diff --git a/.changeset/angry-flowers-yawn.md b/.changeset/angry-flowers-yawn.md
new file mode 100644
index 0000000000..8f478b1eab
--- /dev/null
+++ b/.changeset/angry-flowers-yawn.md
@@ -0,0 +1,29 @@
+---
+'@backstage/catalog-model': patch
+'@backstage/plugin-catalog-backend': patch
+---
+
+Adds a `backstage.io/managed-by-origin-location` annotation to all entities. It links to the
+location that was registered to the catalog and which emitted this entity. It has a different
+semantic than the existing `backstage.io/managed-by-location` annotation, which tells the direct
+parent location that created this entity.
+
+Consider this example: The Backstage operator adds a location of type `github-org` in the
+`app-config.yaml`. This setting will be added to a `bootstrap:boostrap` location. The processor
+discovers the entities in the following branch
+`Location bootstrap:bootstrap -> Location github-org:… -> User xyz`. The user `xyz` will be:
+
+```yaml
+apiVersion: backstage.io/v1alpha1
+kind: User
+metadata:
+  name: xyz
+  annotations:
+    # This entity was added by the 'github-org:…' location
+    backstage.io/managed-by-location: github-org:…
+    # The entity was added because the 'bootstrap:boostrap' was added to the catalog
+    backstage.io/managed-by-origin-location: bootstrap:bootstrap
+    # ...
+spec:
+  # ...
+```
diff --git a/.changeset/bright-radios-eat.md b/.changeset/bright-radios-eat.md
new file mode 100644
index 0000000000..73d2b32e23
--- /dev/null
+++ b/.changeset/bright-radios-eat.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-github-actions': minor
+---
+
+Support GHE
diff --git a/.changeset/calm-turtles-smoke.md b/.changeset/calm-turtles-smoke.md
new file mode 100644
index 0000000000..f2d473fe9f
--- /dev/null
+++ b/.changeset/calm-turtles-smoke.md
@@ -0,0 +1,7 @@
+---
+'@backstage/core': minor
+---
+
+Removed `InfoCard` variant `height100`, originally deprecated in [#2826](https://github.com/backstage/backstage/pull/2826).
+
+If your component still relies on this variant, simply replace it with `gridItem`.
diff --git a/.changeset/cool-horses-applaud.md b/.changeset/cool-horses-applaud.md
new file mode 100644
index 0000000000..83667d2b54
--- /dev/null
+++ b/.changeset/cool-horses-applaud.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-catalog': patch
+---
+
+Derive the list of to-delete entities in the `UnregisterEntityDialog` from the `backstage.io/managed-by-origin-location` annotation.
+The dialog also rejects deleting entities that are created by the `bootstrap:bootstrap` location.
diff --git a/.changeset/green-coins-confess.md b/.changeset/green-coins-confess.md
new file mode 100644
index 0000000000..7fc52b8a43
--- /dev/null
+++ b/.changeset/green-coins-confess.md
@@ -0,0 +1,40 @@
+---
+'@backstage/create-app': patch
+---
+
+Migrate to using `FlatRoutes` from `@backstage/core` for the root app routes.
+
+This is the first step in migrating applications as mentioned here: https://backstage.io/docs/plugins/composability#porting-existing-apps.
+
+To apply this change to an existing app, switch out the `Routes` component from `react-router` to `FlatRoutes` from `@backstage/core`.
+This also allows you to remove any `/*` suffixes on the route paths. For example:
+
+```diff
+import {
+   OAuthRequestDialog,
+   SidebarPage,
+   createRouteRef,
++  FlatRoutes,
+ } from '@backstage/core';
+ import { AppSidebar } from './sidebar';
+-import { Route, Routes, Navigate } from 'react-router';
++import { Route, Navigate } from 'react-router';
+ import { Router as CatalogRouter } from '@backstage/plugin-catalog';
+...
+         <AppSidebar />
+-        <Routes>
++        <FlatRoutes>
+...
+           <Route
+-            path="/catalog/*"
++            path="/catalog"
+             element={<CatalogRouter EntityPage={EntityPage} />}
+           />
+-          <Route path="/docs/*" element={<DocsRouter />} />
++          <Route path="/docs" element={<DocsRouter />} />
+...
+           <Route path="/settings" element={<SettingsRouter />} />
+-        </Routes>
++        </FlatRoutes>
+       </SidebarPage>
+```
diff --git a/.changeset/khaki-icons-trade.md b/.changeset/khaki-icons-trade.md
new file mode 100644
index 0000000000..4d30c3977e
--- /dev/null
+++ b/.changeset/khaki-icons-trade.md
@@ -0,0 +1,26 @@
+---
+'@backstage/backend-common': patch
+---
+
+1. URL Reader's `readTree` method now returns an `etag` in the response along with the blob. The etag is an identifier of the blob and will only change if the blob is modified on the target. Usually it is set to the latest commit SHA on the target.
+
+`readTree` also takes an optional `etag` in its options and throws a `NotModifiedError` if the etag matches with the etag of the resource.
+
+So, the `etag` can be used in building a cache when working with URL Reader.
+
+An example -
+
+```ts
+const response = await reader.readTree(
+  'https://github.com/backstage/backstage',
+);
+
+const etag = response.etag;
+
+// Will throw a new NotModifiedError (exported from @backstage/backstage-common)
+await reader.readTree('https://github.com/backstage/backstage', {
+  etag,
+});
+```
+
+2. URL Reader's readTree method can now detect the default branch. So, `url:https://github.com/org/repo/tree/master` can be replaced with `url:https://github.com/org/repo` in places like `backstage.io/techdocs-ref`.
diff --git a/.changeset/nervous-mails-repair.md b/.changeset/nervous-mails-repair.md
new file mode 100644
index 0000000000..f72e2b5e66
--- /dev/null
+++ b/.changeset/nervous-mails-repair.md
@@ -0,0 +1,5 @@
+---
+'@backstage/integration': patch
+---
+
+Fix GitLab API base URL and add it by default to the gitlab.com host
diff --git a/.changeset/proud-news-impress.md b/.changeset/proud-news-impress.md
new file mode 100644
index 0000000000..d10c37819f
--- /dev/null
+++ b/.changeset/proud-news-impress.md
@@ -0,0 +1,55 @@
+---
+'@backstage/core': minor
+---
+
+Removed deprecated `router.registerRoute` method in `createPlugin`.
+
+Deprecated `router.addRoute` method in `createPlugin`.
+
+Replace usage of the above two components with a routable extension.
+
+For example, given the following:
+
+```ts
+import { createPlugin } from '@backstage/core';
+import { MyPage } from './components/MyPage';
+import { rootRoute } from './routes';
+
+export const plugin = createPlugin({
+  id: 'my-plugin',
+  register({ router }) {
+    router.addRoute(rootRoute, MyPage);
+  },
+});
+```
+
+Migrate to
+
+```ts
+import { createPlugin, createRoutableExtension } from '@backstage/core';
+import { rootRoute } from './routes';
+
+export const plugin = createPlugin({
+  id: 'my-plugin',
+  routes: {
+    root: rootRoute,
+  },
+});
+
+export const MyPage = plugin.provide(
+  createRoutableExtension({
+    component: () => import('./components/MyPage').then(m => m.MyPage),
+    mountPoint: rootRoute,
+  }),
+);
+```
+
+And then use `MyPage` like this in the app:
+
+```tsx
+<FlatRoutes>
+...
+  <Route path='/my-path' element={<MyPage />}>
+...
+</FlatRoutes>
+```
diff --git a/.changeset/rich-turtles-roll.md b/.changeset/rich-turtles-roll.md
new file mode 100644
index 0000000000..9015161369
--- /dev/null
+++ b/.changeset/rich-turtles-roll.md
@@ -0,0 +1,19 @@
+---
+'@backstage/backend-common': minor
+---
+
+Remove fallback option from `UrlReaders.create` and `UrlReaders.default`, as well as the default fallback reader.
+
+To be able to read data from endpoints outside of the configured integrations, you now need to explicitly allow it by
+adding an entry in the `backend.reading.allow` list. For example:
+
+```yml
+backend:
+  baseUrl: ...
+  reading:
+    allow:
+      - host: example.com
+      - host: '*.examples.org'
+```
+
+Apart from adding the above configuration, most projects should not need to take any action to migrate existing code. If you do happen to have your own fallback reader configured, this needs to be replaced with a reader factory that selects a specific set of URLs to work with. If you where wrapping the existing fallback reader, the new one that handles the allow list is created using `FetchUrlReader.factory`.
diff --git a/.changeset/strong-ligers-lay.md b/.changeset/strong-ligers-lay.md
new file mode 100644
index 0000000000..56f4a91a9d
--- /dev/null
+++ b/.changeset/strong-ligers-lay.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-catalog': patch
+---
+
+Display systems in catalog table and make both owner and system link to the entity pages.
+The owner field is now taken from the relations of the entity instead of its spec.
diff --git a/.changeset/techdocs-glasses-wonder.md b/.changeset/techdocs-glasses-wonder.md
new file mode 100644
index 0000000000..7610be2665
--- /dev/null
+++ b/.changeset/techdocs-glasses-wonder.md
@@ -0,0 +1,5 @@
+---
+'@backstage/techdocs-common': patch
+---
+
+TechDocs backend now streams files through from Google Cloud Storage to the browser, improving memory usage.
diff --git a/.changeset/twelve-ants-sort.md b/.changeset/twelve-ants-sort.md
new file mode 100644
index 0000000000..978047ab8e
--- /dev/null
+++ b/.changeset/twelve-ants-sort.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Add AWS ALB OIDC reverse proxy authentication provider
diff --git a/.changeset/warm-months-bake.md b/.changeset/warm-months-bake.md
new file mode 100644
index 0000000000..c8f3723eb1
--- /dev/null
+++ b/.changeset/warm-months-bake.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-lighthouse': patch
+---
+
+Fix display of floating point precision errors in card category scores
diff --git a/.changeset/wise-mice-invite.md b/.changeset/wise-mice-invite.md
new file mode 100644
index 0000000000..9021336c07
--- /dev/null
+++ b/.changeset/wise-mice-invite.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': minor
+---
+
+Remove support for HTTPS certificate generation parameters. Use `backend.https = true` instead.
diff --git a/.changeset/yellow-ties-switch.md b/.changeset/yellow-ties-switch.md
new file mode 100644
index 0000000000..784d2a18ae
--- /dev/null
+++ b/.changeset/yellow-ties-switch.md
@@ -0,0 +1,5 @@
+---
+'@backstage/catalog-model': minor
+---
+
+The catalog no longer attempts to merge old and new annotations, when updating an entity from a remote location. This was a behavior that was copied from kubernetes, and catered to use cases where you wanted to use HTTP POST to update an entity in-place, outside of what the refresh loop does. This has proved to be a mistake, because as a side effect, the refresh loop effectively is unable to ever delete annotations when they are removed from source YAML. This is obviously a breaking change, but we believe that this is not a behavior that is relied upon in the wild, and it has never been an actually supported use flow of the catalog. We therefore choose to break the behavior outright, and instead just store updated annotations verbatim - just like we already do for example for labels
diff --git a/.github/styles/vocab.txt b/.github/styles/vocab.txt
index c3c67ab66e..03f84f4417 100644
--- a/.github/styles/vocab.txt
+++ b/.github/styles/vocab.txt
@@ -67,6 +67,7 @@ Dominik
 dtuite
 dzolotusky
 Ek
+etag
 env
 Env
 eslint
@@ -115,6 +116,7 @@ Kumar
 learnings
 lerna
 Lerna
+Luxon
 magiclink
 mailto
 maintainership
diff --git a/README.md b/README.md
index d2e01195d4..7c04672998 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,7 @@ Check out [the documentation](https://backstage.io/docs/getting-started) on how
 
 - [Main documentation](https://backstage.io/docs)
 - [Service Catalog](https://backstage.io/docs/features/software-catalog/software-catalog-overview)
-- [Architecture](https://backstage.io/docs/overview/architecture-terminology) ([Decisions](https://backstage.io/docs/architecture-decisions/adrs-overview))
+- [Architecture](https://backstage.io/docs/overview/architecture-overview) ([Decisions](https://backstage.io/docs/architecture-decisions/adrs-overview))
 - [Designing for Backstage](https://backstage.io/docs/dls/design)
 - [Storybook - UI components](https://backstage.io/storybook)
 
@@ -57,6 +57,6 @@ Check out [the documentation](https://backstage.io/docs/getting-started) on how
 
 ## License
 
-Copyright 2020 © Backstage Project Authors. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page: https://www.linuxfoundation.org/trademark-usage
+Copyright 2020-2021 © Backstage Project Authors. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page: https://www.linuxfoundation.org/trademark-usage
 
 Licensed under the Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0
diff --git a/app-config.yaml b/app-config.yaml
index 5866354a87..741991877e 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -16,6 +16,10 @@ backend:
     credentials: true
   csp:
     connect-src: ["'self'", 'http:', 'https:']
+  reading:
+    allow:
+      - host: example.com
+      - host: '*.mozilla.org'
   # workingDirectory: /tmp # Use this to configure a working directory for the scaffolder, defaults to the OS temp-dir
 
 # See README.md in the proxy-backend plugin for information on the configuration format
diff --git a/catalog-info.yaml b/catalog-info.yaml
index 2144d1709c..7e60af5755 100644
--- a/catalog-info.yaml
+++ b/catalog-info.yaml
@@ -6,7 +6,7 @@ metadata:
     Backstage is an open-source developer portal that puts the developer experience first.
   annotations:
     github.com/project-slug: backstage/backstage
-    backstage.io/techdocs-ref: url:https://github.com/backstage/backstage/tree/master
+    backstage.io/techdocs-ref: url:https://github.com/backstage/backstage
     lighthouse.com/website-url: https://backstage.io
 spec:
   type: library
diff --git a/docs/architecture-decisions/adr000-template.md b/docs/architecture-decisions/adr000-template.md
index 783db8e4bc..538afccf87 100644
--- a/docs/architecture-decisions/adr000-template.md
+++ b/docs/architecture-decisions/adr000-template.md
@@ -4,18 +4,10 @@ title: ADR000: [TITLE]
 description: Architecture Decision Record (ADR) for [TITLE] [DESCRIPTION]
 ---
 
-| Created    | Status |
-| ---------- | ------ |
-| YYYY-MM-DD | Open   |
-
 # ADR000: [title]
 
 <!-- These documents have names that are short noun phrases. For example, "ADR001: Deployment on Ruby on Rails 3.0.10" or "ADR009: LDAP for Multitenant Integration" -->
 
-## Status
-
-<!-- A decision may be "proposed" if the project stakeholders haven't agreed with it yet, or "accepted" once it is agreed. If a later ADR changes or reverses a decision, it may be marked as "deprecated" or "superseded" with a reference to its replacement. -->
-
 ## Context
 
 <!--
diff --git a/docs/architecture-decisions/adr001-add-adr-log.md b/docs/architecture-decisions/adr001-add-adr-log.md
index 16783367ab..872b3311a5 100644
--- a/docs/architecture-decisions/adr001-add-adr-log.md
+++ b/docs/architecture-decisions/adr001-add-adr-log.md
@@ -4,12 +4,16 @@ title: ADR001: Architecture Decision Record (ADR) log
 description: Architecture Decision Record (ADR) logs as a reference point for the team
 ---
 
-| Created    | Status |
-| ---------- | ------ |
-| 2020-04-26 | Open   |
+## Decision
 
-## Decision: A decision was made to store ADRs in a log in the project repository
+A decision was made to store ADRs in a log in the project repository
 
-## Discussion: There is a need to store big decisions made in a log as a reference point for the team, help with onboarding new members and give context to others interested in the project.
+## Discussion
 
-## Risks: People stop adding ADRs to the log and context gets lost
+There is a need to store big decisions made in a log as a reference point for
+the team, help with onboarding new members and give context to others interested
+in the project.
+
+## Risks
+
+People stop adding ADRs to the log and context gets lost
diff --git a/docs/architecture-decisions/adr002-default-catalog-file-format.md b/docs/architecture-decisions/adr002-default-catalog-file-format.md
index 699f7af8ed..8523b4a111 100644
--- a/docs/architecture-decisions/adr002-default-catalog-file-format.md
+++ b/docs/architecture-decisions/adr002-default-catalog-file-format.md
@@ -4,10 +4,6 @@ title: ADR002: Default Software Catalog File Format
 description: Architecture Decision Record (ADR) log on Default Software Catalog File Format
 ---
 
-| Created    | Status |
-| ---------- | ------ |
-| 2020-05-17 | Open   |
-
 ## Background
 
 Backstage comes with a software catalog functionality, that you can use to track
diff --git a/docs/architecture-decisions/adr003-avoid-default-exports.md b/docs/architecture-decisions/adr003-avoid-default-exports.md
index d08bc6a882..878d0d701c 100644
--- a/docs/architecture-decisions/adr003-avoid-default-exports.md
+++ b/docs/architecture-decisions/adr003-avoid-default-exports.md
@@ -4,10 +4,6 @@ title: ADR003: Avoid Default Exports and Prefer Named Exports
 description: Architecture Decision Record (ADR) log on Avoid Default Exports and Prefer Named Exports
 ---
 
-| Created    | Status |
-| ---------- | ------ |
-| 2020-05-19 | Open   |
-
 ## Context
 
 When CommonJS was the primary authoring format, the best practice was to export
diff --git a/docs/architecture-decisions/adr004-module-export-structure.md b/docs/architecture-decisions/adr004-module-export-structure.md
index 14c94c4ed1..846ca8feae 100644
--- a/docs/architecture-decisions/adr004-module-export-structure.md
+++ b/docs/architecture-decisions/adr004-module-export-structure.md
@@ -4,10 +4,6 @@ title: ADR004: Module Export Structure
 description: Architecture Decision Record (ADR) log on Module Export Structure
 ---
 
-| Created    | Status |
-| ---------- | ------ |
-| 2020-05-27 | Open   |
-
 ## Context
 
 With a growing number of exports of packages like `@backstage/core`, it is
diff --git a/docs/architecture-decisions/adr005-catalog-core-entities.md b/docs/architecture-decisions/adr005-catalog-core-entities.md
index 34d6449c6b..83196c12e2 100644
--- a/docs/architecture-decisions/adr005-catalog-core-entities.md
+++ b/docs/architecture-decisions/adr005-catalog-core-entities.md
@@ -4,10 +4,6 @@ title: ADR005: Catalog Core Entities
 description: Architecture Decision Record (ADR) log on Catalog Core Entities
 ---
 
-| Created    | Status |
-| ---------- | ------ |
-| 2020-05-29 | Open   |
-
 ## Context
 
 We want to standardize on a few core entities that we are tracking in the
diff --git a/docs/architecture-decisions/adr010-luxon-date-library.md b/docs/architecture-decisions/adr010-luxon-date-library.md
new file mode 100644
index 0000000000..b4c1ddedba
--- /dev/null
+++ b/docs/architecture-decisions/adr010-luxon-date-library.md
@@ -0,0 +1,38 @@
+---
+id: adrs-adr010
+title: ADR010: Use the Luxon Date Library
+description: Architecture Decision Record (ADR) for Luxon Date Library
+---
+
+# ADR010: Use the Luxon Date Library
+
+## Context
+
+Date formatting (e.g. `a day ago`) and calculations are common within Backstage.
+Some of these useful features are not supported by the standard JavaScript
+`Date` object. The popular [Moment.js](https://momentjs.com/) library has been
+commonly used to fill this gap but suffers from large bundle sizes and mutable
+state issues. On top of this, `momentjs` is
+[being sunset](https://momentjs.com/docs/#/-project-status/) and the project
+recommends using one of the more modern alternative libraries.
+
+See
+[[RFC] Standardized Date & Time Library](https://github.com/backstage/backstage/issues/3401).
+
+## Decision
+
+We will use [Luxon](https://moment.github.io/luxon/index.html) as the standard
+date library within Backstage.
+
+`Luxon` provides a similar feature set and API to `Moment.js`, but improves on
+its design through immutability and the usage of modern JavaScript APIs (e.g.
+`Intl`). This results in smaller bundle sizes while providing a full feature set
+and avoids the need for using additional libraries for common date & time tasks.
+
+## Consequences
+
+- All core packages and plugins within Backstage should use `Luxon` for any date
+  manipulation or formatting that cannot be easily accomplished with the native
+  JavaScript `Date` object.
+- Using a single date library avoids having to learn multiple library APIs
+- Having a single date library will reduce bundle sizes
diff --git a/docs/assets/search/architecture.drawio.svg b/docs/assets/search/architecture.drawio.svg
index 736d4545f0..af04ab63e8 100644
--- a/docs/assets/search/architecture.drawio.svg
+++ b/docs/assets/search/architecture.drawio.svg
@@ -92,7 +92,7 @@
                             <div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #5C5C5C; line-height: 1.2; pointer-events: all; white-space: nowrap; ">
                                 Other Plugins
                                 <br/>
-                                (TechDocs, Catalogue, Etc)
+                                (TechDocs, Catalog, Etc)
                             </div>
                         </div>
                     </div>
@@ -147,13 +147,13 @@
                     <div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 289px; margin-left: 555px;">
                         <div style="box-sizing: border-box; font-size: 0; text-align: center; ">
                             <div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #5C5C5C; line-height: 1.2; pointer-events: all; white-space: nowrap; ">
-                                Other Backend Plugin (TechDocs, Catalogue, Etc)
+                                Other Backend Plugin (TechDocs, Catalog, Etc)
                             </div>
                         </div>
                     </div>
                 </foreignObject>
                 <text x="555" y="293" fill="#5C5C5C" font-family="Helvetica" font-size="12px" text-anchor="middle">
-                    Other Backend Plugin (TechDocs, Catalogue, Etc)
+                    Other Backend Plugin (TechDocs, Catalog, Etc)
                 </text>
             </switch>
         </g>
diff --git a/docs/features/software-catalog/descriptor-format.md b/docs/features/software-catalog/descriptor-format.md
index 77feef45e2..5b7c82152d 100644
--- a/docs/features/software-catalog/descriptor-format.md
+++ b/docs/features/software-catalog/descriptor-format.md
@@ -131,6 +131,19 @@ spec:
     $text: https://petstore.swagger.io/v2/swagger.json
 ```
 
+Note that to be able to read from targets that are outside of the normal
+integration points such as `github.com`, you'll need to explicitly allow it by
+adding an entry in the `backend.reading.allow` list. For example:
+
+```yml
+backend:
+  baseUrl: ...
+  reading:
+    allow:
+      - host: example.com
+      - host: '*.examples.org'
+```
+
 ## Common to All Kinds: The Envelope
 
 The root envelope object has the following structure.
diff --git a/docs/features/software-catalog/well-known-annotations.md b/docs/features/software-catalog/well-known-annotations.md
index 3627c74b9a..2cbb829554 100644
--- a/docs/features/software-catalog/well-known-annotations.md
+++ b/docs/features/software-catalog/well-known-annotations.md
@@ -22,7 +22,7 @@ use.
 # Example:
 metadata:
   annotations:
-    backstage.io/managed-by-location: github:http://github.com/backstage/backstage/catalog-info.yaml
+    backstage.io/managed-by-location: url:http://github.com/backstage/backstage/blob/master/catalog-info.yaml
 ```
 
 The value of this annotation is a so called location reference string, that
@@ -30,8 +30,8 @@ points to the source from which the entity was originally fetched. This
 annotation is added automatically by the catalog as it fetches the data from a
 registered location, and is not meant to normally be written by humans. The
 annotation may point to any type of generic location that the catalog supports,
-so it cannot be relied on to always be specifically of type `github`, nor that
-it even represents a single file. Note also that a single location can be the
+so it cannot be relied on to always be specifically of type `url`, nor that it
+even represents a single file. Note also that a single location can be the
 source of many entities, so it represents a many-to-one relationship.
 
 The format of the value is `<type>:<target>`. Note that the target may also
@@ -40,13 +40,30 @@ expecting a two-item array out of it. The format of the target part is
 type-dependent and could conceivably even be an empty string, but the separator
 colon is always present.
 
+### backstage.io/managed-by-origin-location
+
+```yaml
+# Example:
+metadata:
+  annotations:
+    backstage.io/managed-by-origin-location: url:http://github.com/backstage/backstage/blob/master/catalog-info.yaml
+```
+
+The value of this annotation is a location reference string (see above). It
+points to the location, whose registration lead to the creation of the entity.
+In most cases, the `backstage.io/managed-by-location` and
+`backstage.io/managed-by-origin-location` will be equal. They will be different
+if the original location delegates to another location. A common case is, that a
+location is registered as `bootstrap:bootstrap` which means that it is part of
+the `app-config.yaml` of a Backstage installation.
+
 ### backstage.io/techdocs-ref
 
 ```yaml
 # Example:
 metadata:
   annotations:
-    backstage.io/techdocs-ref: github:https://github.com/backstage/backstage.git
+    backstage.io/techdocs-ref: url:https://github.com/backstage/backstage/tree/master
 ```
 
 The value of this annotation is a location reference string (see above). If this
diff --git a/docs/features/software-templates/extending/create-your-own-templater.md b/docs/features/software-templates/extending/create-your-own-templater.md
index 63acd38286..19c54733b4 100644
--- a/docs/features/software-templates/extending/create-your-own-templater.md
+++ b/docs/features/software-templates/extending/create-your-own-templater.md
@@ -86,10 +86,11 @@ follows:
 
 _note_ Currently the templaters that we provide are basically Docker action
 containers that are run on top of the skeleton folder. This keeps dependencies
-to a minimal for running backstage scaffolder, but you don't /have/ to use
-Docker. You could create your own templater that spins up an EC2 instance and
-downloads the folder and does everything using an AMI if you want. It's entirely
-up to you!
+to a minimum for running backstage scaffolder, but you don't _have_ to use
+Docker. You can `pip install cookiecutter` to run it locally in your backend.
+You could create your own templater that spins up an EC2 instance and downloads
+the folder and does everything using an AMI if you want. It's entirely up to
+you!
 
 Now it's up to you to implement the `run` function, and then return a
 `TemplaterRunResult` which is `{ resultDir: string }`.
diff --git a/docs/features/techdocs/architecture.md b/docs/features/techdocs/architecture.md
index 7c35fbc943..53149ae4f3 100644
--- a/docs/features/techdocs/architecture.md
+++ b/docs/features/techdocs/architecture.md
@@ -142,12 +142,11 @@ Status of all the features mentioned above.
 
 - Basic setup with techdocs-backend file server as storage.
 - Basic setup with cloud storage solution.
-
-**Work in progress 🚧**
-
 - `techdocs-cli` is able to generate docs in CI/CD environment.
 - `techdocs-cli` is able to publish docs site to any storage.
 
+**Work in progress 🚧**
+
 **Not implemented yet ❌**
 
 - `techdocs-backend` integration with Backstage access control management.
diff --git a/docs/features/techdocs/configuring-ci-cd.md b/docs/features/techdocs/configuring-ci-cd.md
new file mode 100644
index 0000000000..5841a02fa8
--- /dev/null
+++ b/docs/features/techdocs/configuring-ci-cd.md
@@ -0,0 +1,98 @@
+---
+id: configuring-ci-cd
+title: Configuring CI/CD to generate and publish TechDocs sites
+# prettier-ignore
+description: Configuring CI/CD to generate and publish TechDocs sites to cloud storage
+---
+
+In the [Recommended deployment setup](./architecture.md#recommended-deployment),
+TechDocs reads the static generated documentation files from a cloud storage
+bucket (GCS, AWS S3, etc.). The documentation site is generated on the CI/CD
+workflow associated with the repository containing the documentation files. This
+document explains the steps needed to generate docs on CI and publish to a cloud
+storage using [`techdocs-cli`](https://github.com/backstage/techdocs-cli).
+
+The steps here target all kinds of CI providers (GitHub Actions, CircleCI,
+Jenkins, etc.). Specific tools for individual providers will also be made
+available here for simplicity (e.g. a GitHub Actions runner, CircleCI orb,
+etc.).
+
+A summary of the instructions below looks like this -
+
+```sh
+# This is an example script
+
+# Prepare
+REPOSITORY_URL='https://github.com/org/repo'
+git clone $REPOSITORY_URL
+cd repo
+
+# Generate
+npx @techdocs/cli generate
+
+# Publish
+npx @techdocs/cli publish --publisher-type awsS3 --storage-name <bucket/container> --entity <Namespace/Kind/Name>
+```
+
+That's it!
+
+Take a look at
+[`techdocs-cli` README](https://github.com/backstage/techdocs-cli) for the
+complete command reference, details, and options.
+
+## 1. Setup a workflow
+
+The TechDocs workflow should trigger on CI when any changes are made in the
+repository containing the documentation files. You can be specific and configure
+the workflow to be triggered only when files inside the `docs/` directory or
+`mkdocs.yml` are changed.
+
+## 2. Prepare step
+
+The first step on the CI is to clone your documentation source repository in a
+working directory. This is almost always the first step in most CI workflows.
+
+On GitHub Actions, you can add a step
+
+[`- uses: actions@checkout@v2`](https://github.com/actions/checkout).
+
+On CircleCI, you can add a special
+[`checkout`](https://circleci.com/docs/2.0/configuration-reference/#checkout)
+step.
+
+Eventually we are trying to do a `git clone <https://path/to/docs-repository/>`.
+
+## 3. Generate step
+
+Install [`npx`](https://www.npmjs.com/package/npx) to use it for running
+`techdocs-cli`. Or you can install using `npm install -g @techdocs/cli`.
+
+We are going to use the
+[`techdocs-cli generate`](https://github.com/backstage/techdocs-cli#generate-techdocs-site-from-a-documentation-project)
+command in this step.
+
+```sh
+npx @techdocs/cli generate --no-docker --source-dir PATH_TO_REPO --output-dir ./site
+```
+
+`PATH_TO_REPO` should be the location in the file path where the prepare step
+above clones the repository.
+
+## 4. Publish step
+
+Depending on your cloud storage provider (AWS, Google Cloud, or Azure), set the
+necessary authentication environment variables.
+
+- [Google Cloud authentication](https://cloud.google.com/storage/docs/authentication#libauth)
+- [AWS authentication](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/loading-node-credentials-environment.html)
+
+And then run the
+[`techdocs-cli publish`](https://github.com/backstage/techdocs-cli#publish-generated-techdocs-sites)
+command.
+
+```sh
+npx @techdocs/cli publish --publisher-type <awsS3|googleGcs> --storage-name <bucket/container> --entity <namespace/kind/name> --directory ./site
+```
+
+The updated TechDocs site built in this workflow is now ready to be served by
+the TechDocs plugin in your Backstage app.
diff --git a/docs/plugins/plugin-development.md b/docs/plugins/plugin-development.md
index c5d9763f7d..109f6ed6ba 100644
--- a/docs/plugins/plugin-development.md
+++ b/docs/plugins/plugin-development.md
@@ -54,13 +54,4 @@ addRoute(
   Component: ComponentType<any>,
   options?: RouteOptions,
 ): void;
-
-/**
- * @deprecated See the `addRoute` method
- */
-registerRoute(
-  path: RoutePath,
-  Component: ComponentType<any>,
-  options?: RouteOptions,
-): void;
 ```
diff --git a/docs/reference/createPlugin-router.md b/docs/reference/createPlugin-router.md
index 89ee44e558..0ef5bdbd0f 100644
--- a/docs/reference/createPlugin-router.md
+++ b/docs/reference/createPlugin-router.md
@@ -15,15 +15,6 @@ addRoute(
   Component: ComponentType<any>,
   options?: RouteOptions,
 ): void;
-
-/**
- * @deprecated See the `addRoute` method
- */
-registerRoute(
-  path: RoutePath,
-  Component: ComponentType<any>,
-  options?: RouteOptions,
-): void;
 ```
 
 ## RouteRef
diff --git a/microsite/sidebars.json b/microsite/sidebars.json
index f5a433fc84..c2ccea8740 100644
--- a/microsite/sidebars.json
+++ b/microsite/sidebars.json
@@ -91,6 +91,7 @@
           "features/techdocs/creating-and-publishing",
           "features/techdocs/configuration",
           "features/techdocs/using-cloud-storage",
+          "features/techdocs/configuring-ci-cd",
           "features/techdocs/how-to-guides",
           "features/techdocs/troubleshooting",
           "features/techdocs/faqs"
@@ -182,7 +183,8 @@
       "architecture-decisions/adrs-adr006",
       "architecture-decisions/adrs-adr007",
       "architecture-decisions/adrs-adr008",
-      "architecture-decisions/adrs-adr009"
+      "architecture-decisions/adrs-adr009",
+      "architecture-decisions/adrs-adr010"
     ],
     "Contribute": ["../CONTRIBUTING"],
     "Support": ["support/support", "support/project-structure"],
diff --git a/mkdocs.yml b/mkdocs.yml
index 99a96d77dc..a2cbf11b4c 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -118,6 +118,7 @@ nav:
       - ADR007 - Use MSW for Network Request Mocking: 'architecture-decisions/adr007-use-msw-to-mock-service-requests.md'
       - ADR008 - Default Catalog File Name: 'architecture-decisions/adr008-default-catalog-file-name.md'
       - ADR009 - Entity References: 'architecture-decisions/adr009-entity-references.md'
+      - ADR010 - Luxon Date Library: 'architecture-decisions/adr010-luxon-date-library.md'
   - Contribute: '../CONTRIBUTING.md'
   - Support:
       - 'support/support.md'
diff --git a/packages/app/src/App.tsx b/packages/app/src/App.tsx
index 627b5d19aa..1b76773979 100644
--- a/packages/app/src/App.tsx
+++ b/packages/app/src/App.tsx
@@ -20,6 +20,7 @@ import {
   OAuthRequestDialog,
   SignInPage,
   createRouteRef,
+  FlatRoutes,
 } from '@backstage/core';
 import React from 'react';
 import Root from './components/Root';
@@ -35,7 +36,7 @@ import { Router as LighthouseRouter } from '@backstage/plugin-lighthouse';
 import { Router as RegisterComponentRouter } from '@backstage/plugin-register-component';
 import { Router as SettingsRouter } from '@backstage/plugin-user-settings';
 import { Router as ImportComponentRouter } from '@backstage/plugin-catalog-import';
-import { Route, Routes, Navigate } from 'react-router';
+import { Route, Navigate } from 'react-router';
 
 import { EntityPage } from './components/catalog/EntityPage';
 
@@ -65,31 +66,31 @@ const catalogRouteRef = createRouteRef({
   title: 'Service Catalog',
 });
 
-const AppRoutes = () => (
-  <Routes>
+const routes = (
+  <FlatRoutes>
     <Navigate key="/" to="/catalog" />
     <Route
-      path="/catalog-import/*"
+      path="/catalog-import"
       element={<ImportComponentRouter catalogRouteRef={catalogRouteRef} />}
     />
     <Route
-      path={`${catalogRouteRef.path}/*`}
+      path={`${catalogRouteRef.path}`}
       element={<CatalogRouter EntityPage={EntityPage} />}
     />
-    <Route path="/docs/*" element={<DocsRouter />} />
+    <Route path="/docs" element={<DocsRouter />} />
     <Route
       path="/tech-radar"
       element={<TechRadarRouter width={1500} height={800} />}
     />
     <Route path="/graphiql" element={<GraphiQLRouter />} />
-    <Route path="/lighthouse/*" element={<LighthouseRouter />} />
+    <Route path="/lighthouse" element={<LighthouseRouter />} />
     <Route
       path="/register-component"
       element={<RegisterComponentRouter catalogRouteRef={catalogRouteRef} />}
     />
     <Route path="/settings" element={<SettingsRouter />} />
     {...deprecatedAppRoutes}
-  </Routes>
+  </FlatRoutes>
 );
 
 const App = () => (
@@ -97,9 +98,7 @@ const App = () => (
     <AlertDisplay />
     <OAuthRequestDialog />
     <AppRouter>
-      <Root>
-        <AppRoutes />
-      </Root>
+      <Root>{routes}</Root>
     </AppRouter>
   </AppProvider>
 );
diff --git a/packages/backend-common/config.d.ts b/packages/backend-common/config.d.ts
index b7241bcc03..74c199e737 100644
--- a/packages/backend-common/config.d.ts
+++ b/packages/backend-common/config.d.ts
@@ -41,31 +41,16 @@ export interface Config {
     https?:
       | true
       | {
-          /**
-           * Certificate configuration or parameters for generating a self-signed certificate
-           *
-           * Setting parameters for self-signed certificates is deprecated and will be removed in
-           * the future, set `backend.https = true` instead.
-           */
-          certificate?:
-            | {
-                /** Algorithm to use to generate a self-signed certificate */
-                algorithm?: string;
-                keySize?: number;
-                days?: number;
-                attributes: {
-                  commonName: string;
-                };
-              }
-            | {
-                /** PEM encoded certificate. Use $file to load in a file */
-                cert: string;
-                /**
-                 * PEM encoded certificate key. Use $file to load in a file.
-                 * @visibility secret
-                 */
-                key: string;
-              };
+          /** Certificate configuration */
+          certificate?: {
+            /** PEM encoded certificate. Use $file to load in a file */
+            cert: string;
+            /**
+             * PEM encoded certificate key. Use $file to load in a file.
+             * @visibility secret
+             */
+            key: string;
+          };
         };
 
     /** Database connection configuration, select database type using the `client` field */
@@ -94,6 +79,26 @@ export interface Config {
       optionsSuccessStatus?: number;
     };
 
+    /**
+     * Configuration related to URL reading, used for example for reading catalog info
+     * files, scaffolder templates, and techdocs content.
+     */
+    reading?: {
+      /**
+       * A list of targets to allow outgoing requests to. Users will be able to make
+       * requests on behalf of the backend to the targets that are allowed by this list.
+       */
+      allow?: Array<{
+        /**
+         * A host to allow outgoing requests to, being either a full host or
+         * a subdomain wildcard pattern with a leading `*`. For example `example.com`
+         * and `*.example.com` are valid values, `prod.*.example.com` is not.
+         * The host may also contain a port, for example `example.com:8080`.
+         */
+        host: string;
+      }>;
+    };
+
     /**
      * Content Security Policy options.
      *
@@ -104,81 +109,4 @@ export interface Config {
      */
     csp?: { [policyId: string]: string[] | false };
   };
-
-  /** Configuration for integrations towards various external repository provider systems */
-  integrations?: {
-    /** Integration configuration for Azure */
-    azure?: Array<{
-      /**
-       * The hostname of the given Azure instance
-       */
-      host: string;
-      /**
-       * Token used to authenticate requests.
-       * @visibility secret
-       */
-      token?: string;
-    }>;
-
-    /** Integration configuration for BitBucket */
-    bitbucket?: Array<{
-      /**
-       * The hostname of the given Bitbucket instance
-       */
-      host: string;
-      /**
-       * Token used to authenticate requests.
-       * @visibility secret
-       */
-      token?: string;
-      /**
-       * The base url for the BitBucket API, for example https://api.bitbucket.org/2.0
-       */
-      apiBaseUrl?: string;
-      /**
-       * The username to use for authenticated requests.
-       * @visibility secret
-       */
-      username?: string;
-      /**
-       * BitBucket app password used to authenticate requests.
-       * @visibility secret
-       */
-      appPassword?: string;
-    }>;
-
-    /** Integration configuration for GitHub */
-    github?: Array<{
-      /**
-       * The hostname of the given GitHub instance
-       */
-      host: string;
-      /**
-       * Token used to authenticate requests.
-       * @visibility secret
-       */
-      token?: string;
-      /**
-       * The base url for the GitHub API, for example https://api.github.com
-       */
-      apiBaseUrl?: string;
-      /**
-       * The base url for GitHub raw resources, for example https://raw.githubusercontent.com
-       */
-      rawBaseUrl?: string;
-    }>;
-
-    /** Integration configuration for GitLab */
-    gitlab?: Array<{
-      /**
-       * The hostname of the given GitLab instance
-       */
-      host: string;
-      /**
-       * Token used to authenticate requests.
-       * @visibility secret
-       */
-      token?: string;
-    }>;
-  };
 }
diff --git a/packages/backend-common/src/errors.ts b/packages/backend-common/src/errors.ts
index b68dc8e3f0..39703127e6 100644
--- a/packages/backend-common/src/errors.ts
+++ b/packages/backend-common/src/errors.ts
@@ -75,3 +75,8 @@ export class NotFoundError extends CustomErrorBase {}
  * resource.
  */
 export class ConflictError extends CustomErrorBase {}
+
+/**
+ * The requested resource has not changed since last request.
+ */
+export class NotModifiedError extends CustomErrorBase {}
diff --git a/packages/backend-common/src/middleware/errorHandler.test.ts b/packages/backend-common/src/middleware/errorHandler.test.ts
index a7a3d64bd1..6d22c2f175 100644
--- a/packages/backend-common/src/middleware/errorHandler.test.ts
+++ b/packages/backend-common/src/middleware/errorHandler.test.ts
@@ -72,6 +72,9 @@ describe('errorHandler', () => {
 
   it('handles well-known error classes', async () => {
     const app = express();
+    app.use('/NotModifiedError', () => {
+      throw new errors.NotModifiedError();
+    });
     app.use('/InputError', () => {
       throw new errors.InputError();
     });
@@ -90,6 +93,7 @@ describe('errorHandler', () => {
     app.use(errorHandler());
 
     const r = request(app);
+    expect((await r.get('/NotModifiedError')).status).toBe(304);
     expect((await r.get('/InputError')).status).toBe(400);
     expect((await r.get('/AuthenticationError')).status).toBe(401);
     expect((await r.get('/NotAllowedError')).status).toBe(403);
diff --git a/packages/backend-common/src/middleware/errorHandler.ts b/packages/backend-common/src/middleware/errorHandler.ts
index 7365ce8b93..a08849813d 100644
--- a/packages/backend-common/src/middleware/errorHandler.ts
+++ b/packages/backend-common/src/middleware/errorHandler.ts
@@ -101,6 +101,8 @@ function getStatusCode(error: Error): number {
 
   // Handle well-known error types
   switch (error.name) {
+    case errors.NotModifiedError.name:
+      return 304;
     case errors.InputError.name:
       return 400;
     case errors.AuthenticationError.name:
diff --git a/packages/backend-common/src/reading/AzureUrlReader.test.ts b/packages/backend-common/src/reading/AzureUrlReader.test.ts
index 616cbaaadc..20f8feba42 100644
--- a/packages/backend-common/src/reading/AzureUrlReader.test.ts
+++ b/packages/backend-common/src/reading/AzureUrlReader.test.ts
@@ -23,6 +23,7 @@ import { getVoidLogger } from '../logging';
 import { AzureUrlReader } from './AzureUrlReader';
 import { msw } from '@backstage/test-utils';
 import { ReadTreeResponseFactory } from './tree';
+import { NotModifiedError } from '../errors';
 
 const logger = getVoidLogger();
 
@@ -139,7 +140,12 @@ describe('AzureUrlReader', () => {
 
   describe('readTree', () => {
     const repoBuffer = fs.readFileSync(
-      path.resolve('src', 'reading', '__fixtures__', 'repo.zip'),
+      path.resolve('src', 'reading', '__fixtures__', 'mock-main.zip'),
+    );
+
+    const processor = new AzureUrlReader(
+      { host: 'dev.azure.com' },
+      { treeResponseFactory },
     );
 
     beforeEach(() => {
@@ -153,24 +159,70 @@ describe('AzureUrlReader', () => {
               ctx.body(repoBuffer),
             ),
         ),
+        rest.get(
+          // https://docs.microsoft.com/en-us/rest/api/azure/devops/git/commits/get%20commits?view=azure-devops-rest-6.0#on-a-branch
+          'https://dev.azure.com/organization/project/_apis/git/repositories/repository/commits',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.json({
+                count: 2,
+                value: [
+                  {
+                    commitId: '123abc2',
+                    comment: 'second commit',
+                  },
+                  {
+                    commitId: '123abc1',
+                    comment: 'first commit',
+                  },
+                ],
+              }),
+            ),
+        ),
       );
     });
 
     it('returns the wanted files from an archive', async () => {
-      const processor = new AzureUrlReader(
-        { host: 'dev.azure.com' },
-        { treeResponseFactory },
-      );
-
       const response = await processor.readTree(
         'https://dev.azure.com/organization/project/_git/repository',
       );
 
+      expect(response.etag).toBe('123abc2');
+
       const files = await response.files();
 
       expect(files.length).toBe(2);
-      const mkDocsFile = await files[1].content();
-      const indexMarkdownFile = await files[0].content();
+      const mkDocsFile = await files[0].content();
+      const indexMarkdownFile = await files[1].content();
+
+      expect(mkDocsFile.toString()).toBe('site_name: Test\n');
+      expect(indexMarkdownFile.toString()).toBe('# Test\n');
+    });
+
+    it('throws a NotModifiedError when given a etag in options', async () => {
+      const fnAzure = async () => {
+        await processor.readTree(
+          'https://dev.azure.com/organization/project/_git/repository',
+          { etag: '123abc2' },
+        );
+      };
+
+      await expect(fnAzure).rejects.toThrow(NotModifiedError);
+    });
+
+    it('should not throw a NotModifiedError when given an outdated etag in options', async () => {
+      const response = await processor.readTree(
+        'https://dev.azure.com/organization/project/_git/repository',
+        { etag: 'outdated123abc' },
+      );
+
+      expect(response.etag).toBe('123abc2');
+      const files = await response.files();
+
+      expect(files.length).toBe(2);
+      const mkDocsFile = await files[0].content();
+      const indexMarkdownFile = await files[1].content();
 
       expect(mkDocsFile.toString()).toBe('site_name: Test\n');
       expect(indexMarkdownFile.toString()).toBe('# Test\n');
diff --git a/packages/backend-common/src/reading/AzureUrlReader.ts b/packages/backend-common/src/reading/AzureUrlReader.ts
index ea716a1d4a..59e437607f 100644
--- a/packages/backend-common/src/reading/AzureUrlReader.ts
+++ b/packages/backend-common/src/reading/AzureUrlReader.ts
@@ -20,10 +20,11 @@ import {
   getAzureFileFetchUrl,
   getAzureDownloadUrl,
   getAzureRequestOptions,
+  getAzureCommitsUrl,
 } from '@backstage/integration';
 import fetch from 'cross-fetch';
 import { Readable } from 'stream';
-import { NotFoundError } from '../errors';
+import { NotFoundError, NotModifiedError } from '../errors';
 import {
   ReaderFactory,
   ReadTreeOptions,
@@ -75,20 +76,40 @@ export class AzureUrlReader implements UrlReader {
     url: string,
     options?: ReadTreeOptions,
   ): Promise<ReadTreeResponse> {
-    const response = await fetch(
-      getAzureDownloadUrl(url),
-      getAzureRequestOptions(this.options, { Accept: 'application/zip' }),
+    // Get latest commit SHA
+
+    const commitsAzureResponse = await fetch(
+      getAzureCommitsUrl(url),
+      getAzureRequestOptions(this.options),
     );
-    if (!response.ok) {
-      const message = `Failed to read tree from ${url}, ${response.status} ${response.statusText}`;
-      if (response.status === 404) {
+    if (!commitsAzureResponse.ok) {
+      const message = `Failed to read tree from ${url}, ${commitsAzureResponse.status} ${commitsAzureResponse.statusText}`;
+      if (commitsAzureResponse.status === 404) {
         throw new NotFoundError(message);
       }
       throw new Error(message);
     }
 
-    return this.deps.treeResponseFactory.fromZipArchive({
-      stream: (response.body as unknown) as Readable,
+    const commitSha = (await commitsAzureResponse.json()).value[0].commitId;
+    if (options?.etag && options.etag === commitSha) {
+      throw new NotModifiedError();
+    }
+
+    const archiveAzureResponse = await fetch(
+      getAzureDownloadUrl(url),
+      getAzureRequestOptions(this.options, { Accept: 'application/zip' }),
+    );
+    if (!archiveAzureResponse.ok) {
+      const message = `Failed to read tree from ${url}, ${archiveAzureResponse.status} ${archiveAzureResponse.statusText}`;
+      if (archiveAzureResponse.status === 404) {
+        throw new NotFoundError(message);
+      }
+      throw new Error(message);
+    }
+
+    return await this.deps.treeResponseFactory.fromZipArchive({
+      stream: (archiveAzureResponse.body as unknown) as Readable,
+      etag: commitSha,
       filter: options?.filter,
     });
   }
diff --git a/packages/backend-common/src/reading/BitbucketUrlReader.test.ts b/packages/backend-common/src/reading/BitbucketUrlReader.test.ts
index e327770114..3542e822e1 100644
--- a/packages/backend-common/src/reading/BitbucketUrlReader.test.ts
+++ b/packages/backend-common/src/reading/BitbucketUrlReader.test.ts
@@ -20,6 +20,7 @@ import fs from 'fs';
 import { rest } from 'msw';
 import { setupServer } from 'msw/node';
 import path from 'path';
+import { NotModifiedError } from '../errors';
 import { BitbucketUrlReader } from './BitbucketUrlReader';
 import { ReadTreeResponseFactory } from './tree';
 
@@ -27,15 +28,24 @@ const treeResponseFactory = ReadTreeResponseFactory.create({
   config: new ConfigReader({}),
 });
 
+const bitbucketProcessor = new BitbucketUrlReader(
+  { host: 'bitbucket.org', apiBaseUrl: 'https://api.bitbucket.org/2.0' },
+  { treeResponseFactory },
+);
+
+const hostedBitbucketProcessor = new BitbucketUrlReader(
+  {
+    host: 'bitbucket.mycompany.net',
+    apiBaseUrl: 'https://api.bitbucket.mycompany.net/rest/api/1.0',
+  },
+  { treeResponseFactory },
+);
+
 describe('BitbucketUrlReader', () => {
   describe('implementation', () => {
     it('rejects unknown targets', async () => {
-      const processor = new BitbucketUrlReader(
-        { host: 'bitbucket.org', apiBaseUrl: 'https://api.bitbucket.org/2.0' },
-        { treeResponseFactory },
-      );
       await expect(
-        processor.read('https://not.bitbucket.com/apa'),
+        bitbucketProcessor.read('https://not.bitbucket.com/apa'),
       ).rejects.toThrow(
         'Incorrect URL: https://not.bitbucket.com/apa, Error: Invalid Bitbucket URL or file path',
       );
@@ -55,8 +65,30 @@ describe('BitbucketUrlReader', () => {
       ),
     );
 
-    it('returns the wanted files from an archive', async () => {
+    const privateBitbucketRepoBuffer = fs.readFileSync(
+      path.resolve(
+        'src',
+        'reading',
+        '__fixtures__',
+        'bitbucket-server-repo.zip',
+      ),
+    );
+
+    beforeEach(() => {
       worker.use(
+        rest.get(
+          'https://api.bitbucket.org/2.0/repositories/backstage/mock',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.json({
+                mainbranch: {
+                  type: 'branch',
+                  name: 'master',
+                },
+              }),
+            ),
+        ),
         rest.get(
           'https://bitbucket.org/backstage/mock/get/master.zip',
           (_, res, ctx) =>
@@ -76,17 +108,35 @@ describe('BitbucketUrlReader', () => {
               }),
             ),
         ),
+        rest.get(
+          'https://api.bitbucket.mycompany.net/rest/api/1.0/projects/backstage/repos/mock/archive?format=zip&prefix=mock&path=docs',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/zip'),
+              ctx.body(privateBitbucketRepoBuffer),
+            ),
+        ),
+        rest.get(
+          'https://api.bitbucket.mycompany.net/rest/api/1.0/repositories/backstage/mock/commits/some-branch',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.json({
+                values: [{ hash: '12ab34cd56ef78gh90ij12kl34mn56op78qr90st' }],
+              }),
+            ),
+        ),
       );
+    });
 
-      const processor = new BitbucketUrlReader(
-        { host: 'bitbucket.org', apiBaseUrl: 'https://api.bitbucket.org/2.0' },
-        { treeResponseFactory },
-      );
-
-      const response = await processor.readTree(
+    it('returns the wanted files from an archive', async () => {
+      const response = await bitbucketProcessor.readTree(
         'https://bitbucket.org/backstage/mock/src/master',
       );
 
+      expect(response.etag).toBe('12ab34cd56ef');
+
       const files = await response.files();
 
       expect(files.length).toBe(2);
@@ -98,38 +148,12 @@ describe('BitbucketUrlReader', () => {
     });
 
     it('uses private bitbucket host', async () => {
-      const privateBitbucketRepoBuffer = fs.readFileSync(
-        path.resolve(
-          'src',
-          'reading',
-          '__fixtures__',
-          'bitbucket-server-repo.zip',
-        ),
-      );
-      worker.use(
-        rest.get(
-          'https://api.bitbucket.mycompany.net/rest/api/1.0/projects/backstage/repos/mock/archive?format=zip&prefix=mock&path=docs',
-          (_, res, ctx) =>
-            res(
-              ctx.status(200),
-              ctx.set('Content-Type', 'application/zip'),
-              ctx.body(privateBitbucketRepoBuffer),
-            ),
-        ),
-      );
-
-      const processor = new BitbucketUrlReader(
-        {
-          host: 'bitbucket.mycompany.net',
-          apiBaseUrl: 'https://api.bitbucket.mycompany.net/rest/api/1.0',
-        },
-        { treeResponseFactory },
-      );
-
-      const response = await processor.readTree(
+      const response = await hostedBitbucketProcessor.readTree(
         'https://bitbucket.mycompany.net/projects/backstage/repos/mock/browse/docs?at=some-branch',
       );
 
+      expect(response.etag).toBe('12ab34cd56ef');
+
       const files = await response.files();
 
       expect(files.length).toBe(1);
@@ -139,37 +163,12 @@ describe('BitbucketUrlReader', () => {
     });
 
     it('returns the wanted files from an archive with a subpath', async () => {
-      worker.use(
-        rest.get(
-          'https://bitbucket.org/backstage/mock/get/master.zip',
-          (_, res, ctx) =>
-            res(
-              ctx.status(200),
-              ctx.set('Content-Type', 'application/zip'),
-              ctx.body(repoBuffer),
-            ),
-        ),
-        rest.get(
-          'https://api.bitbucket.org/2.0/repositories/backstage/mock/commits/master',
-          (_, res, ctx) =>
-            res(
-              ctx.status(200),
-              ctx.json({
-                values: [{ hash: '12ab34cd56ef78gh90ij12kl34mn56op78qr90st' }],
-              }),
-            ),
-        ),
-      );
-
-      const processor = new BitbucketUrlReader(
-        { host: 'bitbucket.org', apiBaseUrl: 'https://api.bitbucket.org/2.0' },
-        { treeResponseFactory },
-      );
-
-      const response = await processor.readTree(
+      const response = await bitbucketProcessor.readTree(
         'https://bitbucket.org/backstage/mock/src/master/docs',
       );
 
+      expect(response.etag).toBe('12ab34cd56ef');
+
       const files = await response.files();
 
       expect(files.length).toBe(1);
@@ -177,5 +176,25 @@ describe('BitbucketUrlReader', () => {
 
       expect(indexMarkdownFile.toString()).toBe('# Test\n');
     });
+
+    it('throws a NotModifiedError when given a etag in options', async () => {
+      const fnBitbucket = async () => {
+        await bitbucketProcessor.readTree(
+          'https://bitbucket.org/backstage/mock',
+          { etag: '12ab34cd56ef' },
+        );
+      };
+
+      await expect(fnBitbucket).rejects.toThrow(NotModifiedError);
+    });
+
+    it('should not throw a NotModifiedError when given an outdated etag in options', async () => {
+      const response = await bitbucketProcessor.readTree(
+        'https://bitbucket.org/backstage/mock',
+        { etag: 'outdatedetag123abc' },
+      );
+
+      expect(response.etag).toBe('12ab34cd56ef');
+    });
   });
 });
diff --git a/packages/backend-common/src/reading/BitbucketUrlReader.ts b/packages/backend-common/src/reading/BitbucketUrlReader.ts
index 4578436521..869870f248 100644
--- a/packages/backend-common/src/reading/BitbucketUrlReader.ts
+++ b/packages/backend-common/src/reading/BitbucketUrlReader.ts
@@ -25,7 +25,7 @@ import {
 import fetch from 'cross-fetch';
 import parseGitUrl from 'git-url-parse';
 import { Readable } from 'stream';
-import { NotFoundError } from '../errors';
+import { NotFoundError, NotModifiedError } from '../errors';
 import { ReadTreeResponseFactory } from './tree';
 import {
   ReaderFactory,
@@ -105,16 +105,21 @@ export class BitbucketUrlReader implements UrlReader {
       url,
     );
 
+    const lastCommitShortHash = await this.getLastCommitShortHash(url);
+    if (options?.etag && options.etag === lastCommitShortHash) {
+      throw new NotModifiedError();
+    }
+
     const isHosted = resource === 'bitbucket.org';
 
     const downloadUrl = await getBitbucketDownloadUrl(url, this.config);
-    const response = await fetch(
+    const archiveBitbucketResponse = await fetch(
       downloadUrl,
       getBitbucketRequestOptions(this.config),
     );
-    if (!response.ok) {
-      const message = `Failed to read tree from ${url}, ${response.status} ${response.statusText}`;
-      if (response.status === 404) {
+    if (!archiveBitbucketResponse.ok) {
+      const message = `Failed to read tree from ${url}, ${archiveBitbucketResponse.status} ${archiveBitbucketResponse.statusText}`;
+      if (archiveBitbucketResponse.status === 404) {
         throw new NotFoundError(message);
       }
       throw new Error(message);
@@ -122,13 +127,13 @@ export class BitbucketUrlReader implements UrlReader {
 
     let folderPath = `${project}-${repoName}`;
     if (isHosted) {
-      const lastCommitShortHash = await this.getLastCommitShortHash(url);
       folderPath = `${project}-${repoName}-${lastCommitShortHash}`;
     }
 
-    return this.treeResponseFactory.fromZipArchive({
-      stream: (response.body as unknown) as Readable,
+    return await this.treeResponseFactory.fromZipArchive({
+      stream: (archiveBitbucketResponse.body as unknown) as Readable,
       path: `${folderPath}/${filepath}`,
+      etag: lastCommitShortHash,
       filter: options?.filter,
     });
   }
@@ -142,7 +147,7 @@ export class BitbucketUrlReader implements UrlReader {
     return `bitbucket{host=${host},authed=${authed}}`;
   }
 
-  private async getLastCommitShortHash(url: string): Promise<String> {
+  private async getLastCommitShortHash(url: string): Promise<string> {
     const { name: repoName, owner: project, ref } = parseGitUrl(url);
 
     let branch = ref;
diff --git a/packages/backend-common/src/reading/FetchUrlReader.test.ts b/packages/backend-common/src/reading/FetchUrlReader.test.ts
new file mode 100644
index 0000000000..8dc4aba29b
--- /dev/null
+++ b/packages/backend-common/src/reading/FetchUrlReader.test.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { ConfigReader } from '@backstage/config';
+import { msw } from '@backstage/test-utils';
+import { setupServer } from 'msw/node';
+import { getVoidLogger } from '../logging';
+import { FetchUrlReader } from './FetchUrlReader';
+import { ReadTreeResponseFactory } from './tree';
+
+describe('FetchUrlReader', () => {
+  const worker = setupServer();
+
+  msw.setupDefaultHandlers(worker);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('factory should create a single entry with a predicate that matches config', async () => {
+    const entries = FetchUrlReader.factory({
+      config: new ConfigReader({
+        backend: {
+          reading: {
+            allow: [
+              { host: 'example.com' },
+              { host: 'example.com:700' },
+              { host: '*.examples.org' },
+              { host: '*.examples.org:700' },
+            ],
+          },
+        },
+      }),
+      logger: getVoidLogger(),
+      treeResponseFactory: ReadTreeResponseFactory.create({
+        config: new ConfigReader({}),
+      }),
+    });
+
+    expect(entries.length).toBe(1);
+    const [{ predicate }] = entries;
+
+    expect(predicate(new URL('https://example.com/test'))).toBe(true);
+    expect(predicate(new URL('https://a.example.com/test'))).toBe(false);
+    expect(predicate(new URL('https://example.com:600/test'))).toBe(false);
+    expect(predicate(new URL('https://a.example.com:600/test'))).toBe(false);
+    expect(predicate(new URL('https://example.com:700/test'))).toBe(true);
+    expect(predicate(new URL('https://a.example.com:700/test'))).toBe(false);
+    expect(predicate(new URL('https://other.com/test'))).toBe(false);
+    expect(predicate(new URL('https://examples.org/test'))).toBe(false);
+    expect(predicate(new URL('https://a.examples.org/test'))).toBe(true);
+    expect(predicate(new URL('https://a.b.examples.org/test'))).toBe(true);
+    expect(predicate(new URL('https://examples.org:600/test'))).toBe(false);
+    expect(predicate(new URL('https://a.examples.org:600/test'))).toBe(false);
+    expect(predicate(new URL('https://a.b.examples.org:600/test'))).toBe(false);
+    expect(predicate(new URL('https://examples.org:700/test'))).toBe(false);
+    expect(predicate(new URL('https://a.examples.org:700/test'))).toBe(true);
+    expect(predicate(new URL('https://a.b.examples.org:700/test'))).toBe(true);
+  });
+});
diff --git a/packages/backend-common/src/reading/FetchUrlReader.ts b/packages/backend-common/src/reading/FetchUrlReader.ts
index 1d1784590c..81f1dfa90e 100644
--- a/packages/backend-common/src/reading/FetchUrlReader.ts
+++ b/packages/backend-common/src/reading/FetchUrlReader.ts
@@ -16,12 +16,39 @@
 
 import fetch from 'cross-fetch';
 import { NotFoundError } from '../errors';
-import { ReadTreeResponse, UrlReader } from './types';
+import { ReaderFactory, ReadTreeResponse, UrlReader } from './types';
 
 /**
  * A UrlReader that does a plain fetch of the URL.
  */
 export class FetchUrlReader implements UrlReader {
+  /**
+   * The factory creates a single reader that will be used for reading any URL that's listed
+   * in configuration at `backend.reading.allow`. The allow list contains a list of objects describing
+   * targets to allow, containing the following fields:
+   *
+   * `host`:
+   *   Either full hostnames to match, or subdomain wildcard matchers with a leading `*`.
+   *   For example `example.com` and `*.example.com` are valid values, `prod.*.example.com` is not.
+   */
+  static factory: ReaderFactory = ({ config }) => {
+    const predicates =
+      config
+        .getOptionalConfigArray('backend.reading.allow')
+        ?.map(allowConfig => {
+          const host = allowConfig.getString('host');
+          if (host.startsWith('*.')) {
+            const suffix = host.slice(1);
+            return (url: URL) => url.host.endsWith(suffix);
+          }
+          return (url: URL) => url.host === host;
+        }) ?? [];
+
+    const reader = new FetchUrlReader();
+    const predicate = (url: URL) => predicates.some(p => p(url));
+    return [{ reader, predicate }];
+  };
+
   async read(url: string): Promise<Buffer> {
     let response: Response;
     try {
diff --git a/packages/backend-common/src/reading/GithubUrlReader.test.ts b/packages/backend-common/src/reading/GithubUrlReader.test.ts
index 1a0f27d28f..0b7d56480f 100644
--- a/packages/backend-common/src/reading/GithubUrlReader.test.ts
+++ b/packages/backend-common/src/reading/GithubUrlReader.test.ts
@@ -21,6 +21,7 @@ import fs from 'fs';
 import { rest } from 'msw';
 import { setupServer } from 'msw/node';
 import path from 'path';
+import { NotFoundError, NotModifiedError } from '../errors';
 import { GithubUrlReader } from './GithubUrlReader';
 import { ReadTreeResponseFactory } from './tree';
 
@@ -28,11 +29,27 @@ const treeResponseFactory = ReadTreeResponseFactory.create({
   config: new ConfigReader({}),
 });
 
-describe('GithubUrlReader', () => {
-  const mockCredentialsProvider = ({
-    getCredentials: jest.fn().mockResolvedValue({ headers: {} }),
-  } as unknown) as GithubCredentialsProvider;
+const mockCredentialsProvider = ({
+  getCredentials: jest.fn().mockResolvedValue({ headers: {} }),
+} as unknown) as GithubCredentialsProvider;
 
+const githubProcessor = new GithubUrlReader(
+  {
+    host: 'github.com',
+    apiBaseUrl: 'https://api.github.com',
+  },
+  { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
+);
+
+const gheProcessor = new GithubUrlReader(
+  {
+    host: 'ghe.github.com',
+    apiBaseUrl: 'https://ghe.github.com/api/v3',
+  },
+  { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
+);
+
+describe('GithubUrlReader', () => {
   const worker = setupServer();
 
   msw.setupDefaultHandlers(worker);
@@ -43,15 +60,8 @@ describe('GithubUrlReader', () => {
 
   describe('implementation', () => {
     it('rejects unknown targets', async () => {
-      const processor = new GithubUrlReader(
-        {
-          host: 'github.com',
-          apiBaseUrl: 'https://api.github.com',
-        },
-        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
-      );
       await expect(
-        processor.read('https://not.github.com/apa'),
+        githubProcessor.read('https://not.github.com/apa'),
       ).rejects.toThrow(
         'Incorrect URL: https://not.github.com/apa, Error: Invalid GitHub URL or file path',
       );
@@ -73,7 +83,7 @@ describe('GithubUrlReader', () => {
 
       worker.use(
         rest.get(
-          'https://api.github.com/repos/backstage/mock/tree/contents/?ref=repo',
+          'https://api.github.com/repos/backstage/mock/tree/contents/?ref=main',
           (req, res, ctx) => {
             expect(req.headers.get('authorization')).toBe(
               mockHeaders.Authorization,
@@ -90,28 +100,67 @@ describe('GithubUrlReader', () => {
         ),
       );
 
-      const processor = new GithubUrlReader(
-        {
-          host: 'ghe.github.com',
-          apiBaseUrl: 'https://api.github.com',
-        },
-        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
-      );
-      await processor.read(
-        'https://ghe.github.com/backstage/mock/tree/blob/repo',
+      await githubProcessor.read(
+        'https://github.com/backstage/mock/tree/blob/main',
       );
     });
   });
 
   describe('readTree', () => {
     const repoBuffer = fs.readFileSync(
-      path.resolve('src', 'reading', '__fixtures__', 'repo.tar.gz'),
+      path.resolve(
+        'src',
+        'reading',
+        '__fixtures__',
+        'backstage-mock-etag123.tar.gz',
+      ),
     );
 
+    const reposGithubApiResponse = {
+      id: '123',
+      full_name: 'backstage/mock',
+      default_branch: 'main',
+      branches_url:
+        'https://api.github.com/repos/backstage/mock/branches{/branch}',
+      archive_url:
+        'https://api.github.com/repos/backstage/mock/{archive_format}{/ref}',
+    };
+
+    const reposGheApiResponse = {
+      ...reposGithubApiResponse,
+      branches_url:
+        'https://ghe.github.com/api/v3/repos/backstage/mock/branches{/branch}',
+      archive_url:
+        'https://ghe.github.com/api/v3/repos/backstage/mock/{archive_format}{/ref}',
+    };
+
+    const branchesApiResponse = {
+      name: 'main',
+      commit: {
+        sha: 'etag123abc',
+      },
+    };
+
     beforeEach(() => {
       worker.use(
+        rest.get('https://api.github.com/repos/backstage/mock', (_, res, ctx) =>
+          res(
+            ctx.status(200),
+            ctx.set('Content-Type', 'application/json'),
+            ctx.json(reposGithubApiResponse),
+          ),
+        ),
         rest.get(
-          'https://github.com/backstage/mock/archive/repo.tar.gz',
+          'https://api.github.com/repos/backstage/mock/branches/main',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/json'),
+              ctx.json(branchesApiResponse),
+            ),
+        ),
+        rest.get(
+          'https://api.github.com/repos/backstage/mock/tarball/etag123abc',
           (_, res, ctx) =>
             res(
               ctx.status(200),
@@ -119,21 +168,46 @@ describe('GithubUrlReader', () => {
               ctx.body(repoBuffer),
             ),
         ),
+        rest.get(
+          'https://api.github.com/repos/backstage/mock/branches/branchDoesNotExist',
+          (_, res, ctx) => res(ctx.status(404)),
+        ),
+        rest.get(
+          'https://ghe.github.com/api/v3/repos/backstage/mock/tarball/etag123abc',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/x-gzip'),
+              ctx.body(repoBuffer),
+            ),
+        ),
+        rest.get(
+          'https://ghe.github.com/api/v3/repos/backstage/mock',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/json'),
+              ctx.json(reposGheApiResponse),
+            ),
+        ),
+        rest.get(
+          'https://ghe.github.com/api/v3/repos/backstage/mock/branches/main',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/json'),
+              ctx.json(branchesApiResponse),
+            ),
+        ),
       );
     });
 
     it('returns the wanted files from an archive', async () => {
-      const processor = new GithubUrlReader(
-        {
-          host: 'github.com',
-          apiBaseUrl: 'https://api.github.com',
-        },
-        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
+      const response = await githubProcessor.readTree(
+        'https://github.com/backstage/mock/tree/main',
       );
 
-      const response = await processor.readTree(
-        'https://github.com/backstage/mock/tree/repo',
-      );
+      expect(response.etag).toBe('etag123abc');
 
       const files = await response.files();
 
@@ -145,40 +219,6 @@ describe('GithubUrlReader', () => {
       expect(indexMarkdownFile.toString()).toBe('# Test\n');
     });
 
-    it('includes the subdomain in the github url', async () => {
-      worker.resetHandlers();
-      worker.use(
-        rest.get(
-          'https://ghe.github.com/backstage/mock/archive/repo.tar.gz',
-          (_, res, ctx) =>
-            res(
-              ctx.status(200),
-              ctx.set('Content-Type', 'application/x-gzip'),
-              ctx.body(repoBuffer),
-            ),
-        ),
-      );
-
-      const processor = new GithubUrlReader(
-        {
-          host: 'ghe.github.com',
-          apiBaseUrl: 'https://api.github.com',
-        },
-        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
-      );
-
-      const response = await processor.readTree(
-        'https://ghe.github.com/backstage/mock/tree/repo/docs',
-      );
-
-      const files = await response.files();
-
-      expect(files.length).toBe(1);
-      const indexMarkdownFile = await files[0].content();
-
-      expect(indexMarkdownFile.toString()).toBe('# Test\n');
-    });
-
     it('should use the headers from the credentials provider to the fetch request', async () => {
       expect.assertions(2);
 
@@ -193,7 +233,7 @@ describe('GithubUrlReader', () => {
 
       worker.use(
         rest.get(
-          'https://ghe.github.com/backstage/mock/archive/repo.tar.gz',
+          'https://ghe.github.com/api/v3/repos/backstage/mock/tarball/etag123abc',
           (req, res, ctx) => {
             expect(req.headers.get('authorization')).toBe(
               mockHeaders.Authorization,
@@ -210,46 +250,14 @@ describe('GithubUrlReader', () => {
         ),
       );
 
-      const processor = new GithubUrlReader(
-        {
-          host: 'ghe.github.com',
-          apiBaseUrl: 'https://api.github.com',
-        },
-        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
-      );
-
-      await processor.readTree(
-        'https://ghe.github.com/backstage/mock/tree/repo/docs',
+      await gheProcessor.readTree(
+        'https://ghe.github.com/backstage/mock/tree/main',
       );
     });
 
-    it('must specify a branch', async () => {
-      const processor = new GithubUrlReader(
-        {
-          host: 'github.com',
-          apiBaseUrl: 'https://api.github.com',
-        },
-        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
-      );
-
-      await expect(
-        processor.readTree('https://github.com/backstage/mock'),
-      ).rejects.toThrow(
-        'GitHub URL must contain branch to be able to fetch tree',
-      );
-    });
-
-    it('returns the wanted files from an archive with a subpath', async () => {
-      const processor = new GithubUrlReader(
-        {
-          host: 'github.com',
-          apiBaseUrl: 'https://api.github.com',
-        },
-        { treeResponseFactory, credentialsProvider: mockCredentialsProvider },
-      );
-
-      const response = await processor.readTree(
-        'https://github.com/backstage/mock/tree/repo/docs',
+    it('includes the subdomain in the github url', async () => {
+      const response = await gheProcessor.readTree(
+        'https://ghe.github.com/backstage/mock/tree/main/docs',
       );
 
       const files = await response.files();
@@ -259,5 +267,64 @@ describe('GithubUrlReader', () => {
 
       expect(indexMarkdownFile.toString()).toBe('# Test\n');
     });
+
+    it('returns the wanted files from an archive with a subpath', async () => {
+      const response = await githubProcessor.readTree(
+        'https://github.com/backstage/mock/tree/main/docs',
+      );
+
+      const files = await response.files();
+
+      expect(files.length).toBe(1);
+      const indexMarkdownFile = await files[0].content();
+
+      expect(indexMarkdownFile.toString()).toBe('# Test\n');
+    });
+
+    it('throws a NotModifiedError when given a etag in options', async () => {
+      const fnGithub = async () => {
+        await githubProcessor.readTree('https://github.com/backstage/mock', {
+          etag: 'etag123abc',
+        });
+      };
+
+      const fnGhe = async () => {
+        await gheProcessor.readTree(
+          'https://ghe.github.com/backstage/mock/tree/main/docs',
+          {
+            etag: 'etag123abc',
+          },
+        );
+      };
+
+      await expect(fnGithub).rejects.toThrow(NotModifiedError);
+      await expect(fnGhe).rejects.toThrow(NotModifiedError);
+    });
+
+    it('should not throw error when given an outdated etag in options', async () => {
+      const response = await githubProcessor.readTree(
+        'https://github.com/backstage/mock/tree/main',
+        {
+          etag: 'outdatedetag123abc',
+        },
+      );
+      expect((await response.files()).length).toBe(2);
+    });
+
+    it('should detect the default branch', async () => {
+      const response = await githubProcessor.readTree(
+        'https://github.com/backstage/mock',
+      );
+      expect((await response.files()).length).toBe(2);
+    });
+
+    it('should throw error on missing branch', async () => {
+      const fnGithub = async () => {
+        await githubProcessor.readTree(
+          'https://github.com/backstage/mock/tree/branchDoesNotExist',
+        );
+      };
+      await expect(fnGithub).rejects.toThrow(NotFoundError);
+    });
   });
 });
diff --git a/packages/backend-common/src/reading/GithubUrlReader.ts b/packages/backend-common/src/reading/GithubUrlReader.ts
index 45ce8336e6..b5b4e9c1a7 100644
--- a/packages/backend-common/src/reading/GithubUrlReader.ts
+++ b/packages/backend-common/src/reading/GithubUrlReader.ts
@@ -23,7 +23,7 @@ import {
 import fetch from 'cross-fetch';
 import parseGitUrl from 'git-url-parse';
 import { Readable } from 'stream';
-import { InputError, NotFoundError } from '../errors';
+import { NotFoundError, NotModifiedError } from '../errors';
 import { ReadTreeResponseFactory } from './tree';
 import {
   ReaderFactory,
@@ -98,51 +98,93 @@ export class GithubUrlReader implements UrlReader {
     url: string,
     options?: ReadTreeOptions,
   ): Promise<ReadTreeResponse> {
-    const {
-      name: repoName,
-      ref,
-      protocol,
-      resource,
-      full_name,
-      filepath,
-    } = parseGitUrl(url);
-
-    if (!ref) {
-      // TODO(Rugvip): We should add support for defaulting to the default branch
-      throw new InputError(
-        'GitHub URL must contain branch to be able to fetch tree',
-      );
-    }
+    const { ref, filepath, full_name } = parseGitUrl(url);
+    // Caveat: The ref will totally be incorrect if the branch name includes a /
+    // Thus, readTree can not work on url containing branch name that has a /
 
     const { headers } = await this.deps.credentialsProvider.getCredentials({
       url,
     });
-    // TODO(Rugvip): use API to fetch URL instead
-    const response = await fetch(
-      new URL(
-        `${protocol}://${resource}/${full_name}/archive/${ref}.tar.gz`,
-      ).toString(),
+
+    // Get GitHub API urls for the repository
+    const repoGitHubResponse = await fetch(
+      new URL(`${this.config.apiBaseUrl}/repos/${full_name}`).toString(),
       {
-        headers: {
-          ...headers,
-        },
+        headers,
       },
     );
-    if (!response.ok) {
-      const message = `Failed to read tree from ${url}, ${response.status} ${response.statusText}`;
-      if (response.status === 404) {
+    if (!repoGitHubResponse.ok) {
+      const message = `Failed to read tree (repository) from ${url}, ${repoGitHubResponse.status} ${repoGitHubResponse.statusText}`;
+      if (repoGitHubResponse.status === 404) {
         throw new NotFoundError(message);
       }
       throw new Error(message);
     }
 
-    const path = `${repoName}-${ref}/${filepath}`;
+    const repoResponseJson = await repoGitHubResponse.json();
 
-    return this.deps.treeResponseFactory.fromTarArchive({
+    // ref is an empty string if no branch is set in provided url to readTree.
+    // Use GitHub API to get the default branch of the repository.
+    const branch = ref || repoResponseJson.default_branch;
+    const branchesApiUrl = repoResponseJson.branches_url;
+    const archiveApiUrl = repoResponseJson.archive_url;
+
+    // Fetch the latest commit in the provided or default branch to compare against
+    // the provided sha.
+    const branchGitHubResponse = await fetch(
+      // branchesApiUrl looks like "https://api.github.com/repos/owner/repo/branches{/branch}"
+      branchesApiUrl.replace('{/branch}', `/${branch}`),
+      {
+        headers,
+      },
+    );
+    if (!branchGitHubResponse.ok) {
+      const message = `Failed to read tree (branch) from ${url}, ${branchGitHubResponse.status} ${branchGitHubResponse.statusText}`;
+      if (branchGitHubResponse.status === 404) {
+        throw new NotFoundError(message);
+      }
+      throw new Error(message);
+    }
+    const commitSha = (await branchGitHubResponse.json()).commit.sha;
+
+    if (options?.etag && options.etag === commitSha) {
+      throw new NotModifiedError();
+    }
+
+    const archive = await fetch(
+      // archiveApiUrl looks like "https://api.github.com/repos/owner/repo/{archive_format}{/ref}"
+      archiveApiUrl
+        .replace('{archive_format}', 'tarball')
+        .replace('{/ref}', `/${commitSha}`),
+      { headers },
+    );
+    if (!archive.ok) {
+      const message = `Failed to read tree (archive) from ${url}, ${archive.status} ${archive.statusText}`;
+      if (archive.status === 404) {
+        throw new NotFoundError(message);
+      }
+      throw new Error(message);
+    }
+
+    // Note that repoResponseJson.full_name must be used over full_name because the path
+    // is case sensitive and full_name may not be inq the correct case.
+    // TODO(OrkoHunter): The directory name inside the tarball should be retrieved from the tar
+    // instead of being constructed here. Same goes for GitLab, Bitbucket and Azure.
+    const extractedDirName = `${repoResponseJson.full_name.replace(
+      '/',
+      '-',
+    )}-${commitSha.substr(0, 7)}`;
+
+    // The path includes the name of the directory inside the tarball and a sub path
+    // if requested in readTree.
+    const path = `${extractedDirName}/${filepath}`;
+
+    return await this.deps.treeResponseFactory.fromTarArchive({
       // TODO(Rugvip): Underlying implementation of fetch will be node-fetch, we probably want
       //               to stick to using that in exclusively backend code.
-      stream: (response.body as unknown) as Readable,
+      stream: (archive.body as unknown) as Readable,
       path,
+      etag: commitSha,
       filter: options?.filter,
     });
   }
diff --git a/packages/backend-common/src/reading/GitlabUrlReader.test.ts b/packages/backend-common/src/reading/GitlabUrlReader.test.ts
index 6cc5e30dbd..2e66794397 100644
--- a/packages/backend-common/src/reading/GitlabUrlReader.test.ts
+++ b/packages/backend-common/src/reading/GitlabUrlReader.test.ts
@@ -23,6 +23,7 @@ import path from 'path';
 import { getVoidLogger } from '../logging';
 import { GitlabUrlReader } from './GitlabUrlReader';
 import { ReadTreeResponseFactory } from './tree';
+import { NotModifiedError, NotFoundError } from '../errors';
 
 const logger = getVoidLogger();
 
@@ -30,6 +31,22 @@ const treeResponseFactory = ReadTreeResponseFactory.create({
   config: new ConfigReader({}),
 });
 
+const gitlabProcessor = new GitlabUrlReader(
+  {
+    host: 'gitlab.com',
+    apiBaseUrl: 'https://gitlab.com/api/v4',
+  },
+  { treeResponseFactory },
+);
+
+const hostedGitlabProcessor = new GitlabUrlReader(
+  {
+    host: 'gitlab.mycompany.com',
+    apiBaseUrl: 'https://gitlab.mycompany.com/api/v4',
+  },
+  { treeResponseFactory },
+);
+
 describe('GitlabUrlReader', () => {
   const worker = setupServer();
   msw.setupDefaultHandlers(worker);
@@ -136,39 +153,94 @@ describe('GitlabUrlReader', () => {
   });
 
   describe('readTree', () => {
-    const repoBuffer = fs.readFileSync(
-      path.resolve('src', 'reading', '__fixtures__', 'repo.zip'),
+    const archiveBuffer = fs.readFileSync(
+      path.resolve('src', 'reading', '__fixtures__', 'gitlab-archive.zip'),
     );
 
+    const projectGitlabApiResponse = {
+      id: 11111111,
+      default_branch: 'main',
+    };
+
+    const branchGitlabApiResponse = {
+      commit: {
+        id: 'sha123abc',
+      },
+    };
+
     beforeEach(() => {
       worker.use(
         rest.get(
-          'https://gitlab.com/backstage/mock/-/archive/repo/mock-repo.zip',
+          'https://gitlab.com/api/v4/projects/backstage%2Fmock/repository/archive.zip?sha=main',
           (_, res, ctx) =>
             res(
               ctx.status(200),
               ctx.set('Content-Type', 'application/zip'),
-              ctx.body(repoBuffer),
+              ctx.body(archiveBuffer),
+            ),
+        ),
+        rest.get(
+          'https://gitlab.com/api/v4/projects/backstage%2Fmock',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/json'),
+              ctx.json(projectGitlabApiResponse),
+            ),
+        ),
+        rest.get(
+          'https://gitlab.com/api/v4/projects/backstage%2Fmock/repository/branches/main',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/json'),
+              ctx.json(branchGitlabApiResponse),
+            ),
+        ),
+        rest.get(
+          'https://gitlab.com/api/v4/projects/backstage%2Fmock/repository/branches/branchDoesNotExist',
+          (_, res, ctx) => res(ctx.status(404)),
+        ),
+        rest.get(
+          'https://gitlab.mycompany.com/api/v4/projects/backstage%2Fmock',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/json'),
+              ctx.json(projectGitlabApiResponse),
+            ),
+        ),
+        rest.get(
+          'https://gitlab.mycompany.com/api/v4/projects/backstage%2Fmock/repository/branches/main',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/json'),
+              ctx.json(branchGitlabApiResponse),
+            ),
+        ),
+        rest.get(
+          'https://gitlab.mycompany.com/api/v4/projects/backstage%2Fmock/repository/archive.zip?sha=main',
+          (_, res, ctx) =>
+            res(
+              ctx.status(200),
+              ctx.set('Content-Type', 'application/zip'),
+              ctx.body(archiveBuffer),
             ),
         ),
       );
     });
 
     it('returns the wanted files from an archive', async () => {
-      const processor = new GitlabUrlReader(
-        { host: 'gitlab.com' },
-        { treeResponseFactory },
-      );
-
-      const response = await processor.readTree(
-        'https://gitlab.com/backstage/mock/tree/repo',
+      const response = await gitlabProcessor.readTree(
+        'https://gitlab.com/backstage/mock/tree/main',
       );
 
       const files = await response.files();
       expect(files.length).toBe(2);
 
-      const indexMarkdownFile = await files[0].content();
-      const mkDocsFile = await files[1].content();
+      const mkDocsFile = await files[0].content();
+      const indexMarkdownFile = await files[1].content();
 
       expect(mkDocsFile.toString()).toBe('site_name: Test\n');
       expect(indexMarkdownFile.toString()).toBe('# Test\n');
@@ -177,23 +249,18 @@ describe('GitlabUrlReader', () => {
     it('returns the wanted files from hosted gitlab', async () => {
       worker.use(
         rest.get(
-          'https://git.mycompany.com/backstage/mock/-/archive/repo/mock-repo.zip',
+          'https://gitlab.mycompany.com/backstage/mock/-/archive/main.zip',
           (_, res, ctx) =>
             res(
               ctx.status(200),
               ctx.set('Content-Type', 'application/zip'),
-              ctx.body(repoBuffer),
+              ctx.body(archiveBuffer),
             ),
         ),
       );
 
-      const processor = new GitlabUrlReader(
-        { host: 'git.mycompany.com' },
-        { treeResponseFactory },
-      );
-
-      const response = await processor.readTree(
-        'https://git.mycompany.com/backstage/mock/tree/repo/docs',
+      const response = await hostedGitlabProcessor.readTree(
+        'https://gitlab.mycompany.com/backstage/mock/tree/main/docs',
       );
 
       const files = await response.files();
@@ -204,27 +271,9 @@ describe('GitlabUrlReader', () => {
       expect(indexMarkdownFile.toString()).toBe('# Test\n');
     });
 
-    it('throws an error when branch is not specified', async () => {
-      const processor = new GitlabUrlReader(
-        { host: 'gitlab.com' },
-        { treeResponseFactory },
-      );
-
-      await expect(
-        processor.readTree('https://gitlab.com/backstage/mock'),
-      ).rejects.toThrow(
-        'GitLab URL must contain a branch to be able to fetch its tree',
-      );
-    });
-
     it('returns the wanted files from an archive with a subpath', async () => {
-      const processor = new GitlabUrlReader(
-        { host: 'gitlab.com' },
-        { treeResponseFactory },
-      );
-
-      const response = await processor.readTree(
-        'https://gitlab.com/backstage/mock/tree/repo/docs',
+      const response = await gitlabProcessor.readTree(
+        'https://gitlab.com/backstage/mock/tree/main/docs',
       );
 
       const files = await response.files();
@@ -234,5 +283,51 @@ describe('GitlabUrlReader', () => {
 
       expect(indexMarkdownFile.toString()).toBe('# Test\n');
     });
+
+    it('throws a NotModifiedError when given a etag in options', async () => {
+      const fnGitlab = async () => {
+        await gitlabProcessor.readTree('https://gitlab.com/backstage/mock', {
+          etag: 'sha123abc',
+        });
+      };
+
+      const fnHostedGitlab = async () => {
+        await hostedGitlabProcessor.readTree(
+          'https://gitlab.mycompany.com/backstage/mock',
+          {
+            etag: 'sha123abc',
+          },
+        );
+      };
+
+      await expect(fnGitlab).rejects.toThrow(NotModifiedError);
+      await expect(fnHostedGitlab).rejects.toThrow(NotModifiedError);
+    });
+
+    it('should not throw error when given an outdated etag in options', async () => {
+      const response = await gitlabProcessor.readTree(
+        'https://gitlab.com/backstage/mock/tree/main',
+        {
+          etag: 'outdatedsha123abc',
+        },
+      );
+      expect((await response.files()).length).toBe(2);
+    });
+
+    it('should detect the default branch', async () => {
+      const response = await gitlabProcessor.readTree(
+        'https://gitlab.com/backstage/mock',
+      );
+      expect((await response.files()).length).toBe(2);
+    });
+
+    it('should throw error on missing branch', async () => {
+      const fnGithub = async () => {
+        await gitlabProcessor.readTree(
+          'https://gitlab.com/backstage/mock/tree/branchDoesNotExist',
+        );
+      };
+      await expect(fnGithub).rejects.toThrow(NotFoundError);
+    });
   });
 });
diff --git a/packages/backend-common/src/reading/GitlabUrlReader.ts b/packages/backend-common/src/reading/GitlabUrlReader.ts
index 299bbc783b..72db901ac1 100644
--- a/packages/backend-common/src/reading/GitlabUrlReader.ts
+++ b/packages/backend-common/src/reading/GitlabUrlReader.ts
@@ -21,7 +21,7 @@ import {
   readGitLabIntegrationConfigs,
 } from '@backstage/integration';
 import fetch from 'cross-fetch';
-import { InputError, NotFoundError } from '../errors';
+import { NotFoundError, NotModifiedError } from '../errors';
 import { ReadTreeResponseFactory } from './tree';
 import {
   ReaderFactory,
@@ -39,26 +39,26 @@ export class GitlabUrlReader implements UrlReader {
     const configs = readGitLabIntegrationConfigs(
       config.getOptionalConfigArray('integrations.gitlab') ?? [],
     );
-    return configs.map(options => {
-      const reader = new GitlabUrlReader(options, { treeResponseFactory });
-      const predicate = (url: URL) => url.host === options.host;
+    return configs.map(provider => {
+      const reader = new GitlabUrlReader(provider, { treeResponseFactory });
+      const predicate = (url: URL) => url.host === provider.host;
       return { reader, predicate };
     });
   };
 
   constructor(
-    private readonly options: GitLabIntegrationConfig,
+    private readonly config: GitLabIntegrationConfig,
     deps: { treeResponseFactory: ReadTreeResponseFactory },
   ) {
     this.treeResponseFactory = deps.treeResponseFactory;
   }
 
   async read(url: string): Promise<Buffer> {
-    const builtUrl = await getGitLabFileFetchUrl(url, this.options);
+    const builtUrl = await getGitLabFileFetchUrl(url, this.config);
 
     let response: Response;
     try {
-      response = await fetch(builtUrl, getGitLabRequestOptions(this.options));
+      response = await fetch(builtUrl, getGitLabRequestOptions(this.config));
     } catch (e) {
       throw new Error(`Unable to read ${url}, ${e}`);
     }
@@ -78,45 +78,82 @@ export class GitlabUrlReader implements UrlReader {
     url: string,
     options?: ReadTreeOptions,
   ): Promise<ReadTreeResponse> {
-    const {
-      name: repoName,
-      ref,
-      protocol,
-      resource,
-      full_name,
-      filepath,
-    } = parseGitUrl(url);
+    const { name: repoName, ref, full_name, filepath } = parseGitUrl(url);
 
-    if (!ref) {
-      throw new InputError(
-        'GitLab URL must contain a branch to be able to fetch its tree',
-      );
-    }
-
-    const archive = `${protocol}://${resource}/${full_name}/-/archive/${ref}/${repoName}-${ref}.zip`;
-    const response = await fetch(
-      archive,
-      getGitLabRequestOptions(this.options),
+    // Use GitLab API to get the default branch
+    // encodeURIComponent is required for GitLab API
+    // https://docs.gitlab.com/ee/api/README.html#namespaced-path-encoding
+    const projectGitlabResponse = await fetch(
+      new URL(
+        `${this.config.apiBaseUrl}/projects/${encodeURIComponent(full_name)}`,
+      ).toString(),
+      getGitLabRequestOptions(this.config),
     );
-    if (!response.ok) {
-      const msg = `Failed to read tree from ${url}, ${response.status} ${response.statusText}`;
-      if (response.status === 404) {
+    if (!projectGitlabResponse.ok) {
+      const msg = `Failed to read tree from ${url}, ${projectGitlabResponse.status} ${projectGitlabResponse.statusText}`;
+      if (projectGitlabResponse.status === 404) {
         throw new NotFoundError(msg);
       }
       throw new Error(msg);
     }
+    const projectGitlabResponseJson = await projectGitlabResponse.json();
 
-    const path = filepath ? `${repoName}-${ref}/${filepath}/` : '';
+    // ref is an empty string if no branch is set in provided url to readTree.
+    const branch = ref || projectGitlabResponseJson.default_branch;
 
-    return this.treeResponseFactory.fromZipArchive({
-      stream: (response.body as unknown) as Readable,
+    // Fetch the latest commit in the provided or default branch to compare against
+    // the provided sha.
+    const branchGitlabResponse = await fetch(
+      new URL(
+        `${this.config.apiBaseUrl}/projects/${encodeURIComponent(
+          full_name,
+        )}/repository/branches/${branch}`,
+      ).toString(),
+      getGitLabRequestOptions(this.config),
+    );
+    if (!branchGitlabResponse.ok) {
+      const message = `Failed to read tree (branch) from ${url}, ${branchGitlabResponse.status} ${branchGitlabResponse.statusText}`;
+      if (branchGitlabResponse.status === 404) {
+        throw new NotFoundError(message);
+      }
+      throw new Error(message);
+    }
+
+    const commitSha = (await branchGitlabResponse.json()).commit.id;
+
+    if (options?.etag && options.etag === commitSha) {
+      throw new NotModifiedError();
+    }
+
+    // https://docs.gitlab.com/ee/api/repositories.html#get-file-archive
+    const archiveGitLabResponse = await fetch(
+      `${this.config.apiBaseUrl}/projects/${encodeURIComponent(
+        full_name,
+      )}/repository/archive.zip?sha=${branch}`,
+      getGitLabRequestOptions(this.config),
+    );
+    if (!archiveGitLabResponse.ok) {
+      const message = `Failed to read tree (archive) from ${url}, ${archiveGitLabResponse.status} ${archiveGitLabResponse.statusText}`;
+      if (archiveGitLabResponse.status === 404) {
+        throw new NotFoundError(message);
+      }
+      throw new Error(message);
+    }
+
+    const path = filepath
+      ? `${repoName}-${branch}-${commitSha}/${filepath}/`
+      : '';
+
+    return await this.treeResponseFactory.fromZipArchive({
+      stream: (archiveGitLabResponse.body as unknown) as Readable,
       path,
+      etag: commitSha,
       filter: options?.filter,
     });
   }
 
   toString() {
-    const { host, token } = this.options;
+    const { host, token } = this.config;
     return `gitlab{host=${host},authed=${Boolean(token)}}`;
   }
 }
diff --git a/packages/backend-common/src/reading/UrlReaderPredicateMux.ts b/packages/backend-common/src/reading/UrlReaderPredicateMux.ts
index 465c125fda..3183aa0c28 100644
--- a/packages/backend-common/src/reading/UrlReaderPredicateMux.ts
+++ b/packages/backend-common/src/reading/UrlReaderPredicateMux.ts
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+import { NotAllowedError } from '../errors';
 import {
   ReadTreeOptions,
   ReadTreeResponse,
@@ -21,22 +22,12 @@ import {
   UrlReaderPredicateTuple,
 } from './types';
 
-type Options = {
-  // UrlReader to fall back to if no other reader is matched
-  fallback?: UrlReader;
-};
-
 /**
  * A UrlReader implementation that selects from a set of UrlReaders
  * based on a predicate tied to each reader.
  */
 export class UrlReaderPredicateMux implements UrlReader {
   private readonly readers: UrlReaderPredicateTuple[] = [];
-  private readonly fallback?: UrlReader;
-
-  constructor({ fallback }: Options) {
-    this.fallback = fallback;
-  }
 
   register(tuple: UrlReaderPredicateTuple): void {
     this.readers.push(tuple);
@@ -51,32 +42,25 @@ export class UrlReaderPredicateMux implements UrlReader {
       }
     }
 
-    if (this.fallback) {
-      return this.fallback.read(url);
-    }
-
-    throw new Error(`No reader found that could handle '${url}'`);
+    throw new NotAllowedError(`Reading from '${url}' is not allowed`);
   }
 
-  readTree(url: string, options?: ReadTreeOptions): Promise<ReadTreeResponse> {
+  async readTree(
+    url: string,
+    options?: ReadTreeOptions,
+  ): Promise<ReadTreeResponse> {
     const parsed = new URL(url);
 
     for (const { predicate, reader } of this.readers) {
       if (predicate(parsed)) {
-        return reader.readTree(url, options);
+        return await reader.readTree(url, options);
       }
     }
 
-    if (this.fallback) {
-      return this.fallback.readTree(url, options);
-    }
-
-    throw new Error(`No reader found that could handle '${url}'`);
+    throw new NotAllowedError(`Reading from '${url}' is not allowed`);
   }
 
   toString() {
-    return `predicateMux{readers=${this.readers
-      .map(t => t.reader)
-      .join(',')},fallback=${this.fallback}}`;
+    return `predicateMux{readers=${this.readers.map(t => t.reader).join(',')}`;
   }
 }
diff --git a/packages/backend-common/src/reading/UrlReaders.ts b/packages/backend-common/src/reading/UrlReaders.ts
index 2bb5617907..2f233463bb 100644
--- a/packages/backend-common/src/reading/UrlReaders.ts
+++ b/packages/backend-common/src/reading/UrlReaders.ts
@@ -22,8 +22,8 @@ import { AzureUrlReader } from './AzureUrlReader';
 import { BitbucketUrlReader } from './BitbucketUrlReader';
 import { GithubUrlReader } from './GithubUrlReader';
 import { GitlabUrlReader } from './GitlabUrlReader';
-import { FetchUrlReader } from './FetchUrlReader';
 import { ReadTreeResponseFactory } from './tree';
+import { FetchUrlReader } from './FetchUrlReader';
 
 type CreateOptions = {
   /** Root config object */
@@ -32,8 +32,6 @@ type CreateOptions = {
   logger: Logger;
   /** A list of factories used to construct individual readers that match on URLs */
   factories?: ReaderFactory[];
-  /** Fallback reader to use if none of the readers created by the factories match */
-  fallback?: UrlReader;
 };
 
 /**
@@ -43,13 +41,8 @@ export class UrlReaders {
   /**
    * Creates a UrlReader without any known types.
    */
-  static create({
-    logger,
-    config,
-    factories,
-    fallback,
-  }: CreateOptions): UrlReader {
-    const mux = new UrlReaderPredicateMux({ fallback: fallback });
+  static create({ logger, config, factories }: CreateOptions): UrlReader {
+    const mux = new UrlReaderPredicateMux();
     const treeResponseFactory = ReadTreeResponseFactory.create({ config });
 
     for (const factory of factories ?? []) {
@@ -67,10 +60,8 @@ export class UrlReaders {
    * Creates a UrlReader that includes all the default factories from this package.
    *
    * Any additional factories passed will be loaded before the default ones.
-   *
-   * If no fallback reader is passed, a plain fetch reader will be used.
    */
-  static default({ logger, config, factories = [], fallback }: CreateOptions) {
+  static default({ logger, config, factories = [] }: CreateOptions) {
     return UrlReaders.create({
       logger,
       config,
@@ -79,8 +70,8 @@ export class UrlReaders {
         BitbucketUrlReader.factory,
         GithubUrlReader.factory,
         GitlabUrlReader.factory,
+        FetchUrlReader.factory,
       ]),
-      fallback: fallback ?? new FetchUrlReader(),
     });
   }
 }
diff --git a/packages/backend-common/src/reading/__fixtures__/backstage-mock-etag123.tar.gz b/packages/backend-common/src/reading/__fixtures__/backstage-mock-etag123.tar.gz
new file mode 100644
index 0000000000..e1ac2579de
Binary files /dev/null and b/packages/backend-common/src/reading/__fixtures__/backstage-mock-etag123.tar.gz differ
diff --git a/packages/backend-common/src/reading/__fixtures__/gitlab-archive.zip b/packages/backend-common/src/reading/__fixtures__/gitlab-archive.zip
new file mode 100644
index 0000000000..884ec20004
Binary files /dev/null and b/packages/backend-common/src/reading/__fixtures__/gitlab-archive.zip differ
diff --git a/packages/backend-common/src/reading/__fixtures__/mock-main.tar.gz b/packages/backend-common/src/reading/__fixtures__/mock-main.tar.gz
new file mode 100644
index 0000000000..291690b447
Binary files /dev/null and b/packages/backend-common/src/reading/__fixtures__/mock-main.tar.gz differ
diff --git a/packages/backend-common/src/reading/__fixtures__/mock-main.zip b/packages/backend-common/src/reading/__fixtures__/mock-main.zip
new file mode 100644
index 0000000000..beee59d3a0
Binary files /dev/null and b/packages/backend-common/src/reading/__fixtures__/mock-main.zip differ
diff --git a/packages/backend-common/src/reading/__fixtures__/repo.tar.gz b/packages/backend-common/src/reading/__fixtures__/repo.tar.gz
deleted file mode 100644
index 7a8e9902a2..0000000000
Binary files a/packages/backend-common/src/reading/__fixtures__/repo.tar.gz and /dev/null differ
diff --git a/packages/backend-common/src/reading/__fixtures__/repo.zip b/packages/backend-common/src/reading/__fixtures__/repo.zip
deleted file mode 100644
index f66bf2d612..0000000000
Binary files a/packages/backend-common/src/reading/__fixtures__/repo.zip and /dev/null differ
diff --git a/packages/backend-common/src/reading/tree/ReadTreeResponseFactory.ts b/packages/backend-common/src/reading/tree/ReadTreeResponseFactory.ts
index 986a0302bc..7332154d09 100644
--- a/packages/backend-common/src/reading/tree/ReadTreeResponseFactory.ts
+++ b/packages/backend-common/src/reading/tree/ReadTreeResponseFactory.ts
@@ -26,6 +26,8 @@ type FromArchiveOptions = {
   stream: Readable;
   // If set, the root of the tree will be set to the given directory path.
   path?: string;
+  // etag of the blob
+  etag: string;
   // Filter passed on from the ReadTreeOptions
   filter?: (path: string) => boolean;
 };
@@ -45,6 +47,7 @@ export class ReadTreeResponseFactory {
       options.stream,
       options.path ?? '',
       this.workDir,
+      options.etag,
       options.filter,
     );
   }
@@ -54,6 +57,7 @@ export class ReadTreeResponseFactory {
       options.stream,
       options.path ?? '',
       this.workDir,
+      options.etag,
       options.filter,
     );
   }
diff --git a/packages/backend-common/src/reading/tree/TarArchiveResponse.test.ts b/packages/backend-common/src/reading/tree/TarArchiveResponse.test.ts
index 1bc0d3a386..2cbfc4a89e 100644
--- a/packages/backend-common/src/reading/tree/TarArchiveResponse.test.ts
+++ b/packages/backend-common/src/reading/tree/TarArchiveResponse.test.ts
@@ -20,7 +20,7 @@ import { resolve as resolvePath } from 'path';
 import { TarArchiveResponse } from './TarArchiveResponse';
 
 const archiveData = fs.readFileSync(
-  resolvePath(__filename, '../../__fixtures__/repo.tar.gz'),
+  resolvePath(__filename, '../../__fixtures__/mock-main.tar.gz'),
 );
 
 describe('TarArchiveResponse', () => {
@@ -38,7 +38,7 @@ describe('TarArchiveResponse', () => {
   it('should read files', async () => {
     const stream = fs.createReadStream('/test-archive.tar.gz');
 
-    const res = new TarArchiveResponse(stream, 'mock-repo/', '/tmp');
+    const res = new TarArchiveResponse(stream, 'mock-main/', '/tmp', 'etag');
     const files = await res.files();
 
     expect(files).toEqual([
@@ -61,8 +61,12 @@ describe('TarArchiveResponse', () => {
   it('should read files with filter', async () => {
     const stream = fs.createReadStream('/test-archive.tar.gz');
 
-    const res = new TarArchiveResponse(stream, 'mock-repo/', '/tmp', path =>
-      path.endsWith('.yml'),
+    const res = new TarArchiveResponse(
+      stream,
+      'mock-main/',
+      '/tmp',
+      'etag',
+      path => path.endsWith('.yml'),
     );
     const files = await res.files();
 
@@ -79,14 +83,14 @@ describe('TarArchiveResponse', () => {
   it('should read as archive and files', async () => {
     const stream = fs.createReadStream('/test-archive.tar.gz');
 
-    const res = new TarArchiveResponse(stream, 'mock-repo/', '/tmp');
+    const res = new TarArchiveResponse(stream, 'mock-main/', '/tmp', 'etag');
     const buffer = await res.archive();
 
     await expect(res.archive()).rejects.toThrow(
       'Response has already been read',
     );
 
-    const res2 = new TarArchiveResponse(buffer, '', '/tmp');
+    const res2 = new TarArchiveResponse(buffer, '', '/tmp', 'etag');
     const files = await res2.files();
 
     expect(files).toEqual([
@@ -109,21 +113,26 @@ describe('TarArchiveResponse', () => {
   it('should extract entire archive into directory', async () => {
     const stream = fs.createReadStream('/test-archive.tar.gz');
 
-    const res = new TarArchiveResponse(stream, '', '/tmp');
+    const res = new TarArchiveResponse(stream, '', '/tmp', 'etag');
     const dir = await res.dir();
 
     await expect(
-      fs.readFile(resolvePath(dir, 'mock-repo/mkdocs.yml'), 'utf8'),
+      fs.readFile(resolvePath(dir, 'mock-main/mkdocs.yml'), 'utf8'),
     ).resolves.toBe('site_name: Test\n');
     await expect(
-      fs.readFile(resolvePath(dir, 'mock-repo/docs/index.md'), 'utf8'),
+      fs.readFile(resolvePath(dir, 'mock-main/docs/index.md'), 'utf8'),
     ).resolves.toBe('# Test\n');
   });
 
   it('should extract archive into directory with a subpath', async () => {
     const stream = fs.createReadStream('/test-archive.tar.gz');
 
-    const res = new TarArchiveResponse(stream, 'mock-repo/docs/', '/tmp');
+    const res = new TarArchiveResponse(
+      stream,
+      'mock-main/docs/',
+      '/tmp',
+      'etag',
+    );
     const dir = await res.dir();
 
     expect(dir).toMatch(/^[\/\\]tmp[\/\\].*$/);
@@ -135,8 +144,12 @@ describe('TarArchiveResponse', () => {
   it('should extract archive into directory with a subpath and filter', async () => {
     const stream = fs.createReadStream('/test-archive.tar.gz');
 
-    const res = new TarArchiveResponse(stream, 'mock-repo/', '/tmp', path =>
-      path.endsWith('.yml'),
+    const res = new TarArchiveResponse(
+      stream,
+      'mock-main/',
+      '/tmp',
+      'etag',
+      path => path.endsWith('.yml'),
     );
     const dir = await res.dir({ targetDir: '/tmp' });
 
diff --git a/packages/backend-common/src/reading/tree/TarArchiveResponse.ts b/packages/backend-common/src/reading/tree/TarArchiveResponse.ts
index 5d18ec7dc6..5927eb75a1 100644
--- a/packages/backend-common/src/reading/tree/TarArchiveResponse.ts
+++ b/packages/backend-common/src/reading/tree/TarArchiveResponse.ts
@@ -41,6 +41,7 @@ export class TarArchiveResponse implements ReadTreeResponse {
     private readonly stream: Readable,
     private readonly subPath: string,
     private readonly workDir: string,
+    public readonly etag: string,
     private readonly filter?: (path: string) => boolean,
   ) {
     if (subPath) {
@@ -53,6 +54,8 @@ export class TarArchiveResponse implements ReadTreeResponse {
         );
       }
     }
+
+    this.etag = etag;
   }
 
   // Make sure the input stream is only read once
diff --git a/packages/backend-common/src/reading/tree/ZipArchiveResponse.test.ts b/packages/backend-common/src/reading/tree/ZipArchiveResponse.test.ts
index 6c2592ffce..b42ec79d81 100644
--- a/packages/backend-common/src/reading/tree/ZipArchiveResponse.test.ts
+++ b/packages/backend-common/src/reading/tree/ZipArchiveResponse.test.ts
@@ -20,7 +20,7 @@ import { resolve as resolvePath } from 'path';
 import { ZipArchiveResponse } from './ZipArchiveResponse';
 
 const archiveData = fs.readFileSync(
-  resolvePath(__filename, '../../__fixtures__/repo.zip'),
+  resolvePath(__filename, '../../__fixtures__/mock-main.zip'),
 );
 
 describe('ZipArchiveResponse', () => {
@@ -38,31 +38,35 @@ describe('ZipArchiveResponse', () => {
   it('should read files', async () => {
     const stream = fs.createReadStream('/test-archive.zip');
 
-    const res = new ZipArchiveResponse(stream, 'mock-repo/', '/tmp');
+    const res = new ZipArchiveResponse(stream, 'mock-main/', '/tmp', 'etag');
     const files = await res.files();
 
     expect(files).toEqual([
       {
-        path: 'docs/index.md',
+        path: 'mkdocs.yml',
         content: expect.any(Function),
       },
       {
-        path: 'mkdocs.yml',
+        path: 'docs/index.md',
         content: expect.any(Function),
       },
     ]);
     const contents = await Promise.all(files.map(f => f.content()));
     expect(contents.map(c => c.toString('utf8').trim())).toEqual([
-      '# Test',
       'site_name: Test',
+      '# Test',
     ]);
   });
 
   it('should read files with filter', async () => {
     const stream = fs.createReadStream('/test-archive.zip');
 
-    const res = new ZipArchiveResponse(stream, 'mock-repo/', '/tmp', path =>
-      path.endsWith('.yml'),
+    const res = new ZipArchiveResponse(
+      stream,
+      'mock-main/',
+      '/tmp',
+      'etag',
+      path => path.endsWith('.yml'),
     );
     const files = await res.files();
 
@@ -79,51 +83,56 @@ describe('ZipArchiveResponse', () => {
   it('should read as archive and files', async () => {
     const stream = fs.createReadStream('/test-archive.zip');
 
-    const res = new ZipArchiveResponse(stream, 'mock-repo/', '/tmp');
+    const res = new ZipArchiveResponse(stream, 'mock-main/', '/tmp', 'etag');
     const buffer = await res.archive();
 
     await expect(res.archive()).rejects.toThrow(
       'Response has already been read',
     );
 
-    const res2 = new ZipArchiveResponse(buffer, '', '/tmp');
+    const res2 = new ZipArchiveResponse(buffer, '', '/tmp', 'etag');
     const files = await res2.files();
 
     expect(files).toEqual([
       {
-        path: 'docs/index.md',
+        path: 'mkdocs.yml',
         content: expect.any(Function),
       },
       {
-        path: 'mkdocs.yml',
+        path: 'docs/index.md',
         content: expect.any(Function),
       },
     ]);
     const contents = await Promise.all(files.map(f => f.content()));
     expect(contents.map(c => c.toString('utf8').trim())).toEqual([
-      '# Test',
       'site_name: Test',
+      '# Test',
     ]);
   });
 
   it('should extract entire archive into directory', async () => {
     const stream = fs.createReadStream('/test-archive.zip');
 
-    const res = new ZipArchiveResponse(stream, '', '/tmp');
+    const res = new ZipArchiveResponse(stream, '', '/tmp', 'etag');
     const dir = await res.dir();
 
     await expect(
-      fs.readFile(resolvePath(dir, 'mock-repo/mkdocs.yml'), 'utf8'),
+      fs.readFile(resolvePath(dir, 'mock-main/mkdocs.yml'), 'utf8'),
     ).resolves.toBe('site_name: Test\n');
     await expect(
-      fs.readFile(resolvePath(dir, 'mock-repo/docs/index.md'), 'utf8'),
+      fs.readFile(resolvePath(dir, 'mock-main/docs/index.md'), 'utf8'),
     ).resolves.toBe('# Test\n');
   });
 
   it('should extract archive into directory with a subpath', async () => {
     const stream = fs.createReadStream('/test-archive.zip');
 
-    const res = new ZipArchiveResponse(stream, 'mock-repo/docs/', '/tmp');
+    const res = new ZipArchiveResponse(
+      stream,
+      'mock-main/docs/',
+      '/tmp',
+      'etag',
+    );
     const dir = await res.dir();
 
     expect(dir).toMatch(/^[\/\\]tmp[\/\\].*$/);
@@ -135,8 +144,12 @@ describe('ZipArchiveResponse', () => {
   it('should extract archive into directory with a subpath and filter', async () => {
     const stream = fs.createReadStream('/test-archive.zip');
 
-    const res = new ZipArchiveResponse(stream, 'mock-repo/', '/tmp', path =>
-      path.endsWith('.yml'),
+    const res = new ZipArchiveResponse(
+      stream,
+      'mock-main/',
+      '/tmp',
+      'etag',
+      path => path.endsWith('.yml'),
     );
     const dir = await res.dir({ targetDir: '/tmp' });
 
diff --git a/packages/backend-common/src/reading/tree/ZipArchiveResponse.ts b/packages/backend-common/src/reading/tree/ZipArchiveResponse.ts
index 4106d49a11..07d34faaa3 100644
--- a/packages/backend-common/src/reading/tree/ZipArchiveResponse.ts
+++ b/packages/backend-common/src/reading/tree/ZipArchiveResponse.ts
@@ -35,6 +35,7 @@ export class ZipArchiveResponse implements ReadTreeResponse {
     private readonly stream: Readable,
     private readonly subPath: string,
     private readonly workDir: string,
+    public readonly etag: string,
     private readonly filter?: (path: string) => boolean,
   ) {
     if (subPath) {
@@ -47,6 +48,8 @@ export class ZipArchiveResponse implements ReadTreeResponse {
         );
       }
     }
+
+    this.etag = etag;
   }
 
   // Make sure the input stream is only read once
diff --git a/packages/backend-common/src/reading/types.ts b/packages/backend-common/src/reading/types.ts
index f9dca3e1d5..e98f760d8f 100644
--- a/packages/backend-common/src/reading/types.ts
+++ b/packages/backend-common/src/reading/types.ts
@@ -32,6 +32,19 @@ export type ReadTreeOptions = {
    * If no filter is provided all files are extracted.
    */
   filter?(path: string): boolean;
+
+  /**
+   * An etag can be provided to check whether readTree's response has changed from a previous execution.
+   *
+   * In the readTree() response, an etag is returned along with the tree blob. The etag is a unique identifer
+   * of the tree blob, usually the commit SHA or etag from the target.
+   *
+   * When a etag is given in ReadTreeOptions, readTree will first compare the etag against the etag
+   * on the target branch. If they match, readTree will throw a NotModifiedError indicating that the readTree
+   * response will not differ from the previous response which included this particular etag. If they mismatch,
+   * readTree will return the rest of ReadTreeResponse along with a new etag.
+   */
+  etag?: string;
 };
 
 /**
@@ -70,5 +83,14 @@ export type ReadTreeResponseDirOptions = {
 export type ReadTreeResponse = {
   files(): Promise<ReadTreeResponseFile[]>;
   archive(): Promise<NodeJS.ReadableStream>;
+
+  /**
+   * dir() extracts the tree response into a directory and returns the path of the directory.
+   */
   dir(options?: ReadTreeResponseDirOptions): Promise<string>;
+
+  /**
+   * A unique identifer of the tree blob, usually the commit SHA or etag from the target.
+   */
+  etag: string;
 };
diff --git a/packages/backend-common/src/service/lib/config.ts b/packages/backend-common/src/service/lib/config.ts
index 4547c41b7b..3a33675d5f 100644
--- a/packages/backend-common/src/service/lib/config.ts
+++ b/packages/backend-common/src/service/lib/config.ts
@@ -22,23 +22,8 @@ export type BaseOptions = {
   listenHost?: string;
 };
 
-export type CertificateOptions = {
-  key?: CertificateKeyOptions;
-  attributes?: CertificateAttributeOptions;
-};
-
-export type CertificateKeyOptions = {
-  size?: number;
-  algorithm?: string;
-  days?: number;
-};
-
-export type CertificateAttributeOptions = {
-  commonName?: string;
-};
-
 export type HttpsSettings = {
-  certificate: CertificateSigningOptions | CertificateReferenceOptions;
+  certificate: CertificateGenerationOptions | CertificateReferenceOptions;
 };
 
 export type CertificateReferenceOptions = {
@@ -46,11 +31,8 @@ export type CertificateReferenceOptions = {
   cert: string;
 };
 
-export type CertificateSigningOptions = {
-  algorithm?: string;
-  size?: number;
-  days?: number;
-  attributes: CertificateAttributes;
+export type CertificateGenerationOptions = {
+  hostname: string;
 };
 
 export type CertificateAttributes = {
@@ -196,20 +178,14 @@ export function readHttpsSettings(config: Config): HttpsSettings | undefined {
   const https = config.getOptional('https');
   if (https === true) {
     const baseUrl = config.getString('baseUrl');
-    let commonName;
+    let hostname;
     try {
-      commonName = new URL(baseUrl).hostname;
+      hostname = new URL(baseUrl).hostname;
     } catch (error) {
       throw new Error(`Invalid backend.baseUrl "${baseUrl}"`);
     }
 
-    return {
-      certificate: {
-        attributes: {
-          commonName,
-        },
-      },
-    };
+    return { certificate: { hostname } };
   }
 
   const cc = config.getOptionalConfig('https');
diff --git a/packages/backend-common/src/service/lib/hostFactory.ts b/packages/backend-common/src/service/lib/hostFactory.ts
index 656f160c31..db202a84ab 100644
--- a/packages/backend-common/src/service/lib/hostFactory.ts
+++ b/packages/backend-common/src/service/lib/hostFactory.ts
@@ -20,10 +20,12 @@ import express from 'express';
 import * as http from 'http';
 import * as https from 'https';
 import { Logger } from 'winston';
-import { CertificateSigningOptions, HttpsSettings } from './config';
+import { HttpsSettings } from './config';
 
 const ALMOST_MONTH_IN_MS = 25 * 24 * 60 * 60 * 1000;
 
+const IP_HOSTNAME_REGEX = /:|^\d+\.\d+\.\d+\.\d+$/;
+
 /**
  * Creates a Http server instance based on an Express application.
  *
@@ -59,17 +61,17 @@ export async function createHttpsServer(
 
   let credentials: { key: string | Buffer; cert: string | Buffer };
 
-  const signingOptions: any = httpsSettings?.certificate;
-
-  // TODO(Rugvip): remove support for generated certificate params and make this a more straightforward check
-  if (signingOptions?.attributes) {
-    credentials = await getGeneratedCertificate(signingOptions, logger);
+  if ('hostname' in httpsSettings?.certificate) {
+    credentials = await getGeneratedCertificate(
+      httpsSettings.certificate.hostname,
+      logger,
+    );
   } else {
     logger?.info('Loading certificate from config');
 
     credentials = {
-      key: signingOptions?.key,
-      cert: signingOptions?.cert,
+      key: httpsSettings?.certificate?.key,
+      cert: httpsSettings?.certificate?.cert,
     };
   }
 
@@ -80,16 +82,7 @@ export async function createHttpsServer(
   return https.createServer(credentials, app) as http.Server;
 }
 
-async function getGeneratedCertificate(
-  options: CertificateSigningOptions,
-  logger?: Logger,
-) {
-  if (options?.algorithm) {
-    logger?.warn(
-      'Certificate generation configuration with parameters in backend.https.certificate is deprecated, set backend.https = true instead',
-    );
-  }
-
+async function getGeneratedCertificate(hostname: string, logger?: Logger) {
   const hasModules = await fs.pathExists('node_modules');
   let certPath;
   if (hasModules) {
@@ -119,20 +112,61 @@ async function getGeneratedCertificate(
   }
 
   logger?.info('Generating new self-signed certificate');
-  const newCert = await createCertificate(options);
+  const newCert = await createCertificate(hostname);
   await fs.writeFile(certPath, newCert.cert + newCert.key, 'utf8');
   return newCert;
 }
 
-async function createCertificate(options: CertificateSigningOptions) {
-  const attributes: Array<any> = Object.entries(
-    options.attributes,
-  ).map(([name, value]) => ({ name, value }));
+async function createCertificate(hostname: string) {
+  const attributes = [
+    {
+      name: 'commonName',
+      value: 'dev-cert',
+    },
+  ];
+
+  const sans = [
+    {
+      type: 2, // DNS
+      value: 'localhost',
+    },
+    {
+      type: 2,
+      value: 'localhost.localdomain',
+    },
+    {
+      type: 2,
+      value: '[::1]',
+    },
+    {
+      type: 7, // IP
+      ip: '127.0.0.1',
+    },
+    {
+      type: 7,
+      ip: 'fe80::1',
+    },
+  ];
+
+  // Add hostname from backend.baseUrl if it doesn't already exist in our list of SANs
+  if (!sans.find(({ value, ip }) => value === hostname || ip === hostname)) {
+    sans.push(
+      IP_HOSTNAME_REGEX.test(hostname)
+        ? {
+            type: 7,
+            ip: hostname,
+          }
+        : {
+            type: 2,
+            value: hostname,
+          },
+    );
+  }
 
   const params = {
-    algorithm: options?.algorithm || 'sha256',
-    keySize: options?.size || 2048,
-    days: options?.days || 30,
+    algorithm: 'sha256',
+    keySize: 2048,
+    days: 30,
     extensions: [
       {
         name: 'keyUsage',
@@ -151,36 +185,7 @@ async function createCertificate(options: CertificateSigningOptions) {
       },
       {
         name: 'subjectAltName',
-        altNames: [
-          {
-            type: 2, // DNS
-            value: 'localhost',
-          },
-          {
-            type: 2,
-            value: 'localhost.localdomain',
-          },
-          {
-            type: 2,
-            value: '[::1]',
-          },
-          {
-            type: 7, // IP
-            ip: '127.0.0.1',
-          },
-          {
-            type: 7,
-            ip: 'fe80::1',
-          },
-          ...(options.attributes.commonName
-            ? [
-                {
-                  type: 2, // DNS
-                  value: options.attributes.commonName,
-                },
-              ]
-            : []),
-        ],
+        altNames: sans,
       },
     ],
   };
diff --git a/packages/catalog-model/src/entity/util.test.ts b/packages/catalog-model/src/entity/util.test.ts
index e4399bbe05..c7e2c036b5 100644
--- a/packages/catalog-model/src/entity/util.test.ts
+++ b/packages/catalog-model/src/entity/util.test.ts
@@ -96,18 +96,12 @@ describe('util', () => {
       b = lodash.cloneDeep(a);
       b.metadata.labels.labelKey += 'a';
       expect(entityHasChanges(a, b)).toBe(true);
-    });
-
-    it('detects annotation changes, but not removals', () => {
-      let b: any = lodash.cloneDeep(a);
+      b = lodash.cloneDeep(a);
       b.metadata.annotations.annotationKey += 'a';
       expect(entityHasChanges(a, b)).toBe(true);
       b = lodash.cloneDeep(a);
-      b.metadata.annotations.n = 'n';
-      expect(entityHasChanges(a, b)).toBe(true);
-      b = lodash.cloneDeep(a);
       delete b.metadata.annotations.annotationKey;
-      expect(entityHasChanges(a, b)).toBe(false);
+      expect(entityHasChanges(a, b)).toBe(true);
     });
 
     it('detects spec changes', () => {
diff --git a/packages/catalog-model/src/entity/util.ts b/packages/catalog-model/src/entity/util.ts
index ed68339a99..2c63cc4c49 100644
--- a/packages/catalog-model/src/entity/util.ts
+++ b/packages/catalog-model/src/entity/util.ts
@@ -54,10 +54,6 @@ export function generateEntityEtag(): string {
  * @param next The new state of the entity
  */
 export function entityHasChanges(previous: Entity, next: Entity): boolean {
-  if (entityHasAnnotationChanges(previous, next)) {
-    return true;
-  }
-
   const e1 = lodash.cloneDeep(previous);
   const e2 = lodash.cloneDeep(next);
 
@@ -67,6 +63,18 @@ export function entityHasChanges(previous: Entity, next: Entity): boolean {
   if (!e2.metadata.labels) {
     e2.metadata.labels = {};
   }
+  if (!e1.metadata.annotations) {
+    e1.metadata.annotations = {};
+  }
+  if (!e2.metadata.annotations) {
+    e2.metadata.annotations = {};
+  }
+  if (!e1.metadata.tags) {
+    e1.metadata.tags = [];
+  }
+  if (!e2.metadata.tags) {
+    e2.metadata.tags = [];
+  }
 
   // Remove generated fields
   delete e1.metadata.uid;
@@ -76,10 +84,6 @@ export function entityHasChanges(previous: Entity, next: Entity): boolean {
   delete e2.metadata.etag;
   delete e2.metadata.generation;
 
-  // Remove already compared things
-  delete e1.metadata.annotations;
-  delete e2.metadata.annotations;
-
   // Remove things that we explicitly do not compare
   delete e1.relations;
   delete e2.relations;
@@ -106,14 +110,6 @@ export function generateUpdatedEntity(previous: Entity, next: Entity): Entity {
 
   const result = lodash.cloneDeep(next);
 
-  // Annotations are merged, with the new ones taking precedence
-  if (previous.metadata.annotations) {
-    next.metadata.annotations = {
-      ...previous.metadata.annotations,
-      ...next.metadata.annotations,
-    };
-  }
-
   // Generated fields are copied and updated
   const bumpEtag = entityHasChanges(previous, result);
   const bumpGeneration = !lodash.isEqual(previous.spec, result.spec);
@@ -123,26 +119,3 @@ export function generateUpdatedEntity(previous: Entity, next: Entity): Entity {
 
   return result;
 }
-
-function entityHasAnnotationChanges(previous: Entity, next: Entity): boolean {
-  // Since the next annotations get merged into the previous, extract only
-  // the overlapping keys and check if their values match.
-  if (next.metadata.annotations) {
-    if (!previous.metadata.annotations) {
-      return true;
-    }
-    if (
-      !lodash.isEqual(
-        next.metadata.annotations,
-        lodash.pick(
-          previous.metadata.annotations,
-          Object.keys(next.metadata.annotations),
-        ),
-      )
-    ) {
-      return true;
-    }
-  }
-
-  return false;
-}
diff --git a/packages/catalog-model/src/location/annotation.ts b/packages/catalog-model/src/location/annotation.ts
index 371d095685..93f2fabea4 100644
--- a/packages/catalog-model/src/location/annotation.ts
+++ b/packages/catalog-model/src/location/annotation.ts
@@ -15,3 +15,5 @@
  */
 
 export const LOCATION_ANNOTATION = 'backstage.io/managed-by-location';
+export const ORIGIN_LOCATION_ANNOTATION =
+  'backstage.io/managed-by-origin-location';
diff --git a/packages/catalog-model/src/location/index.ts b/packages/catalog-model/src/location/index.ts
index ce64b988a6..8fd516120a 100644
--- a/packages/catalog-model/src/location/index.ts
+++ b/packages/catalog-model/src/location/index.ts
@@ -20,4 +20,4 @@ export {
   locationSpecSchema,
   analyzeLocationSchema,
 } from './validation';
-export { LOCATION_ANNOTATION } from './annotation';
+export { LOCATION_ANNOTATION, ORIGIN_LOCATION_ANNOTATION } from './annotation';
diff --git a/packages/core-api/src/plugin/Plugin.tsx b/packages/core-api/src/plugin/Plugin.tsx
index dd6d7960ac..cc168707be 100644
--- a/packages/core-api/src/plugin/Plugin.tsx
+++ b/packages/core-api/src/plugin/Plugin.tsx
@@ -68,9 +68,6 @@ export class PluginImpl<
             options,
           });
         },
-        registerRoute(path, component, options) {
-          outputs.push({ type: 'legacy-route', path, component, options });
-        },
       },
       featureFlags: {
         register(name) {
diff --git a/packages/core-api/src/plugin/types.ts b/packages/core-api/src/plugin/types.ts
index 94bd4e8172..711246f1f4 100644
--- a/packages/core-api/src/plugin/types.ts
+++ b/packages/core-api/src/plugin/types.ts
@@ -99,26 +99,22 @@ export type PluginConfig<
 };
 
 export type PluginHooks = {
+  /**
+   * @deprecated All router hooks have been deprecated
+   */
   router: RouterHooks;
   featureFlags: FeatureFlagsHooks;
 };
 
 export type RouterHooks = {
+  /**
+   * @deprecated Use a routable extension instead, see https://backstage.io/docs/plugins/composability#porting-existing-plugins
+   */
   addRoute(
     target: RouteRef,
     Component: ComponentType<any>,
     options?: RouteOptions,
   ): void;
-
-  /**
-   * @deprecated See the `addRoute` method
-   * @see https://github.com/backstage/backstage/issues/418
-   */
-  registerRoute(
-    path: RoutePath,
-    Component: ComponentType<any>,
-    options?: RouteOptions,
-  ): void;
 };
 
 export type FeatureFlagsHooks = {
diff --git a/packages/core/src/layout/InfoCard/InfoCard.tsx b/packages/core/src/layout/InfoCard/InfoCard.tsx
index 5d77f4f34a..af10010d14 100644
--- a/packages/core/src/layout/InfoCard/InfoCard.tsx
+++ b/packages/core/src/layout/InfoCard/InfoCard.tsx
@@ -76,26 +76,11 @@ const VARIANT_STYLES = {
       height: 'calc(100% - 10px)', // for pages without content header
       marginBottom: '10px',
     },
-    /**
-     * @deprecated This variant is replaced by 'gridItem'.
-     */
-    height100: {
-      display: 'flex',
-      flexDirection: 'column',
-      height: 'calc(100% - 10px)', // for pages without content header
-      marginBottom: '10px',
-    },
   },
   cardContent: {
     fullHeight: {
       flex: 1,
     },
-    /**
-     * @deprecated This variant is replaced by 'gridItem'.
-     */
-    height100: {
-      flex: 1,
-    },
     gridItem: {
       flex: 1,
     },
@@ -167,12 +152,6 @@ export const InfoCard = ({
   if (variant) {
     const variants = variant.split(/[\s]+/g);
     variants.forEach(name => {
-      if (name === 'height100') {
-        // eslint-disable-next-line no-console
-        console.warn(
-          "Variant 'height100' of InfoCard is deprecated. Use variant 'gridItem' instead.",
-        );
-      }
       calculatedStyle = {
         ...calculatedStyle,
         ...VARIANT_STYLES.card[name as keyof typeof VARIANT_STYLES['card']],
diff --git a/packages/create-app/templates/default-app/packages/app/src/App.tsx b/packages/create-app/templates/default-app/packages/app/src/App.tsx
index 13880f9ee3..6deedcd748 100644
--- a/packages/create-app/templates/default-app/packages/app/src/App.tsx
+++ b/packages/create-app/templates/default-app/packages/app/src/App.tsx
@@ -5,11 +5,12 @@ import {
   OAuthRequestDialog,
   SidebarPage,
   createRouteRef,
+  FlatRoutes,
 } from '@backstage/core';
 import { apis } from './apis';
 import * as plugins from './plugins';
 import { AppSidebar } from './sidebar';
-import { Route, Routes, Navigate } from 'react-router';
+import { Route, Navigate } from 'react-router';
 import { Router as CatalogRouter } from '@backstage/plugin-catalog';
 import { Router as DocsRouter } from '@backstage/plugin-techdocs';
 import { Router as ImportComponentRouter } from '@backstage/plugin-catalog-import';
@@ -41,13 +42,13 @@ const App = () => (
     <AppRouter>
       <SidebarPage>
         <AppSidebar />
-        <Routes>
+        <FlatRoutes>
           <Navigate key="/" to="/catalog" />
           <Route
-            path="/catalog/*"
+            path="/catalog"
             element={<CatalogRouter EntityPage={EntityPage} />}
           />
-          <Route path="/docs/*" element={<DocsRouter />} />
+          <Route path="/docs" element={<DocsRouter />} />
           <Route
             path="/tech-radar"
             element={<TechRadarRouter width={1500} height={800} />}
@@ -62,7 +63,7 @@ const App = () => (
           />
           <Route path="/settings" element={<SettingsRouter />} />
           {deprecatedAppRoutes}
-        </Routes>
+        </FlatRoutes>
       </SidebarPage>
     </AppRouter>
   </AppProvider>
diff --git a/packages/integration/config.d.ts b/packages/integration/config.d.ts
index 6a9fd62995..e302c6f29c 100644
--- a/packages/integration/config.d.ts
+++ b/packages/integration/config.d.ts
@@ -15,41 +15,115 @@
  */
 
 export interface Config {
+  /** Configuration for integrations towards various external repository provider systems */
   integrations?: {
+    /** Integration configuration for Azure */
     azure?: Array<{
-      /** @visibility frontend */
+      /**
+       * The hostname of the given Azure instance
+       * @visibility frontend
+       */
       host: string;
+      /**
+       * Token used to authenticate requests.
+       * @visibility secret
+       */
+      token?: string;
     }>;
 
+    /** Integration configuration for Bitbucket */
     bitbucket?: Array<{
-      /** @visibility frontend */
+      /**
+       * The hostname of the given Bitbucket instance
+       * @visibility frontend
+       */
       host: string;
-      /** @visibility frontend */
+      /**
+       * Token used to authenticate requests.
+       * @visibility secret
+       */
+      token?: string;
+      /**
+       * The base url for the Bitbucket API, for example https://api.bitbucket.org/2.0
+       * @visibility frontend
+       */
       apiBaseUrl?: string;
+      /**
+       * The username to use for authenticated requests.
+       * @visibility secret
+       */
+      username?: string;
+      /**
+       * Bitbucket app password used to authenticate requests.
+       * @visibility secret
+       */
+      appPassword?: string;
     }>;
 
+    /** Integration configuration for GitHub */
     github?: Array<{
-      /** @visibility frontend */
+      /**
+       * The hostname of the given GitHub instance
+       * @visibility frontend
+       */
       host: string;
-      /** @visibility frontend */
+      /**
+       * Token used to authenticate requests.
+       * @visibility secret
+       */
+      token?: string;
+      /**
+       * The base url for the GitHub API, for example https://api.github.com
+       * @visibility frontend
+       */
       apiBaseUrl?: string;
-      /** @visibility frontend */
+      /**
+       * The base url for GitHub raw resources, for example https://raw.githubusercontent.com
+       * @visibility frontend
+       */
       rawBaseUrl?: string;
+
+      /** GitHub Apps configuration */
       apps?: Array<{
+        /**
+         * The numeric GitHub App ID
+         * @visibility frontend
+         */
         appId: number;
-        /** @visiblity secret */
+        /**
+         * The private key to use for auth against the app
+         * @visibility secret
+         */
         privateKey: string;
-        /** @visiblity secret */
+        /**
+         * The secret used for webhooks
+         * @visibility secret
+         */
         webhookSecret: string;
+        /**
+         * The client ID to use
+         */
         clientId: string;
-        /** @visiblity secret */
+        /**
+         * The client secret to use
+         * @visibility secret
+         */
         clientSecret: string;
       }>;
     }>;
 
+    /** Integration configuration for GitLab */
     gitlab?: Array<{
-      /** @visibility frontend */
+      /**
+       * The hostname of the given GitLab instance
+       * @visibility frontend
+       */
       host: string;
+      /**
+       * Token used to authenticate requests.
+       * @visibility secret
+       */
+      token?: string;
     }>;
   };
 }
diff --git a/packages/integration/src/azure/core.ts b/packages/integration/src/azure/core.ts
index 7900774c79..b2878af89e 100644
--- a/packages/integration/src/azure/core.ts
+++ b/packages/integration/src/azure/core.ts
@@ -108,6 +108,62 @@ export function getAzureDownloadUrl(url: string): string {
   return `${protocol}://${resource}/${organization}/${project}/_apis/git/repositories/${repoName}/items?recursionLevel=full&download=true&api-version=6.0${scopePath}`;
 }
 
+/**
+ * Given a URL, return the API URL to fetch commits on the branch.
+ *
+ * @param url A URL pointing to a repository or a sub-path
+ */
+export function getAzureCommitsUrl(url: string): string {
+  try {
+    const parsedUrl = new URL(url);
+
+    const [
+      empty,
+      userOrOrg,
+      project,
+      srcKeyword,
+      repoName,
+    ] = parsedUrl.pathname.split('/');
+
+    // Remove the "GB" from "GBmain" for example.
+    const ref = parsedUrl.searchParams.get('version')?.substr(2);
+
+    if (
+      !!empty ||
+      !userOrOrg ||
+      !project ||
+      srcKeyword !== '_git' ||
+      !repoName
+    ) {
+      throw new Error('Wrong Azure Devops URL');
+    }
+
+    // transform to commits api
+    parsedUrl.pathname = [
+      empty,
+      userOrOrg,
+      project,
+      '_apis',
+      'git',
+      'repositories',
+      repoName,
+      'commits',
+    ].join('/');
+
+    const queryParams = [];
+    if (ref) {
+      queryParams.push(`searchCriteria.itemVersion.version=${ref}`);
+    }
+    parsedUrl.search = queryParams.join('&');
+
+    parsedUrl.protocol = 'https';
+
+    return parsedUrl.toString();
+  } catch (e) {
+    throw new Error(`Incorrect URL: ${url}, ${e}`);
+  }
+}
+
 /**
  * Gets the request options necessary to make requests to a given provider.
  *
diff --git a/packages/integration/src/azure/index.ts b/packages/integration/src/azure/index.ts
index 365e4cdcdc..6d57437779 100644
--- a/packages/integration/src/azure/index.ts
+++ b/packages/integration/src/azure/index.ts
@@ -23,4 +23,5 @@ export {
   getAzureDownloadUrl,
   getAzureFileFetchUrl,
   getAzureRequestOptions,
+  getAzureCommitsUrl,
 } from './core';
diff --git a/packages/integration/src/gitlab/config.test.ts b/packages/integration/src/gitlab/config.test.ts
index 7e298e6043..eb3ccd643f 100644
--- a/packages/integration/src/gitlab/config.test.ts
+++ b/packages/integration/src/gitlab/config.test.ts
@@ -51,6 +51,17 @@ describe('readGitLabIntegrationConfig', () => {
     });
   });
 
+  it('injects the correct GitLab API base URL when missing', () => {
+    const output = readGitLabIntegrationConfig(
+      buildConfig({ host: 'gitlab.com' }),
+    );
+
+    expect(output).toEqual({
+      host: 'gitlab.com',
+      apiBaseUrl: 'https://gitlab.com/api/v4',
+    });
+  });
+
   it('rejects funky configs', () => {
     const valid: any = {
       host: 'a.com',
@@ -91,6 +102,7 @@ describe('readGitLabIntegrationConfigs', () => {
     expect(output).toEqual([
       {
         host: 'gitlab.com',
+        apiBaseUrl: 'https://gitlab.com/api/v4',
       },
     ]);
   });
diff --git a/packages/integration/src/gitlab/config.ts b/packages/integration/src/gitlab/config.ts
index 87a402176f..47269b4c32 100644
--- a/packages/integration/src/gitlab/config.ts
+++ b/packages/integration/src/gitlab/config.ts
@@ -18,7 +18,8 @@ import { Config } from '@backstage/config';
 import { isValidHost } from '../helpers';
 
 const GITLAB_HOST = 'gitlab.com';
-const GITLAB_API_BASE_URL = 'gitlab.com/api/v4';
+const GITLAB_API_BASE_URL = 'https://gitlab.com/api/v4';
+
 /**
  * The configuration parameters for a single GitLab integration.
  */
@@ -29,7 +30,6 @@ export type GitLabIntegrationConfig = {
   host: string;
 
   /**
-   * @deprecated
    * The base URL of the API of this provider, e.g. "https://gitlab.com/api/v4",
    * with no trailing slash.
    *
@@ -99,7 +99,7 @@ export function readGitLabIntegrationConfigs(
   // As a convenience we always make sure there's at least an unauthenticated
   // reader for public gitlab repos.
   if (!result.some(c => c.host === GITLAB_HOST)) {
-    result.push({ host: GITLAB_HOST });
+    result.push({ host: GITLAB_HOST, apiBaseUrl: GITLAB_API_BASE_URL });
   }
 
   return result;
diff --git a/packages/techdocs-common/src/helpers.test.ts b/packages/techdocs-common/src/helpers.test.ts
index 88c4d8829e..740a08aaa2 100644
--- a/packages/techdocs-common/src/helpers.test.ts
+++ b/packages/techdocs-common/src/helpers.test.ts
@@ -135,6 +135,7 @@ describe('getDocFilesFromRepository', () => {
           archive: async () => {
             return Readable.from('');
           },
+          etag: '',
         };
       }
     }
diff --git a/packages/techdocs-common/src/stages/publish/googleStorage.ts b/packages/techdocs-common/src/stages/publish/googleStorage.ts
index e6b2c26943..9c28de4130 100644
--- a/packages/techdocs-common/src/stages/publish/googleStorage.ts
+++ b/packages/techdocs-common/src/stages/publish/googleStorage.ts
@@ -170,29 +170,24 @@ export class GoogleGCSPublish implements PublisherBase {
       const fileExtension = path.extname(filePath);
       const responseHeaders = getHeadersForFileExtension(fileExtension);
 
-      const fileStreamChunks: Array<any> = [];
+      // Pipe file chunks directly from storage to client.
       this.storageClient
         .bucket(this.bucketName)
         .file(filePath)
         .createReadStream()
+        .on('pipe', () => {
+          res.writeHead(200, responseHeaders);
+        })
         .on('error', err => {
           this.logger.warn(err.message);
-          res.status(404).send(err.message);
-        })
-        .on('data', chunk => {
-          fileStreamChunks.push(chunk);
-        })
-        .on('end', () => {
-          const fileContent = Buffer.concat(fileStreamChunks);
-          // Inject response headers
-          for (const [headerKey, headerValue] of Object.entries(
-            responseHeaders,
-          )) {
-            res.setHeader(headerKey, headerValue);
+          // Send a 404 with a meaningful message if possible.
+          if (!res.headersSent) {
+            res.status(404).send(err.message);
+          } else {
+            res.destroy();
           }
-
-          res.send(fileContent);
-        });
+        })
+        .pipe(res);
     };
   }
 
diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index 8f88c69487..880b9a33e8 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -16,6 +16,11 @@
     "url": "https://github.com/backstage/backstage",
     "directory": "plugins/auth-backend"
   },
+  "jest": {
+    "moduleNameMapper": {
+      "^jose/(.*)$": "<rootDir>/../../../node_modules/jose/dist/node/cjs/$1"
+    }
+  },
   "keywords": [
     "backstage"
   ],
@@ -44,11 +49,12 @@
     "fs-extra": "^9.0.0",
     "got": "^11.5.2",
     "helmet": "^4.0.0",
-    "jose": "^1.27.1",
+    "jose": "^3.5.1",
     "jwt-decode": "^3.1.0",
     "knex": "^0.21.6",
     "moment": "^2.26.0",
     "morgan": "^1.10.0",
+    "node-cache": "^5.1.2",
     "openid-client": "^4.2.1",
     "passport": "^0.4.1",
     "passport-github2": "^0.1.12",
diff --git a/plugins/auth-backend/src/identity/TokenFactory.test.ts b/plugins/auth-backend/src/identity/TokenFactory.test.ts
index 8b719799b1..e28ded2bf2 100644
--- a/plugins/auth-backend/src/identity/TokenFactory.test.ts
+++ b/plugins/auth-backend/src/identity/TokenFactory.test.ts
@@ -13,12 +13,23 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import { TextDecoder, TextEncoder } from 'util';
+
+// These two statements are structured like this because Jest doesn't include these in the default
+// test environment, even though they exist in Node.
+global.TextEncoder = TextEncoder;
+// @ts-ignore
+global.TextDecoder = TextDecoder;
 
 import { utc } from 'moment';
 import { TokenFactory } from './TokenFactory';
 import { getVoidLogger } from '@backstage/backend-common';
-import { KeyStore, AnyJWK, StoredKey } from './types';
-import { JWKS, JSONWebKey, JWT } from 'jose';
+import { AnyJWK, KeyStore, StoredKey } from './types';
+import jwtVerify from 'jose/jwt/verify';
+import parseJwk from 'jose/jwk/parse';
+import decodeProtectedHeader, {
+  ProtectedHeaderParameters,
+} from 'jose/util/decode_protected_header';
 
 const logger = getVoidLogger();
 
@@ -52,10 +63,8 @@ class MemoryKeyStore implements KeyStore {
 }
 
 function jwtKid(jwt: string): string {
-  const { header } = JWT.decode(jwt, { complete: true }) as {
-    header: { kid: string };
-  };
-  return header.kid;
+  const header = decodeProtectedHeader(jwt) as ProtectedHeaderParameters;
+  return header.kid as string;
 }
 
 describe('TokenFactory', () => {
@@ -72,14 +81,14 @@ describe('TokenFactory', () => {
     const token = await factory.issueToken({ claims: { sub: 'foo' } });
 
     const { keys } = await factory.listPublicKeys();
-    const keyStore = JWKS.asKeyStore({
-      keys: keys.map(key => key as JSONWebKey),
-    });
+    const keyMap = Object.fromEntries(keys.map(key => [key.kid, key]));
 
-    const payload = JWT.verify(token, keyStore) as object & {
-      iat: number;
-      exp: number;
-    };
+    const payload = (
+      await jwtVerify(token, async header => {
+        const kid = header.kid as string;
+        return await parseJwk(keyMap[kid]);
+      })
+    ).payload;
     expect(payload).toEqual({
       iss: 'my-issuer',
       aud: 'backstage',
@@ -87,7 +96,7 @@ describe('TokenFactory', () => {
       iat: expect.any(Number),
       exp: expect.any(Number),
     });
-    expect(payload.exp).toBe(payload.iat + keyDurationSeconds);
+    expect(payload.exp).toBe(Number(payload.iat) + keyDurationSeconds);
   });
 
   it('should generate new signing keys when the current one expires', async () => {
diff --git a/plugins/auth-backend/src/identity/TokenFactory.ts b/plugins/auth-backend/src/identity/TokenFactory.ts
index 36622332e0..a1d846d5d7 100644
--- a/plugins/auth-backend/src/identity/TokenFactory.ts
+++ b/plugins/auth-backend/src/identity/TokenFactory.ts
@@ -16,7 +16,10 @@
 
 import moment from 'moment';
 import { TokenIssuer, TokenParams, KeyStore, AnyJWK } from './types';
-import { JSONWebKey, JWK, JWS } from 'jose';
+import parseJwk, { JWK } from 'jose/jwk/parse';
+import SignJWT from 'jose/jwt/sign';
+import generateKeyPair from 'jose/util/generate_key_pair';
+import fromKeyLike from 'jose/jwk/from_key_like';
 import { Logger } from 'winston';
 import { v4 as uuid } from 'uuid';
 
@@ -53,7 +56,7 @@ export class TokenFactory implements TokenIssuer {
   private readonly keyDurationSeconds: number;
 
   private keyExpiry?: moment.Moment;
-  private privateKeyPromise?: Promise<JSONWebKey>;
+  private privateKeyPromise?: Promise<JWK>;
 
   constructor(options: Options) {
     this.issuer = options.issuer;
@@ -64,7 +67,7 @@ export class TokenFactory implements TokenIssuer {
 
   async issueToken(params: TokenParams): Promise<string> {
     const key = await this.getKey();
-
+    const keyLike = await parseJwk(key);
     const iss = this.issuer;
     const sub = params.claims.sub;
     const aud = 'backstage';
@@ -72,11 +75,9 @@ export class TokenFactory implements TokenIssuer {
     const exp = iat + this.keyDurationSeconds;
 
     this.logger.info(`Issuing token for ${sub}`);
-
-    return JWS.sign({ iss, sub, aud, iat, exp }, key, {
-      alg: key.alg,
-      kid: key.kid,
-    });
+    return new SignJWT({ iss, sub, aud, iat, exp })
+      .setProtectedHeader({ alg: key.alg, typ: 'JWT', kid: key.kid })
+      .sign(keyLike);
   }
 
   // This will be called by other services that want to verify ID tokens.
@@ -114,7 +115,7 @@ export class TokenFactory implements TokenIssuer {
     return { keys: validKeys.map(({ key }) => key) };
   }
 
-  private async getKey(): Promise<JSONWebKey> {
+  private async getKey(): Promise<JWK> {
     // Make sure that we only generate one key at a time
     if (this.privateKeyPromise) {
       if (this.keyExpiry?.isAfter()) {
@@ -127,23 +128,30 @@ export class TokenFactory implements TokenIssuer {
     this.keyExpiry = moment().add(this.keyDurationSeconds, 'seconds');
     const promise = (async () => {
       // This generates a new signing key to be used to sign tokens until the next key rotation
-      const key = await JWK.generate('EC', 'P-256', {
-        use: 'sig',
-        kid: uuid(),
-        alg: 'ES256',
-      });
 
+      const key = await generateKeyPair('ES256');
+      const kid = uuid();
+      const jwk = await fromKeyLike(key.privateKey);
+
+      // JOSE Library provides optional for most fields - and TS does not distinguish between missing/undefined.
+      // Because AnyJWK requires keys to have type "string", this throws a TypeError - though in practice, if the field
+      // is undefined, JOSE will not send it back as key.
+      const storedJwk: AnyJWK = {
+        ...jwk,
+        alg: 'ES256',
+        kid: kid,
+        use: 'sig',
+      } as AnyJWK;
       // We're not allowed to use the key until it has been successfully stored
       // TODO: some token verification implementations aggressively cache the list of keys, and
       //       don't attempt to fetch new ones even if they encounter an unknown kid. Therefore we
       //       may want to keep using the existing key for some period of time until we switch to
       //       the new one. This also needs to be implemented cross-service though, meaning new services
       //       that boot up need to be able to grab an existing key to use for signing.
-      this.logger.info(`Created new signing key ${key.kid}`);
-      await this.keyStore.addKey((key.toJWK(false) as unknown) as AnyJWK);
-
+      this.logger.info(`Created new signing key ${jwk.kid}`);
+      await this.keyStore.addKey(storedJwk);
       // At this point we are allowed to start using the new key
-      return key as JSONWebKey;
+      return storedJwk;
     })();
 
     this.privateKeyPromise = promise;
diff --git a/plugins/auth-backend/src/providers/aws-alb/index.ts b/plugins/auth-backend/src/providers/aws-alb/index.ts
new file mode 100644
index 0000000000..f8b5c9e5d7
--- /dev/null
+++ b/plugins/auth-backend/src/providers/aws-alb/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright 2021 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export { createAwsAlbProvider } from './provider';
diff --git a/plugins/auth-backend/src/providers/aws-alb/provider.test.ts b/plugins/auth-backend/src/providers/aws-alb/provider.test.ts
new file mode 100644
index 0000000000..3d27539314
--- /dev/null
+++ b/plugins/auth-backend/src/providers/aws-alb/provider.test.ts
@@ -0,0 +1,192 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { getVoidLogger } from '@backstage/backend-common';
+import express from 'express';
+import * as jwtVerify from 'jose/jwt/verify';
+
+import { AwsAlbAuthProvider } from './provider';
+import { AuthResponse } from '../types';
+
+const mockedJwtVerify = jwtVerify as jest.Mocked<any>;
+
+const mockKey = async () => {
+  return `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnuN4LlaJhaUpx+qZFTzYCrSBLk0I
+yOlxJ2VW88mLAQGJ7HPAvOdylxZsItMnzCuqNzZvie8m/NJsOjhDncVkrw==
+-----END PUBLIC KEY-----
+`;
+};
+
+jest.mock('cross-fetch', () => ({
+  __esModule: true,
+  default: async () => {
+    return {
+      json: async () => {
+        return mockKey();
+      },
+    };
+  },
+}));
+
+jest.mock('jose/jwt/verify', () => {
+  return {
+    __esModule: true,
+    default: jest.fn(),
+  };
+});
+
+const identityResolutionCallbackMock = async (): Promise<AuthResponse<any>> => {
+  return {
+    backstageIdentity: {
+      id: 'foo',
+      idToken: '',
+    },
+    profile: {
+      displayName: 'Foo Bar',
+    },
+    providerInfo: {},
+  };
+};
+
+const identityResolutionCallbackRejectedMock = async (): Promise<
+  AuthResponse<any>
+> => {
+  throw new Error('failed');
+};
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+describe('AwsALBAuthProvider', () => {
+  const catalogApi = {
+    /* eslint-disable-next-line @typescript-eslint/no-unused-vars */
+    addLocation: jest.fn(),
+    getEntities: jest.fn(),
+    getLocationByEntity: jest.fn(),
+    getLocationById: jest.fn(),
+    removeEntityByUid: jest.fn(),
+    getEntityByName: jest.fn(),
+  };
+
+  const mockResponseSend = jest.fn();
+  const mockRequest = ({
+    header: jest.fn(() => {
+      return 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImZvbyIsImlzc3VlciI6ImZvbyJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.zUkMYAuMwC1T0tyHMpxXrkbFDa4aGhB8d9um_tI2hsI';
+    }),
+  } as unknown) as express.Request;
+  const mockRequestWithoutJwt = ({
+    header: jest.fn(() => {
+      return undefined;
+    }),
+  } as unknown) as express.Request;
+  const mockResponse = ({
+    header: () => jest.fn(),
+    send: mockResponseSend,
+  } as unknown) as express.Response;
+
+  describe('should transform to type OAuthResponse', () => {
+    it('when JWT is valid and identity is resolved successfully', async () => {
+      const provider = new AwsAlbAuthProvider(getVoidLogger(), catalogApi, {
+        region: 'us-west-2',
+        identityResolutionCallback: identityResolutionCallbackMock,
+        issuer: 'foo',
+      });
+
+      mockedJwtVerify.default.mockImplementationOnce(async () => {
+        return {
+          payload: {
+            sub: 'foo',
+          },
+        };
+      });
+
+      await provider.refresh(mockRequest, mockResponse);
+
+      expect(mockResponseSend.mock.calls[0][0]).toEqual({
+        backstageIdentity: {
+          id: 'foo',
+          idToken: '',
+        },
+        profile: {
+          displayName: 'Foo Bar',
+        },
+        providerInfo: {},
+      });
+    });
+  });
+  describe('should fail when', () => {
+    it('JWT is missing', async () => {
+      const provider = new AwsAlbAuthProvider(getVoidLogger(), catalogApi, {
+        region: 'us-west-2',
+        identityResolutionCallback: identityResolutionCallbackMock,
+        issuer: 'foo',
+      });
+
+      await provider.refresh(mockRequestWithoutJwt, mockResponse);
+
+      expect(mockResponseSend.mock.calls[0][0]).toEqual(401);
+    });
+
+    it('JWT is invalid', async () => {
+      const provider = new AwsAlbAuthProvider(getVoidLogger(), catalogApi, {
+        region: 'us-west-2',
+        identityResolutionCallback: identityResolutionCallbackMock,
+        issuer: 'foo',
+      });
+
+      mockedJwtVerify.default.mockImplementationOnce(async () => {
+        throw new Error('bad JWT');
+      });
+
+      await provider.refresh(mockRequest, mockResponse);
+
+      expect(mockResponseSend.mock.calls[0][0]).toEqual(401);
+    });
+
+    it('issuer is invalid', async () => {
+      const provider = new AwsAlbAuthProvider(getVoidLogger(), catalogApi, {
+        region: 'us-west-2',
+        identityResolutionCallback: identityResolutionCallbackMock,
+        issuer: 'foobar',
+      });
+
+      mockedJwtVerify.default.mockImplementationOnce(async () => {
+        return {};
+      });
+
+      await provider.refresh(mockRequest, mockResponse);
+
+      expect(mockResponseSend.mock.calls[0][0]).toEqual(401);
+    });
+
+    it('identity resolution callback rejects', async () => {
+      const provider = new AwsAlbAuthProvider(getVoidLogger(), catalogApi, {
+        region: 'us-west-2',
+        identityResolutionCallback: identityResolutionCallbackRejectedMock,
+        issuer: 'foo',
+      });
+
+      mockedJwtVerify.default.mockImplementationOnce(async () => {
+        return {};
+      });
+
+      await provider.refresh(mockRequest, mockResponse);
+
+      expect(mockResponseSend.mock.calls[0][0]).toEqual(401);
+    });
+  });
+});
diff --git a/plugins/auth-backend/src/providers/aws-alb/provider.ts b/plugins/auth-backend/src/providers/aws-alb/provider.ts
new file mode 100644
index 0000000000..d8ec0cb525
--- /dev/null
+++ b/plugins/auth-backend/src/providers/aws-alb/provider.ts
@@ -0,0 +1,130 @@
+/*
+ * Copyright 2021 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import {
+  AuthProviderFactoryOptions,
+  AuthProviderRouteHandlers,
+  ExperimentalIdentityResolver,
+} from '../types';
+import express from 'express';
+import fetch from 'cross-fetch';
+import * as crypto from 'crypto';
+import { KeyObject } from 'crypto';
+import { Logger } from 'winston';
+import NodeCache from 'node-cache';
+import jwtVerify from 'jose/jwt/verify';
+import { CatalogApi } from '@backstage/catalog-client';
+
+const ALB_JWT_HEADER = 'x-amzn-oidc-data';
+/**
+ * A callback function that receives a verified JWT and returns a UserEntity
+ *  @param {payload} The verified JWT payload
+ */
+type AwsAlbAuthProviderOptions = {
+  region: string;
+  issuer: string;
+  identityResolutionCallback: ExperimentalIdentityResolver;
+};
+export const getJWTHeaders = (input: string) => {
+  const encoded = input.split('.')[0];
+  return JSON.parse(Buffer.from(encoded, 'base64').toString('utf8'));
+};
+
+export class AwsAlbAuthProvider implements AuthProviderRouteHandlers {
+  private logger: Logger;
+  private readonly catalogClient: CatalogApi;
+  private options: AwsAlbAuthProviderOptions;
+  private readonly keyCache: NodeCache;
+
+  constructor(
+    logger: Logger,
+    catalogClient: CatalogApi,
+    options: AwsAlbAuthProviderOptions,
+  ) {
+    this.logger = logger;
+    this.catalogClient = catalogClient;
+    this.options = options;
+    this.keyCache = new NodeCache({ stdTTL: 3600 });
+  }
+  frameHandler(): Promise<void> {
+    return Promise.resolve(undefined);
+  }
+
+  async refresh(req: express.Request, res: express.Response): Promise<void> {
+    const jwt = req.header(ALB_JWT_HEADER);
+    if (jwt !== undefined) {
+      try {
+        const headers = getJWTHeaders(jwt);
+        const key = await this.getKey(headers.kid);
+        const verifiedToken = await jwtVerify(jwt, key, {});
+
+        if (
+          this.options.issuer !== '' &&
+          headers.issuer !== this.options.issuer
+        ) {
+          throw new Error('issuer mismatch on JWT');
+        }
+
+        const resolvedEntity = await this.options.identityResolutionCallback(
+          verifiedToken.payload,
+          this.catalogClient,
+        );
+        res.send(resolvedEntity);
+      } catch (e) {
+        this.logger.error('exception occurred during JWT processing', e);
+        res.send(401);
+      }
+    } else {
+      res.send(401);
+    }
+  }
+
+  start(): Promise<void> {
+    return Promise.resolve(undefined);
+  }
+
+  async getKey(keyId: string): Promise<KeyObject> {
+    const optionalCacheKey = this.keyCache.get<KeyObject>(keyId);
+    if (optionalCacheKey) {
+      return optionalCacheKey;
+    }
+    const keyText: string = await fetch(
+      `https://public-keys.auth.elb.${this.options.region}.amazonaws.com/${keyId}`,
+    ).then(response => response.json());
+    const keyValue = crypto.createPublicKey(keyText);
+    this.keyCache.set(keyId, keyValue);
+    return keyValue;
+  }
+}
+
+export const createAwsAlbProvider = ({
+  logger,
+  catalogApi,
+  config,
+  identityResolver,
+}: AuthProviderFactoryOptions) => {
+  const region = config.getString('region');
+  const issuer = config.getString('iss');
+  if (identityResolver !== undefined) {
+    return new AwsAlbAuthProvider(logger, catalogApi, {
+      region,
+      issuer,
+      identityResolutionCallback: identityResolver,
+    });
+  }
+  throw new Error(
+    'Identity resolver is required to use this authentication provider',
+  );
+};
diff --git a/plugins/auth-backend/src/providers/factories.ts b/plugins/auth-backend/src/providers/factories.ts
index 7bad4f4d81..619fb1c706 100644
--- a/plugins/auth-backend/src/providers/factories.ts
+++ b/plugins/auth-backend/src/providers/factories.ts
@@ -25,6 +25,7 @@ import { createAuth0Provider } from './auth0';
 import { createMicrosoftProvider } from './microsoft';
 import { createOneLoginProvider } from './onelogin';
 import { AuthProviderFactory } from './types';
+import { createAwsAlbProvider } from './aws-alb';
 
 export const factories: { [providerId: string]: AuthProviderFactory } = {
   google: createGoogleProvider,
@@ -37,4 +38,5 @@ export const factories: { [providerId: string]: AuthProviderFactory } = {
   oauth2: createOAuth2Provider,
   oidc: createOidcProvider,
   onelogin: createOneLoginProvider,
+  awsalb: createAwsAlbProvider,
 };
diff --git a/plugins/auth-backend/src/providers/oidc/provider.test.ts b/plugins/auth-backend/src/providers/oidc/provider.test.ts
index f2bd8dcb90..ae0ca2da2b 100644
--- a/plugins/auth-backend/src/providers/oidc/provider.test.ts
+++ b/plugins/auth-backend/src/providers/oidc/provider.test.ts
@@ -13,13 +13,17 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import { TextDecoder, TextEncoder } from 'util';
 
+// @ts-ignore
+global.TextDecoder = TextDecoder;
+global.TextEncoder = TextEncoder;
 import express from 'express';
 import { Session } from 'express-session';
 import nock from 'nock';
 import { ClientMetadata, IssuerMetadata } from 'openid-client';
 import { createOidcProvider, OidcAuthProvider } from './provider';
-import { JWT, JWK } from 'jose';
+import UnsecuredJWT from 'jose/jwt/unsecured';
 import { AuthProviderFactoryOptions } from '../types';
 import { Config } from '@backstage/config';
 import { OAuthAdapter } from '../../lib/oauth';
@@ -71,6 +75,7 @@ describe('OidcAuthProvider', () => {
     const jwt = {
       sub: 'alice',
       iss: 'https://oidc.test',
+      iat: Date.now(),
       aud: clientMetadata.clientId,
       exp: Date.now() + 10000,
     };
@@ -79,7 +84,7 @@ describe('OidcAuthProvider', () => {
       .reply(200, issuerMetadata)
       .post('/as/token.oauth2')
       .reply(200, {
-        id_token: JWT.sign(jwt, JWK.None),
+        id_token: new UnsecuredJWT(jwt).encode(),
         access_token: 'test',
         authorization_signed_response_alg: 'HS256',
       })
diff --git a/plugins/auth-backend/src/providers/types.ts b/plugins/auth-backend/src/providers/types.ts
index a40f2a96ee..1a4e7b118a 100644
--- a/plugins/auth-backend/src/providers/types.ts
+++ b/plugins/auth-backend/src/providers/types.ts
@@ -112,6 +112,19 @@ export interface AuthProviderRouteHandlers {
   logout?(req: express.Request, res: express.Response): Promise<void>;
 }
 
+/**
+ * EXPERIMENTAL - this will almost certainly break in a future release.
+ *
+ * Used to resolve an identity from auth information in some auth providers.
+ */
+export type ExperimentalIdentityResolver = (
+  /**
+   * An object containing information specific to the auth provider.
+   */
+  payload: object,
+  catalogApi: CatalogApi,
+) => Promise<AuthResponse<any>>;
+
 export type AuthProviderFactoryOptions = {
   providerId: string;
   globalConfig: AuthProviderConfig;
@@ -120,6 +133,7 @@ export type AuthProviderFactoryOptions = {
   tokenIssuer: TokenIssuer;
   discovery: PluginEndpointDiscovery;
   catalogApi: CatalogApi;
+  identityResolver?: ExperimentalIdentityResolver;
 };
 
 export type AuthProviderFactory = (
diff --git a/plugins/catalog-backend/src/ingestion/LocationReaders.ts b/plugins/catalog-backend/src/ingestion/LocationReaders.ts
index a9248bb3fb..cb703b8e15 100644
--- a/plugins/catalog-backend/src/ingestion/LocationReaders.ts
+++ b/plugins/catalog-backend/src/ingestion/LocationReaders.ts
@@ -78,13 +78,17 @@ export class LocationReaders implements LocationReader {
           if (rulesEnforcer.isAllowed(item.entity, item.location)) {
             const relations = Array<EntityRelationSpec>();
 
-            const entity = await this.handleEntity(item, emitResult => {
-              if (emitResult.type === 'relation') {
-                relations.push(emitResult.relation);
-                return;
-              }
-              emit(emitResult);
-            });
+            const entity = await this.handleEntity(
+              item,
+              emitResult => {
+                if (emitResult.type === 'relation') {
+                  relations.push(emitResult.relation);
+                  return;
+                }
+                emit(emitResult);
+              },
+              location,
+            );
 
             if (entity) {
               output.entities.push({
@@ -165,6 +169,7 @@ export class LocationReaders implements LocationReader {
   private async handleEntity(
     item: CatalogProcessorEntityResult,
     emit: CatalogProcessorEmit,
+    originLocation: LocationSpec,
   ): Promise<Entity | undefined> {
     const { processors, logger } = this.options;
 
@@ -185,6 +190,7 @@ export class LocationReaders implements LocationReader {
             current,
             item.location,
             emit,
+            originLocation,
           );
         } catch (e) {
           const message = `Processor ${processor.constructor.name} threw an error while preprocessing entity ${kind}:${namespace}/${name} at ${item.location.type} ${item.location.target}, ${e}`;
diff --git a/plugins/catalog-backend/src/ingestion/processors/AnnotateLocationEntityProcessor.test.ts b/plugins/catalog-backend/src/ingestion/processors/AnnotateLocationEntityProcessor.test.ts
new file mode 100644
index 0000000000..cfd98e9e6a
--- /dev/null
+++ b/plugins/catalog-backend/src/ingestion/processors/AnnotateLocationEntityProcessor.test.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Entity, LocationSpec } from '@backstage/catalog-model';
+import { AnnotateLocationEntityProcessor } from './AnnotateLocationEntityProcessor';
+
+describe('AnnotateLocationEntityProcessor', () => {
+  describe('preProcessEntity', () => {
+    it('adds annotations', async () => {
+      const entity: Entity = {
+        apiVersion: 'backstage.io/v1alpha1',
+        kind: 'Component',
+        metadata: {
+          name: 'my-component',
+        },
+      };
+
+      const location: LocationSpec = {
+        type: 'url',
+        target: 'my-location',
+      };
+      const originLocation: LocationSpec = {
+        type: 'url',
+        target: 'my-origin-location',
+      };
+
+      const processor = new AnnotateLocationEntityProcessor();
+
+      expect(
+        await processor.preProcessEntity(
+          entity,
+          location,
+          () => {},
+          originLocation,
+        ),
+      ).toEqual({
+        apiVersion: 'backstage.io/v1alpha1',
+        kind: 'Component',
+        metadata: {
+          name: 'my-component',
+          annotations: {
+            'backstage.io/managed-by-location': 'url:my-location',
+            'backstage.io/managed-by-origin-location': 'url:my-origin-location',
+          },
+        },
+      });
+    });
+  });
+});
diff --git a/plugins/catalog-backend/src/ingestion/processors/AnnotateLocationEntityProcessor.ts b/plugins/catalog-backend/src/ingestion/processors/AnnotateLocationEntityProcessor.ts
index ea8afcddc5..b40378226a 100644
--- a/plugins/catalog-backend/src/ingestion/processors/AnnotateLocationEntityProcessor.ts
+++ b/plugins/catalog-backend/src/ingestion/processors/AnnotateLocationEntityProcessor.ts
@@ -14,20 +14,28 @@
  * limitations under the License.
  */
 
-import { Entity, LocationSpec } from '@backstage/catalog-model';
+import {
+  Entity,
+  LOCATION_ANNOTATION,
+  LocationSpec,
+  ORIGIN_LOCATION_ANNOTATION,
+} from '@backstage/catalog-model';
 import lodash from 'lodash';
-import { CatalogProcessor } from './types';
+import { CatalogProcessor, CatalogProcessorEmit } from './types';
 
 export class AnnotateLocationEntityProcessor implements CatalogProcessor {
   async preProcessEntity(
     entity: Entity,
     location: LocationSpec,
+    _: CatalogProcessorEmit,
+    originLocation: LocationSpec,
   ): Promise<Entity> {
     return lodash.merge(
       {
         metadata: {
           annotations: {
-            'backstage.io/managed-by-location': `${location.type}:${location.target}`,
+            [LOCATION_ANNOTATION]: `${location.type}:${location.target}`,
+            [ORIGIN_LOCATION_ANNOTATION]: `${originLocation.type}:${originLocation.target}`,
           },
         },
       },
diff --git a/plugins/catalog-backend/src/ingestion/processors/UrlReaderProcessor.test.ts b/plugins/catalog-backend/src/ingestion/processors/UrlReaderProcessor.test.ts
index 9bf72d620b..aac4235e3a 100644
--- a/plugins/catalog-backend/src/ingestion/processors/UrlReaderProcessor.test.ts
+++ b/plugins/catalog-backend/src/ingestion/processors/UrlReaderProcessor.test.ts
@@ -27,13 +27,18 @@ import {
 } from './types';
 
 describe('UrlReaderProcessor', () => {
-  const mockApiOrigin = 'http://localhost:23000';
+  const mockApiOrigin = 'http://localhost';
   const server = setupServer();
 
   msw.setupDefaultHandlers(server);
   it('should load from url', async () => {
     const logger = getVoidLogger();
-    const reader = UrlReaders.default({ logger, config: new ConfigReader({}) });
+    const reader = UrlReaders.default({
+      logger,
+      config: new ConfigReader({
+        backend: { reading: { allow: [{ host: 'localhost' }] } },
+      }),
+    });
     const processor = new UrlReaderProcessor({ reader, logger });
     const spec = {
       type: 'url',
@@ -57,7 +62,12 @@ describe('UrlReaderProcessor', () => {
 
   it('should fail load from url with error', async () => {
     const logger = getVoidLogger();
-    const reader = UrlReaders.default({ logger, config: new ConfigReader({}) });
+    const reader = UrlReaders.default({
+      logger,
+      config: new ConfigReader({
+        backend: { reading: { allow: [{ host: 'localhost' }] } },
+      }),
+    });
     const processor = new UrlReaderProcessor({ reader, logger });
     const spec = {
       type: 'url',
diff --git a/plugins/catalog-backend/src/ingestion/processors/types.ts b/plugins/catalog-backend/src/ingestion/processors/types.ts
index 5da3510f7a..1bf30567bc 100644
--- a/plugins/catalog-backend/src/ingestion/processors/types.ts
+++ b/plugins/catalog-backend/src/ingestion/processors/types.ts
@@ -46,12 +46,16 @@ export type CatalogProcessor = {
    * @param entity The (possibly partial) entity to process
    * @param location The location that the entity came from
    * @param emit A sink for auxiliary items resulting from the processing
+   * @param originLocation The location that the entity originally came from.
+   *   While location resolves to the direct parent location, originLocation
+   *   tells which location was used to start the ingestion loop.
    * @returns The same entity or a modified version of it
    */
   preProcessEntity?(
     entity: Entity,
     location: LocationSpec,
     emit: CatalogProcessorEmit,
+    originLocation: LocationSpec,
   ): Promise<Entity>;
 
   /**
diff --git a/plugins/catalog/src/components/CatalogTable/CatalogTable.tsx b/plugins/catalog/src/components/CatalogTable/CatalogTable.tsx
index 684e0e3916..8741cb6157 100644
--- a/plugins/catalog/src/components/CatalogTable/CatalogTable.tsx
+++ b/plugins/catalog/src/components/CatalogTable/CatalogTable.tsx
@@ -13,7 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { Entity } from '@backstage/catalog-model';
+import {
+  Entity,
+  EntityName,
+  RELATION_OWNED_BY,
+  RELATION_PART_OF,
+} from '@backstage/catalog-model';
 import { Table, TableColumn, TableProps } from '@backstage/core';
 import { Chip, Link } from '@material-ui/core';
 import Edit from '@material-ui/icons/Edit';
@@ -22,20 +27,31 @@ import { Alert } from '@material-ui/lab';
 import React from 'react';
 import { generatePath, Link as RouterLink } from 'react-router-dom';
 import { findLocationForEntityMeta } from '../../data/utils';
-import { createEditLink } from '../createEditLink';
 import { useStarredEntities } from '../../hooks/useStarredEntities';
 import { entityRoute, entityRouteParams } from '../../routes';
+import { createEditLink } from '../createEditLink';
+import { EntityRefLink, formatEntityRefTitle } from '../EntityRefLink';
 import {
   favouriteEntityIcon,
   favouriteEntityTooltip,
 } from '../FavouriteEntity/FavouriteEntity';
+import { getEntityRelations } from '../getEntityRelations';
 
-const columns: TableColumn<Entity>[] = [
+type EntityRow = Entity & {
+  row: {
+    partOfSystemRelationTitle?: string;
+    partOfSystemRelation?: EntityName;
+    ownedByRelationsTitle?: string;
+    ownedByRelations: EntityName[];
+  };
+};
+
+const columns: TableColumn<EntityRow>[] = [
   {
     title: 'Name',
     field: 'metadata.name',
     highlight: true,
-    render: (entity: any) => (
+    render: entity => (
       <Link
         component={RouterLink}
         to={generatePath(entityRoute.path, {
@@ -47,9 +63,33 @@ const columns: TableColumn<Entity>[] = [
       </Link>
     ),
   },
+  {
+    title: 'System',
+    field: 'row.partOfSystemRelationTitle',
+    render: entity => (
+      <>
+        {entity.row.partOfSystemRelation && (
+          <EntityRefLink
+            entityRef={entity.row.partOfSystemRelation}
+            defaultKind="system"
+          />
+        )}
+      </>
+    ),
+  },
   {
     title: 'Owner',
-    field: 'spec.owner',
+    field: 'row.ownedByRelationsTitle',
+    render: entity => (
+      <>
+        {entity.row.ownedByRelations.map((t, i) => (
+          <React.Fragment key={i}>
+            {i > 0 && ', '}
+            <EntityRefLink entityRef={t} defaultKind="group" />
+          </React.Fragment>
+        ))}
+      </>
+    ),
   },
   {
     title: 'Lifecycle',
@@ -65,7 +105,7 @@ const columns: TableColumn<Entity>[] = [
     cellStyle: {
       padding: '0px 16px 0px 20px',
     },
-    render: (entity: Entity) => (
+    render: entity => (
       <>
         {entity.metadata.tags &&
           entity.metadata.tags.map(t => (
@@ -141,8 +181,31 @@ export const CatalogTable = ({
     },
   ];
 
+  const rows = entities.map(e => {
+    const [partOfSystemRelation] = getEntityRelations(e, RELATION_PART_OF, {
+      kind: 'system',
+    });
+    const ownedByRelations = getEntityRelations(e, RELATION_OWNED_BY);
+
+    return {
+      ...e,
+      row: {
+        ownedByRelationsTitle: ownedByRelations
+          .map(r => formatEntityRefTitle(r, { defaultKind: 'group' }))
+          .join(', '),
+        ownedByRelations,
+        partOfSystemRelationTitle: partOfSystemRelation
+          ? formatEntityRefTitle(partOfSystemRelation, {
+              defaultKind: 'system',
+            })
+          : undefined,
+        partOfSystemRelation,
+      },
+    };
+  });
+
   return (
-    <Table<Entity>
+    <Table<EntityRow>
       isLoading={loading}
       columns={columns}
       options={{
@@ -155,7 +218,7 @@ export const CatalogTable = ({
         pageSizeOptions: [20, 50, 100],
       }}
       title={`${titlePreamble} (${(entities && entities.length) || 0})`}
-      data={entities}
+      data={rows}
       actions={actions}
     />
   );
diff --git a/plugins/catalog/src/components/EntityRefLink/EntityRefLink.test.tsx b/plugins/catalog/src/components/EntityRefLink/EntityRefLink.test.tsx
index 28f5caca00..b6fe8a77d8 100644
--- a/plugins/catalog/src/components/EntityRefLink/EntityRefLink.test.tsx
+++ b/plugins/catalog/src/components/EntityRefLink/EntityRefLink.test.tsx
@@ -37,7 +37,10 @@ describe('<EntityRefLink />', () => {
       wrapper: MemoryRouter,
     });
 
-    expect(getByText('component:software')).toBeInTheDocument();
+    expect(getByText('component:software')).toHaveAttribute(
+      'href',
+      '/catalog/default/component/software',
+    );
   });
 
   it('renders link for entity in other namespace', () => {
@@ -57,7 +60,10 @@ describe('<EntityRefLink />', () => {
     const { getByText } = render(<EntityRefLink entityRef={entity} />, {
       wrapper: MemoryRouter,
     });
-    expect(getByText('component:test/software')).toBeInTheDocument();
+    expect(getByText('component:test/software')).toHaveAttribute(
+      'href',
+      '/catalog/test/component/software',
+    );
   });
 
   it('renders link for entity and hides default kind', () => {
@@ -80,7 +86,10 @@ describe('<EntityRefLink />', () => {
         wrapper: MemoryRouter,
       },
     );
-    expect(getByText('test/software')).toBeInTheDocument();
+    expect(getByText('test/software')).toHaveAttribute(
+      'href',
+      '/catalog/test/component/software',
+    );
   });
 
   it('renders link for entity name in default namespace', () => {
@@ -92,7 +101,10 @@ describe('<EntityRefLink />', () => {
     const { getByText } = render(<EntityRefLink entityRef={entityName} />, {
       wrapper: MemoryRouter,
     });
-    expect(getByText('component:software')).toBeInTheDocument();
+    expect(getByText('component:software')).toHaveAttribute(
+      'href',
+      '/catalog/default/component/software',
+    );
   });
 
   it('renders link for entity name in other namespace', () => {
@@ -104,7 +116,10 @@ describe('<EntityRefLink />', () => {
     const { getByText } = render(<EntityRefLink entityRef={entityName} />, {
       wrapper: MemoryRouter,
     });
-    expect(getByText('component:test/software')).toBeInTheDocument();
+    expect(getByText('component:test/software')).toHaveAttribute(
+      'href',
+      '/catalog/test/component/software',
+    );
   });
 
   it('renders link for entity name and hides default kind', () => {
@@ -119,6 +134,29 @@ describe('<EntityRefLink />', () => {
         wrapper: MemoryRouter,
       },
     );
-    expect(getByText('test/software')).toBeInTheDocument();
+    expect(getByText('test/software')).toHaveAttribute(
+      'href',
+      '/catalog/test/component/software',
+    );
+  });
+
+  it('renders link with custom children', () => {
+    const entityName = {
+      kind: 'Component',
+      namespace: 'test',
+      name: 'software',
+    };
+    const { getByText } = render(
+      <EntityRefLink entityRef={entityName} defaultKind="component">
+        Custom Children
+      </EntityRefLink>,
+      {
+        wrapper: MemoryRouter,
+      },
+    );
+    expect(getByText('Custom Children')).toHaveAttribute(
+      'href',
+      '/catalog/test/component/software',
+    );
   });
 });
diff --git a/plugins/catalog/src/components/EntityRefLink/EntityRefLink.tsx b/plugins/catalog/src/components/EntityRefLink/EntityRefLink.tsx
index a06ba69fbe..64b2bb8615 100644
--- a/plugins/catalog/src/components/EntityRefLink/EntityRefLink.tsx
+++ b/plugins/catalog/src/components/EntityRefLink/EntityRefLink.tsx
@@ -17,17 +17,18 @@ import {
   Entity,
   EntityName,
   ENTITY_DEFAULT_NAMESPACE,
-  serializeEntityRef,
 } from '@backstage/catalog-model';
 import { Link } from '@material-ui/core';
 import React from 'react';
 import { generatePath } from 'react-router';
 import { Link as RouterLink } from 'react-router-dom';
 import { entityRoute } from '../../routes';
+import { formatEntityRefTitle } from './format';
 
 type EntityRefLinkProps = {
   entityRef: Entity | EntityName;
   defaultKind?: string;
+  children?: React.ReactNode;
 };
 
 // TODO: This component is private for now, as it should probably belong into
@@ -36,6 +37,7 @@ type EntityRefLinkProps = {
 export const EntityRefLink = ({
   entityRef,
   defaultKind,
+  children,
 }: EntityRefLinkProps) => {
   let kind;
   let namespace;
@@ -51,17 +53,8 @@ export const EntityRefLink = ({
     name = entityRef.name;
   }
 
-  if (namespace === ENTITY_DEFAULT_NAMESPACE) {
-    namespace = undefined;
-  }
-
   kind = kind.toLowerCase();
 
-  const title = `${serializeEntityRef({
-    kind: defaultKind && defaultKind.toLowerCase() === kind ? undefined : kind,
-    name,
-    namespace,
-  })}`;
   const routeParams = {
     kind,
     namespace: namespace?.toLowerCase() ?? ENTITY_DEFAULT_NAMESPACE,
@@ -74,7 +67,8 @@ export const EntityRefLink = ({
       component={RouterLink}
       to={generatePath(`/catalog/${entityRoute.path}`, routeParams)}
     >
-      {title}
+      {children}
+      {!children && formatEntityRefTitle(entityRef, { defaultKind })}
     </Link>
   );
 };
diff --git a/plugins/catalog/src/components/EntityRefLink/format.test.ts b/plugins/catalog/src/components/EntityRefLink/format.test.ts
new file mode 100644
index 0000000000..142c914453
--- /dev/null
+++ b/plugins/catalog/src/components/EntityRefLink/format.test.ts
@@ -0,0 +1,106 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { formatEntityRefTitle } from './format';
+
+describe('formatEntityRefTitle', () => {
+  it('formats entity in default namespace', () => {
+    const entity = {
+      apiVersion: 'v1',
+      kind: 'Component',
+      metadata: {
+        name: 'software',
+      },
+      spec: {
+        owner: 'guest',
+        type: 'service',
+        lifecycle: 'production',
+      },
+    };
+    const title = formatEntityRefTitle(entity);
+    expect(title).toEqual('component:software');
+  });
+
+  it('formats entity in other namespace', () => {
+    const entity = {
+      apiVersion: 'v1',
+      kind: 'Component',
+      metadata: {
+        name: 'software',
+        namespace: 'test',
+      },
+      spec: {
+        owner: 'guest',
+        type: 'service',
+        lifecycle: 'production',
+      },
+    };
+    const title = formatEntityRefTitle(entity);
+    expect(title).toEqual('component:test/software');
+  });
+
+  it('formats entity and hides default kind', () => {
+    const entity = {
+      apiVersion: 'v1',
+      kind: 'Component',
+      metadata: {
+        name: 'software',
+        namespace: 'test',
+      },
+      spec: {
+        owner: 'guest',
+        type: 'service',
+        lifecycle: 'production',
+      },
+    };
+    const title = formatEntityRefTitle(entity, { defaultKind: 'Component' });
+    expect(title).toEqual('test/software');
+  });
+
+  it('formats entity name in default namespace', () => {
+    const entityName = {
+      kind: 'Component',
+      namespace: 'default',
+      name: 'software',
+    };
+    const title = formatEntityRefTitle(entityName);
+    expect(title).toEqual('component:software');
+  });
+
+  it('formats entity name in other namespace', () => {
+    const entityName = {
+      kind: 'Component',
+      namespace: 'test',
+      name: 'software',
+    };
+
+    const title = formatEntityRefTitle(entityName);
+    expect(title).toEqual('component:test/software');
+  });
+
+  it('renders link for entity name and hides default kind', () => {
+    const entityName = {
+      kind: 'Component',
+      namespace: 'test',
+      name: 'software',
+    };
+
+    const title = formatEntityRefTitle(entityName, {
+      defaultKind: 'component',
+    });
+    expect(title).toEqual('test/software');
+  });
+});
diff --git a/plugins/catalog/src/components/EntityRefLink/format.ts b/plugins/catalog/src/components/EntityRefLink/format.ts
new file mode 100644
index 0000000000..28ba1bd22d
--- /dev/null
+++ b/plugins/catalog/src/components/EntityRefLink/format.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {
+  Entity,
+  EntityName,
+  ENTITY_DEFAULT_NAMESPACE,
+  serializeEntityRef,
+} from '@backstage/catalog-model';
+
+export function formatEntityRefTitle(
+  entityRef: Entity | EntityName,
+  opts?: { defaultKind?: string },
+) {
+  const defaultKind = opts?.defaultKind;
+  let kind;
+  let namespace;
+  let name;
+
+  if ('metadata' in entityRef) {
+    kind = entityRef.kind;
+    namespace = entityRef.metadata.namespace;
+    name = entityRef.metadata.name;
+  } else {
+    kind = entityRef.kind;
+    namespace = entityRef.namespace;
+    name = entityRef.name;
+  }
+
+  if (namespace === ENTITY_DEFAULT_NAMESPACE) {
+    namespace = undefined;
+  }
+
+  kind = kind.toLowerCase();
+
+  return `${serializeEntityRef({
+    kind: defaultKind && defaultKind.toLowerCase() === kind ? undefined : kind,
+    name,
+    namespace,
+  })}`;
+}
diff --git a/plugins/catalog/src/components/EntityRefLink/index.ts b/plugins/catalog/src/components/EntityRefLink/index.ts
index aa2c6641ef..76a7da38c5 100644
--- a/plugins/catalog/src/components/EntityRefLink/index.ts
+++ b/plugins/catalog/src/components/EntityRefLink/index.ts
@@ -14,3 +14,4 @@
  * limitations under the License.
  */
 export { EntityRefLink } from './EntityRefLink';
+export { formatEntityRefTitle } from './format';
diff --git a/plugins/catalog/src/components/UnregisterEntityDialog/UnregisterEntityDialog.tsx b/plugins/catalog/src/components/UnregisterEntityDialog/UnregisterEntityDialog.tsx
index ce6e63da1b..2c8fcfd6e9 100644
--- a/plugins/catalog/src/components/UnregisterEntityDialog/UnregisterEntityDialog.tsx
+++ b/plugins/catalog/src/components/UnregisterEntityDialog/UnregisterEntityDialog.tsx
@@ -14,8 +14,8 @@
  * limitations under the License.
  */
 
-import { Entity, LOCATION_ANNOTATION } from '@backstage/catalog-model';
-import { alertApiRef, Progress, useApi } from '@backstage/core';
+import { Entity, ORIGIN_LOCATION_ANNOTATION } from '@backstage/catalog-model';
+import { alertApiRef, configApiRef, Progress, useApi } from '@backstage/core';
 import {
   Button,
   Dialog,
@@ -32,6 +32,7 @@ import React from 'react';
 import { useAsync } from 'react-use';
 import { AsyncState } from 'react-use/lib/useAsync';
 import { catalogApiRef } from '../../plugin';
+import { formatEntityRefTitle } from '../EntityRefLink';
 
 type Props = {
   open: boolean;
@@ -40,15 +41,30 @@ type Props = {
   entity: Entity;
 };
 
+class DeniedLocationException extends Error {
+  constructor(public readonly locationName: string) {
+    super(`You may not remove the location ${locationName}`);
+    this.name = 'DeniedLocationException';
+  }
+}
+
 function useColocatedEntities(entity: Entity): AsyncState<Entity[]> {
   const catalogApi = useApi(catalogApiRef);
   return useAsync(async () => {
-    const myLocation = entity.metadata.annotations?.[LOCATION_ANNOTATION];
+    const myLocation =
+      entity.metadata.annotations?.[ORIGIN_LOCATION_ANNOTATION];
     if (!myLocation) {
       return [];
     }
+
+    if (myLocation === 'bootstrap:bootstrap') {
+      throw new DeniedLocationException(myLocation);
+    }
+
     const response = await catalogApi.getEntities({
-      filter: { [LOCATION_ANNOTATION]: myLocation },
+      filter: {
+        [`metadata.annotations.${ORIGIN_LOCATION_ANNOTATION}`]: myLocation,
+      },
     });
     return response.items;
   }, [catalogApi, entity]);
@@ -65,6 +81,7 @@ export const UnregisterEntityDialog = ({
   const fullScreen = useMediaQuery(theme.breakpoints.down('sm'));
   const catalogApi = useApi(catalogApiRef);
   const alertApi = useApi(alertApiRef);
+  const configApi = useApi(configApiRef);
 
   const removeEntity = async () => {
     const uid = entity.metadata.uid;
@@ -82,13 +99,27 @@ export const UnregisterEntityDialog = ({
       <DialogTitle id="responsive-dialog-title">
         Are you sure you want to unregister this entity?
       </DialogTitle>
+
       <DialogContent>
         {loading ? <Progress /> : null}
+
         {error ? (
           <Alert severity="error" style={{ wordBreak: 'break-word' }}>
-            {error.toString()}
+            {error.name === 'DeniedLocationException' ? (
+              <>
+                You cannot unregister this entity, since it originates from a
+                protected Backstage configuration (location
+                {`"${(error as DeniedLocationException).locationName}"`}). If
+                you believe this is in error, please contact the{' '}
+                {configApi.getOptionalString('app.title') ?? 'Backstage'}{' '}
+                integrator.
+              </>
+            ) : (
+              error.toString()
+            )}
           </Alert>
         ) : null}
+
         {entities?.length ? (
           <>
             <DialogContentText>
@@ -96,9 +127,10 @@ export const UnregisterEntityDialog = ({
             </DialogContentText>
             <Typography component="div">
               <ul>
-                {entities.map(e => (
-                  <li key={e.metadata.name}>{e.metadata.name}</li>
-                ))}
+                {entities.map(e => {
+                  const fullName = formatEntityRefTitle(e);
+                  return <li key={fullName}>{fullName}</li>;
+                })}
               </ul>
             </Typography>
             <DialogContentText>
@@ -107,16 +139,21 @@ export const UnregisterEntityDialog = ({
             <Typography component="div">
               <ul style={{ wordBreak: 'break-word' }}>
                 <li>
-                  {entities[0]?.metadata.annotations?.[LOCATION_ANNOTATION]}
+                  {
+                    entities[0]?.metadata.annotations?.[
+                      ORIGIN_LOCATION_ANNOTATION
+                    ]
+                  }
                 </li>
               </ul>
             </Typography>
+            <DialogContentText>
+              To undo, just re-register the entity in Backstage.
+            </DialogContentText>
           </>
         ) : null}
-        <DialogContentText>
-          To undo, just re-register the entity in Backstage.
-        </DialogContentText>
       </DialogContent>
+
       <DialogActions>
         <Button onClick={onClose} color="primary">
           Cancel
diff --git a/plugins/github-actions/README.md b/plugins/github-actions/README.md
index 1a46022c58..d47144351e 100644
--- a/plugins/github-actions/README.md
+++ b/plugins/github-actions/README.md
@@ -43,25 +43,12 @@ If you didn't clone this repo you have to do some extra work.
 yarn add @backstage/plugin-github-actions
 ```
 
-```js
-// packages/app/src/api.ts
-import { ApiRegistry } from '@backstage/core';
-import { GithubActionsClient, githubActionsApiRef } from '@backstage/plugin-github-actions';
-
-const builder = ApiRegistry.builder();
-builder.add(githubActionsApiRef, new GithubActionsClient());
-
-export default builder.build() as ApiHolder;
-```
-
-2. Add plugin itself:
-
 ```js
 // packages/app/src/plugins.ts
 export { plugin as GithubActions } from '@backstage/plugin-github-actions';
 ```
 
-3. Run the app with `yarn start` and the backend with `yarn --cwd packages/backend start`, navigate to `/github-actions/`.
+2. Run the app with `yarn start` and the backend with `yarn --cwd packages/backend start`, navigate to `/github-actions/`.
 
 ## Features
 
diff --git a/plugins/github-actions/package.json b/plugins/github-actions/package.json
index 9b2d199b1f..1cef46df02 100644
--- a/plugins/github-actions/package.json
+++ b/plugins/github-actions/package.json
@@ -34,6 +34,7 @@
   "dependencies": {
     "@backstage/catalog-model": "^0.6.1",
     "@backstage/core": "^0.4.4",
+    "@backstage/integration": "^0.2.0",
     "@backstage/plugin-catalog": "^0.2.11",
     "@backstage/theme": "^0.2.2",
     "@material-ui/core": "^4.11.0",
diff --git a/plugins/github-actions/src/api/GithubActionsApi.ts b/plugins/github-actions/src/api/GithubActionsApi.ts
index 75086998c9..637bb23216 100644
--- a/plugins/github-actions/src/api/GithubActionsApi.ts
+++ b/plugins/github-actions/src/api/GithubActionsApi.ts
@@ -24,14 +24,14 @@ export const githubActionsApiRef = createApiRef<GithubActionsApi>({
 
 export type GithubActionsApi = {
   listWorkflowRuns: ({
-    token,
+    hostname,
     owner,
     repo,
     pageSize,
     page,
     branch,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     pageSize?: number;
@@ -41,12 +41,12 @@ export type GithubActionsApi = {
     RestEndpointMethodTypes['actions']['listWorkflowRuns']['response']['data']
   >;
   getWorkflow: ({
-    token,
+    hostname,
     owner,
     repo,
     id,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     id: number;
@@ -54,12 +54,12 @@ export type GithubActionsApi = {
     RestEndpointMethodTypes['actions']['getWorkflow']['response']['data']
   >;
   getWorkflowRun: ({
-    token,
+    hostname,
     owner,
     repo,
     id,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     id: number;
@@ -67,23 +67,23 @@ export type GithubActionsApi = {
     RestEndpointMethodTypes['actions']['getWorkflowRun']['response']['data']
   >;
   reRunWorkflow: ({
-    token,
+    hostname,
     owner,
     repo,
     runId,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     runId: number;
   }) => Promise<any>;
   downloadJobLogsForWorkflowRun: ({
-    token,
+    hostname,
     owner,
     repo,
     runId,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     runId: number;
diff --git a/plugins/github-actions/src/api/GithubActionsClient.ts b/plugins/github-actions/src/api/GithubActionsClient.ts
index 5be2c9a743..a667ddc4ad 100644
--- a/plugins/github-actions/src/api/GithubActionsClient.ts
+++ b/plugins/github-actions/src/api/GithubActionsClient.ts
@@ -14,36 +14,60 @@
  * limitations under the License.
  */
 
+import { ConfigApi, OAuthApi } from '@backstage/core';
+import { readGitHubIntegrationConfigs } from '@backstage/integration';
 import { GithubActionsApi } from './GithubActionsApi';
 import { Octokit, RestEndpointMethodTypes } from '@octokit/rest';
 
 export class GithubActionsClient implements GithubActionsApi {
+  private readonly configApi: ConfigApi;
+  private readonly githubAuthApi: OAuthApi;
+
+  constructor(options: { configApi: ConfigApi; githubAuthApi: OAuthApi }) {
+    this.configApi = options.configApi;
+    this.githubAuthApi = options.githubAuthApi;
+  }
+
+  private async getOctokit(hostname?: string): Promise<Octokit> {
+    // TODO: Get access token for the specified hostname
+    const token = await this.githubAuthApi.getAccessToken(['repo']);
+    const configs = readGitHubIntegrationConfigs(
+      this.configApi.getOptionalConfigArray('integrations.github') ?? [],
+    );
+    const githubIntegrationConfig = configs.find(
+      v => v.host === hostname ?? 'github.com',
+    );
+    const baseUrl = githubIntegrationConfig?.apiBaseUrl;
+    return new Octokit({ auth: token, baseUrl });
+  }
+
   async reRunWorkflow({
-    token,
+    hostname,
     owner,
     repo,
     runId,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     runId: number;
   }): Promise<any> {
-    return new Octokit({ auth: token }).actions.reRunWorkflow({
+    const octokit = await this.getOctokit(hostname);
+    return octokit.actions.reRunWorkflow({
       owner,
       repo,
       run_id: runId,
     });
   }
   async listWorkflowRuns({
-    token,
+    hostname,
     owner,
     repo,
     pageSize = 100,
     page = 0,
     branch,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     pageSize?: number;
@@ -52,9 +76,8 @@ export class GithubActionsClient implements GithubActionsApi {
   }): Promise<
     RestEndpointMethodTypes['actions']['listWorkflowRuns']['response']['data']
   > {
-    const workflowRuns = await new Octokit({
-      auth: token,
-    }).actions.listWorkflowRunsForRepo({
+    const octokit = await this.getOctokit(hostname);
+    const workflowRuns = await octokit.actions.listWorkflowRunsForRepo({
       owner,
       repo,
       per_page: pageSize,
@@ -64,19 +87,20 @@ export class GithubActionsClient implements GithubActionsApi {
     return workflowRuns.data;
   }
   async getWorkflow({
-    token,
+    hostname,
     owner,
     repo,
     id,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     id: number;
   }): Promise<
     RestEndpointMethodTypes['actions']['getWorkflow']['response']['data']
   > {
-    const workflow = await new Octokit({ auth: token }).actions.getWorkflow({
+    const octokit = await this.getOctokit(hostname);
+    const workflow = await octokit.actions.getWorkflow({
       owner,
       repo,
       workflow_id: id,
@@ -84,19 +108,20 @@ export class GithubActionsClient implements GithubActionsApi {
     return workflow.data;
   }
   async getWorkflowRun({
-    token,
+    hostname,
     owner,
     repo,
     id,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     id: number;
   }): Promise<
     RestEndpointMethodTypes['actions']['getWorkflowRun']['response']['data']
   > {
-    const run = await new Octokit({ auth: token }).actions.getWorkflowRun({
+    const octokit = await this.getOctokit(hostname);
+    const run = await octokit.actions.getWorkflowRun({
       owner,
       repo,
       run_id: id,
@@ -104,21 +129,20 @@ export class GithubActionsClient implements GithubActionsApi {
     return run.data;
   }
   async downloadJobLogsForWorkflowRun({
-    token,
+    hostname,
     owner,
     repo,
     runId,
   }: {
-    token: string;
+    hostname?: string;
     owner: string;
     repo: string;
     runId: number;
   }): Promise<
     RestEndpointMethodTypes['actions']['downloadJobLogsForWorkflowRun']['response']['data']
   > {
-    const workflow = await new Octokit({
-      auth: token,
-    }).actions.downloadJobLogsForWorkflowRun({
+    const octokit = await this.getOctokit(hostname);
+    const workflow = await octokit.actions.downloadJobLogsForWorkflowRun({
       owner,
       repo,
       job_id: runId,
diff --git a/plugins/github-actions/src/components/Cards/Cards.tsx b/plugins/github-actions/src/components/Cards/Cards.tsx
index 1f1e2997df..f1c27cb666 100644
--- a/plugins/github-actions/src/components/Cards/Cards.tsx
+++ b/plugins/github-actions/src/components/Cards/Cards.tsx
@@ -17,6 +17,7 @@ import React, { useEffect } from 'react';
 import { useWorkflowRuns } from '../useWorkflowRuns';
 import { WorkflowRun, WorkflowRunsTable } from '../WorkflowRunsTable';
 import { Entity } from '@backstage/catalog-model';
+import { readGitHubIntegrationConfigs } from '@backstage/integration';
 import { WorkflowRunStatus } from '../WorkflowRunStatus';
 import {
   Link,
@@ -28,6 +29,7 @@ import {
 import {
   InfoCard,
   StructuredMetadataTable,
+  configApiRef,
   errorApiRef,
   useApi,
 } from '@backstage/core';
@@ -84,11 +86,17 @@ export const LatestWorkflowRunCard = ({
   // Display the card full height suitable for
   variant,
 }: Props) => {
+  const config = useApi(configApiRef);
   const errorApi = useApi(errorApiRef);
+  // TODO: Get github hostname from metadata annotation
+  const hostname = readGitHubIntegrationConfigs(
+    config.getOptionalConfigArray('integrations.github') ?? [],
+  )[0].host;
   const [owner, repo] = (
     entity?.metadata.annotations?.[GITHUB_ACTIONS_ANNOTATION] ?? '/'
   ).split('/');
   const [{ runs, loading, error }] = useWorkflowRuns({
+    hostname,
     owner,
     repo,
     branch,
diff --git a/plugins/github-actions/src/components/Cards/RecentWorkflowRunsCard.test.tsx b/plugins/github-actions/src/components/Cards/RecentWorkflowRunsCard.test.tsx
index 0fd77c0443..0deb4ae39d 100644
--- a/plugins/github-actions/src/components/Cards/RecentWorkflowRunsCard.test.tsx
+++ b/plugins/github-actions/src/components/Cards/RecentWorkflowRunsCard.test.tsx
@@ -14,7 +14,14 @@
  * limitations under the License.
  */
 
-import { ApiProvider, ApiRegistry, errorApiRef } from '@backstage/core';
+import {
+  ApiProvider,
+  ApiRegistry,
+  errorApiRef,
+  configApiRef,
+  ConfigApi,
+  ConfigReader,
+} from '@backstage/core';
 import { lightTheme } from '@backstage/theme';
 import { ThemeProvider } from '@material-ui/core';
 import { render } from '@testing-library/react';
@@ -33,6 +40,8 @@ const mockErrorApi: jest.Mocked<typeof errorApiRef.T> = {
   error$: jest.fn(),
 };
 
+const configApi: ConfigApi = new ConfigReader({});
+
 describe('<RecentWorkflowRunsCard />', () => {
   const entity = {
     apiVersion: 'v1',
@@ -69,7 +78,12 @@ describe('<RecentWorkflowRunsCard />', () => {
     render(
       <ThemeProvider theme={lightTheme}>
         <MemoryRouter>
-          <ApiProvider apis={ApiRegistry.with(errorApiRef, mockErrorApi)}>
+          <ApiProvider
+            apis={ApiRegistry.with(errorApiRef, mockErrorApi).with(
+              configApiRef,
+              configApi,
+            )}
+          >
             <RecentWorkflowRunsCard {...props} />
           </ApiProvider>
         </MemoryRouter>
diff --git a/plugins/github-actions/src/components/Cards/RecentWorkflowRunsCard.tsx b/plugins/github-actions/src/components/Cards/RecentWorkflowRunsCard.tsx
index 9bb52b9ab1..aa30423c3e 100644
--- a/plugins/github-actions/src/components/Cards/RecentWorkflowRunsCard.tsx
+++ b/plugins/github-actions/src/components/Cards/RecentWorkflowRunsCard.tsx
@@ -15,12 +15,14 @@
  */
 import { Entity } from '@backstage/catalog-model';
 import {
+  configApiRef,
   EmptyState,
   errorApiRef,
   InfoCard,
   Table,
   useApi,
 } from '@backstage/core';
+import { readGitHubIntegrationConfigs } from '@backstage/integration';
 import { Button, Link } from '@material-ui/core';
 import React, { useEffect } from 'react';
 import { generatePath, Link as RouterLink } from 'react-router-dom';
@@ -45,11 +47,17 @@ export const RecentWorkflowRunsCard = ({
   limit = 5,
   variant,
 }: Props) => {
+  const config = useApi(configApiRef);
   const errorApi = useApi(errorApiRef);
+  // TODO: Get github hostname from metadata annotation
+  const hostname = readGitHubIntegrationConfigs(
+    config.getOptionalConfigArray('integrations.github') ?? [],
+  )[0].host;
   const [owner, repo] = (
     entity?.metadata.annotations?.[GITHUB_ACTIONS_ANNOTATION] ?? '/'
   ).split('/');
   const [{ runs = [], loading, error }] = useWorkflowRuns({
+    hostname,
     owner,
     repo,
     branch,
diff --git a/plugins/github-actions/src/components/WorkflowRunDetails/WorkflowRunDetails.tsx b/plugins/github-actions/src/components/WorkflowRunDetails/WorkflowRunDetails.tsx
index ac238b8d0f..8503210c5e 100644
--- a/plugins/github-actions/src/components/WorkflowRunDetails/WorkflowRunDetails.tsx
+++ b/plugins/github-actions/src/components/WorkflowRunDetails/WorkflowRunDetails.tsx
@@ -14,7 +14,8 @@
  * limitations under the License.
  */
 import { Entity } from '@backstage/catalog-model';
-import { Link } from '@backstage/core';
+import { configApiRef, Link, useApi } from '@backstage/core';
+import { readGitHubIntegrationConfigs } from '@backstage/integration';
 import {
   Accordion,
   AccordionDetails,
@@ -159,10 +160,15 @@ const JobListItem = ({
 };
 
 export const WorkflowRunDetails = ({ entity }: { entity: Entity }) => {
+  const config = useApi(configApiRef);
   const projectName = useProjectName(entity);
 
+  // TODO: Get github hostname from metadata annotation
+  const hostname = readGitHubIntegrationConfigs(
+    config.getOptionalConfigArray('integrations.github') ?? [],
+  )[0].host;
   const [owner, repo] = projectName.value ? projectName.value.split('/') : [];
-  const details = useWorkflowRunsDetails(repo, owner);
+  const details = useWorkflowRunsDetails({ hostname, owner, repo });
   const jobs = useWorkflowRunJobs(details.value?.jobs_url);
 
   const error = projectName.error || (projectName.value && details.error);
diff --git a/plugins/github-actions/src/components/WorkflowRunDetails/useWorkflowRunsDetails.ts b/plugins/github-actions/src/components/WorkflowRunDetails/useWorkflowRunsDetails.ts
index b38284d52f..d0141c27fa 100644
--- a/plugins/github-actions/src/components/WorkflowRunDetails/useWorkflowRunsDetails.ts
+++ b/plugins/github-actions/src/components/WorkflowRunDetails/useWorkflowRunsDetails.ts
@@ -13,20 +13,26 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { useApi, githubAuthApiRef } from '@backstage/core';
+import { useApi } from '@backstage/core';
 import { useParams } from 'react-router-dom';
 import { useAsync } from 'react-use';
 import { githubActionsApiRef } from '../../api';
 
-export const useWorkflowRunsDetails = (repo: string, owner: string) => {
+export const useWorkflowRunsDetails = ({
+  hostname,
+  owner,
+  repo,
+}: {
+  hostname?: string;
+  owner: string;
+  repo: string;
+}) => {
   const api = useApi(githubActionsApiRef);
-  const auth = useApi(githubAuthApiRef);
   const { id } = useParams();
   const details = useAsync(async () => {
-    const token = await auth.getAccessToken(['repo']);
     return repo && owner
       ? api.getWorkflowRun({
-          token,
+          hostname,
           owner,
           repo,
           id: parseInt(id, 10),
diff --git a/plugins/github-actions/src/components/WorkflowRunLogs/WorkflowRunLogs.tsx b/plugins/github-actions/src/components/WorkflowRunLogs/WorkflowRunLogs.tsx
index d03c2d6be8..fe1c774dad 100644
--- a/plugins/github-actions/src/components/WorkflowRunLogs/WorkflowRunLogs.tsx
+++ b/plugins/github-actions/src/components/WorkflowRunLogs/WorkflowRunLogs.tsx
@@ -34,6 +34,8 @@ import { useProjectName } from '../useProjectName';
 import ExpandMoreIcon from '@material-ui/icons/ExpandMore';
 import DescriptionIcon from '@material-ui/icons/Description';
 import { Entity } from '@backstage/catalog-model';
+import { configApiRef, useApi } from '@backstage/core';
+import { readGitHubIntegrationConfigs } from '@backstage/integration';
 
 const LazyLog = React.lazy(() => import('react-lazylog/build/LazyLog'));
 const LinePart = React.lazy(() => import('react-lazylog/build/LinePart'));
@@ -107,11 +109,21 @@ export const WorkflowRunLogs = ({
   runId: string;
   inProgress: boolean;
 }) => {
+  const config = useApi(configApiRef);
   const classes = useStyles();
   const projectName = useProjectName(entity);
 
+  // TODO: Get github hostname from metadata annotation
+  const hostname = readGitHubIntegrationConfigs(
+    config.getOptionalConfigArray('integrations.github') ?? [],
+  )[0].host;
   const [owner, repo] = projectName.value ? projectName.value.split('/') : [];
-  const jobLogs = useDownloadWorkflowRunLogs(repo, owner, runId);
+  const jobLogs = useDownloadWorkflowRunLogs({
+    hostname,
+    owner,
+    repo,
+    id: runId,
+  });
   const [open, setOpen] = React.useState(false);
 
   const handleOpen = () => {
diff --git a/plugins/github-actions/src/components/WorkflowRunLogs/useDownloadWorkflowRunLogs.ts b/plugins/github-actions/src/components/WorkflowRunLogs/useDownloadWorkflowRunLogs.ts
index 734f617b1f..0acf67a344 100644
--- a/plugins/github-actions/src/components/WorkflowRunLogs/useDownloadWorkflowRunLogs.ts
+++ b/plugins/github-actions/src/components/WorkflowRunLogs/useDownloadWorkflowRunLogs.ts
@@ -14,22 +14,26 @@
  * limitations under the License.
  */
 
-import { useApi, githubAuthApiRef } from '@backstage/core';
+import { useApi } from '@backstage/core';
 import { useAsync } from 'react-use';
 import { githubActionsApiRef } from '../../api';
 
-export const useDownloadWorkflowRunLogs = (
-  repo: string,
-  owner: string,
-  id: string,
-) => {
+export const useDownloadWorkflowRunLogs = ({
+  hostname,
+  owner,
+  repo,
+  id,
+}: {
+  hostname?: string;
+  owner: string;
+  repo: string;
+  id: string;
+}) => {
   const api = useApi(githubActionsApiRef);
-  const auth = useApi(githubAuthApiRef);
   const details = useAsync(async () => {
-    const token = await auth.getAccessToken(['repo']);
     return repo && owner
       ? api.downloadJobLogsForWorkflowRun({
-          token,
+          hostname,
           owner,
           repo,
           runId: parseInt(id, 10),
diff --git a/plugins/github-actions/src/components/WorkflowRunsTable/WorkflowRunsTable.tsx b/plugins/github-actions/src/components/WorkflowRunsTable/WorkflowRunsTable.tsx
index f49dfeba64..6a3b88b052 100644
--- a/plugins/github-actions/src/components/WorkflowRunsTable/WorkflowRunsTable.tsx
+++ b/plugins/github-actions/src/components/WorkflowRunsTable/WorkflowRunsTable.tsx
@@ -25,13 +25,20 @@ import {
 import RetryIcon from '@material-ui/icons/Replay';
 import GitHubIcon from '@material-ui/icons/GitHub';
 import { Link as RouterLink, generatePath } from 'react-router-dom';
-import { EmptyState, Table, TableColumn } from '@backstage/core';
+import {
+  EmptyState,
+  Table,
+  TableColumn,
+  configApiRef,
+  useApi,
+} from '@backstage/core';
 import { useWorkflowRuns } from '../useWorkflowRuns';
 import { WorkflowRunStatus } from '../WorkflowRunStatus';
 import SyncIcon from '@material-ui/icons/Sync';
 import { buildRouteRef } from '../../plugin';
 import { useProjectName } from '../useProjectName';
 import { Entity } from '@backstage/catalog-model';
+import { readGitHubIntegrationConfigs } from '@backstage/integration';
 
 export type WorkflowRun = {
   id: string;
@@ -162,12 +169,18 @@ export const WorkflowRunsTable = ({
   entity: Entity;
   branch?: string;
 }) => {
+  const config = useApi(configApiRef);
   const { value: projectName, loading } = useProjectName(entity);
+  // TODO: Get github hostname from metadata annotation
+  const hostname = readGitHubIntegrationConfigs(
+    config.getOptionalConfigArray('integrations.github') ?? [],
+  )[0].host;
   const [owner, repo] = (projectName ?? '/').split('/');
   const [
     { runs, ...tableProps },
     { retry, setPage, setPageSize },
   ] = useWorkflowRuns({
+    hostname,
     owner,
     repo,
     branch,
diff --git a/plugins/github-actions/src/components/useWorkflowRuns.ts b/plugins/github-actions/src/components/useWorkflowRuns.ts
index 4261012c26..4a4ded2d94 100644
--- a/plugins/github-actions/src/components/useWorkflowRuns.ts
+++ b/plugins/github-actions/src/components/useWorkflowRuns.ts
@@ -17,21 +17,22 @@ import { useState } from 'react';
 import { useAsyncRetry } from 'react-use';
 import { WorkflowRun } from './WorkflowRunsTable/WorkflowRunsTable';
 import { githubActionsApiRef } from '../api/GithubActionsApi';
-import { useApi, githubAuthApiRef, errorApiRef } from '@backstage/core';
+import { useApi, errorApiRef } from '@backstage/core';
 
 export function useWorkflowRuns({
+  hostname,
   owner,
   repo,
   branch,
   initialPageSize = 5,
 }: {
+  hostname?: string;
   owner: string;
   repo: string;
   branch?: string;
   initialPageSize?: number;
 }) {
   const api = useApi(githubActionsApiRef);
-  const auth = useApi(githubAuthApiRef);
 
   const errorApi = useApi(errorApiRef);
 
@@ -42,12 +43,11 @@ export function useWorkflowRuns({
   const { loading, value: runs, retry, error } = useAsyncRetry<
     WorkflowRun[]
   >(async () => {
-    const token = await auth.getAccessToken(['repo']);
     return (
       api
         // GitHub API pagination count starts from 1
         .listWorkflowRuns({
-          token,
+          hostname,
           owner,
           repo,
           pageSize,
@@ -63,7 +63,7 @@ export function useWorkflowRuns({
             onReRunClick: async () => {
               try {
                 await api.reRunWorkflow({
-                  token,
+                  hostname,
                   owner,
                   repo,
                   runId: run.id,
diff --git a/plugins/github-actions/src/plugin.ts b/plugins/github-actions/src/plugin.ts
index 9e3c965d46..39ffc468b1 100644
--- a/plugins/github-actions/src/plugin.ts
+++ b/plugins/github-actions/src/plugin.ts
@@ -15,9 +15,11 @@
  */
 
 import {
+  configApiRef,
   createPlugin,
   createRouteRef,
   createApiFactory,
+  githubAuthApiRef,
 } from '@backstage/core';
 import { githubActionsApiRef, GithubActionsClient } from './api';
 
@@ -34,5 +36,12 @@ export const buildRouteRef = createRouteRef({
 
 export const plugin = createPlugin({
   id: 'github-actions',
-  apis: [createApiFactory(githubActionsApiRef, new GithubActionsClient())],
+  apis: [
+    createApiFactory({
+      api: githubActionsApiRef,
+      deps: { configApi: configApiRef, githubAuthApi: githubAuthApiRef },
+      factory: ({ configApi, githubAuthApi }) =>
+        new GithubActionsClient({ configApi, githubAuthApi }),
+    }),
+  ],
 });
diff --git a/plugins/lighthouse/src/components/Cards/LastLighthouseAuditCard.test.tsx b/plugins/lighthouse/src/components/Cards/LastLighthouseAuditCard.test.tsx
index 20b3b9c072..42c213b42e 100644
--- a/plugins/lighthouse/src/components/Cards/LastLighthouseAuditCard.test.tsx
+++ b/plugins/lighthouse/src/components/Cards/LastLighthouseAuditCard.test.tsx
@@ -38,7 +38,7 @@ const websiteListResponse = data as WebsiteListResponse;
 let entityWebsite = websiteListResponse.items[2];
 
 describe('<LastLighthouseAuditCard />', () => {
-  const asPercentage = (fraction: number) => `${fraction * 100}%`;
+  const asPercentage = (fraction: number) => `${Math.round(fraction * 100)}%`;
 
   beforeEach(() => {
     (useWebsiteForEntity as jest.Mock).mockReturnValue({
diff --git a/plugins/lighthouse/src/components/Cards/LastLighthouseAuditCard.tsx b/plugins/lighthouse/src/components/Cards/LastLighthouseAuditCard.tsx
index 0bb83077ce..d30b9a3312 100644
--- a/plugins/lighthouse/src/components/Cards/LastLighthouseAuditCard.tsx
+++ b/plugins/lighthouse/src/components/Cards/LastLighthouseAuditCard.tsx
@@ -27,7 +27,7 @@ import { useWebsiteForEntity } from '../../hooks/useWebsiteForEntity';
 import AuditStatusIcon from '../AuditStatusIcon';
 
 const LighthouseCategoryScoreStatus = ({ score }: { score: number }) => {
-  const scoreAsPercentage = score * 100;
+  const scoreAsPercentage = Math.round(score * 100);
   switch (true) {
     case scoreAsPercentage >= 90:
       return (
diff --git a/plugins/scaffolder/src/components/JobStage/JobStage.tsx b/plugins/scaffolder/src/components/JobStage/JobStage.tsx
index 86c2982dde..f285cb98c0 100644
--- a/plugins/scaffolder/src/components/JobStage/JobStage.tsx
+++ b/plugins/scaffolder/src/components/JobStage/JobStage.tsx
@@ -161,7 +161,7 @@ export const JobStage = ({ endedAt, startedAt, name, log, status }: Props) => {
       </AccordionDetails>
       <AccordionActions>
         <Button color="primary" onClick={toggleLogsFullScreen}>
-          Open in fullcreen
+          Open in fullscreen
         </Button>
       </AccordionActions>
     </Accordion>
diff --git a/scripts/check-if-release.js b/scripts/check-if-release.js
index 57a0ad792c..dcfc862e48 100755
--- a/scripts/check-if-release.js
+++ b/scripts/check-if-release.js
@@ -58,25 +58,44 @@ async function main() {
     'diff',
     '--name-only',
     parentRef,
-    'packages/*/package.json',
-    'plugins/*/package.json',
+    "'packages/*/package.json'",
+    "'plugins/*/package.json'",
   );
   const packageList = diff.split(/^(.*)$/gm).filter(s => s.trim());
 
   const packageVersions = await Promise.all(
     packageList.map(async path => {
-      const { name, version: newVersion } = JSON.parse(
-        await fs.readFile(path, 'utf8'),
-      );
-      const { version: oldVersion } = JSON.parse(
-        await runPlain('git', 'show', `${parentRef}:${path}`),
-      );
+      let name;
+      let newVersion;
+      let oldVersion;
+
+      try {
+        const data = JSON.parse(
+          await runPlain('git', 'show', `${parentRef}:${path}`),
+        );
+        name = data.name;
+        oldVersion = data.version;
+      } catch {
+        oldVersion = '<none>';
+      }
+
+      try {
+        const data = JSON.parse(await fs.readFile(path, 'utf8'));
+        name = data.name;
+        newVersion = data.version;
+      } catch (error) {
+        if (error.code === 'ENOENT') {
+          newVersion = '<none>';
+        }
+      }
+
       return { name, oldVersion, newVersion };
     }),
   );
 
   const newVersions = packageVersions.filter(
-    ({ oldVersion, newVersion }) => oldVersion !== newVersion,
+    ({ oldVersion, newVersion }) =>
+      oldVersion !== newVersion && newVersion !== '<none>',
   );
 
   if (newVersions.length === 0) {
@@ -89,7 +108,7 @@ async function main() {
   const maxLength = Math.max(...newVersions.map(_ => _.name.length));
   for (const { name, oldVersion, newVersion } of newVersions) {
     console.log(
-      `  ${name.padEnd(maxLength, ' ')} ${oldVersion} -> ${newVersion}`,
+      `  ${name.padEnd(maxLength, ' ')} ${oldVersion} to ${newVersion}`,
     );
   }
   console.log(`::set-output name=needs_release::true`);
diff --git a/yarn.lock b/yarn.lock
index fa2f5aca5e..3e16bc8793 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1989,20 +1989,6 @@
     "@babel/helper-plugin-utils" "^7.10.4"
     "@babel/plugin-syntax-jsx" "^7.12.1"
 
-"@babel/plugin-transform-react-jsx-self@^7.12.1":
-  version "7.12.1"
-  resolved "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-self/-/plugin-transform-react-jsx-self-7.12.1.tgz#ef43cbca2a14f1bd17807dbe4376ff89d714cf28"
-  integrity sha512-FbpL0ieNWiiBB5tCldX17EtXgmzeEZjFrix72rQYeq9X6nUK38HCaxexzVQrZWXanxKJPKVVIU37gFjEQYkPkA==
-  dependencies:
-    "@babel/helper-plugin-utils" "^7.10.4"
-
-"@babel/plugin-transform-react-jsx-source@^7.12.1":
-  version "7.12.1"
-  resolved "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-source/-/plugin-transform-react-jsx-source-7.12.1.tgz#d07de6863f468da0809edcf79a1aa8ce2a82a26b"
-  integrity sha512-keQ5kBfjJNRc6zZN1/nVHCd6LLIHq4aUKcVnvE/2l+ZZROSbqoiGFRtT5t3Is89XJxBQaP7NLZX2jgGHdZvvFQ==
-  dependencies:
-    "@babel/helper-plugin-utils" "^7.10.4"
-
 "@babel/plugin-transform-react-jsx@^7.0.0":
   version "7.10.4"
   resolved "https://registry.npmjs.org/@babel/plugin-transform-react-jsx/-/plugin-transform-react-jsx-7.10.4.tgz#673c9f913948764a4421683b2bef2936968fddf2"
@@ -2023,16 +2009,6 @@
     "@babel/helper-plugin-utils" "^7.10.4"
     "@babel/plugin-syntax-jsx" "^7.12.1"
 
-"@babel/plugin-transform-react-jsx@^7.12.7":
-  version "7.12.7"
-  resolved "https://registry.npmjs.org/@babel/plugin-transform-react-jsx/-/plugin-transform-react-jsx-7.12.7.tgz#8b14d45f6eccd41b7f924bcb65c021e9f0a06f7f"
-  integrity sha512-YFlTi6MEsclFAPIDNZYiCRbneg1MFGao9pPG9uD5htwE0vDbPaMUMeYd6itWjw7K4kro4UbdQf3ljmFl9y48dQ==
-  dependencies:
-    "@babel/helper-builder-react-jsx" "^7.10.4"
-    "@babel/helper-builder-react-jsx-experimental" "^7.12.4"
-    "@babel/helper-plugin-utils" "^7.10.4"
-    "@babel/plugin-syntax-jsx" "^7.12.1"
-
 "@babel/plugin-transform-react-pure-annotations@^7.12.1":
   version "7.12.1"
   resolved "https://registry.npmjs.org/@babel/plugin-transform-react-pure-annotations/-/plugin-transform-react-pure-annotations-7.12.1.tgz#05d46f0ab4d1339ac59adf20a1462c91b37a1a42"
@@ -2229,7 +2205,7 @@
     "@babel/types" "^7.4.4"
     esutils "^2.0.2"
 
-"@babel/preset-react@^7.12.1":
+"@babel/preset-react@^7.12.1", "@babel/preset-react@^7.12.5", "@babel/preset-react@^7.9.4":
   version "7.12.10"
   resolved "https://registry.npmjs.org/@babel/preset-react/-/preset-react-7.12.10.tgz#4fed65f296cbb0f5fb09de6be8cddc85cc909be9"
   integrity sha512-vtQNjaHRl4DUpp+t+g4wvTHsLQuye+n0H/wsXIZRn69oz/fvNC7gQ4IK73zGJBaxvHoxElDvnYCthMcT7uzFoQ==
@@ -2240,19 +2216,6 @@
     "@babel/plugin-transform-react-jsx-development" "^7.12.7"
     "@babel/plugin-transform-react-pure-annotations" "^7.12.1"
 
-"@babel/preset-react@^7.12.5", "@babel/preset-react@^7.9.4":
-  version "7.12.7"
-  resolved "https://registry.npmjs.org/@babel/preset-react/-/preset-react-7.12.7.tgz#36d61d83223b07b6ac4ec55cf016abb0f70be83b"
-  integrity sha512-wKeTdnGUP5AEYCYQIMeXMMwU7j+2opxrG0WzuZfxuuW9nhKvvALBjl67653CWamZJVefuJGI219G591RSldrqQ==
-  dependencies:
-    "@babel/helper-plugin-utils" "^7.10.4"
-    "@babel/plugin-transform-react-display-name" "^7.12.1"
-    "@babel/plugin-transform-react-jsx" "^7.12.7"
-    "@babel/plugin-transform-react-jsx-development" "^7.12.7"
-    "@babel/plugin-transform-react-jsx-self" "^7.12.1"
-    "@babel/plugin-transform-react-jsx-source" "^7.12.1"
-    "@babel/plugin-transform-react-pure-annotations" "^7.12.1"
-
 "@babel/preset-typescript@^7.12.1":
   version "7.12.7"
   resolved "https://registry.npmjs.org/@babel/preset-typescript/-/preset-typescript-7.12.7.tgz#fc7df8199d6aae747896f1e6c61fc872056632a3"
@@ -4958,9 +4921,9 @@
     shortid "^2.2.14"
 
 "@rjsf/material-ui@^2.4.0":
-  version "2.4.0"
-  resolved "https://registry.npmjs.org/@rjsf/material-ui/-/material-ui-2.4.0.tgz#1b5859298bf3f61137d7b05084f058a775d6fd73"
-  integrity sha512-U8F/suzg4MuV+8mK1/ufs0Y6c3O8hc1wnuD2IKoOVJvegGfz5JCafyoyGAW6iyuT1DZBMPzVWEqfiuYPmoE7pw==
+  version "2.4.1"
+  resolved "https://registry.npmjs.org/@rjsf/material-ui/-/material-ui-2.4.1.tgz#b0dedff8877b114147e298966ca3faba895a7a62"
+  integrity sha512-pZaWL5Dw+km8S0hFLIK1lRHaeNtheMxTF2mZrWhf6HlGWCTGkQJnXta2UgshJN/nKtZPgO1L4FKz42Eun9nnhg==
 
 "@roadiehq/backstage-plugin-buildkite@^0.1.3":
   version "0.1.3"
@@ -5227,7 +5190,7 @@
     react-syntax-highlighter "^13.5.0"
     regenerator-runtime "^0.13.7"
 
-"@storybook/addons@6.1.11", "@storybook/addons@^6.1.11":
+"@storybook/addons@6.1.11":
   version "6.1.11"
   resolved "https://registry.npmjs.org/@storybook/addons/-/addons-6.1.11.tgz#cb4578411ca00ccb206b484df5a171ccaca34719"
   integrity sha512-OZXsdmn60dVe482l9zWxzOqqJApD2jggk/8QJKn3/Ub9posmqdqg712bW6v71BBe0UXXG/QfkZA7gcyiyEENbw==
@@ -5242,6 +5205,21 @@
     global "^4.3.2"
     regenerator-runtime "^0.13.7"
 
+"@storybook/addons@6.1.14", "@storybook/addons@^6.1.11":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/addons/-/addons-6.1.14.tgz#2b81304bbe696923df95cdcf85cfc592d10f4065"
+  integrity sha512-HlpmV7aejp/MeW8bo/WKME3i71gi0men9qcwoovjDjnSF6jXoNLT336a5udKXdHqYSZgzdyURlgLtilCWkWaJQ==
+  dependencies:
+    "@storybook/api" "6.1.14"
+    "@storybook/channels" "6.1.14"
+    "@storybook/client-logger" "6.1.14"
+    "@storybook/core-events" "6.1.14"
+    "@storybook/router" "6.1.14"
+    "@storybook/theming" "6.1.14"
+    core-js "^3.0.1"
+    global "^4.3.2"
+    regenerator-runtime "^0.13.7"
+
 "@storybook/api@6.1.11":
   version "6.1.11"
   resolved "https://registry.npmjs.org/@storybook/api/-/api-6.1.11.tgz#1e0b798203df823ac21184386258cf8b5f17f440"
@@ -5267,6 +5245,31 @@
     ts-dedent "^2.0.0"
     util-deprecate "^1.0.2"
 
+"@storybook/api@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/api/-/api-6.1.14.tgz#20035dd336aba1c5a0f8c83c8c14a2edaf4db891"
+  integrity sha512-gWcC/xEW8HL5DsocLujHBUdoNsl4YW1Zx1Y4SBbLCyrhj8v4JudJpylwJpOUBDe/GESXq1zqvNKvUPtI8DQNyw==
+  dependencies:
+    "@reach/router" "^1.3.3"
+    "@storybook/channels" "6.1.14"
+    "@storybook/client-logger" "6.1.14"
+    "@storybook/core-events" "6.1.14"
+    "@storybook/csf" "0.0.1"
+    "@storybook/router" "6.1.14"
+    "@storybook/semver" "^7.3.2"
+    "@storybook/theming" "6.1.14"
+    "@types/reach__router" "^1.3.5"
+    core-js "^3.0.1"
+    fast-deep-equal "^3.1.1"
+    global "^4.3.2"
+    lodash "^4.17.15"
+    memoizerific "^1.11.3"
+    regenerator-runtime "^0.13.7"
+    store2 "^2.7.1"
+    telejson "^5.0.2"
+    ts-dedent "^2.0.0"
+    util-deprecate "^1.0.2"
+
 "@storybook/channel-postmessage@6.1.11":
   version "6.1.11"
   resolved "https://registry.npmjs.org/@storybook/channel-postmessage/-/channel-postmessage-6.1.11.tgz#62c1079f04870dd27925bd538a2020e7380daa2e"
@@ -5280,6 +5283,19 @@
     qs "^6.6.0"
     telejson "^5.0.2"
 
+"@storybook/channel-postmessage@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/channel-postmessage/-/channel-postmessage-6.1.14.tgz#41f3115895010dad9fb30f4ac381e4f904b1e50c"
+  integrity sha512-If83dXXW9mKIRuvuWhWa/zkEw/F0FDgikp33x8436J3rWCh3recp27kffFRrKG0YDMpFSk/Ci5G47E9zn9SCjw==
+  dependencies:
+    "@storybook/channels" "6.1.14"
+    "@storybook/client-logger" "6.1.14"
+    "@storybook/core-events" "6.1.14"
+    core-js "^3.0.1"
+    global "^4.3.2"
+    qs "^6.6.0"
+    telejson "^5.0.2"
+
 "@storybook/channels@6.1.11":
   version "6.1.11"
   resolved "https://registry.npmjs.org/@storybook/channels/-/channels-6.1.11.tgz#a93a83746ad78dd40e1c056029f6d93b17bb66bc"
@@ -5289,6 +5305,15 @@
     ts-dedent "^2.0.0"
     util-deprecate "^1.0.2"
 
+"@storybook/channels@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/channels/-/channels-6.1.14.tgz#c479190ebb853a603f3ed90fc470534a02eb46eb"
+  integrity sha512-vP19IB2FXj8SiFbQ9ETljEBienL+KRMLgMzz3Ta3nZj/OfjJJbIuj42ZfexQGV4mS0Bo+OW+qT7VMIY6fulnFw==
+  dependencies:
+    core-js "^3.0.1"
+    ts-dedent "^2.0.0"
+    util-deprecate "^1.0.2"
+
 "@storybook/client-api@6.1.11":
   version "6.1.11"
   resolved "https://registry.npmjs.org/@storybook/client-api/-/client-api-6.1.11.tgz#d25aac484ca84a1acb01d450e756a62408f00c1a"
@@ -5313,6 +5338,30 @@
     ts-dedent "^2.0.0"
     util-deprecate "^1.0.2"
 
+"@storybook/client-api@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/client-api/-/client-api-6.1.14.tgz#6daf56743cc72e13f05fff3d2ac554897cc9f9fd"
+  integrity sha512-pIDSlS48bhJdtgNg7sXV1NmLJtB0ebRHJI9htIiqtL7EGQenb4+Bbwflhj1j51OEkuM+bQsAAZxq5deiUQEGVw==
+  dependencies:
+    "@storybook/addons" "6.1.14"
+    "@storybook/channel-postmessage" "6.1.14"
+    "@storybook/channels" "6.1.14"
+    "@storybook/client-logger" "6.1.14"
+    "@storybook/core-events" "6.1.14"
+    "@storybook/csf" "0.0.1"
+    "@types/qs" "^6.9.0"
+    "@types/webpack-env" "^1.15.3"
+    core-js "^3.0.1"
+    global "^4.3.2"
+    lodash "^4.17.15"
+    memoizerific "^1.11.3"
+    qs "^6.6.0"
+    regenerator-runtime "^0.13.7"
+    stable "^0.1.8"
+    store2 "^2.7.1"
+    ts-dedent "^2.0.0"
+    util-deprecate "^1.0.2"
+
 "@storybook/client-logger@6.1.11":
   version "6.1.11"
   resolved "https://registry.npmjs.org/@storybook/client-logger/-/client-logger-6.1.11.tgz#5dd092e4293e5f58f7e89ddbc6eb2511b7d60954"
@@ -5321,6 +5370,14 @@
     core-js "^3.0.1"
     global "^4.3.2"
 
+"@storybook/client-logger@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/client-logger/-/client-logger-6.1.14.tgz#216b9c1332ffa3a3473dad837780a3b14f686bae"
+  integrity sha512-NSO8nVsp6o0eoQ1Drlu66KXpl6DPuq02Kj8AhttGzvqSYB50SV4CV+wceBcg77tIVu5QmQ+71hAEVXhx7sjRHA==
+  dependencies:
+    core-js "^3.0.1"
+    global "^4.3.2"
+
 "@storybook/components@6.1.11":
   version "6.1.11"
   resolved "https://registry.npmjs.org/@storybook/components/-/components-6.1.11.tgz#edd5db7fe43f47b5a7ab515840795a89d931512e"
@@ -5347,6 +5404,32 @@
     react-textarea-autosize "^8.1.1"
     ts-dedent "^2.0.0"
 
+"@storybook/components@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/components/-/components-6.1.14.tgz#4ea47edfa0a3e4a26882aa5a1eb90c1ec86e6f71"
+  integrity sha512-Nxsp/9o1tqfY8s6RBWNHyM03A5D9k56Kr/4VNa++CbDrz1+TIxpYlDgS4sllUlXyvICLfk3sUtg3KS5CPl2iZA==
+  dependencies:
+    "@popperjs/core" "^2.5.4"
+    "@storybook/client-logger" "6.1.14"
+    "@storybook/csf" "0.0.1"
+    "@storybook/theming" "6.1.14"
+    "@types/overlayscrollbars" "^1.9.0"
+    "@types/react-color" "^3.0.1"
+    "@types/react-syntax-highlighter" "11.0.4"
+    core-js "^3.0.1"
+    fast-deep-equal "^3.1.1"
+    global "^4.3.2"
+    lodash "^4.17.15"
+    markdown-to-jsx "^6.11.4"
+    memoizerific "^1.11.3"
+    overlayscrollbars "^1.10.2"
+    polished "^3.4.4"
+    react-color "^2.17.0"
+    react-popper-tooltip "^3.1.1"
+    react-syntax-highlighter "^13.5.0"
+    react-textarea-autosize "^8.1.1"
+    ts-dedent "^2.0.0"
+
 "@storybook/core-events@6.1.11":
   version "6.1.11"
   resolved "https://registry.npmjs.org/@storybook/core-events/-/core-events-6.1.11.tgz#d50e8ec90490f9a7180a8c8a83afb6dcfe47ed66"
@@ -5354,10 +5437,17 @@
   dependencies:
     core-js "^3.0.1"
 
-"@storybook/core@6.1.11":
-  version "6.1.11"
-  resolved "https://registry.npmjs.org/@storybook/core/-/core-6.1.11.tgz#ed9d3b513794c604ab11180f6a014924b871179e"
-  integrity sha512-pYOOQwiNJ5myLRn6p6nnLUjjjISHK/N55vS4HFnETYSaRLA++h1coN1jk7Zwt89dOQTdF0EsTJn+6snYOC+lxQ==
+"@storybook/core-events@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/core-events/-/core-events-6.1.14.tgz#a3165e32cefd6be7326bbad4b8140653bdfa0426"
+  integrity sha512-tpM3VDvzqgRY7S17CRglgt1625rxNoyEwrLQiNcZkUPyO0rpaacPqVEbPCtcTmUeboI1bLdnSQIjT9B0/Y2Pww==
+  dependencies:
+    core-js "^3.0.1"
+
+"@storybook/core@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/core/-/core-6.1.14.tgz#17e724a5b94d6e1bb557e213b8176660d2d14762"
+  integrity sha512-lHKZmfLAo2VGtF/yrZkkWMYgmFRNKbzIDxYJGp8USyUQyTfEpz2qqJlBdoD6rxr1hFPM2954tIKwh8iPhT2PFQ==
   dependencies:
     "@babel/core" "^7.12.3"
     "@babel/plugin-proposal-class-properties" "^7.12.1"
@@ -5381,20 +5471,20 @@
     "@babel/preset-react" "^7.12.1"
     "@babel/preset-typescript" "^7.12.1"
     "@babel/register" "^7.12.1"
-    "@storybook/addons" "6.1.11"
-    "@storybook/api" "6.1.11"
-    "@storybook/channel-postmessage" "6.1.11"
-    "@storybook/channels" "6.1.11"
-    "@storybook/client-api" "6.1.11"
-    "@storybook/client-logger" "6.1.11"
-    "@storybook/components" "6.1.11"
-    "@storybook/core-events" "6.1.11"
+    "@storybook/addons" "6.1.14"
+    "@storybook/api" "6.1.14"
+    "@storybook/channel-postmessage" "6.1.14"
+    "@storybook/channels" "6.1.14"
+    "@storybook/client-api" "6.1.14"
+    "@storybook/client-logger" "6.1.14"
+    "@storybook/components" "6.1.14"
+    "@storybook/core-events" "6.1.14"
     "@storybook/csf" "0.0.1"
-    "@storybook/node-logger" "6.1.11"
-    "@storybook/router" "6.1.11"
+    "@storybook/node-logger" "6.1.14"
+    "@storybook/router" "6.1.14"
     "@storybook/semver" "^7.3.2"
-    "@storybook/theming" "6.1.11"
-    "@storybook/ui" "6.1.11"
+    "@storybook/theming" "6.1.14"
+    "@storybook/ui" "6.1.14"
     "@types/glob-base" "^0.3.0"
     "@types/micromatch" "^4.0.1"
     "@types/node-fetch" "^2.5.4"
@@ -5468,10 +5558,10 @@
   dependencies:
     lodash "^4.17.15"
 
-"@storybook/node-logger@6.1.11":
-  version "6.1.11"
-  resolved "https://registry.npmjs.org/@storybook/node-logger/-/node-logger-6.1.11.tgz#8e0d058b4804f2fea03c9d7d331b8e2d02f3b7ff"
-  integrity sha512-MASonXDWpSMU9HF9mqbGOR1Ps/DTJ8AVmYD50+OnB9kXl4M42Dliobeq7JwKFMnZ42RelUCCSXdWW80hGrUKKA==
+"@storybook/node-logger@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/node-logger/-/node-logger-6.1.14.tgz#e5294f986e3ec5c67b2738895b9d16c9a2b667fa"
+  integrity sha512-3jrw7coAwFXZu4qK1vm54bCPhNRvxjG+7jISbhhocDoNIv0nLWL3+tJyrC5/k/XHQiUlLkhEzpMaASADmkttNw==
   dependencies:
     "@types/npmlog" "^4.1.2"
     chalk "^4.0.0"
@@ -5480,16 +5570,16 @@
     pretty-hrtime "^1.0.3"
 
 "@storybook/react@^6.1.11":
-  version "6.1.11"
-  resolved "https://registry.npmjs.org/@storybook/react/-/react-6.1.11.tgz#e94403cd878c66b445df993bad9bec9023db3ebe"
-  integrity sha512-EmR7yvVW6z6AYhfzAgJMGR/5+igeBGa1EePaEIibn51r5uboSB72N12NaADyF2OaycIdV+0sW6vP9Zvlvexa/w==
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/react/-/react-6.1.14.tgz#436e9b90096b1d7c83f7f073b5baf47212b2e425"
+  integrity sha512-M99wHjc/5z+Wz1FdFaScVs6dyAi/6PdcIx5Fyip6Qd8aKwm1XyYoOMql5Vu3Cf560feDYCKS4phzyEZ7EJy+EQ==
   dependencies:
     "@babel/preset-flow" "^7.12.1"
     "@babel/preset-react" "^7.12.1"
     "@pmmmwh/react-refresh-webpack-plugin" "^0.4.2"
-    "@storybook/addons" "6.1.11"
-    "@storybook/core" "6.1.11"
-    "@storybook/node-logger" "6.1.11"
+    "@storybook/addons" "6.1.14"
+    "@storybook/core" "6.1.14"
+    "@storybook/node-logger" "6.1.14"
     "@storybook/semver" "^7.3.2"
     "@types/webpack-env" "^1.15.3"
     babel-plugin-add-react-displayname "^0.0.5"
@@ -5518,6 +5608,18 @@
     memoizerific "^1.11.3"
     qs "^6.6.0"
 
+"@storybook/router@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/router/-/router-6.1.14.tgz#f6aef8c9dabf19bf06dddd80907e66369261fdde"
+  integrity sha512-rMaUCYzgfVLwFWo3A1Q/weSv8FBqCLmHY+3+t6ao7OV6NYjR0XgLKRzHrXq1uYdbMxWeIKhN2tIt/LR43bmDjQ==
+  dependencies:
+    "@reach/router" "^1.3.3"
+    "@types/reach__router" "^1.3.5"
+    core-js "^3.0.1"
+    global "^4.3.2"
+    memoizerific "^1.11.3"
+    qs "^6.6.0"
+
 "@storybook/semver@^7.3.2":
   version "7.3.2"
   resolved "https://registry.npmjs.org/@storybook/semver/-/semver-7.3.2.tgz#f3b9c44a1c9a0b933c04e66d0048fcf2fa10dac0"
@@ -5561,21 +5663,39 @@
     resolve-from "^5.0.0"
     ts-dedent "^2.0.0"
 
-"@storybook/ui@6.1.11":
-  version "6.1.11"
-  resolved "https://registry.npmjs.org/@storybook/ui/-/ui-6.1.11.tgz#2e5a5df010f2bb75a09a0fd0439fc8e62f8c89e5"
-  integrity sha512-Qth2dxS5+VbKHcqgkiKpeD+xr/hRUuUIDUA/2Ierh/BaA8Up/krlso/mCLaQOa5E8Og9WJAdDFO0cUbt939c2Q==
+"@storybook/theming@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/theming/-/theming-6.1.14.tgz#fecb66cab22d3b3218b4a98a9c210eb8a7be91e8"
+  integrity sha512-S+t30y4FqBTXWoVr+dtxVJ/ywiQGHBclBd9aUunbdCV4mMFra5InNo2CWn+RJlNEauLZ93gRIEzSFchIbzLk1A==
   dependencies:
     "@emotion/core" "^10.1.1"
-    "@storybook/addons" "6.1.11"
-    "@storybook/api" "6.1.11"
-    "@storybook/channels" "6.1.11"
-    "@storybook/client-logger" "6.1.11"
-    "@storybook/components" "6.1.11"
-    "@storybook/core-events" "6.1.11"
-    "@storybook/router" "6.1.11"
+    "@emotion/is-prop-valid" "^0.8.6"
+    "@emotion/styled" "^10.0.23"
+    "@storybook/client-logger" "6.1.14"
+    core-js "^3.0.1"
+    deep-object-diff "^1.1.0"
+    emotion-theming "^10.0.19"
+    global "^4.3.2"
+    memoizerific "^1.11.3"
+    polished "^3.4.4"
+    resolve-from "^5.0.0"
+    ts-dedent "^2.0.0"
+
+"@storybook/ui@6.1.14":
+  version "6.1.14"
+  resolved "https://registry.npmjs.org/@storybook/ui/-/ui-6.1.14.tgz#766d696480ee6f6a5a0454ccb2f101c38a0eb9d2"
+  integrity sha512-DTW2TM05jTMKxh8LzUGk3g5a528PgJxrtgODFU6zzwSg2+LwdmSDtd1HAxopt2vpfTyQyX+6WN2H+lMNwfQTAQ==
+  dependencies:
+    "@emotion/core" "^10.1.1"
+    "@storybook/addons" "6.1.14"
+    "@storybook/api" "6.1.14"
+    "@storybook/channels" "6.1.14"
+    "@storybook/client-logger" "6.1.14"
+    "@storybook/components" "6.1.14"
+    "@storybook/core-events" "6.1.14"
+    "@storybook/router" "6.1.14"
     "@storybook/semver" "^7.3.2"
-    "@storybook/theming" "6.1.11"
+    "@storybook/theming" "6.1.14"
     "@types/markdown-to-jsx" "^6.11.0"
     copy-to-clipboard "^3.0.8"
     core-js "^3.0.1"
@@ -7202,12 +7322,7 @@
     "@types/serve-static" "*"
     "@types/webpack" "*"
 
-"@types/webpack-env@^1.15.2":
-  version "1.15.3"
-  resolved "https://registry.npmjs.org/@types/webpack-env/-/webpack-env-1.15.3.tgz#fb602cd4c2f0b7c0fb857e922075fdf677d25d84"
-  integrity sha512-5oiXqR7kwDGZ6+gmzIO2lTC+QsriNuQXZDWNYRV3l2XRN/zmPgnC21DLSx2D05zvD8vnXW6qUg7JnXZ4I6qLVQ==
-
-"@types/webpack-env@^1.15.3":
+"@types/webpack-env@^1.15.2", "@types/webpack-env@^1.15.3":
   version "1.16.0"
   resolved "https://registry.npmjs.org/@types/webpack-env/-/webpack-env-1.16.0.tgz#8c0a9435dfa7b3b1be76562f3070efb3f92637b4"
   integrity sha512-Fx+NpfOO0CpeYX2g9bkvX8O5qh9wrU1sOF4g8sft4Mu7z+qfe387YlyY8w8daDyDsKY5vUxM0yxkAYnbkRbZEw==
@@ -7229,9 +7344,9 @@
     source-map "^0.6.1"
 
 "@types/webpack@*", "@types/webpack@^4.41.7", "@types/webpack@^4.41.8":
-  version "4.41.22"
-  resolved "https://registry.npmjs.org/@types/webpack/-/webpack-4.41.22.tgz#ff9758a17c6bd499e459b91e78539848c32d0731"
-  integrity sha512-JQDJK6pj8OMV9gWOnN1dcLCyU9Hzs6lux0wBO4lr1+gyEhIBR9U3FMrz12t2GPkg110XAxEAw2WHF6g7nZIbRQ==
+  version "4.41.26"
+  resolved "https://registry.npmjs.org/@types/webpack/-/webpack-4.41.26.tgz#27a30d7d531e16489f9c7607c747be6bc1a459ef"
+  integrity sha512-7ZyTfxjCRwexh+EJFwRUM+CDB2XvgHl4vfuqf1ZKrgGvcS5BrNvPQqJh3tsZ0P6h6Aa1qClVHaJZszLPzpqHeA==
   dependencies:
     "@types/anymatch" "*"
     "@types/node" "*"
@@ -10011,6 +10126,11 @@ clone-response@^1.0.2:
   dependencies:
     mimic-response "^1.0.0"
 
+clone@2.x:
+  version "2.1.2"
+  resolved "https://registry.npmjs.org/clone/-/clone-2.1.2.tgz#1b7f4b9f591f1e8f83670401600345a02887435f"
+  integrity sha1-G39Ln1kfHo+DZwQBYANFoCiHQ18=
+
 clone@^1.0.2:
   version "1.0.4"
   resolved "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz#da309cc263df15994c688ca902179ca3c7cd7c7e"
@@ -16434,19 +16554,17 @@ jest@^26.0.1:
     import-local "^3.0.2"
     jest-cli "^26.6.3"
 
-jose@^1.27.1:
-  version "1.27.1"
-  resolved "https://registry.npmjs.org/jose/-/jose-1.27.1.tgz#a1de2ecb5b3ae1ae28f0d9d0cc536349ada27ec8"
-  integrity sha512-VyHM6IJPw0TTGqHVNlPWg16/ASDPAmcChcLqSb3WNBvwWFoWPeFqlmAUCm8/oIG1GjZwAlUDuRKFfycowarcVA==
+jose@^2.0.2:
+  version "2.0.3"
+  resolved "https://registry.npmjs.org/jose/-/jose-2.0.3.tgz#9c931ab3e13e2d16a5b9e6183e60b2fc40a8e1b8"
+  integrity sha512-L+RlDgjO0Tk+Ki6/5IXCSEnmJCV8iMFZoBuEgu2vPQJJ4zfG/k3CAqZUMKDYNRHIDyy0QidJpOvX0NgpsAqFlw==
   dependencies:
     "@panva/asn1.js" "^1.0.0"
 
-jose@^2.0.2:
-  version "2.0.2"
-  resolved "https://registry.npmjs.org/jose/-/jose-2.0.2.tgz#fb22385b80c658cc7a0cae05b7086c04c6be49f4"
-  integrity sha512-yD93lsiMA1go/qxSY/vXWBodmIZJIxeB7QhFi8z1yQ3KUwKENqI9UA8VCHlQ5h3x1zWuWZjoY87ByQzkQbIrQg==
-  dependencies:
-    "@panva/asn1.js" "^1.0.0"
+jose@^3.5.1:
+  version "3.5.1"
+  resolved "https://registry.npmjs.org/jose/-/jose-3.5.1.tgz#adc0d5000dbf64a7f4db171d449dbcf6b556b6f0"
+  integrity sha512-BQQJafCDvsmtc/LaK57cjfhU/1AKBhJSbJhKPq+uhrjMoV/sh3/dbk9cm08nAeSGS6j+sjhWoY+LZPUXiKzYzw==
 
 joycon@^2.2.5:
   version "2.2.5"
@@ -18693,6 +18811,13 @@ node-addon-api@2.0.0:
   resolved "https://registry.npmjs.org/node-addon-api/-/node-addon-api-2.0.0.tgz#f9afb8d777a91525244b01775ea0ddbe1125483b"
   integrity sha512-ASCL5U13as7HhOExbT6OlWJJUV/lLzL2voOSP1UVehpRD8FbSrSDjfScK/KwAvVTI5AS6r4VwbOMlIqtvRidnA==
 
+node-cache@^5.1.2:
+  version "5.1.2"
+  resolved "https://registry.npmjs.org/node-cache/-/node-cache-5.1.2.tgz#f264dc2ccad0a780e76253a694e9fd0ed19c398d"
+  integrity sha512-t1QzWwnk4sjLWaQAS8CHgOJ+RAfmHpxFWmc36IWTiWHQfs0w5JDMBS1b1ZxQteo0vVVuWJvIUKHDkkeK7vIGCg==
+  dependencies:
+    clone "2.x"
+
 node-dir@^0.1.10:
   version "0.1.17"
   resolved "https://registry.npmjs.org/node-dir/-/node-dir-0.1.17.tgz#5f5665d93351335caabef8f1c554516cf5f1e4e5"
@@ -22071,12 +22196,7 @@ regenerator-runtime@^0.11.0:
   resolved "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.11.1.tgz#be05ad7f9bf7d22e056f9726cee5017fbf19e2e9"
   integrity sha512-MguG95oij0fC3QV3URf4V2SDYGJhJnJGqvIIgdECeODCT98wSWDAJ94SSuVpYQUoTcGUIL6L4yNB7j1DFFHSBg==
 
-regenerator-runtime@^0.13.3, regenerator-runtime@^0.13.4, regenerator-runtime@^0.13.5:
-  version "0.13.5"
-  resolved "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.5.tgz#d878a1d094b4306d10b9096484b33ebd55e26697"
-  integrity sha512-ZS5w8CpKFinUzOwW3c83oPeVXoNsrLsaCoLtJvAClH135j/R77RuymhiSErhm2lKcwSCIpmvIWSbDkIfAqKQlA==
-
-regenerator-runtime@^0.13.7:
+regenerator-runtime@^0.13.3, regenerator-runtime@^0.13.4, regenerator-runtime@^0.13.5, regenerator-runtime@^0.13.7:
   version "0.13.7"
   resolved "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.7.tgz#cac2dacc8a1ea675feaabaeb8ae833898ae46f55"
   integrity sha512-a54FxoJDIr27pgf7IgeQGxmqUNYrcV338lf/6gH456HZ/PhX+5BcwHXG9ajESmwe6WRO0tAzRUrRmNONWgkrew==
@@ -23963,9 +24083,9 @@ subscriptions-transport-ws@^0.9.11, subscriptions-transport-ws@^0.9.16:
     ws "^5.2.0"
 
 sucrase@^3.16.0:
-  version "3.16.0"
-  resolved "https://registry.npmjs.org/sucrase/-/sucrase-3.16.0.tgz#19b5b886ccca270dd5ca12ff060eeaf0b599735f"
-  integrity sha512-ovVuswxV5TayCPXfTk8bgBgk6uNRvsinIkEpq0J6zS1xXCx5N/LLGcbsKdRhqn/ToZylMX6+yXaR1LSn1I42Pg==
+  version "3.17.0"
+  resolved "https://registry.npmjs.org/sucrase/-/sucrase-3.17.0.tgz#d9fe5d7e359d884cdb31130358fbdfc18bfb4c24"
+  integrity sha512-wtiqaokYRjFSSrv8fQu7pThKTIZSLwiffW+PHQG52hlI8eJO47v1tXbKt6fYb8Z1kCyuCkNH9etpTUebb7g+pA==
   dependencies:
     commander "^4.0.0"
     glob "7.1.6"