diff --git a/.github/workflows/hakari.yml b/.github/workflows/hakari.yml
index d79c836fba..1805da8ad8 100644
--- a/.github/workflows/hakari.yml
+++ b/.github/workflows/hakari.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           toolchain: stable
       - name: Install cargo-hakari
-        uses: taiki-e/install-action@8f354f35e51028c902e8ab954045e37739acf562 # v2
+        uses: taiki-e/install-action@f7c663c03b51ed0d93e9cec22a575d3f02175989 # v2
         with:
           tool: cargo-hakari
       - name: Check workspace-hack Cargo.toml is up-to-date
diff --git a/Cargo.lock b/Cargo.lock
index 4721c92144..7df14512fe 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -324,7 +324,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f4d45f362125ed144544e57b0ec6de8fd6a296d41a6252fc4a20c0cf12e9ed3a"
 dependencies = [
- "rustix 0.38.9",
+ "rustix 0.38.25",
  "tempfile",
  "windows-sys 0.48.0",
 ]
@@ -754,9 +754,9 @@ dependencies = [
 
 [[package]]
 name = "camino-tempfile"
-version = "1.0.2"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ab15a83d13f75dbd86f082bdefd160b628476ef58d3b900a0ef74e001bb097"
+checksum = "cb905055fa81e4d427f919b2cd0d76a998267de7d225ea767a1894743a5263c2"
 dependencies = [
  "camino",
  "tempfile",
@@ -1671,9 +1671,9 @@ dependencies = [
 
 [[package]]
 name = "diesel_derives"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e054665eaf6d97d1e7125512bb2d35d07c73ac86cc6920174cb42d1ab697a554"
+checksum = "ef8337737574f55a468005a83499da720f20c65586241ffea339db9ecdfd2b44"
 dependencies = [
  "diesel_table_macro_syntax",
  "proc-macro2",
@@ -1791,7 +1791,7 @@ dependencies = [
  "omicron-workspace-hack",
  "openapi-lint",
  "openapiv3 1.0.3",
- "pretty-hex 0.3.0",
+ "pretty-hex 0.4.0",
  "schemars",
  "serde",
  "serde_json",
@@ -2151,7 +2151,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ef033ed5e9bad94e55838ca0ca906db0e043f517adda0c8b79c7a8c66c93c1b5"
 dependencies = [
  "cfg-if 1.0.0",
- "rustix 0.38.9",
+ "rustix 0.38.25",
  "windows-sys 0.48.0",
 ]
 
@@ -3072,6 +3072,7 @@ dependencies = [
  "bhyve_api",
  "byteorder",
  "camino",
+ "camino-tempfile",
  "cfg-if 1.0.0",
  "crucible-smf",
  "futures",
@@ -3383,7 +3384,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
  "hermit-abi 0.3.2",
- "rustix 0.38.9",
+ "rustix 0.38.25",
  "windows-sys 0.48.0",
 ]
 
@@ -3636,9 +3637,9 @@ checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.5"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57bcfdad1b858c2db7c38303a6d2ad4dfaf5eb53dfeb0910128b2c26d6158503"
+checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
 
 [[package]]
 name = "lock_api"
@@ -3992,6 +3993,7 @@ dependencies = [
  "sled-agent-client",
  "steno",
  "strum",
+ "thiserror",
  "uuid",
 ]
 
@@ -4177,6 +4179,7 @@ dependencies = [
  "schemars",
  "serde",
  "serde_json",
+ "serde_with",
  "steno",
  "strum",
  "uuid",
@@ -4935,6 +4938,7 @@ dependencies = [
  "diesel",
  "digest",
  "either",
+ "errno",
  "flate2",
  "futures",
  "futures-channel",
@@ -4979,7 +4983,7 @@ dependencies = [
  "regex-syntax 0.8.2",
  "reqwest",
  "ring 0.16.20",
- "rustix 0.38.9",
+ "rustix 0.38.25",
  "schemars",
  "semver 1.0.20",
  "serde",
@@ -5974,9 +5978,9 @@ checksum = "bc5c99d529f0d30937f6f4b8a86d988047327bb88d04d2c4afc356de74722131"
 
 [[package]]
 name = "pretty-hex"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6fa0831dd7cc608c38a5e323422a0077678fa5744aa2be4ad91c4ece8eec8d5"
+checksum = "23c6b968ed37d62e35b4febaba13bfa231b0b7929d68b8a94e65445a17e2d35f"
 
 [[package]]
 name = "pretty_assertions"
@@ -6421,6 +6425,15 @@ dependencies = [
  "bitflags 1.3.2",
 ]
 
+[[package]]
+name = "redox_syscall"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
 [[package]]
 name = "redox_users"
 version = "0.4.3"
@@ -6872,14 +6885,14 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.9"
+version = "0.38.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bfe0f2582b4931a45d1fa608f8a8722e8b3c7ac54dd6d5f3b3212791fedef49"
+checksum = "dc99bc2d4f1fed22595588a013687477aedf3cdcfb26558c559edb67b4d9b22e"
 dependencies = [
  "bitflags 2.4.0",
  "errno",
  "libc",
- "linux-raw-sys 0.4.5",
+ "linux-raw-sys 0.4.11",
  "windows-sys 0.48.0",
 ]
 
@@ -8171,14 +8184,14 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
 dependencies = [
  "cfg-if 1.0.0",
  "fastrand",
- "redox_syscall 0.3.5",
- "rustix 0.38.9",
+ "redox_syscall 0.4.1",
+ "rustix 0.38.25",
  "windows-sys 0.48.0",
 ]
 
@@ -9883,9 +9896,9 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
 dependencies = [
  "zeroize_derive",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index e4588efbde..694cd2c8dc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -160,7 +160,7 @@ byteorder = "1.5.0"
 bytes = "1.5.0"
 bytesize = "1.3.0"
 camino = "1.1"
-camino-tempfile = "1.0.2"
+camino-tempfile = "1.1.1"
 cancel-safe-futures = "0.1.5"
 chacha20poly1305 = "0.10.1"
 ciborium = "0.2.1"
@@ -282,13 +282,13 @@ p256 = "0.13"
 parse-display = "0.8.2"
 partial-io = { version = "0.5.4", features = ["proptest1", "tokio1"] }
 paste = "1.0.14"
-percent-encoding = "2.3.0"
+percent-encoding = "2.3.1"
 pem = "1.1"
 petgraph = "0.6.4"
 postgres-protocol = "0.6.6"
 predicates = "3.0.4"
 pretty_assertions = "1.4.0"
-pretty-hex = "0.3.0"
+pretty-hex = "0.4.0"
 proc-macro2 = "1.0"
 progenitor = { git = "https://github.com/oxidecomputer/progenitor", branch = "main" }
 progenitor-client = { git = "https://github.com/oxidecomputer/progenitor", branch = "main" }
@@ -389,7 +389,7 @@ walkdir = "2.4"
 wicket = { path = "wicket" }
 wicket-common = { path = "wicket-common" }
 wicketd-client = { path = "clients/wicketd-client" }
-zeroize = { version = "1.6.0", features = ["zeroize_derive", "std"] }
+zeroize = { version = "1.7.0", features = ["zeroize_derive", "std"] }
 zip = { version = "0.6.6", default-features = false, features = ["deflate","bzip2"] }
 zone = { version = "0.3", default-features = false, features = ["async"] }
 
diff --git a/bootstore/src/schemes/v0/request_manager.rs b/bootstore/src/schemes/v0/request_manager.rs
index 780213430c..90466fdc07 100644
--- a/bootstore/src/schemes/v0/request_manager.rs
+++ b/bootstore/src/schemes/v0/request_manager.rs
@@ -109,7 +109,7 @@ impl RequestManager {
         let expiry = now + self.config.rack_init_timeout;
         let mut acks = InitAcks::default();
         acks.expected =
-            packages.keys().cloned().filter(|id| id != &self.id).collect();
+            packages.keys().filter(|&id| id != &self.id).cloned().collect();
         let req = TrackableRequest::InitRack {
             rack_uuid,
             packages: packages.clone(),
diff --git a/common/src/api/external/mod.rs b/common/src/api/external/mod.rs
index 0f7bd71dbb..db5272cd6e 100644
--- a/common/src/api/external/mod.rs
+++ b/common/src/api/external/mod.rs
@@ -409,7 +409,7 @@ impl SemverVersion {
     /// This is the official ECMAScript-compatible validation regex for
     /// semver:
     /// <https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string>
-    const VALIDATION_REGEX: &str = r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$";
+    const VALIDATION_REGEX: &'static str = r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$";
 }
 
 impl JsonSchema for SemverVersion {
diff --git a/dev-tools/omicron-dev/tests/test_omicron_dev.rs b/dev-tools/omicron-dev/tests/test_omicron_dev.rs
index f1e8177243..7e78e5dc5a 100644
--- a/dev-tools/omicron-dev/tests/test_omicron_dev.rs
+++ b/dev-tools/omicron-dev/tests/test_omicron_dev.rs
@@ -27,7 +27,7 @@ use subprocess::Redirection;
 const CMD_OMICRON_DEV: &str = env!("CARGO_BIN_EXE_omicron-dev");
 
 /// timeout used for various things that should be pretty quick
-const TIMEOUT: Duration = Duration::from_secs(15);
+const TIMEOUT: Duration = Duration::from_secs(30);
 
 fn path_to_omicron_dev() -> PathBuf {
     path_to_executable(CMD_OMICRON_DEV)
diff --git a/illumos-utils/Cargo.toml b/illumos-utils/Cargo.toml
index 497454e047..8296eace5c 100644
--- a/illumos-utils/Cargo.toml
+++ b/illumos-utils/Cargo.toml
@@ -11,6 +11,7 @@ async-trait.workspace = true
 bhyve_api.workspace = true
 byteorder.workspace = true
 camino.workspace = true
+camino-tempfile.workspace = true
 cfg-if.workspace = true
 crucible-smf.workspace = true
 futures.workspace = true
diff --git a/illumos-utils/src/running_zone.rs b/illumos-utils/src/running_zone.rs
index bdf7ed0cbf..ea80a6d34b 100644
--- a/illumos-utils/src/running_zone.rs
+++ b/illumos-utils/src/running_zone.rs
@@ -11,10 +11,12 @@ use crate::opte::{Port, PortTicket};
 use crate::svc::wait_for_service;
 use crate::zone::{AddressRequest, IPADM, ZONE_PREFIX};
 use camino::{Utf8Path, Utf8PathBuf};
+use camino_tempfile::Utf8TempDir;
 use ipnetwork::IpNetwork;
 use omicron_common::backoff;
 use slog::{error, info, o, warn, Logger};
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+use std::sync::Arc;
 #[cfg(target_os = "illumos")]
 use std::sync::OnceLock;
 #[cfg(target_os = "illumos")]
@@ -214,7 +216,7 @@ mod zenter {
     // the contracts used for this come from templates that define becoming
     // empty as a critical event.
     pub fn contract_reaper(log: Logger) {
-        const EVENT_PATH: &[u8] = b"/system/contract/process/pbundle";
+        const EVENT_PATH: &'static [u8] = b"/system/contract/process/pbundle";
         const CT_PR_EV_EMPTY: u64 = 1;
 
         let cpath = CString::new(EVENT_PATH).unwrap();
@@ -327,7 +329,8 @@ mod zenter {
     }
 
     impl Template {
-        const TEMPLATE_PATH: &[u8] = b"/system/contract/process/template\0";
+        const TEMPLATE_PATH: &'static [u8] =
+            b"/system/contract/process/template\0";
 
         // Constants related to how the contract below is managed. See
         // `usr/src/uts/common/sys/contract/process.h` in the illumos sources
@@ -1042,7 +1045,7 @@ pub struct ServiceProcess {
     pub log_file: Utf8PathBuf,
 }
 
-/// Errors returned from [`InstalledZone::install`].
+/// Errors returned from [`ZoneBuilder::install`].
 #[derive(thiserror::Error, Debug)]
 pub enum InstallZoneError {
     #[error("Cannot create '{zone}': failed to create control VNIC: {err}")]
@@ -1062,6 +1065,9 @@ pub enum InstallZoneError {
 
     #[error("Failed to find zone image '{image}' from {paths:?}")]
     ImageNotFound { image: String, paths: Vec<Utf8PathBuf> },
+
+    #[error("Attempted to call install() on underspecified ZoneBuilder")]
+    IncompleteBuilder,
 }
 
 pub struct InstalledZone {
@@ -1118,24 +1124,208 @@ impl InstalledZone {
         &self.zonepath
     }
 
-    // TODO: This would benefit from a "builder-pattern" interface.
-    #[allow(clippy::too_many_arguments)]
-    pub async fn install(
-        log: &Logger,
-        underlay_vnic_allocator: &VnicAllocator<Etherstub>,
-        zone_root_path: &Utf8Path,
-        zone_image_paths: &[Utf8PathBuf],
-        zone_type: &str,
-        unique_name: Option<Uuid>,
-        datasets: &[zone::Dataset],
-        filesystems: &[zone::Fs],
-        data_links: &[String],
-        devices: &[zone::Device],
-        opte_ports: Vec<(Port, PortTicket)>,
-        bootstrap_vnic: Option<Link>,
-        links: Vec<Link>,
-        limit_priv: Vec<String>,
-    ) -> Result<InstalledZone, InstallZoneError> {
+    pub fn site_profile_xml_path(&self) -> Utf8PathBuf {
+        let mut path: Utf8PathBuf = self.zonepath().into();
+        path.push("root/var/svc/profile/site.xml");
+        path
+    }
+}
+
+#[derive(Clone)]
+pub struct FakeZoneBuilderConfig {
+    temp_dir: Arc<Utf8TempDir>,
+}
+
+#[derive(Clone, Default)]
+pub struct ZoneBuilderFactory {
+    // Why this is part of this builder/factory and not some separate builder
+    // type: At time of writing, to the best of my knowledge:
+    // - If we want builder pattern, we need to return some type of `Self`.
+    // - If we have a trait that returns `Self` type, we can't turn it into a
+    //   trait object (i.e. Box<dyn ZoneBuilderFactoryInterface>).
+    // - Plumbing concrete types as generics through every other type that
+    //   needs to construct zones (and anything else with a lot of parameters)
+    //   seems like a worse idea.
+    fake_cfg: Option<FakeZoneBuilderConfig>,
+}
+
+impl ZoneBuilderFactory {
+    /// For use in unit tests that don't require actual zone creation to occur.
+    pub fn fake() -> Self {
+        Self {
+            fake_cfg: Some(FakeZoneBuilderConfig {
+                temp_dir: Arc::new(Utf8TempDir::new().unwrap()),
+            }),
+        }
+    }
+
+    /// Create a [ZoneBuilder] that inherits this factory's fakeness.
+    pub fn builder<'a>(&self) -> ZoneBuilder<'a> {
+        ZoneBuilder { fake_cfg: self.fake_cfg.clone(), ..Default::default() }
+    }
+}
+
+/// Builder-pattern construct for creating an [InstalledZone].
+/// Created by [ZoneBuilderFactory].
+#[derive(Default)]
+pub struct ZoneBuilder<'a> {
+    log: Option<Logger>,
+    underlay_vnic_allocator: Option<&'a VnicAllocator<Etherstub>>,
+    zone_root_path: Option<&'a Utf8Path>,
+    zone_image_paths: Option<&'a [Utf8PathBuf]>,
+    zone_type: Option<&'a str>,
+    unique_name: Option<Uuid>, // actually optional
+    datasets: Option<&'a [zone::Dataset]>,
+    filesystems: Option<&'a [zone::Fs]>,
+    data_links: Option<&'a [String]>,
+    devices: Option<&'a [zone::Device]>,
+    opte_ports: Option<Vec<(Port, PortTicket)>>,
+    bootstrap_vnic: Option<Link>, // actually optional
+    links: Option<Vec<Link>>,
+    limit_priv: Option<Vec<String>>,
+    fake_cfg: Option<FakeZoneBuilderConfig>,
+}
+
+impl<'a> ZoneBuilder<'a> {
+    pub fn with_log(mut self, log: Logger) -> Self {
+        self.log = Some(log);
+        self
+    }
+
+    pub fn with_underlay_vnic_allocator(
+        mut self,
+        vnic_allocator: &'a VnicAllocator<Etherstub>,
+    ) -> Self {
+        self.underlay_vnic_allocator = Some(vnic_allocator);
+        self
+    }
+
+    pub fn with_zone_root_path(mut self, root_path: &'a Utf8Path) -> Self {
+        self.zone_root_path = Some(root_path);
+        self
+    }
+
+    pub fn with_zone_image_paths(
+        mut self,
+        image_paths: &'a [Utf8PathBuf],
+    ) -> Self {
+        self.zone_image_paths = Some(image_paths);
+        self
+    }
+
+    pub fn with_zone_type(mut self, zone_type: &'a str) -> Self {
+        self.zone_type = Some(zone_type);
+        self
+    }
+
+    pub fn with_unique_name(mut self, uuid: Uuid) -> Self {
+        self.unique_name = Some(uuid);
+        self
+    }
+
+    pub fn with_datasets(mut self, datasets: &'a [zone::Dataset]) -> Self {
+        self.datasets = Some(datasets);
+        self
+    }
+
+    pub fn with_filesystems(mut self, filesystems: &'a [zone::Fs]) -> Self {
+        self.filesystems = Some(filesystems);
+        self
+    }
+
+    pub fn with_data_links(mut self, links: &'a [String]) -> Self {
+        self.data_links = Some(links);
+        self
+    }
+
+    pub fn with_devices(mut self, devices: &'a [zone::Device]) -> Self {
+        self.devices = Some(devices);
+        self
+    }
+
+    pub fn with_opte_ports(mut self, ports: Vec<(Port, PortTicket)>) -> Self {
+        self.opte_ports = Some(ports);
+        self
+    }
+
+    pub fn with_bootstrap_vnic(mut self, vnic: Link) -> Self {
+        self.bootstrap_vnic = Some(vnic);
+        self
+    }
+
+    pub fn with_links(mut self, links: Vec<Link>) -> Self {
+        self.links = Some(links);
+        self
+    }
+
+    pub fn with_limit_priv(mut self, limit_priv: Vec<String>) -> Self {
+        self.limit_priv = Some(limit_priv);
+        self
+    }
+
+    fn fake_install(self) -> Result<InstalledZone, InstallZoneError> {
+        let zone = self
+            .zone_type
+            .ok_or(InstallZoneError::IncompleteBuilder)?
+            .to_string();
+        let control_vnic = self
+            .underlay_vnic_allocator
+            .ok_or(InstallZoneError::IncompleteBuilder)?
+            .new_control(None)
+            .map_err(move |err| InstallZoneError::CreateVnic { zone, err })?;
+        let fake_cfg = self.fake_cfg.unwrap();
+        let temp_dir = fake_cfg.temp_dir.path().to_path_buf();
+        (|| {
+            let full_zone_name = InstalledZone::get_zone_name(
+                self.zone_type?,
+                self.unique_name,
+            );
+            let zonepath = temp_dir
+                .join(self.zone_root_path?.strip_prefix("/").unwrap())
+                .join(&full_zone_name);
+            let iz = InstalledZone {
+                log: self.log?,
+                zonepath,
+                name: full_zone_name,
+                control_vnic,
+                bootstrap_vnic: self.bootstrap_vnic,
+                opte_ports: self.opte_ports?,
+                links: self.links?,
+            };
+            let xml_path = iz.site_profile_xml_path().parent()?.to_path_buf();
+            std::fs::create_dir_all(&xml_path)
+                .unwrap_or_else(|_| panic!("ZoneBuilder::fake_install couldn't create site profile xml path {:?}", xml_path));
+            Some(iz)
+        })()
+        .ok_or(InstallZoneError::IncompleteBuilder)
+    }
+
+    pub async fn install(self) -> Result<InstalledZone, InstallZoneError> {
+        if self.fake_cfg.is_some() {
+            return self.fake_install();
+        }
+
+        let Self {
+            log: Some(log),
+            underlay_vnic_allocator: Some(underlay_vnic_allocator),
+            zone_root_path: Some(zone_root_path),
+            zone_image_paths: Some(zone_image_paths),
+            zone_type: Some(zone_type),
+            unique_name,
+            datasets: Some(datasets),
+            filesystems: Some(filesystems),
+            data_links: Some(data_links),
+            devices: Some(devices),
+            opte_ports: Some(opte_ports),
+            bootstrap_vnic,
+            links: Some(links),
+            limit_priv: Some(limit_priv),
+            ..
+        } = self
+        else {
+            return Err(InstallZoneError::IncompleteBuilder);
+        };
+
         let control_vnic =
             underlay_vnic_allocator.new_control(None).map_err(|err| {
                 InstallZoneError::CreateVnic {
@@ -1144,7 +1334,8 @@ impl InstalledZone {
                 }
             })?;
 
-        let full_zone_name = Self::get_zone_name(zone_type, unique_name);
+        let full_zone_name =
+            InstalledZone::get_zone_name(zone_type, unique_name);
 
         // Looks for the image within `zone_image_path`, in order.
         let image = format!("{}.tar.gz", zone_type);
@@ -1182,7 +1373,7 @@ impl InstalledZone {
         net_device_names.dedup();
 
         Zones::install_omicron_zone(
-            log,
+            &log,
             &zone_root_path,
             &full_zone_name,
             &zone_image_path,
@@ -1209,12 +1400,6 @@ impl InstalledZone {
             links,
         })
     }
-
-    pub fn site_profile_xml_path(&self) -> Utf8PathBuf {
-        let mut path: Utf8PathBuf = self.zonepath().into();
-        path.push("root/var/svc/profile/site.xml");
-        path
-    }
 }
 
 /// Return true if the service with the given FMRI appears to be an
diff --git a/nexus/db-model/Cargo.toml b/nexus/db-model/Cargo.toml
index b7514c4806..477ce7d11f 100644
--- a/nexus/db-model/Cargo.toml
+++ b/nexus/db-model/Cargo.toml
@@ -26,6 +26,7 @@ serde.workspace = true
 serde_json.workspace = true
 steno.workspace = true
 strum.workspace = true
+thiserror.workspace = true
 uuid.workspace = true
 
 db-macros.workspace = true
diff --git a/nexus/db-model/src/lib.rs b/nexus/db-model/src/lib.rs
index 6b65eb87ec..43bf83fd34 100644
--- a/nexus/db-model/src/lib.rs
+++ b/nexus/db-model/src/lib.rs
@@ -70,8 +70,10 @@ mod silo_user;
 mod silo_user_password_hash;
 mod sled;
 mod sled_instance;
+mod sled_provision_state;
 mod sled_resource;
 mod sled_resource_kind;
+mod sled_underlay_subnet_allocation;
 mod snapshot;
 mod ssh_key;
 mod switch;
@@ -151,8 +153,10 @@ pub use silo_user::*;
 pub use silo_user_password_hash::*;
 pub use sled::*;
 pub use sled_instance::*;
+pub use sled_provision_state::*;
 pub use sled_resource::*;
 pub use sled_resource_kind::*;
+pub use sled_underlay_subnet_allocation::*;
 pub use snapshot::*;
 pub use ssh_key::*;
 pub use switch::*;
@@ -285,10 +289,9 @@ macro_rules! impl_enum_type {
                         Ok($model_type::$enum_item)
                     }
                     )*
-                    _ => {
-                        Err(concat!("Unrecognized enum variant for ",
-                                stringify!{$model_type})
-                            .into())
+                    other => {
+                        let s = concat!("Unrecognized enum variant for ", stringify!{$model_type});
+                        Err(format!("{}: (raw bytes: {:?})", s, other).into())
                     }
                 }
             }
diff --git a/nexus/db-model/src/queries/region_allocation.rs b/nexus/db-model/src/queries/region_allocation.rs
index 2025e79fb8..a1b9e0373a 100644
--- a/nexus/db-model/src/queries/region_allocation.rs
+++ b/nexus/db-model/src/queries/region_allocation.rs
@@ -23,6 +23,7 @@
 // a CTE (where we want the alias name to come first).
 
 use crate::schema::dataset;
+use crate::schema::sled;
 use crate::schema::zpool;
 
 table! {
@@ -157,6 +158,7 @@ diesel::allow_tables_to_appear_in_same_query!(
 diesel::allow_tables_to_appear_in_same_query!(
     old_zpool_usage,
     zpool,
+    sled,
     proposed_dataset_changes,
 );
 
diff --git a/nexus/db-model/src/rack.rs b/nexus/db-model/src/rack.rs
index f2bc7528d2..580ec155b4 100644
--- a/nexus/db-model/src/rack.rs
+++ b/nexus/db-model/src/rack.rs
@@ -4,9 +4,8 @@
 
 use crate::schema::rack;
 use db_macros::Asset;
-use ipnetwork::{IpNetwork, Ipv6Network};
+use ipnetwork::IpNetwork;
 use nexus_types::{external_api::views, identity::Asset};
-use omicron_common::api;
 use uuid::Uuid;
 
 /// Information about a local rack.
@@ -29,22 +28,6 @@ impl Rack {
             rack_subnet: None,
         }
     }
-
-    pub fn subnet(&self) -> Result<Ipv6Network, api::external::Error> {
-        match self.rack_subnet {
-            Some(IpNetwork::V6(subnet)) => Ok(subnet),
-            Some(IpNetwork::V4(_)) => {
-                return Err(api::external::Error::InternalError {
-                    internal_message: "rack subnet not IPv6".into(),
-                })
-            }
-            None => {
-                return Err(api::external::Error::InternalError {
-                    internal_message: "rack subnet not set".into(),
-                })
-            }
-        }
-    }
 }
 
 impl From<Rack> for views::Rack {
diff --git a/nexus/db-model/src/schema.rs b/nexus/db-model/src/schema.rs
index 7f7dd57027..6527da3637 100644
--- a/nexus/db-model/src/schema.rs
+++ b/nexus/db-model/src/schema.rs
@@ -741,6 +741,7 @@ table! {
         ip -> Inet,
         port -> Int4,
         last_used_address -> Inet,
+        provision_state -> crate::SledProvisionStateEnum,
     }
 }
 
@@ -755,6 +756,16 @@ table! {
     }
 }
 
+table! {
+    sled_underlay_subnet_allocation (rack_id, sled_id) {
+        rack_id -> Uuid,
+        sled_id -> Uuid,
+        subnet_octet -> Int2,
+        hw_baseboard_id -> Uuid,
+    }
+}
+allow_tables_to_appear_in_same_query!(rack, sled_underlay_subnet_allocation);
+
 table! {
     switch (id) {
         id -> Uuid,
@@ -1289,7 +1300,7 @@ table! {
 ///
 /// This should be updated whenever the schema is changed. For more details,
 /// refer to: schema/crdb/README.adoc
-pub const SCHEMA_VERSION: SemverVersion = SemverVersion::new(13, 0, 0);
+pub const SCHEMA_VERSION: SemverVersion = SemverVersion::new(15, 0, 0);
 
 allow_tables_to_appear_in_same_query!(
     system_update,
diff --git a/nexus/db-model/src/sled.rs b/nexus/db-model/src/sled.rs
index ba572901c6..0f6d1b911e 100644
--- a/nexus/db-model/src/sled.rs
+++ b/nexus/db-model/src/sled.rs
@@ -4,11 +4,11 @@
 
 use super::{ByteCount, Generation, SqlU16, SqlU32};
 use crate::collection::DatastoreCollectionConfig;
-use crate::ipv6;
 use crate::schema::{physical_disk, service, sled, zpool};
+use crate::{ipv6, SledProvisionState};
 use chrono::{DateTime, Utc};
 use db_macros::Asset;
-use nexus_types::{external_api::views, identity::Asset};
+use nexus_types::{external_api::shared, external_api::views, identity::Asset};
 use std::net::Ipv6Addr;
 use std::net::SocketAddrV6;
 use uuid::Uuid;
@@ -59,6 +59,8 @@ pub struct Sled {
 
     /// The last IP address provided to an Oxide service on this sled
     pub last_used_address: ipv6::Ipv6Addr,
+
+    provision_state: SledProvisionState,
 }
 
 impl Sled {
@@ -81,6 +83,10 @@ impl Sled {
     pub fn serial_number(&self) -> &str {
         &self.serial_number
     }
+
+    pub fn provision_state(&self) -> SledProvisionState {
+        self.provision_state
+    }
 }
 
 impl From<Sled> for views::Sled {
@@ -88,11 +94,12 @@ impl From<Sled> for views::Sled {
         Self {
             identity: sled.identity(),
             rack_id: sled.rack_id,
-            baseboard: views::Baseboard {
+            baseboard: shared::Baseboard {
                 serial: sled.serial_number,
                 part: sled.part_number,
                 revision: sled.revision,
             },
+            provision_state: sled.provision_state.into(),
             usable_hardware_threads: sled.usable_hardware_threads.0,
             usable_physical_ram: *sled.usable_physical_ram,
         }
@@ -188,6 +195,8 @@ impl SledUpdate {
             serial_number: self.serial_number,
             part_number: self.part_number,
             revision: self.revision,
+            // By default, sleds start as provisionable.
+            provision_state: SledProvisionState::Provisionable,
             usable_hardware_threads: self.usable_hardware_threads,
             usable_physical_ram: self.usable_physical_ram,
             reservoir_size: self.reservoir_size,
diff --git a/nexus/db-model/src/sled_provision_state.rs b/nexus/db-model/src/sled_provision_state.rs
new file mode 100644
index 0000000000..6cf81b9c70
--- /dev/null
+++ b/nexus/db-model/src/sled_provision_state.rs
@@ -0,0 +1,58 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+use super::impl_enum_type;
+use nexus_types::external_api::views;
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+impl_enum_type!(
+    #[derive(Clone, SqlType, Debug, QueryId)]
+    #[diesel(postgres_type(name = "sled_provision_state"))]
+    pub struct SledProvisionStateEnum;
+
+    #[derive(Clone, Copy, Debug, AsExpression, FromSqlRow, Serialize, Deserialize, PartialEq)]
+    #[diesel(sql_type = SledProvisionStateEnum)]
+    pub enum SledProvisionState;
+
+    // Enum values
+    Provisionable => b"provisionable"
+    NonProvisionable => b"non_provisionable"
+);
+
+impl From<SledProvisionState> for views::SledProvisionState {
+    fn from(state: SledProvisionState) -> Self {
+        match state {
+            SledProvisionState::Provisionable => {
+                views::SledProvisionState::Provisionable
+            }
+            SledProvisionState::NonProvisionable => {
+                views::SledProvisionState::NonProvisionable
+            }
+        }
+    }
+}
+
+impl TryFrom<views::SledProvisionState> for SledProvisionState {
+    type Error = UnknownSledProvisionState;
+
+    fn try_from(state: views::SledProvisionState) -> Result<Self, Self::Error> {
+        match state {
+            views::SledProvisionState::Provisionable => {
+                Ok(SledProvisionState::Provisionable)
+            }
+            views::SledProvisionState::NonProvisionable => {
+                Ok(SledProvisionState::NonProvisionable)
+            }
+            views::SledProvisionState::Unknown => {
+                Err(UnknownSledProvisionState)
+            }
+        }
+    }
+}
+
+/// An unknown [`views::SledProvisionState`] was encountered.
+#[derive(Clone, Debug, Error)]
+#[error("Unknown SledProvisionState")]
+pub struct UnknownSledProvisionState;
diff --git a/nexus/db-model/src/sled_underlay_subnet_allocation.rs b/nexus/db-model/src/sled_underlay_subnet_allocation.rs
new file mode 100644
index 0000000000..4da0bea669
--- /dev/null
+++ b/nexus/db-model/src/sled_underlay_subnet_allocation.rs
@@ -0,0 +1,16 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+use crate::schema::sled_underlay_subnet_allocation;
+use uuid::Uuid;
+
+/// Underlay allocation for a sled added to an initialized rack
+#[derive(Queryable, Insertable, Debug, Clone, Selectable)]
+#[diesel(table_name = sled_underlay_subnet_allocation)]
+pub struct SledUnderlaySubnetAllocation {
+    pub rack_id: Uuid,
+    pub sled_id: Uuid,
+    pub subnet_octet: i16,
+    pub hw_baseboard_id: Uuid,
+}
diff --git a/nexus/db-model/src/switch.rs b/nexus/db-model/src/switch.rs
index c9db100b0a..159888d91e 100644
--- a/nexus/db-model/src/switch.rs
+++ b/nexus/db-model/src/switch.rs
@@ -2,7 +2,7 @@ use super::Generation;
 use crate::schema::switch;
 use chrono::{DateTime, Utc};
 use db_macros::Asset;
-use nexus_types::{external_api::views, identity::Asset};
+use nexus_types::{external_api::shared, external_api::views, identity::Asset};
 use uuid::Uuid;
 
 /// Baseboard information about a switch.
@@ -57,7 +57,7 @@ impl From<Switch> for views::Switch {
         Self {
             identity: switch.identity(),
             rack_id: switch.rack_id,
-            baseboard: views::Baseboard {
+            baseboard: shared::Baseboard {
                 serial: switch.serial_number,
                 part: switch.part_number,
                 revision: switch.revision,
diff --git a/nexus/db-queries/src/db/datastore/inventory.rs b/nexus/db-queries/src/db/datastore/inventory.rs
index 28a438629e..31b24a7e75 100644
--- a/nexus/db-queries/src/db/datastore/inventory.rs
+++ b/nexus/db-queries/src/db/datastore/inventory.rs
@@ -7,6 +7,7 @@ use crate::authz;
 use crate::context::OpContext;
 use crate::db;
 use crate::db::error::public_error_from_diesel;
+use crate::db::error::public_error_from_diesel_lookup;
 use crate::db::error::ErrorHandler;
 use crate::db::queries::ALLOW_FULL_TABLE_SCAN_SQL;
 use crate::db::TransactionError;
@@ -21,6 +22,7 @@ use diesel::ExpressionMethods;
 use diesel::IntoSql;
 use diesel::JoinOnDsl;
 use diesel::NullableExpressionMethods;
+use diesel::OptionalExtension;
 use diesel::QueryDsl;
 use diesel::Table;
 use futures::future::BoxFuture;
@@ -42,9 +44,12 @@ use nexus_db_model::SpType;
 use nexus_db_model::SpTypeEnum;
 use nexus_db_model::SwCaboose;
 use nexus_db_model::SwRotPage;
+use nexus_types::inventory::BaseboardId;
 use nexus_types::inventory::Collection;
 use omicron_common::api::external::Error;
 use omicron_common::api::external::InternalContext;
+use omicron_common::api::external::LookupType;
+use omicron_common::api::external::ResourceType;
 use omicron_common::bail_unless;
 use std::collections::BTreeMap;
 use std::collections::BTreeSet;
@@ -910,30 +915,62 @@ impl DataStore {
         Ok(())
     }
 
+    // Find the primary key for `hw_baseboard_id` given a `BaseboardId`
+    pub async fn find_hw_baseboard_id(
+        &self,
+        opctx: &OpContext,
+        baseboard_id: BaseboardId,
+    ) -> Result<Uuid, Error> {
+        opctx.authorize(authz::Action::Read, &authz::INVENTORY).await?;
+        let conn = self.pool_connection_authorized(opctx).await?;
+        use db::schema::hw_baseboard_id::dsl;
+        dsl::hw_baseboard_id
+            .filter(dsl::serial_number.eq(baseboard_id.serial_number.clone()))
+            .filter(dsl::part_number.eq(baseboard_id.part_number.clone()))
+            .select(dsl::id)
+            .first_async::<Uuid>(&*conn)
+            .await
+            .map_err(|e| {
+                public_error_from_diesel_lookup(
+                    e,
+                    ResourceType::Sled,
+                    &LookupType::ByCompositeId(format!("{baseboard_id:?}")),
+                )
+            })
+    }
+
     /// Attempt to read the latest collection while limiting queries to `limit`
     /// records
+    ///
+    /// If there aren't any collections, return `Ok(None)`.
     pub async fn inventory_get_latest_collection(
         &self,
         opctx: &OpContext,
         limit: NonZeroU32,
-    ) -> Result<Collection, Error> {
+    ) -> Result<Option<Collection>, Error> {
         opctx.authorize(authz::Action::Read, &authz::INVENTORY).await?;
         let conn = self.pool_connection_authorized(opctx).await?;
         use db::schema::inv_collection::dsl;
         let collection_id = dsl::inv_collection
             .select(dsl::id)
             .order_by(dsl::time_started.desc())
-            .limit(1)
             .first_async::<Uuid>(&*conn)
             .await
+            .optional()
             .map_err(|e| public_error_from_diesel(e, ErrorHandler::Server))?;
 
-        self.inventory_collection_read_all_or_nothing(
-            opctx,
-            collection_id,
-            limit,
-        )
-        .await
+        let Some(collection_id) = collection_id else {
+            return Ok(None);
+        };
+
+        Ok(Some(
+            self.inventory_collection_read_all_or_nothing(
+                opctx,
+                collection_id,
+                limit,
+            )
+            .await?,
+        ))
     }
 
     /// Attempt to read the given collection while limiting queries to `limit`
@@ -1335,9 +1372,11 @@ mod test {
     use nexus_inventory::examples::Representative;
     use nexus_test_utils::db::test_setup_database;
     use nexus_test_utils::db::ALLOW_FULL_TABLE_SCAN_SQL;
+    use nexus_types::inventory::BaseboardId;
     use nexus_types::inventory::CabooseWhich;
     use nexus_types::inventory::Collection;
     use nexus_types::inventory::RotPageWhich;
+    use omicron_common::api::external::Error;
     use omicron_test_utils::dev;
     use std::num::NonZeroU32;
     use uuid::Uuid;
@@ -1393,6 +1432,24 @@ mod test {
         }
     }
 
+    #[tokio::test]
+    async fn test_find_hw_baseboard_id_missing_returns_not_found() {
+        let logctx = dev::test_setup_log("inventory_insert");
+        let mut db = test_setup_database(&logctx.log).await;
+        let (opctx, datastore) = datastore_test(&logctx, &db).await;
+        let baseboard_id = BaseboardId {
+            serial_number: "some-serial".into(),
+            part_number: "some-part".into(),
+        };
+        let err = datastore
+            .find_hw_baseboard_id(&opctx, baseboard_id)
+            .await
+            .unwrap_err();
+        assert!(matches!(err, Error::ObjectNotFound { .. }));
+        db.cleanup().await.unwrap();
+        logctx.cleanup_successful();
+    }
+
     /// Tests inserting several collections, reading them back, and making sure
     /// they look the same.
     #[tokio::test]
diff --git a/nexus/db-queries/src/db/datastore/mod.rs b/nexus/db-queries/src/db/datastore/mod.rs
index 0612b960c9..44cd7a95b7 100644
--- a/nexus/db-queries/src/db/datastore/mod.rs
+++ b/nexus/db-queries/src/db/datastore/mod.rs
@@ -372,8 +372,8 @@ mod test {
         BlockSize, ComponentUpdate, ComponentUpdateIdentity, ConsoleSession,
         Dataset, DatasetKind, ExternalIp, PhysicalDisk, PhysicalDiskKind,
         Project, Rack, Region, Service, ServiceKind, SiloUser, SledBaseboard,
-        SledSystemHardware, SledUpdate, SshKey, SystemUpdate,
-        UpdateableComponentType, VpcSubnet, Zpool,
+        SledProvisionState, SledSystemHardware, SledUpdate, SshKey,
+        SystemUpdate, UpdateableComponentType, VpcSubnet, Zpool,
     };
     use crate::db::queries::vpc_subnet::FilterConflictingVpcSubnetRangesQuery;
     use assert_matches::assert_matches;
@@ -610,6 +610,35 @@ mod test {
         sled_id
     }
 
+    // Marks a sled as non-provisionable.
+    async fn mark_sled_non_provisionable(
+        datastore: &DataStore,
+        opctx: &OpContext,
+        sled_id: Uuid,
+    ) {
+        let (authz_sled, sled) = LookupPath::new(opctx, datastore)
+            .sled_id(sled_id)
+            .fetch_for(authz::Action::Modify)
+            .await
+            .unwrap();
+        println!("sled: {:?}", sled);
+        let old_state = datastore
+            .sled_set_provision_state(
+                &opctx,
+                &authz_sled,
+                SledProvisionState::NonProvisionable,
+            )
+            .await
+            .unwrap_or_else(|error| {
+                panic!(
+                    "error marking sled {sled_id} as non-provisionable: {error}"
+                )
+            });
+        // The old state should always be provisionable since that's where we
+        // start.
+        assert_eq!(old_state, SledProvisionState::Provisionable);
+    }
+
     fn test_zpool_size() -> ByteCount {
         ByteCount::from_gibibytes_u32(100)
     }
@@ -770,13 +799,24 @@ mod test {
         let logctx = dev::test_setup_log("test_region_allocation_strat_random");
         let mut db = test_setup_database(&logctx.log).await;
         let (opctx, datastore) = datastore_test(&logctx, &db).await;
-        create_test_datasets_for_region_allocation(
+        let test_datasets = create_test_datasets_for_region_allocation(
             &opctx,
             datastore.clone(),
+            // Even though we're going to mark one sled as non-provisionable to
+            // test that logic, we aren't forcing the datasets to be on
+            // distinct sleds, so REGION_REDUNDANCY_THRESHOLD is enough.
             REGION_REDUNDANCY_THRESHOLD,
         )
         .await;
 
+        let non_provisionable_dataset_id = test_datasets[0].dataset_id;
+        mark_sled_non_provisionable(
+            &datastore,
+            &opctx,
+            test_datasets[0].sled_id,
+        )
+        .await;
+
         // Allocate regions from the datasets for this disk. Do it a few times
         // for good measure.
         for alloc_seed in 0..10 {
@@ -809,6 +849,9 @@ mod test {
                 // Must be 3 unique datasets
                 assert!(disk_datasets.insert(dataset.id()));
 
+                // Dataset must not be non-provisionable.
+                assert_ne!(dataset.id(), non_provisionable_dataset_id);
+
                 // Must be 3 unique zpools
                 assert!(disk_zpools.insert(dataset.pool_id));
 
@@ -837,12 +880,23 @@ mod test {
         let mut db = test_setup_database(&logctx.log).await;
         let (opctx, datastore) = datastore_test(&logctx, &db).await;
 
-        // Create a rack without enough sleds for a successful allocation when
-        // we require 3 distinct sleds.
+        // Create a rack with enough sleds for a successful allocation when we
+        // require 3 distinct provisionable sleds.
         let test_datasets = create_test_datasets_for_region_allocation(
             &opctx,
             datastore.clone(),
-            REGION_REDUNDANCY_THRESHOLD,
+            // We're going to mark one sled as non-provisionable to test that
+            // logic, and we *are* forcing the datasets to be on distinct
+            // sleds: hence threshold + 1.
+            REGION_REDUNDANCY_THRESHOLD + 1,
+        )
+        .await;
+
+        let non_provisionable_dataset_id = test_datasets[0].dataset_id;
+        mark_sled_non_provisionable(
+            &datastore,
+            &opctx,
+            test_datasets[0].sled_id,
         )
         .await;
 
@@ -884,6 +938,9 @@ mod test {
                 // Must be 3 unique datasets
                 assert!(disk_datasets.insert(dataset.id()));
 
+                // Dataset must not be non-provisionable.
+                assert_ne!(dataset.id(), non_provisionable_dataset_id);
+
                 // Must be 3 unique zpools
                 assert!(disk_zpools.insert(dataset.pool_id));
 
@@ -916,11 +973,22 @@ mod test {
         let (opctx, datastore) = datastore_test(&logctx, &db).await;
 
         // Create a rack without enough sleds for a successful allocation when
-        // we require 3 distinct sleds.
-        create_test_datasets_for_region_allocation(
+        // we require 3 distinct provisionable sleds.
+        let test_datasets = create_test_datasets_for_region_allocation(
             &opctx,
             datastore.clone(),
-            REGION_REDUNDANCY_THRESHOLD - 1,
+            // Here, we need to have REGION_REDUNDANCY_THRESHOLD - 1
+            // provisionable sleds to test this failure condition. We're going
+            // to mark one sled as non-provisionable to test that logic, so we
+            // need to add 1 to that number.
+            REGION_REDUNDANCY_THRESHOLD,
+        )
+        .await;
+
+        mark_sled_non_provisionable(
+            &datastore,
+            &opctx,
+            test_datasets[0].sled_id,
         )
         .await;
 
diff --git a/nexus/db-queries/src/db/datastore/rack.rs b/nexus/db-queries/src/db/datastore/rack.rs
index 2cc5880470..e11377f11a 100644
--- a/nexus/db-queries/src/db/datastore/rack.rs
+++ b/nexus/db-queries/src/db/datastore/rack.rs
@@ -41,6 +41,7 @@ use nexus_db_model::InitialDnsGroup;
 use nexus_db_model::PasswordHashString;
 use nexus_db_model::SiloUser;
 use nexus_db_model::SiloUserPasswordHash;
+use nexus_db_model::SledUnderlaySubnetAllocation;
 use nexus_types::external_api::params as external_params;
 use nexus_types::external_api::shared;
 use nexus_types::external_api::shared::IdentityType;
@@ -55,6 +56,7 @@ use omicron_common::api::external::ListResultVec;
 use omicron_common::api::external::LookupType;
 use omicron_common::api::external::ResourceType;
 use omicron_common::api::external::UpdateResult;
+use omicron_common::bail_unless;
 use std::net::IpAddr;
 use uuid::Uuid;
 
@@ -214,6 +216,126 @@ impl DataStore {
         Ok(())
     }
 
+    // Return the subnet for the rack
+    pub async fn rack_subnet(
+        &self,
+        opctx: &OpContext,
+        rack_id: Uuid,
+    ) -> Result<IpNetwork, Error> {
+        opctx.authorize(authz::Action::Read, &authz::FLEET).await?;
+        let conn = self.pool_connection_authorized(opctx).await?;
+        use db::schema::rack::dsl;
+        // It's safe to unwrap the returned `rack_subnet` because
+        // we filter on `rack_subnet.is_not_null()`
+        let subnet = dsl::rack
+            .filter(dsl::id.eq(rack_id))
+            .filter(dsl::rack_subnet.is_not_null())
+            .select(dsl::rack_subnet)
+            .first_async::<Option<IpNetwork>>(&*conn)
+            .await
+            .map_err(|e| public_error_from_diesel(e, ErrorHandler::Server))?;
+        match subnet {
+            Some(subnet) => Ok(subnet),
+            None => Err(Error::internal_error(
+                "DB Error(bug): returned a null subnet for {rack_id}",
+            )),
+        }
+    }
+
+    /// Allocate a rack subnet octet to a given sled
+    ///
+    /// 1. Find the existing allocations
+    /// 2. Calculate the new allocation
+    /// 3. Save the new allocation, if there isn't one for the given
+    ///    `hw_baseboard_id`
+    /// 4. Return the new allocation
+    ///
+    // TODO: This could all actually be done in SQL using a `next_item` query.
+    // See https://github.com/oxidecomputer/omicron/issues/4544
+    pub async fn allocate_sled_underlay_subnet_octets(
+        &self,
+        opctx: &OpContext,
+        rack_id: Uuid,
+        hw_baseboard_id: Uuid,
+    ) -> Result<SledUnderlaySubnetAllocation, Error> {
+        // Fetch all the existing allocations via self.rack_id
+        let allocations = self.rack_subnet_allocations(opctx, rack_id).await?;
+
+        // Calculate the allocation for the new sled by choosing the minimum
+        // octet. The returned allocations are ordered by octet, so we will know
+        // when we have a free one. However, if we already have an allocation
+        // for the given sled then reuse that one.
+        const MIN_SUBNET_OCTET: i16 = 33;
+        let mut new_allocation = SledUnderlaySubnetAllocation {
+            rack_id,
+            sled_id: Uuid::new_v4(),
+            subnet_octet: MIN_SUBNET_OCTET,
+            hw_baseboard_id,
+        };
+        let mut allocation_already_exists = false;
+        for allocation in allocations {
+            if allocation.hw_baseboard_id == new_allocation.hw_baseboard_id {
+                // We already have an allocation for this sled.
+                new_allocation = allocation;
+                allocation_already_exists = true;
+                break;
+            }
+            if allocation.subnet_octet == new_allocation.subnet_octet {
+                bail_unless!(
+                    new_allocation.subnet_octet < 255,
+                    "Too many sled subnets allocated"
+                );
+                new_allocation.subnet_octet += 1;
+            }
+        }
+
+        // Write the new allocation row to CRDB. The UNIQUE constraint
+        // on `subnet_octet` will prevent dueling administrators reusing
+        // allocations when sleds are being added. We will need another
+        // mechanism ala generation numbers when we must interleave additions
+        // and removals of sleds.
+        if !allocation_already_exists {
+            self.sled_subnet_allocation_insert(opctx, &new_allocation).await?;
+        }
+
+        Ok(new_allocation)
+    }
+
+    /// Return all current underlay allocations for the rack.
+    ///
+    /// Order allocations by `subnet_octet`
+    pub async fn rack_subnet_allocations(
+        &self,
+        opctx: &OpContext,
+        rack_id: Uuid,
+    ) -> Result<Vec<SledUnderlaySubnetAllocation>, Error> {
+        opctx.authorize(authz::Action::Read, &authz::FLEET).await?;
+        use db::schema::sled_underlay_subnet_allocation::dsl as subnet_dsl;
+        subnet_dsl::sled_underlay_subnet_allocation
+            .filter(subnet_dsl::rack_id.eq(rack_id))
+            .select(SledUnderlaySubnetAllocation::as_select())
+            .order_by(subnet_dsl::subnet_octet.asc())
+            .load_async(&*self.pool_connection_authorized(opctx).await?)
+            .await
+            .map_err(|e| public_error_from_diesel(e, ErrorHandler::Server))
+    }
+
+    /// Store a new sled subnet allocation in the database
+    pub async fn sled_subnet_allocation_insert(
+        &self,
+        opctx: &OpContext,
+        allocation: &SledUnderlaySubnetAllocation,
+    ) -> Result<(), Error> {
+        opctx.authorize(authz::Action::Modify, &authz::FLEET).await?;
+        use db::schema::sled_underlay_subnet_allocation::dsl;
+        diesel::insert_into(dsl::sled_underlay_subnet_allocation)
+            .values(allocation.clone())
+            .execute_async(&*self.pool_connection_authorized(opctx).await?)
+            .await
+            .map_err(|e| public_error_from_diesel(e, ErrorHandler::Server))?;
+        Ok(())
+    }
+
     // The following methods which return a `TxnError` take a `conn` parameter
     // which comes from the transaction created in `rack_set_initialized`.
 
@@ -1518,4 +1640,136 @@ mod test {
         db.cleanup().await.unwrap();
         logctx.cleanup_successful();
     }
+
+    #[tokio::test]
+    async fn rack_sled_subnet_allocations() {
+        let logctx = dev::test_setup_log("rack_sled_subnet_allocations");
+        let mut db = test_setup_database(&logctx.log).await;
+        let (opctx, datastore) = datastore_test(&logctx, &db).await;
+
+        let rack_id = Uuid::new_v4();
+
+        // Ensure we get an empty list when there are no allocations
+        let allocations =
+            datastore.rack_subnet_allocations(&opctx, rack_id).await.unwrap();
+        assert!(allocations.is_empty());
+
+        // Add 5 allocations
+        for i in 0..5i16 {
+            let allocation = SledUnderlaySubnetAllocation {
+                rack_id,
+                sled_id: Uuid::new_v4(),
+                subnet_octet: 33 + i,
+                hw_baseboard_id: Uuid::new_v4(),
+            };
+            datastore
+                .sled_subnet_allocation_insert(&opctx, &allocation)
+                .await
+                .unwrap();
+        }
+
+        // List all 5 allocations
+        let allocations =
+            datastore.rack_subnet_allocations(&opctx, rack_id).await.unwrap();
+
+        assert_eq!(5, allocations.len());
+
+        // Try to add another allocation for the same octet, but with a distinct
+        // sled_id. Ensure we get an error due to a unique constraint.
+        let mut should_fail_allocation = SledUnderlaySubnetAllocation {
+            rack_id,
+            sled_id: Uuid::new_v4(),
+            subnet_octet: 37,
+            hw_baseboard_id: Uuid::new_v4(),
+        };
+        let _err = datastore
+            .sled_subnet_allocation_insert(&opctx, &should_fail_allocation)
+            .await
+            .unwrap_err();
+
+        // Adding an allocation for the same {rack_id, sled_id} pair fails
+        // the second time, even with a distinct subnet_epoch
+        let mut allocation = should_fail_allocation.clone();
+        allocation.subnet_octet = 38;
+        datastore
+            .sled_subnet_allocation_insert(&opctx, &allocation)
+            .await
+            .unwrap();
+
+        should_fail_allocation.subnet_octet = 39;
+        should_fail_allocation.hw_baseboard_id = Uuid::new_v4();
+        let _err = datastore
+            .sled_subnet_allocation_insert(&opctx, &should_fail_allocation)
+            .await
+            .unwrap_err();
+
+        // Allocations outside our expected range fail
+        let mut should_fail_allocation = SledUnderlaySubnetAllocation {
+            rack_id,
+            sled_id: Uuid::new_v4(),
+            subnet_octet: 32,
+            hw_baseboard_id: Uuid::new_v4(),
+        };
+        let _err = datastore
+            .sled_subnet_allocation_insert(&opctx, &should_fail_allocation)
+            .await
+            .unwrap_err();
+        should_fail_allocation.subnet_octet = 256;
+        let _err = datastore
+            .sled_subnet_allocation_insert(&opctx, &should_fail_allocation)
+            .await
+            .unwrap_err();
+
+        // We should have 6 allocations
+        let allocations =
+            datastore.rack_subnet_allocations(&opctx, rack_id).await.unwrap();
+
+        assert_eq!(6, allocations.len());
+        assert_eq!(
+            vec![33, 34, 35, 36, 37, 38],
+            allocations.iter().map(|a| a.subnet_octet).collect::<Vec<_>>()
+        );
+
+        db.cleanup().await.unwrap();
+        logctx.cleanup_successful();
+    }
+
+    #[tokio::test]
+    async fn allocate_sled_underlay_subnet_octets() {
+        let logctx = dev::test_setup_log("rack_sled_subnet_allocations");
+        let mut db = test_setup_database(&logctx.log).await;
+        let (opctx, datastore) = datastore_test(&logctx, &db).await;
+
+        let rack_id = Uuid::new_v4();
+
+        let mut allocated_octets = vec![];
+        for _ in 0..5 {
+            allocated_octets.push(
+                datastore
+                    .allocate_sled_underlay_subnet_octets(
+                        &opctx,
+                        rack_id,
+                        Uuid::new_v4(),
+                    )
+                    .await
+                    .unwrap()
+                    .subnet_octet,
+            );
+        }
+
+        let expected = vec![33, 34, 35, 36, 37];
+        assert_eq!(expected, allocated_octets);
+
+        // We should have 5 allocations in the DB, sorted appropriately
+        let allocations =
+            datastore.rack_subnet_allocations(&opctx, rack_id).await.unwrap();
+        assert_eq!(5, allocations.len());
+        assert_eq!(
+            expected,
+            allocations.iter().map(|a| a.subnet_octet).collect::<Vec<_>>()
+        );
+
+        db.cleanup().await.unwrap();
+        logctx.cleanup_successful();
+    }
 }
diff --git a/nexus/db-queries/src/db/datastore/sled.rs b/nexus/db-queries/src/db/datastore/sled.rs
index 130c36b496..406119a636 100644
--- a/nexus/db-queries/src/db/datastore/sled.rs
+++ b/nexus/db-queries/src/db/datastore/sled.rs
@@ -15,6 +15,7 @@ use crate::db::model::Sled;
 use crate::db::model::SledResource;
 use crate::db::model::SledUpdate;
 use crate::db::pagination::paginated;
+use crate::db::update_and_check::UpdateAndCheck;
 use async_bb8_diesel::AsyncConnection;
 use async_bb8_diesel::AsyncRunQueryDsl;
 use chrono::Utc;
@@ -153,6 +154,11 @@ impl DataStore {
                             .and(sled_has_space_in_reservoir),
                     )
                     .filter(sled_dsl::time_deleted.is_null())
+                    // Filter out sleds that are not provisionable.
+                    .filter(
+                        sled_dsl::provision_state
+                            .eq(db::model::SledProvisionState::Provisionable),
+                    )
                     .select(sled_dsl::id)
                     .into_boxed();
 
@@ -217,6 +223,37 @@ impl DataStore {
             .map_err(|e| public_error_from_diesel(e, ErrorHandler::Server))?;
         Ok(())
     }
+
+    /// Sets the provision state for this sled.
+    ///
+    /// Returns the previous state.
+    pub async fn sled_set_provision_state(
+        &self,
+        opctx: &OpContext,
+        authz_sled: &authz::Sled,
+        state: db::model::SledProvisionState,
+    ) -> Result<db::model::SledProvisionState, external::Error> {
+        use db::schema::sled::dsl;
+
+        opctx.authorize(authz::Action::Modify, authz_sled).await?;
+
+        let sled_id = authz_sled.id();
+        let query = diesel::update(dsl::sled)
+            .filter(dsl::time_deleted.is_null())
+            .filter(dsl::id.eq(sled_id))
+            .filter(dsl::provision_state.ne(state))
+            .set((
+                dsl::provision_state.eq(state),
+                dsl::time_modified.eq(Utc::now()),
+            ))
+            .check_if_exists::<Sled>(sled_id);
+        let result = query
+            .execute_and_check(&*self.pool_connection_authorized(opctx).await?)
+            .await
+            .map_err(|e| public_error_from_diesel(e, ErrorHandler::Server))?;
+
+        Ok(result.found.provision_state())
+    }
 }
 
 #[cfg(test)]
@@ -226,12 +263,15 @@ mod test {
     use crate::db::datastore::test::{
         sled_baseboard_for_test, sled_system_hardware_for_test,
     };
+    use crate::db::lookup::LookupPath;
     use crate::db::model::ByteCount;
     use crate::db::model::SqlU32;
     use nexus_test_utils::db::test_setup_database;
+    use nexus_types::identity::Asset;
     use omicron_common::api::external;
     use omicron_test_utils::dev;
     use std::net::{Ipv6Addr, SocketAddrV6};
+    use std::num::NonZeroU32;
 
     fn rack_id() -> Uuid {
         Uuid::parse_str(nexus_test_utils::RACK_UUID).unwrap()
@@ -243,19 +283,9 @@ mod test {
         let mut db = test_setup_database(&logctx.log).await;
         let (_opctx, datastore) = datastore_test(&logctx, &db).await;
 
-        let sled_id = Uuid::new_v4();
-        let addr = SocketAddrV6::new(Ipv6Addr::LOCALHOST, 0, 0, 0);
-        let mut sled_update = SledUpdate::new(
-            sled_id,
-            addr,
-            sled_baseboard_for_test(),
-            sled_system_hardware_for_test(),
-            rack_id(),
-        );
-        let observed_sled = datastore
-            .sled_upsert(sled_update.clone())
-            .await
-            .expect("Could not upsert sled during test prep");
+        let mut sled_update = test_new_sled_update();
+        let observed_sled =
+            datastore.sled_upsert(sled_update.clone()).await.unwrap();
         assert_eq!(
             observed_sled.usable_hardware_threads,
             sled_update.usable_hardware_threads
@@ -301,4 +331,119 @@ mod test {
         db.cleanup().await.unwrap();
         logctx.cleanup_successful();
     }
+
+    /// Test that new reservations aren't created on non-provisionable sleds.
+    #[tokio::test]
+    async fn sled_reservation_create_non_provisionable() {
+        let logctx =
+            dev::test_setup_log("sled_reservation_create_non_provisionable");
+        let mut db = test_setup_database(&logctx.log).await;
+        let (opctx, datastore) = datastore_test(&logctx, &db).await;
+
+        let sled_update = test_new_sled_update();
+        let non_provisionable_sled =
+            datastore.sled_upsert(sled_update.clone()).await.unwrap();
+
+        let (authz_sled, _) = LookupPath::new(&opctx, &datastore)
+            .sled_id(non_provisionable_sled.id())
+            .fetch_for(authz::Action::Modify)
+            .await
+            .unwrap();
+
+        let old_state = datastore
+            .sled_set_provision_state(
+                &opctx,
+                &authz_sled,
+                db::model::SledProvisionState::NonProvisionable,
+            )
+            .await
+            .unwrap();
+        assert_eq!(
+            old_state,
+            db::model::SledProvisionState::Provisionable,
+            "a newly created sled starts as provisionable"
+        );
+
+        // This should be an error since there are no provisionable sleds.
+        let resources = db::model::Resources::new(
+            1,
+            // Just require the bare non-zero amount of RAM.
+            ByteCount::try_from(1024).unwrap(),
+            ByteCount::try_from(1024).unwrap(),
+        );
+        let constraints = db::model::SledReservationConstraints::none();
+        let error = datastore
+            .sled_reservation_create(
+                &opctx,
+                Uuid::new_v4(),
+                db::model::SledResourceKind::Instance,
+                resources.clone(),
+                constraints,
+            )
+            .await
+            .unwrap_err();
+        assert!(matches!(error, external::Error::ServiceUnavailable { .. }));
+
+        // Now add a provisionable sled and try again.
+        let sled_update = test_new_sled_update();
+        let provisionable_sled =
+            datastore.sled_upsert(sled_update.clone()).await.unwrap();
+
+        let sleds = datastore
+            .sled_list(&opctx, &first_page(NonZeroU32::new(10).unwrap()))
+            .await
+            .unwrap();
+        println!("sleds: {:?}", sleds);
+
+        // Try a few times to ensure that resources never get allocated to the
+        // non-provisionable sled.
+        for _ in 0..10 {
+            let constraints = db::model::SledReservationConstraints::none();
+            let resource = datastore
+                .sled_reservation_create(
+                    &opctx,
+                    Uuid::new_v4(),
+                    db::model::SledResourceKind::Instance,
+                    resources.clone(),
+                    constraints,
+                )
+                .await
+                .unwrap();
+            assert_eq!(
+                resource.sled_id,
+                provisionable_sled.id(),
+                "resource is always allocated to the provisionable sled"
+            );
+
+            datastore
+                .sled_reservation_delete(&opctx, resource.id)
+                .await
+                .unwrap();
+        }
+
+        db.cleanup().await.unwrap();
+        logctx.cleanup_successful();
+    }
+
+    fn test_new_sled_update() -> SledUpdate {
+        let sled_id = Uuid::new_v4();
+        let addr = SocketAddrV6::new(Ipv6Addr::LOCALHOST, 0, 0, 0);
+        SledUpdate::new(
+            sled_id,
+            addr,
+            sled_baseboard_for_test(),
+            sled_system_hardware_for_test(),
+            rack_id(),
+        )
+    }
+
+    /// Returns pagination parameters to fetch the first page of results for a
+    /// paginated endpoint
+    fn first_page<'a, T>(limit: NonZeroU32) -> DataPageParams<'a, T> {
+        DataPageParams {
+            marker: None,
+            direction: dropshot::PaginationOrder::Ascending,
+            limit,
+        }
+    }
 }
diff --git a/nexus/db-queries/src/db/queries/region_allocation.rs b/nexus/db-queries/src/db/queries/region_allocation.rs
index a080af4c37..031be92c08 100644
--- a/nexus/db-queries/src/db/queries/region_allocation.rs
+++ b/nexus/db-queries/src/db/queries/region_allocation.rs
@@ -290,6 +290,7 @@ impl CandidateZpools {
         seed: u128,
         distinct_sleds: bool,
     ) -> Self {
+        use schema::sled::dsl as sled_dsl;
         use schema::zpool::dsl as zpool_dsl;
 
         // Why are we using raw `diesel::dsl::sql` here?
@@ -310,13 +311,20 @@ impl CandidateZpools {
             + diesel::dsl::sql(&zpool_size_delta.to_string()))
         .le(diesel::dsl::sql(zpool_dsl::total_size::NAME));
 
+        // We need to join on the sled table to access provision_state.
+        let with_sled = sled_dsl::sled.on(zpool_dsl::sled_id.eq(sled_dsl::id));
         let with_zpool = zpool_dsl::zpool
-            .on(zpool_dsl::id.eq(old_zpool_usage::dsl::pool_id));
+            .on(zpool_dsl::id.eq(old_zpool_usage::dsl::pool_id))
+            .inner_join(with_sled);
+
+        let sled_is_provisionable = sled_dsl::provision_state
+            .eq(crate::db::model::SledProvisionState::Provisionable);
 
         let base_query = old_zpool_usage
             .query_source()
             .inner_join(with_zpool)
             .filter(it_will_fit)
+            .filter(sled_is_provisionable)
             .select((old_zpool_usage::dsl::pool_id,));
 
         let query = if distinct_sleds {
diff --git a/nexus/db-queries/src/db/queries/volume.rs b/nexus/db-queries/src/db/queries/volume.rs
index 31882dca89..2c1a9af19b 100644
--- a/nexus/db-queries/src/db/queries/volume.rs
+++ b/nexus/db-queries/src/db/queries/volume.rs
@@ -412,10 +412,11 @@ pub struct DecreaseCrucibleResourceCountAndSoftDeleteVolume {
 }
 
 impl DecreaseCrucibleResourceCountAndSoftDeleteVolume {
-    const UPDATED_REGION_SNAPSHOTS_TABLE: &str = "updated_region_snapshots";
-    const REGION_SNAPSHOTS_TO_CLEAN_UP_TABLE: &str =
+    const UPDATED_REGION_SNAPSHOTS_TABLE: &'static str =
+        "updated_region_snapshots";
+    const REGION_SNAPSHOTS_TO_CLEAN_UP_TABLE: &'static str =
         "region_snapshots_to_clean_up";
-    const UPDATED_VOLUME_TABLE: &str = "updated_volume";
+    const UPDATED_VOLUME_TABLE: &'static str = "updated_volume";
 
     pub fn new(volume_id: Uuid, snapshot_addrs: Vec<String>) -> Self {
         Self {
diff --git a/nexus/db-queries/src/db/saga_recovery.rs b/nexus/db-queries/src/db/saga_recovery.rs
index f3eada1645..802093b889 100644
--- a/nexus/db-queries/src/db/saga_recovery.rs
+++ b/nexus/db-queries/src/db/saga_recovery.rs
@@ -143,8 +143,7 @@ where
             .await
         });
 
-        let mut completion_futures = vec![];
-        completion_futures.reserve(recovery_futures.len());
+        let mut completion_futures = Vec::with_capacity(recovery_futures.len());
         // Loads and resumes all sagas in serial.
         for recovery_future in recovery_futures {
             let saga_complete_future = recovery_future.await?;
diff --git a/nexus/src/app/rack.rs b/nexus/src/app/rack.rs
index 1c2e49e260..984ece2d0c 100644
--- a/nexus/src/app/rack.rs
+++ b/nexus/src/app/rack.rs
@@ -10,7 +10,7 @@ use crate::external_api::params::CertificateCreate;
 use crate::external_api::shared::ServiceUsingCertificate;
 use crate::internal_api::params::RackInitializationRequest;
 use gateway_client::types::SpType;
-use ipnetwork::IpNetwork;
+use ipnetwork::{IpNetwork, Ipv6Network};
 use nexus_db_model::DnsGroup;
 use nexus_db_model::InitialDnsGroup;
 use nexus_db_model::{SwitchLinkFec, SwitchLinkSpeed};
@@ -29,13 +29,14 @@ use nexus_types::external_api::params::{
     AddressLotCreate, LoopbackAddressCreate, Route, SiloCreate,
     SwitchPortSettingsCreate,
 };
+use nexus_types::external_api::shared::Baseboard;
 use nexus_types::external_api::shared::FleetRole;
 use nexus_types::external_api::shared::SiloIdentityMode;
 use nexus_types::external_api::shared::SiloRole;
+use nexus_types::external_api::shared::UninitializedSled;
 use nexus_types::external_api::views;
-use nexus_types::external_api::views::Baseboard;
-use nexus_types::external_api::views::UninitializedSled;
 use nexus_types::internal_api::params::DnsRecord;
+use omicron_common::address::{get_64_subnet, Ipv6Subnet, RACK_PREFIX};
 use omicron_common::api::external::AddressLotKind;
 use omicron_common::api::external::DataPageParams;
 use omicron_common::api::external::Error;
@@ -45,7 +46,10 @@ use omicron_common::api::external::LookupResult;
 use omicron_common::api::external::Name;
 use omicron_common::api::external::NameOrId;
 use omicron_common::api::internal::shared::ExternalPortDiscovery;
+use sled_agent_client::types::AddSledRequest;
 use sled_agent_client::types::EarlyNetworkConfigBody;
+use sled_agent_client::types::StartSledAgentRequest;
+use sled_agent_client::types::StartSledAgentRequestBody;
 use sled_agent_client::types::{
     BgpConfig, BgpPeerConfig, EarlyNetworkConfig, PortConfigV1,
     RackNetworkConfigV1, RouteConfig as SledRouteConfig,
@@ -584,20 +588,7 @@ impl super::Nexus {
         if rack.rack_subnet.is_some() {
             return Ok(());
         }
-        let addr = self
-            .sled_list(opctx, &DataPageParams::max_page())
-            .await?
-            .get(0)
-            .ok_or(Error::InternalError {
-                internal_message: "no sleds at time of bootstore sync".into(),
-            })?
-            .address();
-
-        let sa = sled_agent_client::Client::new(
-            &format!("http://{}", addr),
-            self.log.clone(),
-        );
-
+        let sa = self.get_any_sled_agent(opctx).await?;
         let result = sa
             .read_network_bootstore_config_cache()
             .await
@@ -619,7 +610,7 @@ impl super::Nexus {
         opctx: &OpContext,
     ) -> Result<EarlyNetworkConfig, Error> {
         let rack = self.rack_lookup(opctx, &self.rack_id).await?;
-        let subnet = rack.subnet()?;
+        let subnet = rack_subnet(rack.rack_subnet)?;
 
         let db_ports = self.active_port_settings(opctx).await?;
         let mut ports = Vec::new();
@@ -726,18 +717,28 @@ impl super::Nexus {
         &self,
         opctx: &OpContext,
     ) -> ListResultVec<UninitializedSled> {
+        debug!(self.log, "Getting latest collection");
         // Grab the SPs from the last collection
         let limit = NonZeroU32::new(50).unwrap();
         let collection = self
             .db_datastore
             .inventory_get_latest_collection(opctx, limit)
             .await?;
+
+        // There can't be any uninitialized sleds we know about
+        // if there is no inventory.
+        let Some(collection) = collection else {
+            return Ok(vec![]);
+        };
+
         let pagparams = DataPageParams {
             marker: None,
             direction: dropshot::PaginationOrder::Descending,
             // TODO: This limit is only suitable for a single sled cluster
             limit: NonZeroU32::new(32).unwrap(),
         };
+
+        debug!(self.log, "Listing sleds");
         let sleds = self.db_datastore.sled_list(opctx, &pagparams).await?;
 
         let mut uninitialized_sleds: Vec<UninitializedSled> = collection
@@ -767,4 +768,106 @@ impl super::Nexus {
         uninitialized_sleds.retain(|s| !sled_baseboards.contains(&s.baseboard));
         Ok(uninitialized_sleds)
     }
+
+    /// Add a sled to an intialized rack
+    pub(crate) async fn add_sled_to_initialized_rack(
+        &self,
+        opctx: &OpContext,
+        sled: UninitializedSled,
+    ) -> Result<(), Error> {
+        let baseboard_id = sled.baseboard.clone().into();
+        let hw_baseboard_id =
+            self.db_datastore.find_hw_baseboard_id(opctx, baseboard_id).await?;
+
+        let subnet = self.db_datastore.rack_subnet(opctx, sled.rack_id).await?;
+        let rack_subnet =
+            Ipv6Subnet::<RACK_PREFIX>::from(rack_subnet(Some(subnet))?);
+
+        let allocation = self
+            .db_datastore
+            .allocate_sled_underlay_subnet_octets(
+                opctx,
+                sled.rack_id,
+                hw_baseboard_id,
+            )
+            .await?;
+
+        // Convert the baseboard as necessary
+        let baseboard = sled_agent_client::types::Baseboard::Gimlet {
+            identifier: sled.baseboard.serial.clone(),
+            model: sled.baseboard.part.clone(),
+            revision: sled.baseboard.revision,
+        };
+
+        // Make the call to sled-agent
+        let req = AddSledRequest {
+            sled_id: baseboard,
+            start_request: StartSledAgentRequest {
+                generation: 0,
+                schema_version: 1,
+                body: StartSledAgentRequestBody {
+                    id: allocation.sled_id,
+                    rack_id: allocation.rack_id,
+                    use_trust_quorum: true,
+                    is_lrtq_learner: true,
+                    subnet: sled_agent_client::types::Ipv6Subnet {
+                        net: get_64_subnet(
+                            rack_subnet,
+                            allocation.subnet_octet.try_into().unwrap(),
+                        )
+                        .net()
+                        .into(),
+                    },
+                },
+            },
+        };
+        let sa = self.get_any_sled_agent(opctx).await?;
+        sa.add_sled_to_initialized_rack(&req).await.map_err(|e| {
+            Error::InternalError {
+                internal_message: format!(
+                    "failed to add sled with baseboard {:?} to rack {}: {e}",
+                    sled.baseboard, allocation.rack_id
+                ),
+            }
+        })?;
+
+        Ok(())
+    }
+
+    async fn get_any_sled_agent(
+        &self,
+        opctx: &OpContext,
+    ) -> Result<sled_agent_client::Client, Error> {
+        let addr = self
+            .sled_list(opctx, &DataPageParams::max_page())
+            .await?
+            .get(0)
+            .ok_or(Error::InternalError {
+                internal_message: "no sled agents available".into(),
+            })?
+            .address();
+
+        Ok(sled_agent_client::Client::new(
+            &format!("http://{}", addr),
+            self.log.clone(),
+        ))
+    }
+}
+
+pub fn rack_subnet(
+    rack_subnet: Option<IpNetwork>,
+) -> Result<Ipv6Network, Error> {
+    match rack_subnet {
+        Some(IpNetwork::V6(subnet)) => Ok(subnet),
+        Some(IpNetwork::V4(_)) => {
+            return Err(Error::InternalError {
+                internal_message: "rack subnet not IPv6".into(),
+            })
+        }
+        None => {
+            return Err(Error::InternalError {
+                internal_message: "rack subnet not set".into(),
+            })
+        }
+    }
 }
diff --git a/nexus/src/app/sled.rs b/nexus/src/app/sled.rs
index 8189c0a93d..44efc2934e 100644
--- a/nexus/src/app/sled.rs
+++ b/nexus/src/app/sled.rs
@@ -8,6 +8,7 @@ use crate::internal_api::params::{
     PhysicalDiskDeleteRequest, PhysicalDiskPutRequest, SledAgentStartupInfo,
     SledRole, ZpoolPutRequest,
 };
+use nexus_db_queries::authz;
 use nexus_db_queries::context::OpContext;
 use nexus_db_queries::db;
 use nexus_db_queries::db::lookup;
@@ -38,6 +39,9 @@ impl super::Nexus {
 
     // TODO-robustness we should have a limit on how many sled agents there can
     // be (for graceful degradation at large scale).
+    //
+    // TODO-multisled: This should not use the rack_id for the given nexus,
+    // unless the DNS lookups at sled-agent are only for rack-local nexuses.
     pub(crate) async fn upsert_sled(
         &self,
         opctx: &OpContext,
@@ -139,6 +143,20 @@ impl super::Nexus {
             .await
     }
 
+    /// Returns the old state.
+    pub(crate) async fn sled_set_provision_state(
+        &self,
+        opctx: &OpContext,
+        sled_lookup: &lookup::Sled<'_>,
+        state: db::model::SledProvisionState,
+    ) -> Result<db::model::SledProvisionState, Error> {
+        let (authz_sled,) =
+            sled_lookup.lookup_for(authz::Action::Modify).await?;
+        self.db_datastore
+            .sled_set_provision_state(opctx, &authz_sled, state)
+            .await
+    }
+
     // Physical disks
 
     pub(crate) async fn sled_list_physical_disks(
diff --git a/nexus/src/external_api/http_entrypoints.rs b/nexus/src/external_api/http_entrypoints.rs
index 428632bcf5..f1302f4a73 100644
--- a/nexus/src/external_api/http_entrypoints.rs
+++ b/nexus/src/external_api/http_entrypoints.rs
@@ -6,10 +6,11 @@
 
 use super::{
     console_api, device_auth, params,
+    shared::UninitializedSled,
     views::{
         self, Certificate, Group, IdentityProvider, Image, IpPool, IpPoolRange,
-        PhysicalDisk, Project, Rack, Role, Silo, Sled, Snapshot, SshKey,
-        UninitializedSled, User, UserBuiltin, Vpc, VpcRouter, VpcSubnet,
+        PhysicalDisk, Project, Rack, Role, Silo, Sled, Snapshot, SshKey, User,
+        UserBuiltin, Vpc, VpcRouter, VpcSubnet,
     },
 };
 use crate::external_api::shared;
@@ -217,12 +218,14 @@ pub(crate) fn external_api() -> NexusApiDescription {
         api.register(rack_view)?;
         api.register(sled_list)?;
         api.register(sled_view)?;
+        api.register(sled_set_provision_state)?;
         api.register(sled_instance_list)?;
         api.register(sled_physical_disk_list)?;
         api.register(physical_disk_list)?;
         api.register(switch_list)?;
         api.register(switch_view)?;
         api.register(uninitialized_sled_list)?;
+        api.register(add_sled_to_initialized_rack)?;
 
         api.register(user_builtin_list)?;
         api.register(user_builtin_view)?;
@@ -4402,6 +4405,31 @@ async fn uninitialized_sled_list(
     apictx.external_latencies.instrument_dropshot_handler(&rqctx, handler).await
 }
 
+/// Add a sled to an initialized rack
+//
+// TODO: In the future this should really be a PUT request, once we resolve
+// https://github.com/oxidecomputer/omicron/issues/4494. It should also
+// explicitly be tied to a rack via a `rack_id` path param. For now we assume
+// we are only operating on single rack systems.
+#[endpoint {
+    method = POST,
+    path = "/v1/system/hardware/sleds/",
+    tags = ["system/hardware"]
+}]
+async fn add_sled_to_initialized_rack(
+    rqctx: RequestContext<Arc<ServerContext>>,
+    sled: TypedBody<UninitializedSled>,
+) -> Result<HttpResponseUpdatedNoContent, HttpError> {
+    let apictx = rqctx.context();
+    let nexus = &apictx.nexus;
+    let handler = async {
+        let opctx = crate::context::op_context_for_external_api(&rqctx).await?;
+        nexus.add_sled_to_initialized_rack(&opctx, sled.into_inner()).await?;
+        Ok(HttpResponseUpdatedNoContent())
+    };
+    apictx.external_latencies.instrument_dropshot_handler(&rqctx, handler).await
+}
+
 // Sleds
 
 /// List sleds
@@ -4456,6 +4484,47 @@ async fn sled_view(
     apictx.external_latencies.instrument_dropshot_handler(&rqctx, handler).await
 }
 
+/// Set the sled's provision state.
+#[endpoint {
+    method = PUT,
+    path = "/v1/system/hardware/sleds/{sled_id}/provision-state",
+    tags = ["system/hardware"],
+}]
+async fn sled_set_provision_state(
+    rqctx: RequestContext<Arc<ServerContext>>,
+    path_params: Path<params::SledPath>,
+    new_provision_state: TypedBody<params::SledProvisionStateParams>,
+) -> Result<HttpResponseOk<params::SledProvisionStateResponse>, HttpError> {
+    let apictx = rqctx.context();
+    let handler = async {
+        let nexus = &apictx.nexus;
+
+        let path = path_params.into_inner();
+        let provision_state = new_provision_state.into_inner().state;
+
+        let opctx = crate::context::op_context_for_external_api(&rqctx).await?;
+        // Convert the external `SledProvisionState` into our internal data model.
+        let new_state =
+            db::model::SledProvisionState::try_from(provision_state).map_err(
+                |error| HttpError::for_bad_request(None, format!("{error}")),
+            )?;
+
+        let sled_lookup = nexus.sled_lookup(&opctx, &path.sled_id)?;
+
+        let old_state = nexus
+            .sled_set_provision_state(&opctx, &sled_lookup, new_state)
+            .await?;
+
+        let response = params::SledProvisionStateResponse {
+            old_state: old_state.into(),
+            new_state: new_state.into(),
+        };
+
+        Ok(HttpResponseOk(response))
+    };
+    apictx.external_latencies.instrument_dropshot_handler(&rqctx, handler).await
+}
+
 /// List instances running on a given sled
 #[endpoint {
     method = GET,
diff --git a/nexus/tests/integration_tests/endpoints.rs b/nexus/tests/integration_tests/endpoints.rs
index 64790c49c2..536b96f7ae 100644
--- a/nexus/tests/integration_tests/endpoints.rs
+++ b/nexus/tests/integration_tests/endpoints.rs
@@ -21,8 +21,10 @@ use nexus_test_utils::SLED_AGENT_UUID;
 use nexus_test_utils::SWITCH_UUID;
 use nexus_types::external_api::params;
 use nexus_types::external_api::shared;
+use nexus_types::external_api::shared::Baseboard;
 use nexus_types::external_api::shared::IpRange;
 use nexus_types::external_api::shared::Ipv4Range;
+use nexus_types::external_api::shared::UninitializedSled;
 use omicron_common::api::external::AddressLotKind;
 use omicron_common::api::external::ByteCount;
 use omicron_common::api::external::IdentityMetadataCreateParams;
@@ -39,6 +41,7 @@ use omicron_test_utils::certificates::CertificateChain;
 use std::net::IpAddr;
 use std::net::Ipv4Addr;
 use std::str::FromStr;
+use uuid::Uuid;
 
 lazy_static! {
     pub static ref HARDWARE_RACK_URL: String =
@@ -47,6 +50,12 @@ lazy_static! {
         format!("/v1/system/hardware/uninitialized-sleds");
     pub static ref HARDWARE_SLED_URL: String =
         format!("/v1/system/hardware/sleds/{}", SLED_AGENT_UUID);
+    pub static ref HARDWARE_SLED_PROVISION_STATE_URL: String =
+        format!("/v1/system/hardware/sleds/{}/provision-state", SLED_AGENT_UUID);
+    pub static ref DEMO_SLED_PROVISION_STATE: params::SledProvisionStateParams =
+        params::SledProvisionStateParams {
+            state: nexus_types::external_api::views::SledProvisionState::NonProvisionable,
+        };
     pub static ref HARDWARE_SWITCH_URL: String =
         format!("/v1/system/hardware/switches/{}", SWITCH_UUID);
     pub static ref HARDWARE_DISK_URL: String =
@@ -57,6 +66,16 @@ lazy_static! {
     pub static ref SLED_INSTANCES_URL: String =
         format!("/v1/system/hardware/sleds/{}/instances", SLED_AGENT_UUID);
 
+    pub static ref DEMO_UNINITIALIZED_SLED: UninitializedSled = UninitializedSled {
+        baseboard: Baseboard {
+            serial: "demo-serial".to_string(),
+            part: "demo-part".to_string(),
+            revision: 6
+        },
+        rack_id: Uuid::new_v4(),
+        cubby: 1
+    };
+
     // Global policy
     pub static ref SYSTEM_POLICY_URL: &'static str = "/v1/system/policy";
 
@@ -1577,7 +1596,9 @@ lazy_static! {
             url: "/v1/system/hardware/sleds",
             visibility: Visibility::Public,
             unprivileged_access: UnprivilegedAccess::None,
-            allowed_methods: vec![AllowedMethod::Get],
+            allowed_methods: vec![AllowedMethod::Get, AllowedMethod::Post(
+                serde_json::to_value(&*DEMO_UNINITIALIZED_SLED).unwrap()
+            )],
         },
 
         VerifyEndpoint {
@@ -1594,6 +1615,15 @@ lazy_static! {
             allowed_methods: vec![AllowedMethod::Get],
         },
 
+        VerifyEndpoint {
+            url: &HARDWARE_SLED_PROVISION_STATE_URL,
+            visibility: Visibility::Protected,
+            unprivileged_access: UnprivilegedAccess::None,
+            allowed_methods: vec![AllowedMethod::Put(
+                serde_json::to_value(&*DEMO_SLED_PROVISION_STATE).unwrap()
+            )],
+        },
+
         VerifyEndpoint {
             url: "/v1/system/hardware/switches",
             visibility: Visibility::Public,
diff --git a/nexus/tests/integration_tests/rack.rs b/nexus/tests/integration_tests/rack.rs
index 2c191f27ae..9f77223871 100644
--- a/nexus/tests/integration_tests/rack.rs
+++ b/nexus/tests/integration_tests/rack.rs
@@ -10,8 +10,14 @@ use nexus_test_utils::http_testing::RequestBuilder;
 use nexus_test_utils::TEST_SUITE_PASSWORD;
 use nexus_test_utils_macros::nexus_test;
 use nexus_types::external_api::params;
+use nexus_types::external_api::shared::UninitializedSled;
 use nexus_types::external_api::views::Rack;
+use nexus_types::internal_api::params::Baseboard;
+use nexus_types::internal_api::params::SledAgentStartupInfo;
+use nexus_types::internal_api::params::SledRole;
+use omicron_common::api::external::ByteCount;
 use omicron_nexus::TestInterfaces;
+use uuid::Uuid;
 
 type ControlPlaneTestContext =
     nexus_test_utils::ControlPlaneTestContext<omicron_nexus::Server>;
@@ -77,3 +83,63 @@ async fn test_rack_initialization(cptestctx: &ControlPlaneTestContext) {
     )
     .await;
 }
+
+#[nexus_test]
+async fn test_uninitialized_sled_list(cptestctx: &ControlPlaneTestContext) {
+    let internal_client = &cptestctx.internal_client;
+    let external_client = &cptestctx.external_client;
+    let list_url = "/v1/system/hardware/uninitialized-sleds";
+    let mut uninitialized_sleds =
+        NexusRequest::object_get(external_client, &list_url)
+            .authn_as(AuthnMode::PrivilegedUser)
+            .execute()
+            .await
+            .expect("failed to get uninitialized sleds")
+            .parsed_body::<Vec<UninitializedSled>>()
+            .unwrap();
+    debug!(cptestctx.logctx.log, "{:#?}", uninitialized_sleds);
+
+    // There are currently two fake sim gimlets created in the latest inventory
+    // collection as part of test setup.
+    assert_eq!(2, uninitialized_sleds.len());
+
+    // Insert one of these fake sleds into the `sled` table.
+    // Just pick some random fields other than `baseboard`
+    let baseboard = uninitialized_sleds.pop().unwrap().baseboard;
+    let sled_uuid = Uuid::new_v4();
+    let sa = SledAgentStartupInfo {
+        sa_address: "[fd00:1122:3344:01::1]:8080".parse().unwrap(),
+        role: SledRole::Gimlet,
+        baseboard: Baseboard {
+            serial_number: baseboard.serial,
+            part_number: baseboard.part,
+            revision: baseboard.revision,
+        },
+        usable_hardware_threads: 32,
+        usable_physical_ram: ByteCount::from_gibibytes_u32(100),
+        reservoir_size: ByteCount::from_mebibytes_u32(100),
+    };
+    internal_client
+        .make_request(
+            Method::POST,
+            format!("/sled-agents/{sled_uuid}").as_str(),
+            Some(&sa),
+            StatusCode::NO_CONTENT,
+        )
+        .await
+        .unwrap();
+
+    // Ensure there's only one unintialized sled remaining, and it's not
+    // the one that was just added into the `sled` table
+    let uninitialized_sleds_2 =
+        NexusRequest::object_get(external_client, &list_url)
+            .authn_as(AuthnMode::PrivilegedUser)
+            .execute()
+            .await
+            .expect("failed to get uninitialized sleds")
+            .parsed_body::<Vec<UninitializedSled>>()
+            .unwrap();
+    debug!(cptestctx.logctx.log, "{:#?}", uninitialized_sleds);
+    assert_eq!(1, uninitialized_sleds_2.len());
+    assert_eq!(uninitialized_sleds, uninitialized_sleds_2);
+}
diff --git a/nexus/tests/integration_tests/schema.rs b/nexus/tests/integration_tests/schema.rs
index 213e7f9e4f..6feafe415d 100644
--- a/nexus/tests/integration_tests/schema.rs
+++ b/nexus/tests/integration_tests/schema.rs
@@ -629,7 +629,17 @@ impl InformationSchema {
             self.referential_constraints,
             other.referential_constraints
         );
-        similar_asserts::assert_eq!(self.statistics, other.statistics);
+        similar_asserts::assert_eq!(
+            self.statistics,
+            other.statistics,
+            "Statistics did not match. This often means that in dbinit.sql, a new \
+            column was added into the middle of a table rather than to the end. \
+            If that is the case:\n\n \
+            \
+            * Change dbinit.sql to add the column to the end of the table.\n\
+            * Update nexus/db-model/src/schema.rs and the corresponding \
+            Queryable/Insertable struct with the new column ordering."
+        );
         similar_asserts::assert_eq!(self.sequences, other.sequences);
         similar_asserts::assert_eq!(self.pg_indexes, other.pg_indexes);
     }
diff --git a/nexus/tests/output/nexus_tags.txt b/nexus/tests/output/nexus_tags.txt
index 7f0c30c471..7e57d00df2 100644
--- a/nexus/tests/output/nexus_tags.txt
+++ b/nexus/tests/output/nexus_tags.txt
@@ -110,6 +110,7 @@ snapshot_view                            GET      /v1/snapshots/{snapshot}
 
 API operations found with tag "system/hardware"
 OPERATION ID                             METHOD   URL PATH
+add_sled_to_initialized_rack             POST     /v1/system/hardware/sleds
 networking_switch_port_apply_settings    POST     /v1/system/hardware/switch-port/{port}/settings
 networking_switch_port_clear_settings    DELETE   /v1/system/hardware/switch-port/{port}/settings
 networking_switch_port_list              GET      /v1/system/hardware/switch-port
@@ -119,6 +120,7 @@ rack_view                                GET      /v1/system/hardware/racks/{rac
 sled_instance_list                       GET      /v1/system/hardware/sleds/{sled_id}/instances
 sled_list                                GET      /v1/system/hardware/sleds
 sled_physical_disk_list                  GET      /v1/system/hardware/sleds/{sled_id}/disks
+sled_set_provision_state                 PUT      /v1/system/hardware/sleds/{sled_id}/provision-state
 sled_view                                GET      /v1/system/hardware/sleds/{sled_id}
 switch_list                              GET      /v1/system/hardware/switches
 switch_view                              GET      /v1/system/hardware/switches/{switch_id}
diff --git a/nexus/types/Cargo.toml b/nexus/types/Cargo.toml
index 9cb94a8484..8cbbd8626c 100644
--- a/nexus/types/Cargo.toml
+++ b/nexus/types/Cargo.toml
@@ -14,6 +14,7 @@ parse-display.workspace = true
 schemars = { workspace = true, features = ["chrono", "uuid1"] }
 serde.workspace = true
 serde_json.workspace = true
+serde_with.workspace = true
 steno.workspace = true
 strum.workspace = true
 uuid.workspace = true
diff --git a/nexus/types/src/external_api/params.rs b/nexus/types/src/external_api/params.rs
index a0169ae777..a5f1f3f874 100644
--- a/nexus/types/src/external_api/params.rs
+++ b/nexus/types/src/external_api/params.rs
@@ -75,6 +75,23 @@ pub struct SledSelector {
     pub sled: Uuid,
 }
 
+/// Parameters for `sled_set_provision_state`.
+#[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)]
+pub struct SledProvisionStateParams {
+    /// The provision state.
+    pub state: super::views::SledProvisionState,
+}
+
+/// Response to `sled_set_provision_state`.
+#[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)]
+pub struct SledProvisionStateResponse {
+    /// The old provision state.
+    pub old_state: super::views::SledProvisionState,
+
+    /// The new provision state.
+    pub new_state: super::views::SledProvisionState,
+}
+
 pub struct SwitchSelector {
     /// ID of the switch
     pub switch: Uuid,
diff --git a/nexus/types/src/external_api/shared.rs b/nexus/types/src/external_api/shared.rs
index 48fbb9c10d..a4c5ae1e62 100644
--- a/nexus/types/src/external_api/shared.rs
+++ b/nexus/types/src/external_api/shared.rs
@@ -245,6 +245,42 @@ pub enum UpdateableComponentType {
     HostOmicron,
 }
 
+/// Properties that uniquely identify an Oxide hardware component
+#[derive(
+    Clone,
+    Debug,
+    Serialize,
+    Deserialize,
+    JsonSchema,
+    PartialOrd,
+    Ord,
+    PartialEq,
+    Eq,
+)]
+pub struct Baseboard {
+    pub serial: String,
+    pub part: String,
+    pub revision: i64,
+}
+
+/// A sled that has not been added to an initialized rack yet
+#[derive(
+    Clone,
+    Debug,
+    Serialize,
+    Deserialize,
+    JsonSchema,
+    PartialOrd,
+    Ord,
+    PartialEq,
+    Eq,
+)]
+pub struct UninitializedSled {
+    pub baseboard: Baseboard,
+    pub rack_id: Uuid,
+    pub cubby: u16,
+}
+
 #[cfg(test)]
 mod test {
     use super::Policy;
diff --git a/nexus/types/src/external_api/views.rs b/nexus/types/src/external_api/views.rs
index b34fc7a542..6d02623f34 100644
--- a/nexus/types/src/external_api/views.rs
+++ b/nexus/types/src/external_api/views.rs
@@ -5,7 +5,7 @@
 //! Views are response bodies, most of which are public lenses onto DB models.
 
 use crate::external_api::shared::{
-    self, IpKind, IpRange, ServiceUsingCertificate,
+    self, Baseboard, IpKind, IpRange, ServiceUsingCertificate,
 };
 use crate::identity::AssetIdentityMetadata;
 use api_identity::ObjectIdentity;
@@ -17,6 +17,7 @@ use omicron_common::api::external::{
 };
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
+use serde_with::rust::deserialize_ignore_any;
 use std::collections::BTreeMap;
 use std::collections::BTreeSet;
 use std::net::IpAddr;
@@ -274,44 +275,8 @@ pub struct Rack {
     pub identity: AssetIdentityMetadata,
 }
 
-/// View of a sled that has not been added to an initialized rack yet
-#[derive(
-    Clone,
-    Debug,
-    Serialize,
-    Deserialize,
-    JsonSchema,
-    PartialOrd,
-    Ord,
-    PartialEq,
-    Eq,
-)]
-pub struct UninitializedSled {
-    pub baseboard: Baseboard,
-    pub rack_id: Uuid,
-    pub cubby: u16,
-}
-
 // FRUs
 
-/// Properties that uniquely identify an Oxide hardware component
-#[derive(
-    Clone,
-    Debug,
-    Serialize,
-    Deserialize,
-    JsonSchema,
-    PartialOrd,
-    Ord,
-    PartialEq,
-    Eq,
-)]
-pub struct Baseboard {
-    pub serial: String,
-    pub part: String,
-    pub revision: i64,
-}
-
 // SLEDS
 
 /// An operator's view of a Sled.
@@ -322,12 +287,38 @@ pub struct Sled {
     pub baseboard: Baseboard,
     /// The rack to which this Sled is currently attached
     pub rack_id: Uuid,
+    /// The provision state of the sled.
+    pub provision_state: SledProvisionState,
     /// The number of hardware threads which can execute on this sled
     pub usable_hardware_threads: u32,
     /// Amount of RAM which may be used by the Sled's OS
     pub usable_physical_ram: ByteCount,
 }
 
+/// The provision state of a sled.
+///
+/// This controls whether new resources are going to be provisioned on this
+/// sled.
+#[derive(
+    Copy, Clone, Debug, Deserialize, Serialize, JsonSchema, PartialEq, Eq,
+)]
+#[serde(rename_all = "snake_case")]
+pub enum SledProvisionState {
+    /// New resources will be provisioned on this sled.
+    Provisionable,
+
+    /// New resources will not be provisioned on this sled. However, existing
+    /// resources will continue to be on this sled unless manually migrated
+    /// off.
+    NonProvisionable,
+
+    /// This is a state that isn't known yet.
+    ///
+    /// This is defined to avoid API breakage.
+    #[serde(other, deserialize_with = "deserialize_ignore_any")]
+    Unknown,
+}
+
 /// An operator's view of an instance running on a given sled
 #[derive(Clone, Debug, Deserialize, Serialize, JsonSchema)]
 pub struct SledInstance {
diff --git a/nexus/types/src/internal_api/params.rs b/nexus/types/src/internal_api/params.rs
index c0991ebb17..bc25e8d4bd 100644
--- a/nexus/types/src/internal_api/params.rs
+++ b/nexus/types/src/internal_api/params.rs
@@ -25,7 +25,7 @@ use uuid::Uuid;
 ///
 /// Note that this may change if the sled is physically moved
 /// within the rack.
-#[derive(Serialize, Deserialize, JsonSchema)]
+#[derive(Serialize, Deserialize, JsonSchema, Debug)]
 #[serde(rename_all = "snake_case")]
 pub enum SledRole {
     /// The sled is a general compute sled.
@@ -45,7 +45,7 @@ pub struct Baseboard {
 }
 
 /// Sent by a sled agent on startup to Nexus to request further instruction
-#[derive(Serialize, Deserialize, JsonSchema)]
+#[derive(Serialize, Deserialize, Debug, JsonSchema)]
 pub struct SledAgentStartupInfo {
     /// The address of the sled agent's API endpoint
     pub sa_address: SocketAddrV6,
diff --git a/nexus/types/src/inventory.rs b/nexus/types/src/inventory.rs
index 19c323d894..9401727162 100644
--- a/nexus/types/src/inventory.rs
+++ b/nexus/types/src/inventory.rs
@@ -20,6 +20,8 @@ use std::sync::Arc;
 use strum::EnumIter;
 use uuid::Uuid;
 
+use crate::external_api::shared::Baseboard;
+
 /// Results of collecting hardware/software inventory from various Omicron
 /// components
 ///
@@ -131,6 +133,12 @@ pub struct BaseboardId {
     pub serial_number: String,
 }
 
+impl From<Baseboard> for BaseboardId {
+    fn from(value: Baseboard) -> Self {
+        BaseboardId { part_number: value.part, serial_number: value.serial }
+    }
+}
+
 /// Caboose contents found during a collection
 ///
 /// These are normalized in the database.  Each distinct `Caboose` is assigned a
diff --git a/openapi/nexus.json b/openapi/nexus.json
index 0d19e81d9a..08e6cd7149 100644
--- a/openapi/nexus.json
+++ b/openapi/nexus.json
@@ -3610,6 +3610,34 @@
         "x-dropshot-pagination": {
           "required": []
         }
+      },
+      "post": {
+        "tags": [
+          "system/hardware"
+        ],
+        "summary": "Add a sled to an initialized rack",
+        "operationId": "add_sled_to_initialized_rack",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UninitializedSled"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "resource updated"
+          },
+          "4XX": {
+            "$ref": "#/components/responses/Error"
+          },
+          "5XX": {
+            "$ref": "#/components/responses/Error"
+          }
+        }
       }
     },
     "/v1/system/hardware/sleds/{sled_id}": {
@@ -3789,6 +3817,55 @@
         }
       }
     },
+    "/v1/system/hardware/sleds/{sled_id}/provision-state": {
+      "put": {
+        "tags": [
+          "system/hardware"
+        ],
+        "summary": "Set the sled's provision state.",
+        "operationId": "sled_set_provision_state",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "sled_id",
+            "description": "ID of the sled",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SledProvisionStateParams"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "successful operation",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SledProvisionStateResponse"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "$ref": "#/components/responses/Error"
+          },
+          "5XX": {
+            "$ref": "#/components/responses/Error"
+          }
+        }
+      }
+    },
     "/v1/system/hardware/switch-port": {
       "get": {
         "tags": [
@@ -12948,6 +13025,14 @@
             "type": "string",
             "format": "uuid"
           },
+          "provision_state": {
+            "description": "The provision state of the sled.",
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/SledProvisionState"
+              }
+            ]
+          },
           "rack_id": {
             "description": "The rack to which this Sled is currently attached",
             "type": "string",
@@ -12981,6 +13066,7 @@
         "required": [
           "baseboard",
           "id",
+          "provision_state",
           "rack_id",
           "time_created",
           "time_modified",
@@ -13071,6 +13157,75 @@
           "items"
         ]
       },
+      "SledProvisionState": {
+        "description": "The provision state of a sled.\n\nThis controls whether new resources are going to be provisioned on this sled.",
+        "oneOf": [
+          {
+            "description": "New resources will be provisioned on this sled.",
+            "type": "string",
+            "enum": [
+              "provisionable"
+            ]
+          },
+          {
+            "description": "New resources will not be provisioned on this sled. However, existing resources will continue to be on this sled unless manually migrated off.",
+            "type": "string",
+            "enum": [
+              "non_provisionable"
+            ]
+          },
+          {
+            "description": "This is a state that isn't known yet.\n\nThis is defined to avoid API breakage.",
+            "type": "string",
+            "enum": [
+              "unknown"
+            ]
+          }
+        ]
+      },
+      "SledProvisionStateParams": {
+        "description": "Parameters for `sled_set_provision_state`.",
+        "type": "object",
+        "properties": {
+          "state": {
+            "description": "The provision state.",
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/SledProvisionState"
+              }
+            ]
+          }
+        },
+        "required": [
+          "state"
+        ]
+      },
+      "SledProvisionStateResponse": {
+        "description": "Response to `sled_set_provision_state`.",
+        "type": "object",
+        "properties": {
+          "new_state": {
+            "description": "The new provision state.",
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/SledProvisionState"
+              }
+            ]
+          },
+          "old_state": {
+            "description": "The old provision state.",
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/SledProvisionState"
+              }
+            ]
+          }
+        },
+        "required": [
+          "new_state",
+          "old_state"
+        ]
+      },
       "SledResultsPage": {
         "description": "A single page of results",
         "type": "object",
@@ -13971,7 +14126,7 @@
         ]
       },
       "UninitializedSled": {
-        "description": "View of a sled that has not been added to an initialized rack yet",
+        "description": "A sled that has not been added to an initialized rack yet",
         "type": "object",
         "properties": {
           "baseboard": {
diff --git a/oximeter/instruments/src/kstat/link.rs b/oximeter/instruments/src/kstat/link.rs
index d22ac60378..03397c4108 100644
--- a/oximeter/instruments/src/kstat/link.rs
+++ b/oximeter/instruments/src/kstat/link.rs
@@ -268,8 +268,8 @@ mod tests {
     }
 
     impl TestEtherstub {
-        const PFEXEC: &str = "/usr/bin/pfexec";
-        const DLADM: &str = "/usr/sbin/dladm";
+        const PFEXEC: &'static str = "/usr/bin/pfexec";
+        const DLADM: &'static str = "/usr/sbin/dladm";
         fn new() -> Self {
             let name = format!(
                 "kstest{}0",
diff --git a/package-manifest.toml b/package-manifest.toml
index ca96341f2a..26c45f0ff7 100644
--- a/package-manifest.toml
+++ b/package-manifest.toml
@@ -425,7 +425,7 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "12b392be94ff93abc3017bf2610a3b18e2174a2d"
+source.commit = "579592bf474ec4b86805ada60c1b920b3beef5a7"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/maghemite.sha256.txt
 source.sha256 = "38851c79c85d53e997db748520fb27c82299ce7e58a550e35646a548498f1271"
@@ -441,7 +441,7 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "12b392be94ff93abc3017bf2610a3b18e2174a2d"
+source.commit = "579592bf474ec4b86805ada60c1b920b3beef5a7"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm.sha256.txt
 source.sha256 = "8cd94e9a6f6175081ce78f0281085a08a5306cde453d8e21deb28050945b1d88"
@@ -456,10 +456,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "12b392be94ff93abc3017bf2610a3b18e2174a2d"
+source.commit = "579592bf474ec4b86805ada60c1b920b3beef5a7"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm.sha256.txt
-source.sha256 = "c4a7a626c84a28de3d2c6bfd85592bda2abad8cf5b41b2ce90b9c03904ccd3df"
+source.sha256 = "82aa1ca1d7701b2221c442d58f912be59798258d574effcb866ffab22753cf38"
 output.type = "zone"
 output.intermediate_only = true
 
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 804ff08cce..65ee8a9912 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -4,5 +4,5 @@
 #
 # We choose a specific toolchain (rather than "stable") for repeatability.  The
 # intent is to keep this up-to-date with recently-released stable Rust.
-channel = "1.73.0"
+channel = "1.74.0"
 profile = "default"
diff --git a/schema/crdb/14.0.0/up1.sql b/schema/crdb/14.0.0/up1.sql
new file mode 100644
index 0000000000..3bff831ceb
--- /dev/null
+++ b/schema/crdb/14.0.0/up1.sql
@@ -0,0 +1,37 @@
+-- Table of all sled subnets allocated for sleds added to an already initialized
+-- rack. The sleds in this table and their allocated subnets are created before
+-- a sled is added to the `sled` table. Addition to the `sled` table occurs
+-- after the sled is initialized and notifies Nexus about itself.
+--
+-- For simplicity and space savings, this table doesn't actually contain the
+-- full subnets for a given sled, but only the octet that extends a /56 rack
+-- subnet to a /64 sled subnet. The rack subnet is maintained in the `rack`
+-- table.
+--
+-- This table does not include subnet octets allocated during RSS and therefore
+-- all of the octets start at 33. This makes the data in this table purely additive
+-- post-RSS, which also implies that we cannot re-use subnet octets if an original
+-- sled that was part of RSS was removed from the cluster.
+CREATE TABLE IF NOT EXISTS omicron.public.sled_underlay_subnet_allocation (
+    -- The physical identity of the sled
+    -- (foreign key into `hw_baseboard_id` table)
+    hw_baseboard_id UUID PRIMARY KEY,
+
+    -- The rack to which a sled is being added
+    -- (foreign key into `rack` table)
+    --
+    -- We require this because the sled is not yet part of the sled table when
+    -- we first allocate a subnet for it.
+    rack_id UUID NOT NULL,
+
+    -- The sled to which a subnet is being allocated
+    --
+    -- Eventually will be a foreign key into the `sled` table when the sled notifies nexus
+    -- about itself after initialization.
+    sled_id UUID NOT NULL,
+
+    -- The octet that extends a /56 rack subnet to a /64 sled subnet
+    --
+    -- Always between 33 and 255 inclusive
+    subnet_octet INT2 NOT NULL UNIQUE CHECK (subnet_octet BETWEEN 33 AND 255)
+);
diff --git a/schema/crdb/14.0.0/up2.sql b/schema/crdb/14.0.0/up2.sql
new file mode 100644
index 0000000000..c3e18fa166
--- /dev/null
+++ b/schema/crdb/14.0.0/up2.sql
@@ -0,0 +1,5 @@
+-- Add an index which allows pagination by {rack_id, sled_id} pairs. 
+CREATE UNIQUE INDEX IF NOT EXISTS lookup_subnet_allocation_by_rack_and_sled ON omicron.public.sled_underlay_subnet_allocation (
+    rack_id,
+    sled_id
+);
diff --git a/schema/crdb/15.0.0/up1.sql b/schema/crdb/15.0.0/up1.sql
new file mode 100644
index 0000000000..04baa76370
--- /dev/null
+++ b/schema/crdb/15.0.0/up1.sql
@@ -0,0 +1,6 @@
+CREATE TYPE IF NOT EXISTS omicron.public.sled_provision_state AS ENUM (
+    -- New resources can be provisioned onto the sled
+    'provisionable',
+    -- New resources must not be provisioned onto the sled
+    'non_provisionable'
+);
diff --git a/schema/crdb/15.0.0/up2.sql b/schema/crdb/15.0.0/up2.sql
new file mode 100644
index 0000000000..e3ea2ba11c
--- /dev/null
+++ b/schema/crdb/15.0.0/up2.sql
@@ -0,0 +1,3 @@
+ALTER TABLE omicron.public.sled
+    ADD COLUMN IF NOT EXISTS provision_state omicron.public.sled_provision_state
+    NOT NULL DEFAULT 'provisionable';
diff --git a/schema/crdb/15.0.0/up3.sql b/schema/crdb/15.0.0/up3.sql
new file mode 100644
index 0000000000..aaa3feac20
--- /dev/null
+++ b/schema/crdb/15.0.0/up3.sql
@@ -0,0 +1,5 @@
+-- Drop the default column value for provision_state -- it should always be set
+-- by Nexus.
+ALTER TABLE omicron.public.sled
+    ALTER COLUMN provision_state
+    DROP DEFAULT;
diff --git a/schema/crdb/dbinit.sql b/schema/crdb/dbinit.sql
index fc3bc37fd7..178c7af913 100644
--- a/schema/crdb/dbinit.sql
+++ b/schema/crdb/dbinit.sql
@@ -73,6 +73,13 @@ CREATE TABLE IF NOT EXISTS omicron.public.rack (
  * Sleds
  */
 
+CREATE TYPE IF NOT EXISTS omicron.public.sled_provision_state AS ENUM (
+    -- New resources can be provisioned onto the sled
+    'provisionable',
+    -- New resources must not be provisioned onto the sled
+    'non_provisionable'
+);
+
 CREATE TABLE IF NOT EXISTS omicron.public.sled (
     /* Identity metadata (asset) */
     id UUID PRIMARY KEY,
@@ -104,6 +111,9 @@ CREATE TABLE IF NOT EXISTS omicron.public.sled (
     /* The last address allocated to an Oxide service on this sled. */
     last_used_address INET NOT NULL,
 
+    /* The state of whether resources should be provisioned onto the sled */
+    provision_state omicron.public.sled_provision_state NOT NULL,
+
     -- This constraint should be upheld, even for deleted disks
     -- in the fleet.
     CONSTRAINT serial_part_revision_unique UNIQUE (
@@ -158,6 +168,51 @@ CREATE UNIQUE INDEX IF NOT EXISTS lookup_resource_by_sled ON omicron.public.sled
     id
 );
 
+
+-- Table of all sled subnets allocated for sleds added to an already initialized
+-- rack. The sleds in this table and their allocated subnets are created before
+-- a sled is added to the `sled` table. Addition to the `sled` table occurs
+-- after the sled is initialized and notifies Nexus about itself.
+--
+-- For simplicity and space savings, this table doesn't actually contain the
+-- full subnets for a given sled, but only the octet that extends a /56 rack
+-- subnet to a /64 sled subnet. The rack subnet is maintained in the `rack`
+-- table.
+--
+-- This table does not include subnet octets allocated during RSS and therefore
+-- all of the octets start at 33. This makes the data in this table purely additive
+-- post-RSS, which also implies that we cannot re-use subnet octets if an original
+-- sled that was part of RSS was removed from the cluster.
+CREATE TABLE IF NOT EXISTS omicron.public.sled_underlay_subnet_allocation (
+    -- The physical identity of the sled
+    -- (foreign key into `hw_baseboard_id` table)
+    hw_baseboard_id UUID PRIMARY KEY,
+
+    -- The rack to which a sled is being added
+    -- (foreign key into `rack` table)
+    --
+    -- We require this because the sled is not yet part of the sled table when
+    -- we first allocate a subnet for it.
+    rack_id UUID NOT NULL,
+
+    -- The sled to which a subnet is being allocated
+    --
+    -- Eventually will be a foreign key into the `sled` table when the sled notifies nexus
+    -- about itself after initialization.
+    sled_id UUID NOT NULL,
+
+    -- The octet that extends a /56 rack subnet to a /64 sled subnet
+    --
+    -- Always between 33 and 255 inclusive
+    subnet_octet INT2 NOT NULL UNIQUE CHECK (subnet_octet BETWEEN 33 AND 255)
+);
+
+-- Add an index which allows pagination by {rack_id, sled_id} pairs. 
+CREATE UNIQUE INDEX IF NOT EXISTS lookup_subnet_allocation_by_rack_and_sled ON omicron.public.sled_underlay_subnet_allocation (
+    rack_id,
+    sled_id
+);
+
 /*
  * Switches
  */
@@ -2952,7 +3007,7 @@ INSERT INTO omicron.public.db_metadata (
     version,
     target_version
 ) VALUES
-    ( TRUE, NOW(), NOW(), '13.0.0', NULL)
+    ( TRUE, NOW(), NOW(), '15.0.0', NULL)
 ON CONFLICT DO NOTHING;
 
 COMMIT;
diff --git a/sled-agent/src/instance.rs b/sled-agent/src/instance.rs
index a6f022f5f2..c37f0ffde6 100644
--- a/sled-agent/src/instance.rs
+++ b/sled-agent/src/instance.rs
@@ -26,7 +26,7 @@ use futures::lock::{Mutex, MutexGuard};
 use illumos_utils::dladm::Etherstub;
 use illumos_utils::link::VnicAllocator;
 use illumos_utils::opte::{DhcpCfg, PortManager};
-use illumos_utils::running_zone::{InstalledZone, RunningZone};
+use illumos_utils::running_zone::{RunningZone, ZoneBuilderFactory};
 use illumos_utils::svc::wait_for_service;
 use illumos_utils::zone::Zones;
 use illumos_utils::zone::PROPOLIS_ZONE_PREFIX;
@@ -226,6 +226,9 @@ struct InstanceInner {
     // Storage resources
     storage: StorageHandle,
 
+    // Used to create propolis zones
+    zone_builder_factory: ZoneBuilderFactory,
+
     // Object used to collect zone bundles from this instance when terminated.
     zone_bundler: ZoneBundler,
 
@@ -611,6 +614,7 @@ impl Instance {
             port_manager,
             storage,
             zone_bundler,
+            zone_builder_factory,
         } = services;
 
         let mut dhcp_config = DhcpCfg {
@@ -678,6 +682,7 @@ impl Instance {
             running_state: None,
             nexus_client,
             storage,
+            zone_builder_factory,
             zone_bundler,
             instance_ticket: ticket,
         };
@@ -904,31 +909,28 @@ impl Instance {
             .choose(&mut rng)
             .ok_or_else(|| Error::U2NotFound)?
             .clone();
-        let installed_zone = InstalledZone::install(
-            &inner.log,
-            &inner.vnic_allocator,
-            &root,
-            &["/opt/oxide".into()],
-            "propolis-server",
-            Some(*inner.propolis_id()),
-            // dataset=
-            &[],
-            // filesystems=
-            &[],
-            // data_links=
-            &[],
-            &[
+        let installed_zone = inner
+            .zone_builder_factory
+            .builder()
+            .with_log(inner.log.clone())
+            .with_underlay_vnic_allocator(&inner.vnic_allocator)
+            .with_zone_root_path(&root)
+            .with_zone_image_paths(&["/opt/oxide".into()])
+            .with_zone_type("propolis-server")
+            .with_unique_name(*inner.propolis_id())
+            .with_datasets(&[])
+            .with_filesystems(&[])
+            .with_data_links(&[])
+            .with_devices(&[
                 zone::Device { name: "/dev/vmm/*".to_string() },
                 zone::Device { name: "/dev/vmmctl".to_string() },
                 zone::Device { name: "/dev/viona".to_string() },
-            ],
-            opte_ports,
-            // physical_nic=
-            None,
-            vec![],
-            vec![],
-        )
-        .await?;
+            ])
+            .with_opte_ports(opte_ports)
+            .with_links(vec![])
+            .with_limit_priv(vec![])
+            .install()
+            .await?;
 
         let gateway = inner.port_manager.underlay_ip();
 
diff --git a/sled-agent/src/instance_manager.rs b/sled-agent/src/instance_manager.rs
index fa40a876f0..c1b7e402a4 100644
--- a/sled-agent/src/instance_manager.rs
+++ b/sled-agent/src/instance_manager.rs
@@ -17,6 +17,7 @@ use crate::zone_bundle::ZoneBundler;
 use illumos_utils::dladm::Etherstub;
 use illumos_utils::link::VnicAllocator;
 use illumos_utils::opte::PortManager;
+use illumos_utils::running_zone::ZoneBuilderFactory;
 use illumos_utils::vmm_reservoir;
 use omicron_common::api::external::ByteCount;
 use omicron_common::api::internal::nexus::InstanceRuntimeState;
@@ -76,6 +77,7 @@ struct InstanceManagerInternal {
     port_manager: PortManager,
     storage: StorageHandle,
     zone_bundler: ZoneBundler,
+    zone_builder_factory: ZoneBuilderFactory,
 }
 
 pub(crate) struct InstanceManagerServices {
@@ -84,6 +86,7 @@ pub(crate) struct InstanceManagerServices {
     pub port_manager: PortManager,
     pub storage: StorageHandle,
     pub zone_bundler: ZoneBundler,
+    pub zone_builder_factory: ZoneBuilderFactory,
 }
 
 /// All instances currently running on the sled.
@@ -100,6 +103,7 @@ impl InstanceManager {
         port_manager: PortManager,
         storage: StorageHandle,
         zone_bundler: ZoneBundler,
+        zone_builder_factory: ZoneBuilderFactory,
     ) -> Result<InstanceManager, Error> {
         Ok(InstanceManager {
             inner: Arc::new(InstanceManagerInternal {
@@ -113,6 +117,7 @@ impl InstanceManager {
                 port_manager,
                 storage,
                 zone_bundler,
+                zone_builder_factory,
             }),
         })
     }
@@ -266,6 +271,10 @@ impl InstanceManager {
                     port_manager: self.inner.port_manager.clone(),
                     storage: self.inner.storage.clone(),
                     zone_bundler: self.inner.zone_bundler.clone(),
+                    zone_builder_factory: self
+                        .inner
+                        .zone_builder_factory
+                        .clone(),
                 };
 
                 let state = crate::instance::InstanceInitialState {
diff --git a/sled-agent/src/services.rs b/sled-agent/src/services.rs
index 3636458d90..4599852b9a 100644
--- a/sled-agent/src/services.rs
+++ b/sled-agent/src/services.rs
@@ -53,7 +53,7 @@ use illumos_utils::dladm::{
 use illumos_utils::link::{Link, VnicAllocator};
 use illumos_utils::opte::{DhcpCfg, Port, PortManager, PortTicket};
 use illumos_utils::running_zone::{
-    InstalledZone, RunCommandError, RunningZone,
+    InstalledZone, RunCommandError, RunningZone, ZoneBuilderFactory,
 };
 use illumos_utils::zfs::ZONE_ZFS_RAMDISK_DATASET_MOUNTPOINT;
 use illumos_utils::zone::AddressRequest;
@@ -1443,23 +1443,29 @@ impl ServiceManager {
             }
             ZoneArgs::SledLocal(_) => "switch".to_string(),
         };
-        let installed_zone = InstalledZone::install(
-            &self.inner.log,
-            &self.inner.underlay_vnic_allocator,
-            &request.root(),
-            zone_image_paths.as_slice(),
-            &zone_type_str,
-            unique_name,
-            datasets.as_slice(),
-            &filesystems,
-            &data_links,
-            &devices,
-            opte_ports,
-            bootstrap_vnic,
-            links,
-            limit_priv,
-        )
-        .await?;
+
+        let mut zone_builder = ZoneBuilderFactory::default().builder();
+        if let Some(uuid) = unique_name {
+            zone_builder = zone_builder.with_unique_name(uuid);
+        }
+        if let Some(vnic) = bootstrap_vnic {
+            zone_builder = zone_builder.with_bootstrap_vnic(vnic);
+        }
+        let installed_zone = zone_builder
+            .with_log(self.inner.log.clone())
+            .with_underlay_vnic_allocator(&self.inner.underlay_vnic_allocator)
+            .with_zone_root_path(&request.root())
+            .with_zone_image_paths(zone_image_paths.as_slice())
+            .with_zone_type(&zone_type_str)
+            .with_datasets(datasets.as_slice())
+            .with_filesystems(&filesystems)
+            .with_data_links(&data_links)
+            .with_devices(&devices)
+            .with_opte_ports(opte_ports)
+            .with_links(links)
+            .with_limit_priv(limit_priv)
+            .install()
+            .await?;
 
         // TODO(https://github.com/oxidecomputer/omicron/issues/1898):
         //
diff --git a/sled-agent/src/sled_agent.rs b/sled-agent/src/sled_agent.rs
index 8b45ee9a27..1a369570fc 100644
--- a/sled-agent/src/sled_agent.rs
+++ b/sled-agent/src/sled_agent.rs
@@ -68,6 +68,7 @@ use std::sync::Arc;
 use tokio::sync::oneshot;
 use uuid::Uuid;
 
+use illumos_utils::running_zone::ZoneBuilderFactory;
 #[cfg(not(test))]
 use illumos_utils::{dladm::Dladm, zone::Zones};
 #[cfg(test)]
@@ -382,6 +383,7 @@ impl SledAgent {
             port_manager.clone(),
             storage_manager.clone(),
             long_running_task_handles.zone_bundler.clone(),
+            ZoneBuilderFactory::default(),
         )?;
 
         // Configure the VMM reservoir as either a percentage of DRAM or as an
diff --git a/tools/maghemite_ddm_openapi_version b/tools/maghemite_ddm_openapi_version
index 76bdb9ca92..f60ea76380 100644
--- a/tools/maghemite_ddm_openapi_version
+++ b/tools/maghemite_ddm_openapi_version
@@ -1,2 +1,2 @@
-COMMIT="12b392be94ff93abc3017bf2610a3b18e2174a2d"
+COMMIT="579592bf474ec4b86805ada60c1b920b3beef5a7"
 SHA2="9737906555a60911636532f00f1dc2866dc7cd6553beb106e9e57beabad41cdf"
diff --git a/tools/maghemite_mg_openapi_version b/tools/maghemite_mg_openapi_version
index d6d1788cbc..649db53f6e 100644
--- a/tools/maghemite_mg_openapi_version
+++ b/tools/maghemite_mg_openapi_version
@@ -1,2 +1,2 @@
-COMMIT="12b392be94ff93abc3017bf2610a3b18e2174a2d"
+COMMIT="579592bf474ec4b86805ada60c1b920b3beef5a7"
 SHA2="6c1fab8d5028b52a161d8bf02aae47844699cdc5f7b28e1ac519fc4ec1ab3971"
diff --git a/tools/maghemite_mgd_checksums b/tools/maghemite_mgd_checksums
index 9657147159..08b04d6b67 100644
--- a/tools/maghemite_mgd_checksums
+++ b/tools/maghemite_mgd_checksums
@@ -1,2 +1,2 @@
-CIDL_SHA256="c4a7a626c84a28de3d2c6bfd85592bda2abad8cf5b41b2ce90b9c03904ccd3df"
+CIDL_SHA256="82aa1ca1d7701b2221c442d58f912be59798258d574effcb866ffab22753cf38"
 MGD_LINUX_SHA256="81231b30872fa1c581aa22c101f32d11f33f335758ac1fd2653436fbc7aab93f"
\ No newline at end of file
diff --git a/update-engine/examples/update-engine-basic/display.rs b/update-engine/examples/update-engine-basic/display.rs
index 122777211b..891bdce6d3 100644
--- a/update-engine/examples/update-engine-basic/display.rs
+++ b/update-engine/examples/update-engine-basic/display.rs
@@ -88,6 +88,7 @@ async fn display_group(
     slog::info!(log, "setting up display");
 
     let mut display = GroupDisplay::new(
+        log,
         [
             (GroupDisplayKey::Example, "example"),
             (GroupDisplayKey::Other, "other"),
diff --git a/update-engine/src/buffer.rs b/update-engine/src/buffer.rs
index 6e0e66d6d0..36a0626963 100644
--- a/update-engine/src/buffer.rs
+++ b/update-engine/src/buffer.rs
@@ -1627,6 +1627,16 @@ pub enum TerminalKind {
     Aborted,
 }
 
+impl fmt::Display for TerminalKind {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Completed => write!(f, "completed"),
+            Self::Failed => write!(f, "failed"),
+            Self::Aborted => write!(f, "aborted"),
+        }
+    }
+}
+
 impl ExecutionStatus {
     /// Returns the terminal status and the total amount of time elapsed, or
     /// None if the execution has not reached a terminal state.
@@ -1671,17 +1681,13 @@ mod tests {
     use std::collections::HashSet;
 
     use anyhow::{bail, ensure, Context};
-    use futures::StreamExt;
     use indexmap::IndexSet;
     use omicron_test_utils::dev::test_setup_log;
     use serde::{de::IntoDeserializer, Deserialize};
-    use tokio::sync::mpsc;
-    use tokio_stream::wrappers::ReceiverStream;
 
     use crate::{
-        events::{ProgressCounter, ProgressUnits, StepProgress},
-        test_utils::TestSpec,
-        StepContext, StepSuccess, UpdateEngine,
+        events::ProgressCounter,
+        test_utils::{generate_test_events, GenerateTestEventsKind, TestSpec},
     };
 
     use super::*;
@@ -1689,108 +1695,11 @@ mod tests {
     #[tokio::test]
     async fn test_buffer() {
         let logctx = test_setup_log("test_buffer");
-        // The channel is big enough to contain all possible events.
-        let (sender, receiver) = mpsc::channel(512);
-        let engine: UpdateEngine<TestSpec> =
-            UpdateEngine::new(&logctx.log, sender);
-
-        engine
-            .new_step("foo".to_owned(), 1, "Step 1", move |_cx| async move {
-                StepSuccess::new(()).into()
-            })
-            .register();
-
-        engine
-            .new_step("bar".to_owned(), 2, "Step 2", move |cx| async move {
-                for _ in 0..20 {
-                    cx.send_progress(StepProgress::with_current_and_total(
-                        5,
-                        20,
-                        ProgressUnits::BYTES,
-                        Default::default(),
-                    ))
-                    .await;
-
-                    cx.send_progress(StepProgress::reset(
-                        Default::default(),
-                        "reset step 2",
-                    ))
-                    .await;
-
-                    cx.send_progress(StepProgress::retry("retry step 2")).await;
-                }
-                StepSuccess::new(()).into()
-            })
-            .register();
-
-        engine
-            .new_step(
-                "nested".to_owned(),
-                3,
-                "Step 3 (this is nested)",
-                move |parent_cx| async move {
-                    parent_cx
-                        .with_nested_engine(|engine| {
-                            define_nested_engine(&parent_cx, engine);
-                            Ok(())
-                        })
-                        .await
-                        .expect_err("this is expected to fail");
-
-                    StepSuccess::new(()).into()
-                },
-            )
-            .register();
-
-        let log = logctx.log.clone();
-        engine
-            .new_step(
-                "remote-nested".to_owned(),
-                20,
-                "Step 4 (remote nested)",
-                move |cx| async move {
-                    let (sender, mut receiver) = mpsc::channel(16);
-                    let mut engine = UpdateEngine::new(&log, sender);
-                    define_remote_nested_engine(&mut engine, 20);
-
-                    let mut buffer = EventBuffer::default();
-
-                    let mut execute_fut = std::pin::pin!(engine.execute());
-                    let mut execute_done = false;
-                    loop {
-                        tokio::select! {
-                            res = &mut execute_fut, if !execute_done => {
-                                res.expect("remote nested engine completed successfully");
-                                execute_done = true;
-                            }
-                            Some(event) = receiver.recv() => {
-                                // Generate complete reports to ensure deduping
-                                // happens within StepContexts.
-                                buffer.add_event(event);
-                                cx.send_nested_report(buffer.generate_report()).await?;
-                            }
-                            else => {
-                                break;
-                            }
-                        }
-                    }
-
-                    StepSuccess::new(()).into()
-                },
-            )
-            .register();
-
-        // The step index here (100) is large enough to be higher than all nested
-        // steps.
-        engine
-            .new_step("baz".to_owned(), 100, "Step 5", move |_cx| async move {
-                StepSuccess::new(()).into()
-            })
-            .register();
-
-        engine.execute().await.expect("execution successful");
-        let generated_events: Vec<_> =
-            ReceiverStream::new(receiver).collect().await;
+        let generated_events = generate_test_events(
+            &logctx.log,
+            GenerateTestEventsKind::Completed,
+        )
+        .await;
 
         let test_cx = BufferTestContext::new(generated_events);
 
@@ -2417,71 +2326,6 @@ mod tests {
         }
     }
 
-    fn define_nested_engine<'a>(
-        parent_cx: &'a StepContext<TestSpec>,
-        engine: &mut UpdateEngine<'a, TestSpec>,
-    ) {
-        engine
-            .new_step(
-                "nested-foo".to_owned(),
-                4,
-                "Nested step 1",
-                move |cx| async move {
-                    parent_cx
-                        .send_progress(StepProgress::with_current_and_total(
-                            1,
-                            3,
-                            "steps",
-                            Default::default(),
-                        ))
-                        .await;
-                    cx.send_progress(
-                        StepProgress::progress(Default::default()),
-                    )
-                    .await;
-                    StepSuccess::new(()).into()
-                },
-            )
-            .register();
-
-        engine
-            .new_step::<_, _, ()>(
-                "nested-bar".to_owned(),
-                5,
-                "Nested step 2 (fails)",
-                move |cx| async move {
-                    // This is used by NestedProgressCheck below.
-                    parent_cx
-                        .send_progress(StepProgress::with_current_and_total(
-                            2,
-                            3,
-                            "steps",
-                            Default::default(),
-                        ))
-                        .await;
-
-                    cx.send_progress(StepProgress::with_current(
-                        50,
-                        "units",
-                        Default::default(),
-                    ))
-                    .await;
-
-                    parent_cx
-                        .send_progress(StepProgress::with_current_and_total(
-                            3,
-                            3,
-                            "steps",
-                            Default::default(),
-                        ))
-                        .await;
-
-                    bail!("failing step")
-                },
-            )
-            .register();
-    }
-
     #[derive(Clone, Copy, Debug, PartialEq, Eq)]
     enum NestedProgressCheck {
         Initial,
@@ -2530,42 +2374,4 @@ mod tests {
             );
         }
     }
-
-    fn define_remote_nested_engine(
-        engine: &mut UpdateEngine<'_, TestSpec>,
-        start_id: usize,
-    ) {
-        engine
-            .new_step(
-                "nested-foo".to_owned(),
-                start_id + 1,
-                "Nested step 1",
-                move |cx| async move {
-                    cx.send_progress(
-                        StepProgress::progress(Default::default()),
-                    )
-                    .await;
-                    StepSuccess::new(()).into()
-                },
-            )
-            .register();
-
-        engine
-            .new_step::<_, _, ()>(
-                "nested-bar".to_owned(),
-                start_id + 2,
-                "Nested step 2",
-                move |cx| async move {
-                    cx.send_progress(StepProgress::with_current(
-                        20,
-                        "units",
-                        Default::default(),
-                    ))
-                    .await;
-
-                    StepSuccess::new(()).into()
-                },
-            )
-            .register();
-    }
 }
diff --git a/update-engine/src/display/group_display.rs b/update-engine/src/display/group_display.rs
index 0d50489a9f..cfd37aac16 100644
--- a/update-engine/src/display/group_display.rs
+++ b/update-engine/src/display/group_display.rs
@@ -30,6 +30,7 @@ use super::{
 pub struct GroupDisplay<K, W, S: StepSpec> {
     // We don't need to add any buffering here because we already write data to
     // the writer in a line-buffered fashion (see Self::write_events).
+    log: slog::Logger,
     writer: W,
     max_width: usize,
     // This is set to the highest value of root_total_elapsed seen from any event reports.
@@ -45,6 +46,7 @@ impl<K: Eq + Ord, W: std::io::Write, S: StepSpec> GroupDisplay<K, W, S> {
     ///
     /// The function passed in is expected to create a writer.
     pub fn new<Str>(
+        log: &slog::Logger,
         keys_and_prefixes: impl IntoIterator<Item = (K, Str)>,
         writer: W,
     ) -> Self
@@ -70,6 +72,7 @@ impl<K: Eq + Ord, W: std::io::Write, S: StepSpec> GroupDisplay<K, W, S> {
 
         let not_started = single_states.len();
         Self {
+            log: log.new(slog::o!("component" => "GroupDisplay")),
             writer,
             max_width,
             // This creates the stopwatch in the stopped state with duration 0 -- i.e. a minimal
@@ -84,6 +87,7 @@ impl<K: Eq + Ord, W: std::io::Write, S: StepSpec> GroupDisplay<K, W, S> {
     /// Creates a new `GroupDisplay` with the provided report keys, using the
     /// `Display` impl to obtain the respective prefixes.
     pub fn new_with_display(
+        log: &slog::Logger,
         keys: impl IntoIterator<Item = K>,
         writer: W,
     ) -> Self
@@ -91,6 +95,7 @@ impl<K: Eq + Ord, W: std::io::Write, S: StepSpec> GroupDisplay<K, W, S> {
         K: fmt::Display,
     {
         Self::new(
+            log,
             keys.into_iter().map(|k| {
                 let prefix = k.to_string();
                 (k, prefix)
@@ -144,7 +149,30 @@ impl<K: Eq + Ord, W: std::io::Write, S: StepSpec> GroupDisplay<K, W, S> {
                         TokioSw::with_elapsed_started(root_total_elapsed);
                 }
             }
+
             self.stats.apply_result(result);
+
+            if result.before != result.after {
+                slog::info!(
+                    self.log,
+                    "add_event_report caused state transition";
+                    "prefix" => &state.prefix,
+                    "before" => %result.before,
+                    "after" => %result.after,
+                    "current_stats" => ?self.stats,
+                    "root_total_elapsed" => ?result.root_total_elapsed,
+                );
+            } else {
+                slog::trace!(
+                    self.log,
+                    "add_event_report called, state did not change";
+                    "prefix" => &state.prefix,
+                    "state" => %result.before,
+                    "current_stats" => ?self.stats,
+                    "root_total_elapsed" => ?result.root_total_elapsed,
+                );
+            }
+
             Ok(())
         } else {
             Err(UnknownReportKey {})
@@ -179,7 +207,7 @@ impl<K: Eq + Ord, W: std::io::Write, S: StepSpec> GroupDisplay<K, W, S> {
     }
 }
 
-#[derive(Clone, Copy, Debug)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct GroupDisplayStats {
     /// The total number of reports.
     pub total: usize,
@@ -236,18 +264,9 @@ impl GroupDisplayStats {
     }
 
     fn apply_result(&mut self, result: AddEventReportResult) {
-        // Process result.after first to avoid integer underflow.
-        match result.after {
-            SingleStateTag::NotStarted => self.not_started += 1,
-            SingleStateTag::Running => self.running += 1,
-            SingleStateTag::Terminal(TerminalKind::Completed) => {
-                self.completed += 1
-            }
-            SingleStateTag::Terminal(TerminalKind::Failed) => self.failed += 1,
-            SingleStateTag::Terminal(TerminalKind::Aborted) => {
-                self.aborted += 1
-            }
-            SingleStateTag::Overwritten => self.overwritten += 1,
+        if result.before == result.after {
+            // Nothing to do.
+            return;
         }
 
         match result.before {
@@ -262,6 +281,19 @@ impl GroupDisplayStats {
             }
             SingleStateTag::Overwritten => self.overwritten -= 1,
         }
+
+        match result.after {
+            SingleStateTag::NotStarted => self.not_started += 1,
+            SingleStateTag::Running => self.running += 1,
+            SingleStateTag::Terminal(TerminalKind::Completed) => {
+                self.completed += 1
+            }
+            SingleStateTag::Terminal(TerminalKind::Failed) => self.failed += 1,
+            SingleStateTag::Terminal(TerminalKind::Aborted) => {
+                self.aborted += 1
+            }
+            SingleStateTag::Overwritten => self.overwritten += 1,
+        }
     }
 
     fn format_line(
@@ -336,92 +368,139 @@ impl<S: StepSpec> SingleState<S> {
         &mut self,
         event_report: EventReport<S>,
     ) -> AddEventReportResult {
-        let before = match &self.kind {
+        match &mut self.kind {
             SingleStateKind::NotStarted { .. } => {
-                self.kind = SingleStateKind::Running {
-                    event_buffer: EventBuffer::new(8),
+                // We're starting a new update.
+                let before = SingleStateTag::NotStarted;
+                let mut event_buffer = EventBuffer::default();
+                let (after, root_total_elapsed) =
+                    match Self::apply_report(&mut event_buffer, event_report) {
+                        ApplyReportResult::NotStarted => {
+                            // This means that the event report was empty. Don't
+                            // update `self.kind`.
+                            (SingleStateTag::NotStarted, None)
+                        }
+                        ApplyReportResult::Running(root_total_elapsed) => {
+                            self.kind =
+                                SingleStateKind::Running { event_buffer };
+                            (SingleStateTag::Running, Some(root_total_elapsed))
+                        }
+                        ApplyReportResult::Terminal(info) => {
+                            let terminal_kind = info.kind;
+                            let root_total_elapsed = info.root_total_elapsed;
+
+                            self.kind = SingleStateKind::Terminal {
+                                info,
+                                pending_event_buffer: Some(event_buffer),
+                            };
+                            (
+                                SingleStateTag::Terminal(terminal_kind),
+                                root_total_elapsed,
+                            )
+                        }
+                        ApplyReportResult::Overwritten => {
+                            self.kind = SingleStateKind::Overwritten {
+                                displayed: false,
+                            };
+                            (SingleStateTag::Overwritten, None)
+                        }
+                    };
+
+                AddEventReportResult { before, after, root_total_elapsed }
+            }
+            SingleStateKind::Running { event_buffer } => {
+                // We're in the middle of an update.
+                let before = SingleStateTag::Running;
+                let (after, root_total_elapsed) = match Self::apply_report(
+                    event_buffer,
+                    event_report,
+                ) {
+                    ApplyReportResult::NotStarted => {
+                        // This is an illegal state transition: once a
+                        // non-empty event report has been received, the
+                        // event buffer never goes back to the NotStarted
+                        // state.
+                        unreachable!("illegal state transition from Running to NotStarted")
+                    }
+                    ApplyReportResult::Running(root_total_elapsed) => {
+                        (SingleStateTag::Running, Some(root_total_elapsed))
+                    }
+                    ApplyReportResult::Terminal(info) => {
+                        let terminal_kind = info.kind;
+                        let root_total_elapsed = info.root_total_elapsed;
+
+                        // Grab the event buffer so we can store it in the
+                        // Terminal state below.
+                        let event_buffer = std::mem::replace(
+                            event_buffer,
+                            EventBuffer::new(0),
+                        );
+
+                        self.kind = SingleStateKind::Terminal {
+                            info,
+                            pending_event_buffer: Some(event_buffer),
+                        };
+                        (
+                            SingleStateTag::Terminal(terminal_kind),
+                            root_total_elapsed,
+                        )
+                    }
+                    ApplyReportResult::Overwritten => {
+                        self.kind =
+                            SingleStateKind::Overwritten { displayed: false };
+                        (SingleStateTag::Overwritten, None)
+                    }
                 };
-                SingleStateTag::NotStarted
+                AddEventReportResult { before, after, root_total_elapsed }
             }
-            SingleStateKind::Running { .. } => SingleStateTag::Running,
-
             SingleStateKind::Terminal { info, .. } => {
                 // Once we've reached a terminal state, we don't record any more
                 // events.
-                return AddEventReportResult::unchanged(
+                AddEventReportResult::unchanged(
                     SingleStateTag::Terminal(info.kind),
                     info.root_total_elapsed,
-                );
+                )
             }
             SingleStateKind::Overwritten { .. } => {
                 // This update has already completed -- assume that the event
                 // buffer is for a new update, which we don't show.
-                return AddEventReportResult::unchanged(
+                AddEventReportResult::unchanged(
                     SingleStateTag::Overwritten,
                     None,
-                );
+                )
             }
-        };
-
-        let SingleStateKind::Running { event_buffer } = &mut self.kind else {
-            unreachable!("other branches were handled above");
-        };
+        }
+    }
 
+    /// The internal logic used by [`Self::add_event_report`].
+    fn apply_report(
+        event_buffer: &mut EventBuffer<S>,
+        event_report: EventReport<S>,
+    ) -> ApplyReportResult {
         if let Some(root_execution_id) = event_buffer.root_execution_id() {
             if event_report.root_execution_id != Some(root_execution_id) {
                 // The report is for a different execution ID -- assume that
                 // this event is completed and mark our current execution as
                 // completed.
-                self.kind = SingleStateKind::Overwritten { displayed: false };
-                return AddEventReportResult {
-                    before,
-                    after: SingleStateTag::Overwritten,
-                    root_total_elapsed: None,
-                };
+                return ApplyReportResult::Overwritten;
             }
         }
 
         event_buffer.add_event_report(event_report);
-        let (after, max_total_elapsed) =
-            match event_buffer.root_execution_summary() {
-                Some(summary) => {
-                    match summary.execution_status {
-                        ExecutionStatus::NotStarted => {
-                            (SingleStateTag::NotStarted, None)
-                        }
-                        ExecutionStatus::Running {
-                            root_total_elapsed: max_total_elapsed,
-                            ..
-                        } => (SingleStateTag::Running, Some(max_total_elapsed)),
-                        ExecutionStatus::Terminal(info) => {
-                            // Grab the event buffer to store it in the terminal state.
-                            let event_buffer = std::mem::replace(
-                                event_buffer,
-                                EventBuffer::new(0),
-                            );
-                            let terminal_kind = info.kind;
-                            let root_total_elapsed = info.root_total_elapsed;
-                            self.kind = SingleStateKind::Terminal {
-                                info,
-                                pending_event_buffer: Some(event_buffer),
-                            };
-                            (
-                                SingleStateTag::Terminal(terminal_kind),
-                                root_total_elapsed,
-                            )
-                        }
-                    }
+        match event_buffer.root_execution_summary() {
+            Some(summary) => match summary.execution_status {
+                ExecutionStatus::NotStarted => ApplyReportResult::NotStarted,
+                ExecutionStatus::Running { root_total_elapsed, .. } => {
+                    ApplyReportResult::Running(root_total_elapsed)
                 }
-                None => {
-                    // We don't have a summary yet.
-                    (SingleStateTag::NotStarted, None)
+                ExecutionStatus::Terminal(info) => {
+                    ApplyReportResult::Terminal(info)
                 }
-            };
-
-        AddEventReportResult {
-            before,
-            after,
-            root_total_elapsed: max_total_elapsed,
+            },
+            None => {
+                // We don't have a summary yet.
+                ApplyReportResult::NotStarted
+            }
         }
     }
 
@@ -488,6 +567,7 @@ enum SingleStateKind<S: StepSpec> {
     },
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
 struct AddEventReportResult {
     before: SingleStateTag,
     after: SingleStateTag,
@@ -503,10 +583,238 @@ impl AddEventReportResult {
     }
 }
 
-#[derive(Copy, Clone, Debug)]
+#[derive(Copy, Clone, Debug, Eq, PartialEq)]
 enum SingleStateTag {
     NotStarted,
     Running,
     Terminal(TerminalKind),
     Overwritten,
 }
+
+impl fmt::Display for SingleStateTag {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::NotStarted => write!(f, "not started"),
+            Self::Running => write!(f, "running"),
+            Self::Terminal(kind) => write!(f, "{kind}"),
+            Self::Overwritten => write!(f, "overwritten"),
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+enum ApplyReportResult {
+    NotStarted,
+    Running(Duration),
+    Terminal(ExecutionTerminalInfo),
+    Overwritten,
+}
+
+#[cfg(test)]
+mod tests {
+    use omicron_test_utils::dev::test_setup_log;
+
+    use super::*;
+
+    use crate::test_utils::{generate_test_events, GenerateTestEventsKind};
+
+    #[tokio::test]
+    async fn test_stats() {
+        let logctx = test_setup_log("test_stats");
+        // Generate three sets of events, one for each kind.
+        let generated_completed = generate_test_events(
+            &logctx.log,
+            GenerateTestEventsKind::Completed,
+        )
+        .await;
+        let generated_failed =
+            generate_test_events(&logctx.log, GenerateTestEventsKind::Failed)
+                .await;
+        let generated_aborted =
+            generate_test_events(&logctx.log, GenerateTestEventsKind::Aborted)
+                .await;
+
+        // Set up a `GroupDisplay` with three keys.
+        let mut group_display = GroupDisplay::new_with_display(
+            &logctx.log,
+            vec![
+                GroupDisplayKey::Completed,
+                GroupDisplayKey::Failed,
+                GroupDisplayKey::Aborted,
+                GroupDisplayKey::Overwritten,
+            ],
+            std::io::stdout(),
+        );
+
+        let mut expected_stats = GroupDisplayStats {
+            total: 4,
+            not_started: 4,
+            running: 0,
+            completed: 0,
+            failed: 0,
+            aborted: 0,
+            overwritten: 0,
+        };
+        assert_eq!(group_display.stats(), &expected_stats);
+        assert!(!expected_stats.is_terminal());
+        assert!(!expected_stats.has_failures());
+
+        // Pass in an empty EventReport -- ensure that this doesn't move it to
+        // a Running state.
+
+        group_display
+            .add_event_report(
+                &GroupDisplayKey::Completed,
+                EventReport::default(),
+            )
+            .unwrap();
+        assert_eq!(group_display.stats(), &expected_stats);
+
+        // Pass in events one by one -- ensure that we're always in the running
+        // state until we've completed.
+        {
+            expected_stats.not_started -= 1;
+            expected_stats.running += 1;
+
+            let n = generated_completed.len();
+
+            let mut buffer = EventBuffer::default();
+            let mut last_seen = None;
+
+            for (i, event) in
+                generated_completed.clone().into_iter().enumerate()
+            {
+                buffer.add_event(event);
+                let report = buffer.generate_report_since(&mut last_seen);
+                group_display
+                    .add_event_report(&GroupDisplayKey::Completed, report)
+                    .unwrap();
+                if i == n - 1 {
+                    // The last event should have moved us to the completed
+                    // state.
+                    expected_stats.running -= 1;
+                    expected_stats.completed += 1;
+                } else {
+                    // We should still be in the running state.
+                }
+                assert_eq!(group_display.stats(), &expected_stats);
+                assert!(!expected_stats.is_terminal());
+                assert!(!expected_stats.has_failures());
+            }
+        }
+
+        // Pass in failed events, this time using buffer.generate_report()
+        // rather than buffer.generate_report_since().
+        {
+            expected_stats.not_started -= 1;
+            expected_stats.running += 1;
+
+            let n = generated_failed.len();
+
+            let mut buffer = EventBuffer::default();
+            for (i, event) in generated_failed.clone().into_iter().enumerate() {
+                buffer.add_event(event);
+                let report = buffer.generate_report();
+                group_display
+                    .add_event_report(&GroupDisplayKey::Failed, report)
+                    .unwrap();
+                if i == n - 1 {
+                    // The last event should have moved us to the failed state.
+                    expected_stats.running -= 1;
+                    expected_stats.failed += 1;
+                    assert!(expected_stats.has_failures());
+                } else {
+                    // We should still be in the running state.
+                    assert!(!expected_stats.has_failures());
+                }
+                assert_eq!(group_display.stats(), &expected_stats);
+            }
+        }
+
+        // Pass in aborted events all at once.
+        {
+            expected_stats.not_started -= 1;
+            expected_stats.running += 1;
+
+            let mut buffer = EventBuffer::default();
+            for event in generated_aborted {
+                buffer.add_event(event);
+            }
+            let report = buffer.generate_report();
+            group_display
+                .add_event_report(&GroupDisplayKey::Aborted, report)
+                .unwrap();
+            // The aborted events should have moved us to the aborted state.
+            expected_stats.running -= 1;
+            expected_stats.aborted += 1;
+            assert_eq!(group_display.stats(), &expected_stats);
+
+            // Try passing in one of the events that, if we were running, would
+            // cause us to move to an overwritten state. Ensure that that does
+            // not happen (i.e. expected_stats stays the same)
+            let mut buffer = EventBuffer::default();
+            buffer.add_event(generated_failed.first().unwrap().clone());
+            let report = buffer.generate_report();
+            group_display
+                .add_event_report(&GroupDisplayKey::Aborted, report)
+                .unwrap();
+            assert_eq!(group_display.stats(), &expected_stats);
+        }
+
+        // For the overwritten state, pass in half of the completed events, and
+        // then pass in all of the failed events.
+
+        {
+            expected_stats.not_started -= 1;
+            expected_stats.running += 1;
+
+            let mut buffer = EventBuffer::default();
+            let n = generated_completed.len() / 2;
+            for event in generated_completed.into_iter().take(n) {
+                buffer.add_event(event);
+            }
+            let report = buffer.generate_report();
+            group_display
+                .add_event_report(&GroupDisplayKey::Overwritten, report)
+                .unwrap();
+            assert_eq!(group_display.stats(), &expected_stats);
+
+            // Now pass in a single failed event, which has a different
+            // execution ID.
+            let mut buffer = EventBuffer::default();
+            buffer.add_event(generated_failed.first().unwrap().clone());
+            let report = buffer.generate_report();
+            group_display
+                .add_event_report(&GroupDisplayKey::Overwritten, report)
+                .unwrap();
+            // The overwritten event should have moved us to the overwritten
+            // state.
+            expected_stats.running -= 1;
+            expected_stats.overwritten += 1;
+        }
+
+        assert!(expected_stats.has_failures());
+        assert!(expected_stats.is_terminal());
+
+        logctx.cleanup_successful();
+    }
+
+    #[derive(Debug, Eq, PartialEq, Ord, PartialOrd)]
+    enum GroupDisplayKey {
+        Completed,
+        Failed,
+        Aborted,
+        Overwritten,
+    }
+
+    impl fmt::Display for GroupDisplayKey {
+        fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+            match self {
+                Self::Completed => write!(f, "completed"),
+                Self::Failed => write!(f, "failed"),
+                Self::Aborted => write!(f, "aborted"),
+                Self::Overwritten => write!(f, "overwritten"),
+            }
+        }
+    }
+}
diff --git a/update-engine/src/test_utils.rs b/update-engine/src/test_utils.rs
index 0bacfbeb8d..b943d1ddfe 100644
--- a/update-engine/src/test_utils.rs
+++ b/update-engine/src/test_utils.rs
@@ -4,9 +4,16 @@
 
 // Copyright 2023 Oxide Computer Company
 
+use anyhow::bail;
+use futures::StreamExt;
 use schemars::JsonSchema;
+use tokio::sync::{mpsc, oneshot};
+use tokio_stream::wrappers::ReceiverStream;
 
-use crate::{ExecutionId, StepSpec};
+use crate::{
+    events::{Event, ProgressUnits, StepProgress},
+    EventBuffer, ExecutionId, StepContext, StepSpec, StepSuccess, UpdateEngine,
+};
 
 #[derive(JsonSchema)]
 pub(crate) enum TestSpec {}
@@ -27,3 +34,278 @@ pub(crate) static TEST_EXECUTION_UUID: &str =
 pub fn test_execution_id() -> ExecutionId {
     ExecutionId(TEST_EXECUTION_UUID.parse().expect("valid UUID"))
 }
+
+#[derive(Copy, Clone, Debug)]
+pub(crate) enum GenerateTestEventsKind {
+    Completed,
+    Failed,
+    Aborted,
+}
+
+pub(crate) async fn generate_test_events(
+    log: &slog::Logger,
+    kind: GenerateTestEventsKind,
+) -> Vec<Event<TestSpec>> {
+    // The channel is big enough to contain all possible events.
+    let (sender, receiver) = mpsc::channel(512);
+    let engine = UpdateEngine::new(log, sender);
+
+    match kind {
+        GenerateTestEventsKind::Completed => {
+            define_test_steps(log, &engine, LastStepOutcome::Completed);
+            engine.execute().await.expect("execution successful");
+        }
+        GenerateTestEventsKind::Failed => {
+            define_test_steps(log, &engine, LastStepOutcome::Failed);
+            engine.execute().await.expect_err("execution failed");
+        }
+        GenerateTestEventsKind::Aborted => {
+            // In this case, the last step signals that it has been reached via
+            // sending a message over this channel, and then waits forever. We
+            // abort execution by calling into the AbortHandle.
+            let (sender, receiver) = oneshot::channel();
+            define_test_steps(log, &engine, LastStepOutcome::Aborted(sender));
+            let abort_handle = engine.abort_handle();
+            let mut execute_fut = std::pin::pin!(engine.execute());
+            let mut receiver = std::pin::pin!(receiver);
+            let mut receiver_done = false;
+            loop {
+                tokio::select! {
+                    res = &mut execute_fut => {
+                        res.expect_err("execution should have been aborted, but completed successfully");
+                        break;
+                    }
+                    _ = &mut receiver, if !receiver_done => {
+                        receiver_done = true;
+                        abort_handle
+                            .abort("test engine deliberately aborted")
+                            .expect("engine should still be alive");
+                    }
+                }
+            }
+        }
+    }
+
+    ReceiverStream::new(receiver).collect().await
+}
+
+#[derive(Debug)]
+enum LastStepOutcome {
+    Completed,
+    Failed,
+    Aborted(oneshot::Sender<()>),
+}
+
+#[derive(Debug)]
+enum Never {}
+
+fn define_test_steps(
+    log: &slog::Logger,
+    engine: &UpdateEngine<TestSpec>,
+    last_step_outcome: LastStepOutcome,
+) {
+    engine
+        .new_step("foo".to_owned(), 1, "Step 1", move |_cx| async move {
+            StepSuccess::new(()).into()
+        })
+        .register();
+
+    engine
+        .new_step("bar".to_owned(), 2, "Step 2", move |cx| async move {
+            for _ in 0..20 {
+                cx.send_progress(StepProgress::with_current_and_total(
+                    5,
+                    20,
+                    ProgressUnits::BYTES,
+                    Default::default(),
+                ))
+                .await;
+
+                cx.send_progress(StepProgress::reset(
+                    Default::default(),
+                    "reset step 2",
+                ))
+                .await;
+
+                cx.send_progress(StepProgress::retry("retry step 2")).await;
+            }
+            StepSuccess::new(()).into()
+        })
+        .register();
+
+    engine
+        .new_step(
+            "nested".to_owned(),
+            3,
+            "Step 3 (this is nested)",
+            move |parent_cx| async move {
+                parent_cx
+                    .with_nested_engine(|engine| {
+                        define_nested_engine(&parent_cx, engine);
+                        Ok(())
+                    })
+                    .await
+                    .expect_err("this is expected to fail");
+
+                StepSuccess::new(()).into()
+            },
+        )
+        .register();
+
+    let log = log.clone();
+    engine
+    .new_step(
+        "remote-nested".to_owned(),
+        20,
+        "Step 4 (remote nested)",
+        move |cx| async move {
+            let (sender, mut receiver) = mpsc::channel(16);
+            let mut engine = UpdateEngine::new(&log, sender);
+            define_remote_nested_engine(&mut engine, 20);
+
+            let mut buffer = EventBuffer::default();
+
+            let mut execute_fut = std::pin::pin!(engine.execute());
+            let mut execute_done = false;
+            loop {
+                tokio::select! {
+                    res = &mut execute_fut, if !execute_done => {
+                        res.expect("remote nested engine completed successfully");
+                        execute_done = true;
+                    }
+                    Some(event) = receiver.recv() => {
+                        // Generate complete reports to ensure deduping
+                        // happens within StepContexts.
+                        buffer.add_event(event);
+                        cx.send_nested_report(buffer.generate_report()).await?;
+                    }
+                    else => {
+                        break;
+                    }
+                }
+            }
+
+            StepSuccess::new(()).into()
+        },
+    )
+    .register();
+
+    // The step index here (100) is large enough to be higher than all nested
+    // steps.
+    engine
+        .new_step("baz".to_owned(), 100, "Step 5", move |_cx| async move {
+            match last_step_outcome {
+                LastStepOutcome::Completed => StepSuccess::new(()).into(),
+                LastStepOutcome::Failed => {
+                    bail!("last step failed")
+                }
+                LastStepOutcome::Aborted(sender) => {
+                    sender.send(()).expect("receiver should be alive");
+                    // The driver of the engine is responsible for aborting it
+                    // at this point.
+                    std::future::pending::<Never>().await;
+                    unreachable!("pending future can never resolve");
+                }
+            }
+        })
+        .register();
+}
+
+fn define_nested_engine<'a>(
+    parent_cx: &'a StepContext<TestSpec>,
+    engine: &mut UpdateEngine<'a, TestSpec>,
+) {
+    engine
+        .new_step(
+            "nested-foo".to_owned(),
+            4,
+            "Nested step 1",
+            move |cx| async move {
+                parent_cx
+                    .send_progress(StepProgress::with_current_and_total(
+                        1,
+                        3,
+                        "steps",
+                        Default::default(),
+                    ))
+                    .await;
+                cx.send_progress(StepProgress::progress(Default::default()))
+                    .await;
+                StepSuccess::new(()).into()
+            },
+        )
+        .register();
+
+    engine
+        .new_step::<_, _, ()>(
+            "nested-bar".to_owned(),
+            5,
+            "Nested step 2 (fails)",
+            move |cx| async move {
+                // This is used by NestedProgressCheck below.
+                parent_cx
+                    .send_progress(StepProgress::with_current_and_total(
+                        2,
+                        3,
+                        "steps",
+                        Default::default(),
+                    ))
+                    .await;
+
+                cx.send_progress(StepProgress::with_current(
+                    50,
+                    "units",
+                    Default::default(),
+                ))
+                .await;
+
+                parent_cx
+                    .send_progress(StepProgress::with_current_and_total(
+                        3,
+                        3,
+                        "steps",
+                        Default::default(),
+                    ))
+                    .await;
+
+                bail!("failing step")
+            },
+        )
+        .register();
+}
+
+fn define_remote_nested_engine(
+    engine: &mut UpdateEngine<'_, TestSpec>,
+    start_id: usize,
+) {
+    engine
+        .new_step(
+            "nested-foo".to_owned(),
+            start_id + 1,
+            "Nested step 1",
+            move |cx| async move {
+                cx.send_progress(StepProgress::progress(Default::default()))
+                    .await;
+                StepSuccess::new(()).into()
+            },
+        )
+        .register();
+
+    engine
+        .new_step::<_, _, ()>(
+            "nested-bar".to_owned(),
+            start_id + 2,
+            "Nested step 2",
+            move |cx| async move {
+                cx.send_progress(StepProgress::with_current(
+                    20,
+                    "units",
+                    Default::default(),
+                ))
+                .await;
+
+                StepSuccess::new(()).into()
+            },
+        )
+        .register();
+}
diff --git a/wicket/src/cli/rack_update.rs b/wicket/src/cli/rack_update.rs
index fa41fa7b8c..cac0f09ee5 100644
--- a/wicket/src/cli/rack_update.rs
+++ b/wicket/src/cli/rack_update.rs
@@ -174,6 +174,7 @@ async fn do_attach_to_updates(
     output: CommandOutput<'_>,
 ) -> Result<()> {
     let mut display = GroupDisplay::new_with_display(
+        &log,
         update_ids.iter().copied(),
         output.stderr,
     );
diff --git a/wicket/src/ui/widgets/popup.rs b/wicket/src/ui/widgets/popup.rs
index 19d7aa18b1..fb8c0f1f24 100644
--- a/wicket/src/ui/widgets/popup.rs
+++ b/wicket/src/ui/widgets/popup.rs
@@ -464,7 +464,7 @@ pub fn draw_buttons(
     let button_rects = Layout::default()
         .direction(Direction::Horizontal)
         .horizontal_margin(2)
-        .constraints(constraints.as_ref())
+        .constraints(constraints)
         .split(rect);
 
     let block = Block::default()
diff --git a/workspace-hack/Cargo.toml b/workspace-hack/Cargo.toml
index 1a289bd0cb..fe7c3bdc81 100644
--- a/workspace-hack/Cargo.toml
+++ b/workspace-hack/Cargo.toml
@@ -105,7 +105,7 @@ unicode-normalization = { version = "0.1.22" }
 usdt = { version = "0.3.5" }
 uuid = { version = "1.6.1", features = ["serde", "v4"] }
 yasna = { version = "0.5.2", features = ["bit-vec", "num-bigint", "std", "time"] }
-zeroize = { version = "1.6.0", features = ["std", "zeroize_derive"] }
+zeroize = { version = "1.7.0", features = ["std", "zeroize_derive"] }
 zip = { version = "0.6.6", default-features = false, features = ["bzip2", "deflate"] }
 
 [build-dependencies]
@@ -201,7 +201,7 @@ unicode-normalization = { version = "0.1.22" }
 usdt = { version = "0.3.5" }
 uuid = { version = "1.6.1", features = ["serde", "v4"] }
 yasna = { version = "0.5.2", features = ["bit-vec", "num-bigint", "std", "time"] }
-zeroize = { version = "1.6.0", features = ["std", "zeroize_derive"] }
+zeroize = { version = "1.7.0", features = ["std", "zeroize_derive"] }
 zip = { version = "0.6.6", default-features = false, features = ["bzip2", "deflate"] }
 
 [target.x86_64-unknown-linux-gnu.dependencies]
@@ -209,58 +209,64 @@ bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2.4.0", default-f
 hyper-rustls = { version = "0.24.2" }
 mio = { version = "0.8.9", features = ["net", "os-ext"] }
 once_cell = { version = "1.18.0", features = ["unstable"] }
-rustix = { version = "0.38.9", features = ["fs", "termios"] }
+rustix = { version = "0.38.25", features = ["fs", "termios"] }
 
 [target.x86_64-unknown-linux-gnu.build-dependencies]
 bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2.4.0", default-features = false, features = ["std"] }
 hyper-rustls = { version = "0.24.2" }
 mio = { version = "0.8.9", features = ["net", "os-ext"] }
 once_cell = { version = "1.18.0", features = ["unstable"] }
-rustix = { version = "0.38.9", features = ["fs", "termios"] }
+rustix = { version = "0.38.25", features = ["fs", "termios"] }
 
 [target.x86_64-apple-darwin.dependencies]
 bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2.4.0", default-features = false, features = ["std"] }
+errno = { version = "0.3.2", default-features = false, features = ["std"] }
 hyper-rustls = { version = "0.24.2" }
 mio = { version = "0.8.9", features = ["net", "os-ext"] }
 once_cell = { version = "1.18.0", features = ["unstable"] }
-rustix = { version = "0.38.9", features = ["fs", "termios"] }
+rustix = { version = "0.38.25", features = ["fs", "termios"] }
 
 [target.x86_64-apple-darwin.build-dependencies]
 bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2.4.0", default-features = false, features = ["std"] }
+errno = { version = "0.3.2", default-features = false, features = ["std"] }
 hyper-rustls = { version = "0.24.2" }
 mio = { version = "0.8.9", features = ["net", "os-ext"] }
 once_cell = { version = "1.18.0", features = ["unstable"] }
-rustix = { version = "0.38.9", features = ["fs", "termios"] }
+rustix = { version = "0.38.25", features = ["fs", "termios"] }
 
 [target.aarch64-apple-darwin.dependencies]
 bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2.4.0", default-features = false, features = ["std"] }
+errno = { version = "0.3.2", default-features = false, features = ["std"] }
 hyper-rustls = { version = "0.24.2" }
 mio = { version = "0.8.9", features = ["net", "os-ext"] }
 once_cell = { version = "1.18.0", features = ["unstable"] }
-rustix = { version = "0.38.9", features = ["fs", "termios"] }
+rustix = { version = "0.38.25", features = ["fs", "termios"] }
 
 [target.aarch64-apple-darwin.build-dependencies]
 bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2.4.0", default-features = false, features = ["std"] }
+errno = { version = "0.3.2", default-features = false, features = ["std"] }
 hyper-rustls = { version = "0.24.2" }
 mio = { version = "0.8.9", features = ["net", "os-ext"] }
 once_cell = { version = "1.18.0", features = ["unstable"] }
-rustix = { version = "0.38.9", features = ["fs", "termios"] }
+rustix = { version = "0.38.25", features = ["fs", "termios"] }
 
 [target.x86_64-unknown-illumos.dependencies]
 bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2.4.0", default-features = false, features = ["std"] }
+errno = { version = "0.3.2", default-features = false, features = ["std"] }
 hyper-rustls = { version = "0.24.2" }
 mio = { version = "0.8.9", features = ["net", "os-ext"] }
 once_cell = { version = "1.18.0", features = ["unstable"] }
-rustix = { version = "0.38.9", features = ["fs", "termios"] }
+rustix = { version = "0.38.25", features = ["fs", "termios"] }
 toml_datetime = { version = "0.6.5", default-features = false, features = ["serde"] }
 toml_edit-cdcf2f9584511fe6 = { package = "toml_edit", version = "0.19.15", features = ["serde"] }
 
 [target.x86_64-unknown-illumos.build-dependencies]
 bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2.4.0", default-features = false, features = ["std"] }
+errno = { version = "0.3.2", default-features = false, features = ["std"] }
 hyper-rustls = { version = "0.24.2" }
 mio = { version = "0.8.9", features = ["net", "os-ext"] }
 once_cell = { version = "1.18.0", features = ["unstable"] }
-rustix = { version = "0.38.9", features = ["fs", "termios"] }
+rustix = { version = "0.38.25", features = ["fs", "termios"] }
 toml_datetime = { version = "0.6.5", default-features = false, features = ["serde"] }
 toml_edit-cdcf2f9584511fe6 = { package = "toml_edit", version = "0.19.15", features = ["serde"] }