v2` was rejected: deriving the next suffix requires the current one, reintroducing persisted state.
+A digest also maps a reverted label set back onto the name that generation already holds, so a draining predecessor is re-adopted rather than a third scale set created.
+
+Recording the changeover in peer relation data or on disk was rejected: it establishes a second source of truth alongside GARM and requires its own cleanup.
+
+Blocking the hook until the drain completes was rejected: the drain can exceed six hours.
+
+## Consequences
+
+Live names carry a hash suffix, so `garm-cli scaleset list` reports `my-scaleset-1a2b3c4d`.
+The configured name remains the operator-facing identity and is what the unit status reports.
+Names are capped at 64 characters; a longer configured name is truncated and suffixed with a digest of its full value, so names sharing a prefix resolve to distinct scale sets.
+
+A changeover spans three reconciles, so at the default update-status interval a label change with no in-flight jobs completes in approximately 15 minutes.
+The unit stays active throughout, carrying the phase as its status message.
+Maintenance was rejected: the service is fully functional for the whole drain, and a drain reaching the deadline below would otherwise block `juju wait-for` and integration tests on hours of healthy background convergence.
+
+Both generations carry the full `min_idle_runners` until the predecessor is deleted, so the idle runner count doubles for the duration of the drain.
+Against a fixed OpenStack quota the replacement may be unable to spawn runners at all, which stalls the changeover it is meant to complete.
+Operators should size the quota for twice the configured idle count.
+
+Each generation owns a runner template named after its live scale set, so a draining predecessor retains the template its runners were built from.
+
+An instance GARM does not remove would block deletion indefinitely, so after seven hours the charm stops gating on its runner count and attempts deletion on each reconcile.
+GARM rejects that request while the scale set has active runners, which bounds the effect.
+
+The 32-bit digest can collide, leaving a scale set whose labels do not match its spec.
+The charm logs both label sets and applies the remaining fields, rather than blocking updates to image, flavor, and runner counts while the mismatch persists.
diff --git a/docs/changelog.md b/docs/changelog.md
index b2e314de..957b25dc 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 Each revision is versioned by the date of the revision.
 
+## 2026-08-14
+
+- `garm`: apply scaleset label changes automatically. Labels are immutable once a GitHub scale set exists, so changing them in the `garm-configurator` relation data previously did nothing but log a warning telling the operator to remove and re-add the relation. The charm now applies a label change by creating a replacement scale set and retiring the one it replaces. Both generations run concurrently until the retired one has drained, so the idle runner count doubles for the duration; size the OpenStack quota accordingly. The unit stays active throughout and reports the changeover phase in its status.
+
 ## 2026-07-13
 
 - `garm`: fix the SSH debug (tmate) connection details so the runner actually reads them. The `TMATE_SERVER_*` variables injected into the shared runner template were written to `/home/runner/.env`, but the GitHub Actions runner sources a `.env` file from its install directory (`/home/runner/actions-runner/.env`), so the debug-SSH server host, port, and fingerprints were silently ignored. They are now written to the `.env` file the runner reads, matching the per-scaleset runner options.