diff --git a/.gitignore b/.gitignore
index 33703656f..54c802a21 100644
--- a/.gitignore
+++ b/.gitignore
@@ -132,6 +132,7 @@ venv/
 ENV/
 env.bak/
 venv.bak/
+/server/application-server/src/test/resources/application-github-integration-local.yml
 
 # Spyder project settings
 .spyderproject
diff --git a/AGENTS.md b/AGENTS.md
index d66d27007..45bf294b6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,6 +3,7 @@
 This file governs the entire repository. Combine these guardrails with the scoped instructions under `.github/instructions/**` (general coding, TSX, Storybook, Java tests).
 
 ## 1. Architecture map
+
 - `server/application-server/`: Spring Boot 3.5, Liquibase-managed PostgreSQL schema, synchronous + reactive APIs, generated OpenAPI spec in `openapi.yaml`.
 - `webapp/`: React 19 + TanStack Router/Query, Tailwind 4 UI kit (`src/components/ui`), generated API client in `src/api/**`.
 - `server/intelligence-service/`: FastAPI service orchestrating AI models. OpenAPI spec is exported via Poetry and mirrored into the Java client under the application server.
@@ -10,6 +11,7 @@ This file governs the entire repository. Combine these guardrails with the scope
 - `docs/`: Contributor docs (including the ERD that `db:generate-erd-docs` regenerates).
 
 ## 2. Toolchain & environment prerequisites
+
 - **Node.js**: Use the exact version from `.node-version` (currently 22.10.0). Stick with npm—the repo maintains `package-lock.json` and uses npm workspaces.
 - **Java**: JDK 21 (see `pom.xml`). Maven wrapper is checked in; **always run builds through `./mvnw`** (Maven wrapper) to ensure consistent Maven versions.
 - **Python**: Python 3.13 with Poetry 2.x. Both Python services keep virtualenvs inside their folders (`.venv`). Run `npm run bootstrap:py` before formatting/linting to ensure dev dependencies are installed.
@@ -18,6 +20,7 @@ This file governs the entire repository. Combine these guardrails with the scope
 - **Environment variables**: When generating intelligence service OpenAPI specs locally, set `MODEL_NAME=fake:model` and `DETECTION_MODEL_NAME=fake:model` (the FastAPI settings expect a provider-qualified model name).
 
 ## 3. Quality gates & routine commands
+
 Run the relevant commands locally before opening a PR:
 
 | Concern | Commands |
@@ -27,13 +30,14 @@ Run the relevant commands locally before opening a PR:
 | Webapp build | `npm --workspace webapp run build` (Vite build + `tsc --noEmit`) |
 | Webapp tests | `npm --workspace webapp run test` (Vitest) and add focused unit tests when touching logic. |
 | Storybook | `npm --workspace webapp run build-storybook` (Chromatic depends on a clean build). |
-| Application-server tests | Use Maven groups to mirror CI: `./mvnw test -Dgroups=unit`, `-Dgroups=integration`, `-Dgroups=architecture`. |
+| Application-server tests | Use Maven groups to mirror CI: `./mvnw test -Dgroups=unit`, `-Dgroups=integration`, `-Dgroups=architecture`. Live GitHub sync tests stay skipped unless you pass `-Dgroups=github-integration`, which activates the `github-integration-tests` profile. |
 | Intelligence service lint/type check | `poetry run black --check .`, `poetry run flake8 .`, `poetry run mypy .` inside `server/intelligence-service`. |
 | Webhook ingest lint | `poetry run black --check .` and `poetry run flake8 .` inside `server/webhook-ingest`. |
 
 Document any skipped gate in the PR description with a rationale. Always finish a change set by running `npm run format` followed by `npm run lint` so both styling and type checks reflect the final state.
 
 ## 4. Code generation & forbidden edits
+
 We rely heavily on generated artifacts. Never hand-edit these directories—regenerate instead:
 
 | Artifact | Source command |
@@ -48,6 +52,7 @@ We rely heavily on generated artifacts. Never hand-edit these directories—rege
 Regeneration is destructive; stash local edits before running these commands. Check diffs carefully—generated clients must be committed alongside API changes.
 
 ## 5. Database workflow (Liquibase)
+
 - Liquibase changelog files live under `server/application-server/src/main/resources/db/changelog/` and are included via `master.xml`.
 - Use `npm run db:draft-changelog` after changing JPA entities. The script will:
   1. Spin up PostgreSQL through Docker (ensure Docker is running or set `CI=true` with a ready Postgres).
@@ -58,6 +63,7 @@ Regeneration is destructive; stash local edits before running these commands. Ch
 - Never manually edit generated Liquibase diff sections unless you fully understand the implications. Prefer creating a follow-up changelog to fix mistakes.
 
 ## 6. Frontend (webapp) expectations
+
 - Follow the container/presentation split already in place (route files under `src/routes/**` fetch data and pass it to components under `src/components/**`). Keep components pure and side-effect free.
 - Fetch data exclusively with TanStack Query v5 and the generated helpers in `@/api/@tanstack/react-query.gen.ts`. Spread the option objects: `useQuery(getTeamsOptions({ ... }))`. Use the generated `*.QueryKey()` helpers for cache invalidation.
 - Do not call `fetch` directly; reuse the generated `@hey-api` client configured in `src/api/client.ts` and the shared QueryClient from `src/integrations/tanstack-query/root-provider.tsx`.
@@ -70,6 +76,7 @@ Regeneration is destructive; stash local edits before running these commands. Ch
 - Never hand-edit `routeTree.gen.ts`; it is generated by TanStack Router tooling.
 
 ## 7. Application server (Java/Spring) expectations
+
 - Keep business logic in services annotated with `@Service` and transactional boundaries (`@Transactional`) where needed. Controllers should be thin (input validation + delegation).
 - Use Lombok consistently (`@Getter`, `@Setter`, etc.) but prefer explicit builders or records when immutability helps.
 - Group new tests under the proper JUnit tag so CI picks them up (`@Tag("unit")`, `@Tag("integration")`, or `@Tag("architecture")`). Follow the mantra in `.github/instructions/java-tests.instructions.md` (AAA structure, single assertion focus, deterministic data).
@@ -80,6 +87,7 @@ Regeneration is destructive; stash local edits before running these commands. Ch
 - When integrating with the intelligence-service client, always regenerate (`npm run generate:api:intelligence-service:client`) after touching the spec and commit the updated Java files.
 
 ## 8. Python services expectations
+
 - Both services rely on Poetry with in-project virtualenvs. Run `poetry install --with dev --no-root` before running tooling.
 - Intelligence service:
   - Settings live in `app/settings.py`; `MODEL_NAME` and `DETECTION_MODEL_NAME` must be provider-qualified (`openai:gpt-4o`, `fake:model`, etc.). For tooling/CI we rely on the `fake` provider.
@@ -91,12 +99,15 @@ Regeneration is destructive; stash local edits before running these commands. Ch
 - Formatting: run `poetry run black .` (or `--check`) and `poetry run flake8 .`. Add type hints so mypy stays green in the intelligence service.
 
 ## 9. Documentation & assets
+
 - ERD diagrams live under `docs/contributor/erd/`. Regenerate via `npm run db:generate-erd-docs` after schema changes.
 - Contributor documentation should stay in `docs/` (GitHub Pages). Keep README/CONTRIBUTING updates concise and actionable.
 - Screenshots or large binary assets belong under `docs/images/` or the Storybook stories, not inside source directories.
 
 ## 10. Commit & PR checklist
+
 Before marking work ready for review:
+
 - [ ] Regenerate and commit any impacted OpenAPI specs, clients, ERD docs, or generated SQLAlchemy models.
 - [ ] Run the formatting/linting/typecheck/test commands relevant to the modified modules; capture output for the PR description if CI cannot run a job locally.
 - [ ] Verify database migrations through `db:draft-changelog` when JPA entities change and inspect the produced XML.
@@ -104,6 +115,7 @@ Before marking work ready for review:
 - [ ] Follow Conventional Commit semantics for PR titles (`feat(webapp): ...`, etc., see `CONTRIBUTING.md`).
 
 ## 11. Known command caveats
+
 - `npm run db:draft-changelog` requires Docker to be installed and available on PATH. In CI we set `CI=true`; locally ensure Docker Desktop/daemon is running before invoking the script.
 - `npm run generate:api:intelligence-service:specs` fails unless `MODEL_NAME` and `DETECTION_MODEL_NAME` are set (use the `fake:model` provider for tooling).
 - `npm run generate:api:application-server:specs` performs a full Maven `verify` against the specs profile. The initial run downloads the entire Spring Boot dependency tree (~hundreds of MB); expect several minutes on a cold cache.
diff --git a/docs/contributor/testing.mdx b/docs/contributor/testing.mdx
index 2f64fcb4a..dbfe90644 100644
--- a/docs/contributor/testing.mdx
+++ b/docs/contributor/testing.mdx
@@ -96,3 +96,60 @@ Available examples include `label.created`, `repository.created`, `create`, `pus
 
 Use the optional `-Dgroups=unit` or `-Dgroups=integration` flags once category support lands.
 
+## GitHub live sync integration tests
+
+Some regression scenarios can only be validated against GitHub itself. We ship a focused suite that exercises the live GitHub App installation and verifies end-to-end sync behaviour (repository metadata, labels, milestones, and teams).
+
+### Prerequisites
+
+1. **Sandbox installation** – the `Hephaestus IntegrationTests` GitHub App must be installed in a sandbox organisation you control. The tests create and delete repositories, milestones, labels, and teams on each run.
+2. **Credentials** – provide both a GitHub App private key and a Personal Access Token with the following scopes:
+    - `repo` (full)
+    - `admin:org`
+    - `read:packages`
+3. **Local config file** – copy the template that lives alongside the tests:
+
+    ```bash
+    cd server/application-server/src/test/resources
+    cp application-github-integration-local.example.yml application-github-integration-local.yml
+    ```
+
+    Fill in the placeholders with the sandbox organisation slug, the installation id, and either an inline PEM key (`github.app.privateKey`) or a readable `privateKeyLocation`. Keep this file out of version control—it is already listed in `.gitignore`.
+
+    Alternatively, export the matching environment variables:
+
+    ```bash
+    export GH_IT_APP_ID=2250297
+    export GH_IT_APP_PAT=ghp_xxx...      # PAT with the scopes above
+    export GH_IT_INSTALLATION_ID=93512943
+    export GH_IT_ORGANIZATION=HephaestusTest
+    export GH_IT_APP_PRIVATE_KEY_PATH=/absolute/path/to/private-key.pem
+    ```
+
+    Use either the file _or_ the environment variables; the suite checks both and aborts if key material is missing.
+
+### Running the suite
+
+From `server/application-server/` run:
+
+```bash
+./mvnw test -Dgroups=github-integration
+```
+
+Passing the `groups` system property automatically activates the `github-integration-tests` Maven profile, which clears the default exclusion and runs only the live GitHub scenarios. The regular CI pipeline never sets this flag, so these tests remain skipped unless you opt in locally.
+
+The run takes roughly two minutes and prints the GitHub artefacts it provisions. Clean-up is handled automatically, but if a failure interrupts execution you can safely delete any `hephaestus-it-*` repositories, milestones, or teams that remain in the sandbox.
+
+### Authoring new GitHub sync tests
+
+1. Extend `AbstractGitHubSyncIntegrationTest` (or fall back to `BaseGitHubIntegrationTest` when repositories are not needed). These bases set up credential checks, provide the `workspaceRepository`, and expose helpers such as `createEphemeralRepository`, `registerRepositoryToMonitor`, `createEphemeralTeam`, and `seedOrganizationMembers`.
+2. Use the supplied helpers to create and track temporary GitHub artefacts. They automatically register clean-up handlers via `@AfterEach`, so add new resources to the provided lists instead of implementing manual deletion logic.
+3. Keep tests deterministic: rely on `databaseTestUtils.cleanDatabase()` in `@BeforeEach` (already invoked by the base), and generate unique slugs via `nextEphemeralSlug("suffix")` when naming repositories, branches, or teams.
+4. If a scenario needs extra Spring configuration, extend `application-github-integration-local.yml` in `server/application-server/src/test/resources/`. The checked-in `.example` file documents every property; copy it on demand and keep secrets out of version control.
+
+### Troubleshooting
+
+- **Skipping because of missing credentials** – check the console output; the base test class verifies that the App id, private key, PAT, and installation id are all present before executing.
+- **Hub4j rate-limit failures** – the suite creates several entities per run. Prefer a dedicated sandbox organisation so you do not clash with production automation limits.
+- **Longer runtimes** – each suite bootstraps a Testcontainers PostgreSQL instance and provisions GitHub resources. Expect higher runtimes than the pure Testcontainers integration tests; avoid running them on every PR and instead use them before releases or when touching the GitHub sync layer.
+
diff --git a/package-lock.json b/package-lock.json
index 61f82663f..e9ca69d98 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,6 +11,7 @@
       "devDependencies": {
         "@openapitools/openapi-generator-cli": "2.16.3",
         "npm-run-all": "^4.1.5",
+        "patch-package": "^8.0.1",
         "prettier": "3.5.1",
         "prettier-plugin-java": "2.6.7",
         "prettier-plugin-kotlin": "2.1.0",
@@ -5700,6 +5701,13 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/@yarnpkg/lockfile": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@yarnpkg/lockfile/-/lockfile-1.1.0.tgz",
+      "integrity": "sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==",
+      "dev": true,
+      "license": "BSD-2-Clause"
+    },
     "node_modules/acorn": {
       "version": "8.15.0",
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
@@ -6573,6 +6581,22 @@
         }
       }
     },
+    "node_modules/ci-info": {
+      "version": "3.9.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
+      "integrity": "sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/citty": {
       "version": "0.1.6",
       "resolved": "https://registry.npmjs.org/citty/-/citty-0.1.6.tgz",
@@ -8461,6 +8485,16 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/find-yarn-workspace-root": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/find-yarn-workspace-root/-/find-yarn-workspace-root-2.0.0.tgz",
+      "integrity": "sha512-1IMnbjt4KzsQfnhnzNd8wUEgXZ44IzZaZmnLYx7D5FZlaHt2gW20Cri8Q+E/t5tIj4+epTBub+2Zxu/vNILzqQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "micromatch": "^4.0.2"
+      }
+    },
     "node_modules/follow-redirects": {
       "version": "1.15.9",
       "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.9.tgz",
@@ -10376,6 +10410,26 @@
       "integrity": "sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==",
       "license": "(AFL-2.1 OR BSD-3-Clause)"
     },
+    "node_modules/json-stable-stringify": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify/-/json-stable-stringify-1.3.0.tgz",
+      "integrity": "sha512-qtYiSSFlwot9XHtF9bD9c7rwKjr+RecWT//ZnPvSmEjpV5mmPOCN4j8UjY5hbjNkOwZ/jQv3J6R1/pL7RwgMsg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "call-bound": "^1.0.4",
+        "isarray": "^2.0.5",
+        "jsonify": "^0.0.1",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/json5": {
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
@@ -10401,6 +10455,16 @@
         "graceful-fs": "^4.1.6"
       }
     },
+    "node_modules/jsonify": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/jsonify/-/jsonify-0.0.1.tgz",
+      "integrity": "sha512-2/Ki0GcmuqSrgFyelQq9M05y7PS0mEwuIzrf3f1fPqkVDVRvZrPZtVSMHxdgo8Aq0sxAOb/cr2aqqA3LeWHVPg==",
+      "dev": true,
+      "license": "Public Domain",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/katex": {
       "version": "0.16.22",
       "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.22.tgz",
@@ -10428,6 +10492,16 @@
       "resolved": "https://registry.npmjs.org/khroma/-/khroma-2.1.0.tgz",
       "integrity": "sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw=="
     },
+    "node_modules/klaw-sync": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/klaw-sync/-/klaw-sync-6.0.0.tgz",
+      "integrity": "sha512-nIeuVSzdCCs6TDPTqI8w1Yre34sSq7AkZ4B3sfOBbI2CgVSB4Du4aLQijFU2+lhAFCwt9+42Hel6lQNIv6AntQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.1.11"
+      }
+    },
     "node_modules/kleur": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz",
@@ -11952,6 +12026,33 @@
       ],
       "license": "MIT"
     },
+    "node_modules/micromatch": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "braces": "^3.0.3",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/micromatch/node_modules/picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/mime-db": {
       "version": "1.52.0",
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
@@ -12769,6 +12870,92 @@
         "url": "https://github.com/inikulin/parse5?sponsor=1"
       }
     },
+    "node_modules/patch-package": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/patch-package/-/patch-package-8.0.1.tgz",
+      "integrity": "sha512-VsKRIA8f5uqHQ7NGhwIna6Bx6D9s/1iXlA1hthBVBEbkq+t4kXD0HHt+rJhf/Z+Ci0F/HCB2hvn0qLdLG+Qxlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@yarnpkg/lockfile": "^1.1.0",
+        "chalk": "^4.1.2",
+        "ci-info": "^3.7.0",
+        "cross-spawn": "^7.0.3",
+        "find-yarn-workspace-root": "^2.0.0",
+        "fs-extra": "^10.0.0",
+        "json-stable-stringify": "^1.0.2",
+        "klaw-sync": "^6.0.0",
+        "minimist": "^1.2.6",
+        "open": "^7.4.2",
+        "semver": "^7.5.3",
+        "slash": "^2.0.0",
+        "tmp": "^0.2.4",
+        "yaml": "^2.2.2"
+      },
+      "bin": {
+        "patch-package": "index.js"
+      },
+      "engines": {
+        "node": ">=14",
+        "npm": ">5"
+      }
+    },
+    "node_modules/patch-package/node_modules/is-docker": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
+      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "is-docker": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/patch-package/node_modules/is-wsl": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
+      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-docker": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/patch-package/node_modules/open": {
+      "version": "7.4.2",
+      "resolved": "https://registry.npmjs.org/open/-/open-7.4.2.tgz",
+      "integrity": "sha512-MVHddDVweXZF3awtlAS+6pgKLlm/JgxZ90+/NBurBoQctVOOB/zDdVjcyPzQ+0laDGbsWgrRkflI65sQeOgT9Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-docker": "^2.0.0",
+        "is-wsl": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/patch-package/node_modules/tmp": {
+      "version": "0.2.5",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
+      "integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
     "node_modules/path-data-parser": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/path-data-parser/-/path-data-parser-0.1.0.tgz",
@@ -14724,6 +14911,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/slash": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-2.0.0.tgz",
+      "integrity": "sha512-ZYKh3Wh2z1PpEXWr0MpSBZ0V6mZHAQfYevttO11c51CaWjGTaadiKZ+wVt1PbMlDV5qhMFslpZCemhwOK7C89A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/smart-buffer": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
@@ -16802,6 +16999,19 @@
         "node": ">=18"
       }
     },
+    "node_modules/yaml": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz",
+      "integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==",
+      "devOptional": true,
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      }
+    },
     "node_modules/yargs": {
       "version": "16.2.0",
       "resolved": "https://registry.npmjs.org/yargs/-/yargs-16.2.0.tgz",
diff --git a/package.json b/package.json
index 305c74da0..70c122220 100644
--- a/package.json
+++ b/package.json
@@ -37,9 +37,10 @@
   "devDependencies": {
     "@openapitools/openapi-generator-cli": "2.16.3",
     "npm-run-all": "^4.1.5",
+    "patch-package": "^8.0.1",
     "prettier": "3.5.1",
     "prettier-plugin-java": "2.6.7",
     "prettier-plugin-kotlin": "2.1.0",
     "shx": "0.3.4"
   }
-}
\ No newline at end of file
+}
diff --git a/server/application-server/pom.xml b/server/application-server/pom.xml
index 3106782f0..24d020917 100644
--- a/server/application-server/pom.xml
+++ b/server/application-server/pom.xml
@@ -35,7 +35,8 @@
         <!-- Test Configuration -->
         <maven.test.failure.ignore>false</maven.test.failure.ignore>
         <maven.test.skip>false</maven.test.skip>
-        <hephaestus.surefire.timeout>60</hephaestus.surefire.timeout>
+        <hephaestus.surefire.timeout>180</hephaestus.surefire.timeout>
+        <hephaestus.githubIntegrationExcludedGroups>github-integration</hephaestus.githubIntegrationExcludedGroups>
 
         <!-- Coverage Configuration (disabled by default) -->
         <skipCoverage>true</skipCoverage>
@@ -433,7 +434,8 @@
                     <skipAfterFailureCount>5</skipAfterFailureCount>
                     <!-- Forked JVM timeout settings to prevent hanging -->
                     <forkedProcessTimeoutInSeconds>${hephaestus.surefire.timeout}</forkedProcessTimeoutInSeconds>
-                    <forkedProcessExitTimeoutInSeconds>10</forkedProcessExitTimeoutInSeconds>
+                    <forkedProcessExitTimeoutInSeconds>60</forkedProcessExitTimeoutInSeconds>
+                    <excludedGroups>${hephaestus.githubIntegrationExcludedGroups}</excludedGroups>
                 </configuration>
             </plugin>
 
@@ -557,5 +559,16 @@
                 <hephaestus.surefire.timeout>180</hephaestus.surefire.timeout>
             </properties>
         </profile>
+        <profile>
+            <id>github-integration-tests</id>
+            <activation>
+                <property>
+                    <name>groups</name>
+                </property>
+            </activation>
+            <properties>
+                <hephaestus.githubIntegrationExcludedGroups></hephaestus.githubIntegrationExcludedGroups>
+            </properties>
+        </profile>
     </profiles>
 </project>
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/Application.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/Application.java
index 891f9f8a5..a79b8bb49 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/Application.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/Application.java
@@ -1,5 +1,6 @@
 package de.tum.in.www1.hephaestus;
 
+import de.tum.in.www1.hephaestus.config.GitHubApiPatches;
 import java.util.TimeZone;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
@@ -10,6 +11,9 @@
 @EnableCaching
 @EnableScheduling
 public class Application {
+    static {
+        GitHubApiPatches.ensureApplied();
+    }
 
     public static void main(String[] args) {
         TimeZone.setDefault(TimeZone.getTimeZone("Europe/Berlin"));
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/config/GitHubApiPatches.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/config/GitHubApiPatches.java
index 3de9e023d..acdb4fa32 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/config/GitHubApiPatches.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/config/GitHubApiPatches.java
@@ -1,12 +1,12 @@
 package de.tum.in.www1.hephaestus.config;
 
 import jakarta.annotation.PostConstruct;
+import java.lang.instrument.Instrumentation;
 import net.bytebuddy.agent.ByteBuddyAgent;
 import net.bytebuddy.agent.builder.AgentBuilder;
-import net.bytebuddy.implementation.MethodDelegation;
-import net.bytebuddy.implementation.bind.annotation.RuntimeType;
-import net.bytebuddy.implementation.bind.annotation.This;
+import net.bytebuddy.asm.Advice;
 import net.bytebuddy.matcher.ElementMatchers;
+import org.kohsuke.github.GHUser;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.context.annotation.Configuration;
@@ -18,106 +18,121 @@
 public class GitHubApiPatches {
 
     private static final Logger logger = LoggerFactory.getLogger(GitHubApiPatches.class);
+    private static volatile boolean patchApplied;
 
     @PostConstruct
     public void applyPatches() {
-        try {
-            ByteBuddyAgent.install();
+        ensureApplied();
+    }
 
-            patchGetUser("org.kohsuke.github.GHPullRequestReview");
-            patchGetUser("org.kohsuke.github.GHPullRequestReviewComment");
-        } catch (Throwable t) {
-            logger.warn("Failed to apply Byte Buddy patches for github-api. Proceeding without patches.", t);
+    public static void ensureApplied() {
+        if (patchApplied) {
+            return;
         }
+        synchronized (GitHubApiPatches.class) {
+            if (patchApplied) {
+                return;
+            }
+            try {
+                installPatches();
+                patchApplied = true;
+            } catch (Throwable t) {
+                logger.warn("Failed to apply Byte Buddy patches for github-api. Proceeding without patches.", t);
+            }
+        }
+    }
+
+    private static void installPatches() {
+        Instrumentation instrumentation = ByteBuddyAgent.install();
+        logger.info(
+            "ByteBuddy instrumentation supports retransformation: {}",
+            instrumentation.isRetransformClassesSupported()
+        );
+
+        patchGetUser(instrumentation, "org.kohsuke.github.GHPullRequestReview");
+        patchGetUser(instrumentation, "org.kohsuke.github.GHPullRequestReviewComment");
     }
 
-    private void patchGetUser(String className) throws Exception {
+    private static void patchGetUser(Instrumentation instrumentation, String className) {
         new AgentBuilder.Default()
+            .disableClassFormatChanges()
             .with(AgentBuilder.RedefinitionStrategy.RETRANSFORMATION)
             .ignore(ElementMatchers.none())
             .type(ElementMatchers.named(className))
             .transform((builder, typeDescription, classLoader, module, protectionDomain) ->
-                builder
-                    .method(ElementMatchers.named("getUser"))
-                    .intercept(MethodDelegation.to(GetUserInterceptor.class))
+                builder.visit(Advice.to(GetUserAdvice.class).on(ElementMatchers.named("getUser")))
             )
-            .installOnByteBuddyAgent();
+            .installOn(instrumentation);
+
+        if (instrumentation.isRetransformClassesSupported()) {
+            try {
+                Class<?> targetClass = Class.forName(className, false, GitHubApiPatches.class.getClassLoader());
+                if (instrumentation.isModifiableClass(targetClass)) {
+                    instrumentation.retransformClasses(targetClass);
+                }
+            } catch (ClassNotFoundException ignored) {
+                // Class will be transformed on first load.
+            } catch (UnsupportedOperationException | java.lang.instrument.UnmodifiableClassException ex) {
+                logger.warn("Instrumentation cannot retransform {}: {}", className, ex.getMessage());
+            }
+        }
 
         logger.info("Patched {}#getUser via Byte Buddy", className);
     }
 
     /**
-     * Interceptor implementing: return owner == null || owner.isOffline() ? user : owner.root().getUser(user.login)
+     * Advice returning the embedded user whenever possible to avoid remote API calls.
      */
-    public static class GetUserInterceptor {
+    public static class GetUserAdvice {
 
-        @RuntimeType
-        public static Object intercept(@This Object self) throws Exception {
+        @Advice.OnMethodEnter(skipOn = Advice.OnNonDefaultValue.class)
+        public static GHUser enter(@Advice.This Object self) {
             try {
-                // Reflectively access fields: owner, user
                 var clazz = self.getClass();
-                var ownerField = clazz.getDeclaredField("owner");
-                ownerField.setAccessible(true);
-                Object owner = ownerField.get(self);
 
                 var userField = clazz.getDeclaredField("user");
                 userField.setAccessible(true);
-                Object user = userField.get(self);
+                GHUser user = (GHUser) userField.get(self);
+
+                var ownerField = clazz.getDeclaredField("owner");
+                ownerField.setAccessible(true);
+                Object owner = ownerField.get(self);
 
                 if (owner == null) {
                     return user;
                 }
 
-                // owner has isOffline()
-                var isOfflineMethod = owner.getClass().getMethod("isOffline");
-                boolean isOffline = (Boolean) isOfflineMethod.invoke(owner);
-                if (isOffline) {
+                Object offline = owner.getClass().getMethod("isOffline").invoke(owner);
+                if (Boolean.TRUE.equals(offline)) {
                     return user;
                 }
 
-                if (user == null) {
-                    return null;
-                }
-
-                // user has login field (package-private), fallback to getLogin()
-                String login = null;
-                try {
-                    var loginField = user.getClass().getDeclaredField("login");
-                    loginField.setAccessible(true);
-                    Object v = loginField.get(user);
-                    login = v != null ? v.toString() : null;
-                } catch (NoSuchFieldException ignore) {
-                    try {
-                        var getLogin = user.getClass().getMethod("getLogin");
-                        Object v = getLogin.invoke(user);
-                        login = v != null ? v.toString() : null;
-                    } catch (ReflectiveOperationException ex) {
-                        // ignore
-                    }
-                }
-
-                if (login == null) {
-                    return user;
-                }
-
-                // owner.root().getUser(login)
-                var rootMethod = owner.getClass().getMethod("root");
-                Object root = rootMethod.invoke(owner);
-                if (root == null) {
+                if (user != null) {
                     return user;
                 }
-                var getUserMethod = root.getClass().getMethod("getUser", String.class);
-                return getUserMethod.invoke(root, login);
             } catch (Throwable t) {
-                // On any unexpected error, return the embedded user to be safe
                 try {
-                    var userField = self.getClass().getDeclaredField("user");
-                    userField.setAccessible(true);
-                    return userField.get(self);
-                } catch (Throwable inner) {
+                    var field = self.getClass().getDeclaredField("user");
+                    field.setAccessible(true);
+                    return (GHUser) field.get(self);
+                } catch (Throwable ignored) {
                     return null;
                 }
             }
+
+            return null;
+        }
+
+        @Advice.OnMethodExit(onThrowable = Throwable.class)
+        public static void exit(
+            @Advice.Enter GHUser resolved,
+            @Advice.Return(readOnly = false) GHUser returnValue,
+            @Advice.Thrown(readOnly = false) Throwable throwable
+        ) {
+            if (resolved != null) {
+                returnValue = resolved;
+                throwable = null;
+            }
         }
     }
 }
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/common/github/app/GitHubAppTokenService.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/common/github/app/GitHubAppTokenService.java
index a12c9b29c..7961af58c 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/common/github/app/GitHubAppTokenService.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/common/github/app/GitHubAppTokenService.java
@@ -239,7 +239,14 @@ private static boolean isKeyMaterialPresent(long appId, Resource privateKeyRes,
         if (privateKeyPem != null && !privateKeyPem.isBlank()) {
             return true;
         }
-        return privateKeyRes != null && privateKeyRes.exists();
+        if (privateKeyRes == null) {
+            return false;
+        }
+        try {
+            return privateKeyRes.exists() && privateKeyRes.contentLength() > 0;
+        } catch (IOException ignored) {
+            return false;
+        }
     }
 
     private static PrivateKey generateEphemeralRsaKey() {
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/label/LabelRepository.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/label/LabelRepository.java
index eee1bf11f..007dbaf66 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/label/LabelRepository.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/label/LabelRepository.java
@@ -1,5 +1,6 @@
 package de.tum.in.www1.hephaestus.gitprovider.label;
 
+import java.util.List;
 import java.util.Optional;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.Query;
@@ -17,4 +18,6 @@ public interface LabelRepository extends JpaRepository<Label, Long> {
         """
     )
     Optional<Label> findByRepositoryIdAndName(@Param("repositoryId") Long repositoryId, @Param("name") String name);
+
+    List<Label> findAllByRepository_Id(Long repositoryId);
 }
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/label/github/GitHubLabelSyncService.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/label/github/GitHubLabelSyncService.java
index 9f6cec6c4..9bfbe5b9d 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/label/github/GitHubLabelSyncService.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/label/github/GitHubLabelSyncService.java
@@ -5,7 +5,9 @@
 import de.tum.in.www1.hephaestus.gitprovider.repository.RepositoryRepository;
 import jakarta.transaction.Transactional;
 import java.io.IOException;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 import org.kohsuke.github.GHLabel;
 import org.kohsuke.github.GHRepository;
 import org.slf4j.Logger;
@@ -48,8 +50,42 @@ public void syncLabelsOfAllRepositories(List<GHRepository> repositories) {
      *
      * @param repository the GitHub repository whose labels are to be synchronized
      */
+    @Transactional
     public void syncLabelsOfRepository(GHRepository repository) {
-        repository.listLabels().withPageSize(100).forEach(this::processLabel);
+        if (repository == null) {
+            return;
+        }
+
+        List<GHLabel> remoteLabels;
+        try {
+            remoteLabels = repository.listLabels().withPageSize(100).toList();
+        } catch (IOException listingError) {
+            logger.error(
+                "Failed to list labels for repositoryId={}: {}",
+                repository.getId(),
+                listingError.getMessage()
+            );
+            return;
+        }
+        Set<Long> seenLabelIds = new HashSet<>(remoteLabels.size());
+        remoteLabels.forEach(ghLabel -> {
+            seenLabelIds.add(ghLabel.getId());
+            processLabel(ghLabel);
+        });
+
+        var repositoryId = repository.getId();
+        List<Label> existingLabels = labelRepository.findAllByRepository_Id(repositoryId);
+        int removed = 0;
+        for (Label label : existingLabels) {
+            if (!seenLabelIds.contains(label.getId())) {
+                labelRepository.delete(label);
+                removed++;
+            }
+        }
+
+        if (removed > 0) {
+            logger.info("Deleted {} stale labels for repositoryId={}", removed, repositoryId);
+        }
     }
 
     /**
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/milestone/MilestoneRepository.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/milestone/MilestoneRepository.java
index 2e3f6183b..42db623f2 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/milestone/MilestoneRepository.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/milestone/MilestoneRepository.java
@@ -1,7 +1,10 @@
 package de.tum.in.www1.hephaestus.gitprovider.milestone;
 
+import java.util.List;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.stereotype.Repository;
 
 @Repository
-public interface MilestoneRepository extends JpaRepository<Milestone, Long> {}
+public interface MilestoneRepository extends JpaRepository<Milestone, Long> {
+    List<Milestone> findAllByRepository_Id(Long repositoryId);
+}
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/milestone/github/GitHubMilestoneSyncService.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/milestone/github/GitHubMilestoneSyncService.java
index 845827786..9c32c67be 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/milestone/github/GitHubMilestoneSyncService.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/milestone/github/GitHubMilestoneSyncService.java
@@ -7,7 +7,9 @@
 import de.tum.in.www1.hephaestus.gitprovider.user.github.GitHubUserConverter;
 import jakarta.transaction.Transactional;
 import java.io.IOException;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 import org.kohsuke.github.GHIssueState;
 import org.kohsuke.github.GHMilestone;
 import org.kohsuke.github.GHRepository;
@@ -58,8 +60,43 @@ public void syncMilestonesOfAllRepositories(List<GHRepository> repositories) {
      * @param repository the GitHub repository whose milestones are to be
      *                   synchronized
      */
+    @Transactional
     public void syncMilestonesOfRepository(GHRepository repository) {
-        repository.listMilestones(GHIssueState.ALL).withPageSize(100).forEach(this::processMilestone);
+        if (repository == null) {
+            return;
+        }
+
+        List<GHMilestone> remoteMilestones;
+        try {
+            remoteMilestones = repository.listMilestones(GHIssueState.ALL).withPageSize(100).toList();
+        } catch (IOException listingError) {
+            logger.error(
+                "Failed to list milestones for repositoryId={}: {}",
+                repository.getId(),
+                listingError.getMessage()
+            );
+            return;
+        }
+
+        Set<Long> seenMilestoneIds = new HashSet<>(remoteMilestones.size());
+        remoteMilestones.forEach(ghMilestone -> {
+            seenMilestoneIds.add(ghMilestone.getId());
+            processMilestone(ghMilestone);
+        });
+
+        var repositoryId = repository.getId();
+        List<Milestone> existingMilestones = milestoneRepository.findAllByRepository_Id(repositoryId);
+        int removed = 0;
+        for (Milestone milestone : existingMilestones) {
+            if (!seenMilestoneIds.contains(milestone.getId())) {
+                milestoneRepository.delete(milestone);
+                removed++;
+            }
+        }
+
+        if (removed > 0) {
+            logger.info("Deleted {} stale milestones for repositoryId={}", removed, repositoryId);
+        }
     }
 
     /**
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreview/github/GitHubPullRequestReviewMessageHandler.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreview/github/GitHubPullRequestReviewMessageHandler.java
index b9f1f7df3..76ed553b1 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreview/github/GitHubPullRequestReviewMessageHandler.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreview/github/GitHubPullRequestReviewMessageHandler.java
@@ -44,7 +44,7 @@ protected void handleEvent(GHEventPayload.PullRequestReview eventPayload) {
         repositorySyncService.processRepository(repository);
         pullRequestSyncService.processPullRequest(pullRequest);
         // We don't need to handle the deleted action here, as reviews are not deleted, they are only dismissed
-        pullRequestReviewSyncService.processPullRequestReview(review);
+        pullRequestReviewSyncService.processPullRequestReview(review, pullRequest, eventPayload.getSender());
     }
 
     @Override
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreview/github/GitHubPullRequestReviewSyncService.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreview/github/GitHubPullRequestReviewSyncService.java
index f8a811a5d..95c66553e 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreview/github/GitHubPullRequestReviewSyncService.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreview/github/GitHubPullRequestReviewSyncService.java
@@ -73,6 +73,15 @@ public void syncReviewsOfPullRequest(GHPullRequest pullRequest) {
      */
     @Transactional
     public PullRequestReview processPullRequestReview(GHPullRequestReview ghPullRequestReview) {
+        return processPullRequestReview(ghPullRequestReview, null, null);
+    }
+
+    @Transactional
+    public PullRequestReview processPullRequestReview(
+        GHPullRequestReview ghPullRequestReview,
+        GHPullRequest fallbackPullRequest,
+        GHUser fallbackUser
+    ) {
         var result = pullRequestReviewRepository
             .findById(ghPullRequestReview.getId())
             .map(pullRequestReview -> {
@@ -85,19 +94,36 @@ public PullRequestReview processPullRequestReview(GHPullRequestReview ghPullRequ
         }
 
         // Link pull request
-        var pullRequest = ghPullRequestReview.getParent();
-        var resultPullRequest = pullRequestRepository
-            .findById(pullRequest.getId())
-            .orElseGet(() -> pullRequestRepository.save(pullRequestConverter.convert(pullRequest)));
+        GHPullRequest pullRequest = null;
+        try {
+            pullRequest = ghPullRequestReview.getParent();
+        } catch (NullPointerException ignored) {
+            logger.warn(
+                "Hub4j pull request review {} missing parent reference; falling back to event payload.",
+                ghPullRequestReview.getId()
+            );
+        }
+        if (pullRequest == null) {
+            pullRequest = fallbackPullRequest;
+        }
+        if (pullRequest == null) {
+            logger.error(
+                "Failed to link pull request for pull request review {}: {}",
+                ghPullRequestReview.getId(),
+                "Parent pull request not available"
+            );
+            return null;
+        }
+        var resultPullRequest = pullRequestRepository.findById(pullRequest.getId()).orElse(null);
+        if (resultPullRequest == null) {
+            resultPullRequest = pullRequestRepository.save(pullRequestConverter.convert(pullRequest));
+        }
         result.setPullRequest(resultPullRequest);
 
         // Link author
+        GHUser user = null;
         try {
-            GHUser user = ghPullRequestReview.getUser();
-            var resultAuthor = userRepository
-                .findById(user.getId())
-                .orElseGet(() -> userRepository.save(userConverter.convert(user)));
-            result.setAuthor(resultAuthor);
+            user = ghPullRequestReview.getUser();
         } catch (IOException | NullPointerException e) {
             logger.error(
                 "Failed to link author for pull request review {}: {}",
@@ -105,6 +131,22 @@ public PullRequestReview processPullRequestReview(GHPullRequestReview ghPullRequ
                 e.getMessage()
             );
         }
+        if (user == null) {
+            user = fallbackUser;
+        }
+        if (user != null) {
+            var resultAuthor = userRepository.findById(user.getId()).orElse(null);
+            if (resultAuthor == null) {
+                resultAuthor = userRepository.save(userConverter.convert(user));
+            }
+            result.setAuthor(resultAuthor);
+        } else {
+            logger.warn(
+                "No author information available for pull request review {}; leaving review without author.",
+                ghPullRequestReview.getId()
+            );
+            result.setAuthor(null);
+        }
 
         return pullRequestReviewRepository.save(result);
     }
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentMessageHandler.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentMessageHandler.java
index d26ba5c3d..c7683bbff 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentMessageHandler.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentMessageHandler.java
@@ -53,7 +53,11 @@ protected void handleEvent(GHEventPayload.PullRequestReviewComment eventPayload)
         if (action.equals("deleted")) {
             pullRequestReviewCommentSyncService.deletePullRequestReviewComment(comment.getId());
         } else {
-            pullRequestReviewCommentSyncService.processPullRequestReviewComment(comment, pullRequest);
+            pullRequestReviewCommentSyncService.processPullRequestReviewComment(
+                comment,
+                pullRequest,
+                eventPayload.getSender()
+            );
         }
     }
 
diff --git a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentSyncService.java b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentSyncService.java
index 90016ad69..d2b6798b0 100644
--- a/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentSyncService.java
+++ b/server/application-server/src/main/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentSyncService.java
@@ -87,17 +87,24 @@ public void syncReviewCommentsOfPullRequest(GHPullRequest pullRequest) {
      * @return the updated or newly created PullRequestReviewComment entity, or
      *         {@code null} if an error occurred
      */
+    @Transactional
+    public PullRequestReviewComment processPullRequestReviewComment(GHPullRequestReviewComment ghComment) {
+        return processPullRequestReviewComment(ghComment, null, null);
+    }
+
     @Transactional
     public PullRequestReviewComment processPullRequestReviewComment(
-        GHPullRequestReviewComment ghPullRequestReviewComment
+        GHPullRequestReviewComment ghComment,
+        GHPullRequest providedPullRequest
     ) {
-        return processPullRequestReviewComment(ghPullRequestReviewComment, null);
+        return processPullRequestReviewComment(ghComment, providedPullRequest, null);
     }
 
     @Transactional
     public PullRequestReviewComment processPullRequestReviewComment(
         GHPullRequestReviewComment ghPullRequestReviewComment,
-        GHPullRequest providedPullRequest
+        GHPullRequest providedPullRequest,
+        GHUser fallbackUser
     ) {
         var existing = pullRequestReviewCommentRepository.findById(ghPullRequestReviewComment.getId()).orElse(null);
         var result = existing != null
@@ -131,7 +138,7 @@ public PullRequestReviewComment processPullRequestReviewComment(
                 )
             );
 
-        attachAuthor(ghPullRequestReviewComment, result);
+        attachAuthor(ghPullRequestReviewComment, result, fallbackUser);
 
         attachInReplyTo(ghPullRequestReviewComment, result);
 
@@ -157,24 +164,36 @@ private PullRequestReviewComment updateIfNewer(GHPullRequestReviewComment source
         }
     }
 
-    private void attachAuthor(GHPullRequestReviewComment ghPullRequestReviewComment, PullRequestReviewComment comment) {
+    private void attachAuthor(
+        GHPullRequestReviewComment ghPullRequestReviewComment,
+        PullRequestReviewComment comment,
+        GHUser fallbackUser
+    ) {
+        GHUser user = null;
         try {
-            GHUser user = ghPullRequestReviewComment.getUser();
-            if (user == null) {
-                comment.setAuthor(null);
-                return;
-            }
-            var resultAuthor = userRepository
-                .findById(user.getId())
-                .orElseGet(() -> userRepository.save(userConverter.convert(user)));
-            comment.setAuthor(resultAuthor);
+            user = ghPullRequestReviewComment.getUser();
         } catch (IOException | NullPointerException e) {
             logger.error(
-                "Failed to link author for pull request review comment {}: {}",
+                "Failed to fetch author via API for pull request review comment {}: {}",
                 ghPullRequestReviewComment.getId(),
                 e.getMessage()
             );
         }
+
+        if (user == null) {
+            user = fallbackUser;
+        }
+
+        if (user == null) {
+            comment.setAuthor(null);
+            return;
+        }
+
+        var resultAuthor = userRepository.findById(user.getId()).orElse(null);
+        if (resultAuthor == null) {
+            resultAuthor = userRepository.save(userConverter.convert(user));
+        }
+        comment.setAuthor(resultAuthor);
     }
 
     private void attachInReplyTo(
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/common/GitHubPayloadExtension.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/common/GitHubPayloadExtension.java
index 80c792c5b..30e644576 100644
--- a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/common/GitHubPayloadExtension.java
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/common/GitHubPayloadExtension.java
@@ -1,5 +1,6 @@
 package de.tum.in.www1.hephaestus.gitprovider.common;
 
+import de.tum.in.www1.hephaestus.config.GitHubApiPatches;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.StringReader;
@@ -43,6 +44,7 @@ private <T extends GHEventPayload> T loadPayload(String fileName, Class<T> paylo
                 throw new IOException("GitHub payload not found on classpath: " + resourcePath);
             }
             String jsonPayload = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
+            GitHubApiPatches.ensureApplied();
             try (StringReader reader = new StringReader(jsonPayload)) {
                 return GitHub.offline().parseEventPayload(reader, payloadType);
             }
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/AbstractGitHubSyncIntegrationTest.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/AbstractGitHubSyncIntegrationTest.java
new file mode 100644
index 000000000..32c2b833a
--- /dev/null
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/AbstractGitHubSyncIntegrationTest.java
@@ -0,0 +1,436 @@
+package de.tum.in.www1.hephaestus.gitprovider.github;
+
+import de.tum.in.www1.hephaestus.gitprovider.common.github.app.GitHubAppTokenService;
+import de.tum.in.www1.hephaestus.gitprovider.user.github.GitHubUserSyncService;
+import de.tum.in.www1.hephaestus.workspace.RepositoryToMonitor;
+import de.tum.in.www1.hephaestus.workspace.RepositoryToMonitorRepository;
+import de.tum.in.www1.hephaestus.workspace.Workspace;
+import de.tum.in.www1.hephaestus.workspace.WorkspaceRepository;
+import java.io.IOException;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.kohsuke.github.GHLabel;
+import org.kohsuke.github.GHMilestone;
+import org.kohsuke.github.GHOrganization;
+import org.kohsuke.github.GHOrganization.Permission;
+import org.kohsuke.github.GHOrganization.RepositoryRole;
+import org.kohsuke.github.GHPullRequestReview;
+import org.kohsuke.github.GHPullRequestReviewComment;
+import org.kohsuke.github.GHPullRequestReviewEvent;
+import org.kohsuke.github.GHRepository;
+import org.kohsuke.github.GHTeam;
+import org.kohsuke.github.GHUser;
+import org.kohsuke.github.GitHub;
+import org.kohsuke.github.GitHubBuilder;
+import org.kohsuke.github.PagedIterable;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+
+abstract class AbstractGitHubSyncIntegrationTest extends BaseGitHubIntegrationTest {
+
+    private static final Logger logger = LoggerFactory.getLogger(AbstractGitHubSyncIntegrationTest.class);
+
+    @Autowired
+    protected GitHubAppTokenService gitHubAppTokenService;
+
+    @Autowired
+    protected WorkspaceRepository workspaceRepository;
+
+    @Autowired
+    protected RepositoryToMonitorRepository repositoryToMonitorRepository;
+
+    @Autowired
+    protected GitHubUserSyncService gitHubUserSyncService;
+
+    @Value("${github.meta.auth-token:}")
+    private String personalAccessToken;
+
+    protected final List<String> repositoriesToDelete = new ArrayList<>();
+    protected final List<Long> teamsToDelete = new ArrayList<>();
+
+    protected GitHub installationClient;
+    protected GitHub patClient;
+    protected Workspace workspace;
+
+    @BeforeAll
+    void setUpGitHubClients() throws IOException {
+        assumeGitHubCredentialsConfigured();
+        installationClient = gitHubAppTokenService.clientForInstallation(githubInstallationId());
+        if (personalAccessToken != null && !personalAccessToken.isBlank()) {
+            patClient = new GitHubBuilder().withOAuthToken(personalAccessToken).build();
+        }
+    }
+
+    @BeforeEach
+    void initializeWorkspace() {
+        databaseTestUtils.cleanDatabase();
+        repositoriesToDelete.clear();
+        teamsToDelete.clear();
+        workspace = createWorkspace();
+    }
+
+    @AfterEach
+    void tearDownGitHubArtifacts() {
+        for (String fullName : repositoriesToDelete) {
+            deleteRepositoryQuietly(fullName);
+        }
+        for (Long teamId : teamsToDelete) {
+            deleteTeamQuietly(teamId);
+        }
+        workspace = null;
+    }
+
+    protected Workspace createWorkspace() {
+        var ws = new Workspace();
+        ws.setGitProviderMode(Workspace.GitProviderMode.GITHUB_APP_INSTALLATION);
+        ws.setInstallationId(githubInstallationId());
+        ws.setAccountLogin(githubOrganization());
+        ws.setGithubRepositorySelection(org.kohsuke.github.GHRepositorySelection.ALL);
+        return workspaceRepository.save(ws);
+    }
+
+    protected GHRepository createEphemeralRepository(String suffix) throws IOException, InterruptedException {
+        String repositoryName = nextEphemeralSlug(suffix);
+        GHOrganization organization = fetchOrganization();
+        GHRepository repository;
+        try {
+            repository = organization
+                .createRepository(repositoryName)
+                .autoInit(true)
+                .private_(true)
+                .description("Temporary repository for live integration testing")
+                .create();
+        } catch (IOException creationError) {
+            if (patClient == null) {
+                throw creationError;
+            }
+            logger.warn("Repository creation via installation token failed, retrying with PAT", creationError);
+            var patOrganization = patClient.getOrganization(organization.getLogin());
+            repository = patOrganization
+                .createRepository(repositoryName)
+                .autoInit(true)
+                .private_(true)
+                .description("Temporary repository for live integration testing")
+                .create();
+        }
+        String fullName = repository.getFullName();
+        repositoriesToDelete.add(fullName);
+        awaitCondition("repository default branch", () -> {
+            var refetched = installationClient.getRepository(fullName);
+            return refetched.getDefaultBranch() != null && !refetched.getDefaultBranch().isBlank();
+        });
+        return installationClient.getRepository(fullName);
+    }
+
+    protected RepositoryToMonitor registerRepositoryToMonitor(GHRepository repository) {
+        RepositoryToMonitor monitor = new RepositoryToMonitor();
+        monitor.setNameWithOwner(repository.getFullName());
+        monitor.setWorkspace(workspace);
+        RepositoryToMonitor saved = repositoryToMonitorRepository.save(monitor);
+        workspace.getRepositoriesToMonitor().add(saved);
+        workspaceRepository.save(workspace);
+        return saved;
+    }
+
+    protected List<GHUser> seedOrganizationMembers() throws IOException {
+        GHOrganization org = fetchOrganization();
+        PagedIterable<GHUser> memberIterable = org.listMembers().withPageSize(100);
+        List<GHUser> members = memberIterable.toList();
+        members.forEach(gitHubUserSyncService::processUser);
+        return members;
+    }
+
+    protected GHOrganization fetchOrganization() throws IOException {
+        return installationClient.getOrganization(githubOrganization());
+    }
+
+    protected GHLabel createRepositoryLabel(GHRepository repository, String prefix, String color, String description)
+        throws IOException {
+        String uniqueSuffix = Long.toString(Instant.now().toEpochMilli(), 36);
+        String labelName = (prefix + "-" + uniqueSuffix).toLowerCase();
+        return repository.createLabel(labelName, color, description);
+    }
+
+    protected GHMilestone createRepositoryMilestone(GHRepository repository, String prefix, String description)
+        throws IOException {
+        String uniqueSuffix = Long.toString(Instant.now().toEpochMilli(), 36);
+        String milestoneTitle = prefix + " " + uniqueSuffix;
+        return repository.createMilestone(milestoneTitle, description);
+    }
+
+    protected CreatedTeam createEphemeralTeam(GHRepository repository, GHOrganization organization, GHUser maintainer)
+        throws IOException {
+        return createEphemeralTeam(repository, organization, maintainer, RepositoryRole.from(Permission.MAINTAIN));
+    }
+
+    protected CreatedTeam createEphemeralTeam(
+        GHRepository repository,
+        GHOrganization organization,
+        GHUser maintainer,
+        RepositoryRole repositoryRole
+    ) throws IOException {
+        String teamName = "it-team-" + nextEphemeralSlug("team");
+        GHTeam team;
+        try {
+            team = organization
+                .createTeam(teamName)
+                .privacy(GHTeam.Privacy.CLOSED)
+                .maintainers(maintainer.getLogin())
+                .create();
+        } catch (IOException creationError) {
+            if (patClient == null) {
+                throw creationError;
+            }
+            logger.warn("Team creation via installation token failed, retrying with PAT", creationError);
+            var patOrganization = patClient.getOrganization(organization.getLogin());
+            team = patOrganization
+                .createTeam(teamName)
+                .privacy(GHTeam.Privacy.CLOSED)
+                .maintainers(maintainer.getLogin())
+                .create();
+        }
+        teamsToDelete.add(team.getId());
+        if (!tryAddRepositoryToTeam(team, repository, repositoryRole)) {
+            if (patClient == null) {
+                throw new IOException(
+                    "Failed to add repository to team via installation token and no PAT fallback available."
+                );
+            }
+            var patTeam = patClient.getOrganization(organization.getLogin()).getTeam(team.getId());
+            var patRepository = patClient.getRepository(repository.getFullName());
+            if (!tryAddRepositoryToTeam(patTeam, patRepository, repositoryRole)) {
+                throw new IOException("Failed to add repository to team using PAT fallback.");
+            }
+        }
+        return new CreatedTeam(team.getId(), teamName, maintainer.getLogin());
+    }
+
+    protected CreatedIssue createIssueWithComment(GHRepository repository) throws IOException, InterruptedException {
+        String issueTitle = "IT issue " + nextEphemeralSlug("issue");
+        String issueBody = "Live integration issue created at " + Instant.now();
+        var issue = repository.createIssue(issueTitle).body(issueBody).create();
+        String commentBody = "Issue comment seed " + Instant.now();
+        var comment = issue.comment(commentBody);
+        awaitCondition(
+            "issue comment availability",
+            () -> repository.getIssue(issue.getNumber()).getCommentsCount() >= 1
+        );
+        return new CreatedIssue(issue.getId(), issue.getNumber(), issueTitle, issueBody, comment.getId(), commentBody);
+    }
+
+    protected PullRequestArtifacts createPullRequestWithReview(GHRepository repository) throws Exception {
+        String branchSuffix = nextEphemeralSlug("branch");
+        String branchName = "feature-" + branchSuffix;
+        String defaultBranch = repository.getDefaultBranch();
+        var defaultRef = repository.getRef("heads/" + defaultBranch);
+        repository.createRef("refs/heads/" + branchName, defaultRef.getObject().getSha());
+
+        String filePath = "integration/test-" + branchSuffix + ".txt";
+        String fileContent = "Integration content generated at " + Instant.now();
+        repository
+            .createContent()
+            .path(filePath)
+            .message("Add " + filePath)
+            .content(fileContent)
+            .branch(branchName)
+            .commit();
+
+        String prTitle = "IT pull request " + nextEphemeralSlug("pr");
+        var pullRequest = repository.createPullRequest(prTitle, branchName, defaultBranch, "Integration test PR");
+        pullRequest.refresh();
+
+        awaitCondition("pull request head commit", () -> pullRequest.getHead() != null);
+        String headCommitSha = pullRequest.getHead().getSha();
+
+        String reviewDraftBody = "Initial review message " + Instant.now();
+        String reviewCommentBody = "Review inline note " + Instant.now();
+
+        GHPullRequestReview commentReview = pullRequest
+            .createReview()
+            .body(reviewDraftBody)
+            .comment(reviewCommentBody, filePath, 1)
+            .commitId(headCommitSha)
+            .event(GHPullRequestReviewEvent.COMMENT)
+            .create();
+        awaitCondition("review comment present", () -> !pullRequest.listReviewComments().toList().isEmpty());
+        List<GHPullRequestReviewComment> reviewComments = pullRequest.listReviewComments().toList();
+        GHPullRequestReviewComment reviewComment = reviewComments.get(0);
+        awaitCondition("pull request review present", () ->
+            pullRequest.listReviews().toList().stream().anyMatch(r -> r.getId() == commentReview.getId())
+        );
+
+        return new PullRequestArtifacts(
+            pullRequest.getId(),
+            pullRequest.getNumber(),
+            prTitle,
+            commentReview.getId(),
+            reviewDraftBody,
+            reviewComment.getId(),
+            reviewCommentBody,
+            filePath,
+            reviewComment.getLine(),
+            headCommitSha
+        );
+    }
+
+    protected void awaitCondition(String description, CheckedCondition condition) throws InterruptedException {
+        Instant deadline = Instant.now().plus(Duration.ofSeconds(45));
+        while (Instant.now().isBefore(deadline)) {
+            try {
+                if (condition.evaluate()) {
+                    return;
+                }
+            } catch (Exception ex) {
+                logger.debug("Condition '{}' not yet satisfied: {}", description, ex.getMessage());
+            }
+            Thread.sleep(1000);
+        }
+        throw new IllegalStateException("Timed out waiting for " + description);
+    }
+
+    private void deleteRepositoryQuietly(String fullName) {
+        try {
+            installationClient.getRepository(fullName).delete();
+            return;
+        } catch (IOException installationDeletionError) {
+            logger.warn("Failed to delete repo {} via installation token", fullName, installationDeletionError);
+        }
+
+        if (patClient != null) {
+            try {
+                patClient.getRepository(fullName).delete();
+            } catch (IOException patDeletionError) {
+                logger.warn("Failed to delete repo {} via PAT", fullName, patDeletionError);
+            }
+        }
+    }
+
+    private void deleteTeamQuietly(Long teamId) {
+        if (teamId == null) {
+            return;
+        }
+        try {
+            fetchOrganization().getTeam(teamId).delete();
+            return;
+        } catch (IOException deletionError) {
+            logger.warn("Failed to delete team {} via installation token", teamId, deletionError);
+        }
+
+        if (patClient != null) {
+            try {
+                patClient.getOrganization(githubOrganization()).getTeam(teamId).delete();
+            } catch (IOException patDeletionError) {
+                logger.warn("Failed to delete team {} via PAT", teamId, patDeletionError);
+            }
+        }
+    }
+
+    protected void addRepositoryCollaborator(GHRepository repository, GHUser collaborator) throws IOException {
+        if (tryAddCollaborator(repository, collaborator)) {
+            return;
+        }
+        if (patClient == null) {
+            throw new IOException("Failed to add collaborator via installation token and no PAT available.");
+        }
+        var patRepository = patClient.getRepository(repository.getFullName());
+        var patCollaborator = patClient.getUser(collaborator.getLogin());
+        if (!tryAddCollaborator(patRepository, patCollaborator)) {
+            throw new IOException("Failed to add collaborator using PAT fallback.");
+        }
+    }
+
+    protected void removeRepositoryCollaborator(GHRepository repository, GHUser collaborator) throws IOException {
+        if (tryRemoveCollaborator(repository, collaborator)) {
+            return;
+        }
+        if (patClient == null) {
+            throw new IOException("Failed to remove collaborator via installation token and no PAT available.");
+        }
+        var patRepository = patClient.getRepository(repository.getFullName());
+        var patCollaborator = patClient.getUser(collaborator.getLogin());
+        if (!tryRemoveCollaborator(patRepository, patCollaborator)) {
+            throw new IOException("Failed to remove collaborator using PAT fallback.");
+        }
+    }
+
+    private boolean tryAddRepositoryToTeam(GHTeam team, GHRepository repository, RepositoryRole role) {
+        try {
+            team.add(repository, role);
+            return true;
+        } catch (IOException linkingError) {
+            logger.warn(
+                "Failed to link repository {} to team {}",
+                repository.getFullName(),
+                team.getId(),
+                linkingError
+            );
+            return false;
+        }
+    }
+
+    private boolean tryAddCollaborator(GHRepository repository, GHUser collaborator) {
+        try {
+            repository.addCollaborators(collaborator);
+            return true;
+        } catch (IOException additionError) {
+            logger.warn(
+                "Failed to add collaborator {} to repository {}",
+                collaborator.getLogin(),
+                repository.getFullName(),
+                additionError
+            );
+            return false;
+        }
+    }
+
+    private boolean tryRemoveCollaborator(GHRepository repository, GHUser collaborator) {
+        try {
+            repository.removeCollaborators(collaborator);
+            return true;
+        } catch (IOException removalError) {
+            logger.warn(
+                "Failed to remove collaborator {} from repository {}",
+                collaborator.getLogin(),
+                repository.getFullName(),
+                removalError
+            );
+            return false;
+        }
+    }
+
+    protected record CreatedIssue(
+        long issueId,
+        int issueNumber,
+        String issueTitle,
+        String issueBody,
+        long commentId,
+        String commentBody
+    ) {}
+
+    protected record CreatedTeam(long id, String name, String maintainerLogin) {}
+
+    protected record PullRequestArtifacts(
+        long pullRequestId,
+        int pullRequestNumber,
+        String pullRequestTitle,
+        long reviewId,
+        String reviewBody,
+        long reviewCommentId,
+        String reviewCommentBody,
+        String reviewCommentPath,
+        int reviewCommentLine,
+        String commitSha
+    ) {}
+
+    @FunctionalInterface
+    protected interface CheckedCondition {
+        boolean evaluate() throws Exception;
+    }
+}
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/BaseGitHubIntegrationTest.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/BaseGitHubIntegrationTest.java
new file mode 100644
index 000000000..dbd0f8b9b
--- /dev/null
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/BaseGitHubIntegrationTest.java
@@ -0,0 +1,97 @@
+package de.tum.in.www1.hephaestus.gitprovider.github;
+
+import de.tum.in.www1.hephaestus.testconfig.BaseIntegrationTest;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.TestInstance;
+import org.junit.jupiter.api.parallel.Execution;
+import org.junit.jupiter.api.parallel.ExecutionMode;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.env.Environment;
+import org.springframework.test.context.ActiveProfiles;
+
+/**
+ * Base class for GitHub integration tests. Runs with the {@code github-integration}
+ * profile. Each test automatically checks that real credentials have been provided
+ * and gets skipped otherwise, which keeps the CI pipeline green while enabling
+ * developers to run the suite locally.
+ */
+@TestInstance(TestInstance.Lifecycle.PER_CLASS)
+@ActiveProfiles(value = "github-integration", inheritProfiles = true)
+@Execution(ExecutionMode.SAME_THREAD)
+@Tag("github-integration")
+public abstract class BaseGitHubIntegrationTest extends BaseIntegrationTest {
+
+    private static final DateTimeFormatter SUFFIX_FORMATTER = DateTimeFormatter.ofPattern(
+        "yyyyMMdd-HHmmss-SSS"
+    ).withZone(ZoneOffset.UTC);
+
+    @Autowired
+    private Environment environment;
+
+    @Autowired
+    private org.springframework.core.io.ResourceLoader resourceLoader;
+
+    @BeforeEach
+    void requireGitHubCredentials() {
+        assumeGitHubCredentialsConfigured();
+    }
+
+    protected void assumeGitHubCredentialsConfigured() {
+        long appId = environment.getProperty("github.app.id", Long.class, 0L);
+        var privateKey = environment.getProperty("github.app.privateKey", "");
+        var privateKeyLocation = environment.getProperty("github.app.privateKeyLocation", "");
+        var authToken = environment.getProperty("github.meta.auth-token", "");
+        var installationId = environment.getProperty("integration-tests.github.installation-id", "");
+        boolean missingKeyMaterial = privateKey.isBlank();
+        if (missingKeyMaterial && !privateKeyLocation.isBlank()) {
+            var resource = resourceLoader.getResource(privateKeyLocation);
+            try (var input = resource.exists() ? resource.getInputStream() : null) {
+                missingKeyMaterial = input == null || input.read() == -1;
+            } catch (Exception ignored) {
+                missingKeyMaterial = true;
+            }
+        }
+        boolean missingToken = authToken.isBlank();
+        boolean missingInstallation = installationId.isBlank();
+        boolean missingAppId = appId <= 0;
+
+        Assumptions.assumeFalse(
+            missingAppId || missingKeyMaterial || missingToken || missingInstallation,
+            () ->
+                "GitHub integration credentials missing. Copy the example file to " +
+                "application-github-integration-local.yml (kept out of VCS) or provide " +
+                "environment overrides."
+        );
+    }
+
+    protected String githubOrganization() {
+        return environment.getProperty("integration-tests.github.organization", "");
+    }
+
+    protected long githubInstallationId() {
+        var raw = environment.getProperty("integration-tests.github.installation-id", "");
+        if (raw == null || raw.isBlank()) {
+            throw new IllegalStateException("GitHub installation id not configured for integration tests.");
+        }
+        try {
+            return Long.parseLong(raw);
+        } catch (NumberFormatException ex) {
+            throw new IllegalStateException("GitHub installation id is not a valid number: '" + raw + "'", ex);
+        }
+    }
+
+    protected String sandboxRepository() {
+        return environment.getProperty("integration-tests.github.sandbox-repository", "");
+    }
+
+    protected String nextEphemeralSlug(String suffix) {
+        var prefix = environment.getProperty("integration-tests.ephemeral-prefix", "hephaestus-it");
+        var timestamp = SUFFIX_FORMATTER.format(Instant.now());
+        return (prefix + "-" + timestamp + (suffix == null || suffix.isBlank() ? "" : "-" + suffix)).toLowerCase();
+    }
+}
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubLabelSyncIntegrationTest.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubLabelSyncIntegrationTest.java
new file mode 100644
index 000000000..d7ee4b367
--- /dev/null
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubLabelSyncIntegrationTest.java
@@ -0,0 +1,102 @@
+package de.tum.in.www1.hephaestus.gitprovider.github;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import de.tum.in.www1.hephaestus.gitprovider.label.LabelRepository;
+import de.tum.in.www1.hephaestus.gitprovider.label.github.GitHubLabelSyncService;
+import de.tum.in.www1.hephaestus.gitprovider.repository.github.GitHubRepositorySyncService;
+import java.io.IOException;
+import org.junit.jupiter.api.Test;
+import org.kohsuke.github.GHLabel;
+import org.kohsuke.github.GHRepository;
+import org.springframework.beans.factory.annotation.Autowired;
+
+class GitHubLabelSyncIntegrationTest extends AbstractGitHubSyncIntegrationTest {
+
+    private static final String LABEL_PREFIX = "it-label";
+    private static final String INITIAL_COLOR = "00ffaa";
+    private static final String UPDATED_COLOR = "ff0077";
+    private static final String LABEL_DESCRIPTION = "Focused label sync coverage";
+
+    @Autowired
+    private GitHubRepositorySyncService repositorySyncService;
+
+    @Autowired
+    private GitHubLabelSyncService labelSyncService;
+
+    @Autowired
+    private LabelRepository labelRepository;
+
+    @Test
+    void syncsNewLabels() throws Exception {
+        var seeded = seedRepositoryWithLabel("label-sync");
+        var repository = seeded.repository();
+        var createdLabel = seeded.label();
+
+        repositorySyncService.syncRepository(workspace.getId(), repository.getFullName()).orElseThrow();
+        labelSyncService.syncLabelsOfRepository(repository);
+
+        var storedLabel = labelRepository
+            .findByRepositoryIdAndName(repository.getId(), createdLabel.getName())
+            .orElseThrow();
+        assertThat(storedLabel.getColor()).isEqualTo(INITIAL_COLOR);
+        assertThat(storedLabel.getDescription()).isEqualTo(LABEL_DESCRIPTION);
+    }
+
+    @Test
+    void syncsLabelUpdates() throws Exception {
+        var seeded = seedRepositoryWithLabel("label-update-sync");
+        var repository = seeded.repository();
+        var createdLabel = seeded.label();
+
+        repositorySyncService.syncRepository(workspace.getId(), repository.getFullName()).orElseThrow();
+        labelSyncService.syncLabelsOfRepository(repository);
+
+        createdLabel.update().color(UPDATED_COLOR).description("Updated label sync coverage").done();
+        labelSyncService.syncLabelsOfRepository(repository);
+
+        var updatedLabel = labelRepository
+            .findByRepositoryIdAndName(repository.getId(), createdLabel.getName())
+            .orElseThrow();
+        assertThat(updatedLabel.getColor()).isEqualTo(UPDATED_COLOR);
+        assertThat(updatedLabel.getDescription()).isEqualTo("Updated label sync coverage");
+    }
+
+    @Test
+    void removesDeletedLabels() throws Exception {
+        var seeded = seedRepositoryWithLabel("label-delete-sync");
+        var repository = seeded.repository();
+        var createdLabel = seeded.label();
+
+        repositorySyncService.syncRepository(workspace.getId(), repository.getFullName()).orElseThrow();
+        labelSyncService.syncLabelsOfRepository(repository);
+
+        createdLabel.delete();
+        awaitCondition("label removed remotely", () -> isLabelMissingRemotely(repository, createdLabel));
+
+        labelSyncService.syncLabelsOfRepository(repository);
+
+        assertThat(labelRepository.findByRepositoryIdAndName(repository.getId(), createdLabel.getName())).isEmpty();
+    }
+
+    private RepositoryLabel seedRepositoryWithLabel(String suffix) throws Exception {
+        var repository = createEphemeralRepository(suffix);
+        var label = createRepositoryLabel(repository, LABEL_PREFIX, INITIAL_COLOR, LABEL_DESCRIPTION);
+        return new RepositoryLabel(repository, label);
+    }
+
+    private boolean isLabelMissingRemotely(GHRepository repository, GHLabel label) {
+        try {
+            return repository
+                .listLabels()
+                .withPageSize(30)
+                .toList()
+                .stream()
+                .noneMatch(remote -> remote.getId() == label.getId());
+        } catch (IOException listingError) {
+            return false;
+        }
+    }
+
+    private record RepositoryLabel(GHRepository repository, GHLabel label) {}
+}
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubMilestoneSyncIntegrationTest.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubMilestoneSyncIntegrationTest.java
new file mode 100644
index 000000000..76deb91ec
--- /dev/null
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubMilestoneSyncIntegrationTest.java
@@ -0,0 +1,73 @@
+package de.tum.in.www1.hephaestus.gitprovider.github;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import de.tum.in.www1.hephaestus.gitprovider.milestone.Milestone;
+import de.tum.in.www1.hephaestus.gitprovider.milestone.MilestoneRepository;
+import de.tum.in.www1.hephaestus.gitprovider.milestone.github.GitHubMilestoneSyncService;
+import de.tum.in.www1.hephaestus.gitprovider.repository.github.GitHubRepositorySyncService;
+import java.io.IOException;
+import org.junit.jupiter.api.Test;
+import org.kohsuke.github.GHIssueState;
+import org.springframework.beans.factory.annotation.Autowired;
+
+class GitHubMilestoneSyncIntegrationTest extends AbstractGitHubSyncIntegrationTest {
+
+    @Autowired
+    private GitHubRepositorySyncService repositorySyncService;
+
+    @Autowired
+    private GitHubMilestoneSyncService milestoneSyncService;
+
+    @Autowired
+    private MilestoneRepository milestoneRepository;
+
+    @Test
+    void syncsMilestonesAndReflectsUpdates() throws Exception {
+        var repository = createEphemeralRepository("milestone-sync");
+        var milestone = createRepositoryMilestone(repository, "IT milestone", "Focused milestone sync coverage");
+
+        repositorySyncService.syncRepository(workspace.getId(), repository.getFullName()).orElseThrow();
+
+        milestoneSyncService.syncMilestonesOfRepository(repository);
+
+        var storedMilestone = milestoneRepository
+            .findAll()
+            .stream()
+            .filter(candidate -> candidate.getRepository().getId().equals(repository.getId()))
+            .findFirst()
+            .orElseThrow();
+        assertThat(storedMilestone.getTitle()).isEqualTo(milestone.getTitle());
+        assertThat(storedMilestone.getState()).isEqualTo(Milestone.State.OPEN);
+
+        milestone.close();
+
+        milestoneSyncService.syncMilestonesOfRepository(repository);
+
+        var updatedMilestone = milestoneRepository
+            .findAll()
+            .stream()
+            .filter(candidate -> candidate.getRepository().getId().equals(repository.getId()))
+            .findFirst()
+            .orElseThrow();
+        assertThat(updatedMilestone.getState()).isEqualTo(Milestone.State.CLOSED);
+
+        milestone.delete();
+        awaitCondition("milestone removed remotely", () -> {
+            try {
+                return repository
+                    .listMilestones(GHIssueState.ALL)
+                    .withPageSize(30)
+                    .toList()
+                    .stream()
+                    .noneMatch(candidate -> candidate.getId() == milestone.getId());
+            } catch (IOException listingError) {
+                return false;
+            }
+        });
+
+        milestoneSyncService.syncMilestonesOfRepository(repository);
+
+        assertThat(milestoneRepository.findAllByRepository_Id(repository.getId())).isEmpty();
+    }
+}
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubRepositorySyncIntegrationTest.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubRepositorySyncIntegrationTest.java
new file mode 100644
index 000000000..705699b1c
--- /dev/null
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubRepositorySyncIntegrationTest.java
@@ -0,0 +1,231 @@
+package de.tum.in.www1.hephaestus.gitprovider.github;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import de.tum.in.www1.hephaestus.gitprovider.issue.IssueRepository;
+import de.tum.in.www1.hephaestus.gitprovider.issuecomment.IssueCommentRepository;
+import de.tum.in.www1.hephaestus.gitprovider.label.LabelRepository;
+import de.tum.in.www1.hephaestus.gitprovider.milestone.Milestone;
+import de.tum.in.www1.hephaestus.gitprovider.milestone.MilestoneRepository;
+import de.tum.in.www1.hephaestus.gitprovider.pullrequest.PullRequestRepository;
+import de.tum.in.www1.hephaestus.gitprovider.pullrequestreview.PullRequestReview;
+import de.tum.in.www1.hephaestus.gitprovider.pullrequestreview.PullRequestReviewRepository;
+import de.tum.in.www1.hephaestus.gitprovider.pullrequestreviewcomment.PullRequestReviewCommentRepository;
+import de.tum.in.www1.hephaestus.gitprovider.repository.RepositoryRepository;
+import de.tum.in.www1.hephaestus.gitprovider.repository.collaborator.RepositoryCollaboratorRepository;
+import de.tum.in.www1.hephaestus.gitprovider.sync.GitHubDataSyncService;
+import de.tum.in.www1.hephaestus.gitprovider.team.permission.TeamRepositoryPermissionRepository;
+import de.tum.in.www1.hephaestus.gitprovider.user.UserRepository;
+import java.io.IOException;
+import java.util.Set;
+import java.util.stream.Collectors;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+
+class GitHubRepositorySyncIntegrationTest extends AbstractGitHubSyncIntegrationTest {
+
+    @Autowired
+    private GitHubDataSyncService dataSyncService;
+
+    @Autowired
+    private RepositoryRepository repositoryRepository;
+
+    @Autowired
+    private IssueRepository issueRepository;
+
+    @Autowired
+    private IssueCommentRepository issueCommentRepository;
+
+    @Autowired
+    private PullRequestRepository pullRequestRepository;
+
+    @Autowired
+    private PullRequestReviewRepository pullRequestReviewRepository;
+
+    @Autowired
+    private PullRequestReviewCommentRepository pullRequestReviewCommentRepository;
+
+    @Autowired
+    private LabelRepository labelRepository;
+
+    @Autowired
+    private MilestoneRepository milestoneRepository;
+
+    @Autowired
+    private RepositoryCollaboratorRepository repositoryCollaboratorRepository;
+
+    @Autowired
+    private UserRepository userRepository;
+
+    @Autowired
+    private TeamRepositoryPermissionRepository teamRepositoryPermissionRepository;
+
+    private CreatedTeam createdTeam;
+    private String integrationLabelName;
+    private String integrationMilestoneTitle;
+    private long collaboratorUserId;
+
+    @AfterEach
+    void resetLocalState() {
+        createdTeam = null;
+        integrationLabelName = null;
+        integrationMilestoneTitle = null;
+        collaboratorUserId = 0L;
+    }
+
+    @Test
+    void syncsRepositoryIssuesPullRequestsAndReviewsEndToEnd() throws Exception {
+        var ghRepository = createEphemeralRepository("sync");
+        var label = createRepositoryLabel(ghRepository, "it-label", "0077ff", "Integration label coverage");
+        integrationLabelName = label.getName();
+        var milestone = createRepositoryMilestone(ghRepository, "IT milestone", "Integration milestone coverage");
+        integrationMilestoneTitle = milestone.getTitle();
+
+        var seededMembers = seedOrganizationMembers();
+        Assumptions.assumeFalse(
+            seededMembers.isEmpty(),
+            "Organization must have at least one member to validate sync."
+        );
+
+        var collaborator = seededMembers.getFirst();
+        collaboratorUserId = collaborator.getId();
+        addRepositoryCollaborator(ghRepository, collaborator);
+        awaitCondition("collaborator added remotely", () -> {
+            try {
+                return ghRepository
+                    .listCollaborators()
+                    .withPageSize(100)
+                    .toList()
+                    .stream()
+                    .anyMatch(remote -> remote.getId() == collaborator.getId());
+            } catch (IOException listingError) {
+                return false;
+            }
+        });
+        createdTeam = createEphemeralTeam(ghRepository, fetchOrganization(), collaborator);
+
+        var createdIssue = createIssueWithComment(ghRepository);
+        var pullRequestArtifacts = createPullRequestWithReview(ghRepository);
+
+        var repositoryToMonitor = registerRepositoryToMonitor(ghRepository);
+        dataSyncService.syncRepositoryToMonitor(repositoryToMonitor);
+        dataSyncService.syncUsers(workspace);
+        dataSyncService.syncTeams(workspace);
+
+        var refreshedMonitor = repositoryToMonitorRepository.findById(repositoryToMonitor.getId()).orElseThrow();
+        assertThat(refreshedMonitor.getRepositorySyncedAt()).as("repository sync timestamp").isNotNull();
+        assertThat(refreshedMonitor.getLabelsSyncedAt()).as("label sync timestamp").isNotNull();
+        assertThat(refreshedMonitor.getMilestonesSyncedAt()).as("milestone sync timestamp").isNotNull();
+        assertThat(refreshedMonitor.getIssuesAndPullRequestsSyncedAt()).as("issue sync timestamp").isNotNull();
+
+        var storedRepository = repositoryRepository.findById(ghRepository.getId()).orElseThrow();
+        assertThat(storedRepository.getNameWithOwner()).isEqualTo(ghRepository.getFullName());
+
+        var storedIssue = issueRepository.findById(createdIssue.issueId()).orElseThrow();
+        assertThat(storedIssue.getNumber()).isEqualTo(createdIssue.issueNumber());
+        assertThat(storedIssue.getTitle()).isEqualTo(createdIssue.issueTitle());
+        assertThat(storedIssue.getBody()).isEqualTo(createdIssue.issueBody());
+        assertThat(issueCommentRepository.findById(createdIssue.commentId())).isPresent();
+        var storedIssueComment = issueCommentRepository.findById(createdIssue.commentId()).orElseThrow();
+        assertThat(storedIssueComment.getBody()).isEqualTo(createdIssue.commentBody());
+        assertThat(storedIssueComment.getIssue().getId()).isEqualTo(createdIssue.issueId());
+
+        var storedPullRequest = pullRequestRepository.findById(pullRequestArtifacts.pullRequestId()).orElseThrow();
+        assertThat(storedPullRequest.getNumber()).isEqualTo(pullRequestArtifacts.pullRequestNumber());
+        assertThat(storedPullRequest.getTitle()).isEqualTo(pullRequestArtifacts.pullRequestTitle());
+
+        var storedReview = pullRequestReviewRepository.findById(pullRequestArtifacts.reviewId()).orElseThrow();
+        assertThat(storedReview.getState()).isEqualTo(PullRequestReview.State.COMMENTED);
+        assertThat(storedReview.getBody()).isEqualTo(pullRequestArtifacts.reviewBody());
+
+        var storedReviewComment = pullRequestReviewCommentRepository
+            .findById(pullRequestArtifacts.reviewCommentId())
+            .orElseThrow();
+        assertThat(storedReviewComment.getBody()).isEqualTo(pullRequestArtifacts.reviewCommentBody());
+        assertThat(storedReviewComment.getReview()).isNotNull();
+        assertThat(storedReviewComment.getPath()).isEqualTo(pullRequestArtifacts.reviewCommentPath());
+        assertThat(storedReviewComment.getLine()).isEqualTo(pullRequestArtifacts.reviewCommentLine());
+        assertThat(storedReviewComment.getCommitId()).isEqualTo(pullRequestArtifacts.commitSha());
+
+        var storedLabel = labelRepository
+            .findByRepositoryIdAndName(ghRepository.getId(), integrationLabelName)
+            .orElseThrow();
+        assertThat(storedLabel.getColor()).isEqualTo("0077ff");
+        assertThat(storedLabel.getDescription()).isEqualTo("Integration label coverage");
+
+        var storedMilestone = milestoneRepository
+            .findAll()
+            .stream()
+            .filter(candidate -> candidate.getRepository().getId().equals(ghRepository.getId()))
+            .findFirst()
+            .orElseThrow();
+        assertThat(storedMilestone.getTitle()).isEqualTo(integrationMilestoneTitle);
+        assertThat(storedMilestone.getState()).isEqualTo(Milestone.State.OPEN);
+
+        var storedCollaborator = repositoryCollaboratorRepository
+            .findByRepositoryIdAndUserId(ghRepository.getId(), collaboratorUserId)
+            .orElseThrow();
+        assertThat(storedCollaborator.getPermission()).isEqualTo(
+            de.tum.in.www1.hephaestus.gitprovider.repository.collaborator.RepositoryCollaborator.Permission.ADMIN
+        );
+        var collaboratorEntries = repositoryCollaboratorRepository.findByRepository_Id(ghRepository.getId());
+        var collaboratorUserIdsBeforeSync = collaboratorEntries
+            .stream()
+            .map(entry -> entry.getId().getUserId())
+            .collect(Collectors.toSet());
+        assertThat(collaboratorUserIdsBeforeSync).contains(collaboratorUserId);
+        var collaboratorUser = userRepository.findById(collaboratorUserId).orElseThrow();
+        assertThat(collaboratorUser.getLogin().toLowerCase()).isIn(
+            seededMembers.stream().map(member -> member.getLogin().toLowerCase()).toList()
+        );
+
+        workspace = workspaceRepository.findById(workspace.getId()).orElseThrow();
+        assertThat(workspace.getUsersSyncedAt()).isNotNull();
+        var seededLoginsLowercase = seededMembers
+            .stream()
+            .map(member -> member.getLogin().toLowerCase())
+            .collect(Collectors.toSet());
+        var syncedLogins = userRepository
+            .findAllByLoginLowerIn(seededLoginsLowercase)
+            .stream()
+            .map(user -> user.getLogin().toLowerCase())
+            .toList();
+        assertThat(syncedLogins).containsAll(seededLoginsLowercase);
+        assertThat(collaboratorUserId).isNotZero();
+        assertThat(syncedLogins).contains(collaboratorUser.getLogin().toLowerCase());
+
+        Set<Long> collaboratorIdsBeforeSecondSync = collaboratorUserIdsBeforeSync;
+        dataSyncService.syncRepositoryToMonitor(repositoryToMonitor);
+        Set<Long> collaboratorIdsAfterSecondSync = repositoryCollaboratorRepository
+            .findByRepository_Id(ghRepository.getId())
+            .stream()
+            .map(entry -> entry.getId().getUserId())
+            .collect(Collectors.toSet());
+        assertThat(collaboratorIdsAfterSecondSync)
+            .as("collaborator ids after idempotent run")
+            .isEqualTo(collaboratorIdsBeforeSecondSync);
+
+        var teamMembers = userRepository
+            .findAllByTeamId(createdTeam.id())
+            .stream()
+            .map(user -> user.getLogin().toLowerCase())
+            .toList();
+        assertThat(teamMembers).contains(createdTeam.maintainerLogin().toLowerCase());
+        assertThat(
+            teamRepositoryPermissionRepository.findByTeam_IdAndRepository_Id(createdTeam.id(), ghRepository.getId())
+        )
+            .isPresent()
+            .get()
+            .satisfies(permission -> {
+                assertThat(permission.getPermission())
+                    .as("team repository permission level")
+                    .isIn(
+                        de.tum.in.www1.hephaestus.gitprovider.team.permission.TeamRepositoryPermission.PermissionLevel.MAINTAIN,
+                        de.tum.in.www1.hephaestus.gitprovider.team.permission.TeamRepositoryPermission.PermissionLevel.WRITE
+                    );
+                assertThat(permission.isHiddenFromContributions()).isFalse();
+            });
+    }
+}
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubTeamSyncIntegrationTest.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubTeamSyncIntegrationTest.java
new file mode 100644
index 000000000..79e76c97a
--- /dev/null
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/github/GitHubTeamSyncIntegrationTest.java
@@ -0,0 +1,75 @@
+package de.tum.in.www1.hephaestus.gitprovider.github;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import de.tum.in.www1.hephaestus.gitprovider.repository.github.GitHubRepositorySyncService;
+import de.tum.in.www1.hephaestus.gitprovider.team.github.GitHubTeamSyncService;
+import de.tum.in.www1.hephaestus.gitprovider.team.permission.TeamRepositoryPermissionRepository;
+import java.io.IOException;
+import java.util.stream.Collectors;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+
+class GitHubTeamSyncIntegrationTest extends AbstractGitHubSyncIntegrationTest {
+
+    @Autowired
+    private GitHubRepositorySyncService repositorySyncService;
+
+    @Autowired
+    private GitHubTeamSyncService teamSyncService;
+
+    @Autowired
+    private TeamRepositoryPermissionRepository teamRepositoryPermissionRepository;
+
+    @Test
+    void syncsTeamsAndRepositoryPermissions() throws Exception {
+        var repository = createEphemeralRepository("team-sync");
+        var organization = fetchOrganization();
+        var members = seedOrganizationMembers();
+        Assumptions.assumeFalse(members.isEmpty(), "Organization must have members to validate team sync.");
+        var maintainer = members.getFirst();
+        addRepositoryCollaborator(repository, maintainer);
+        var createdTeam = createEphemeralTeam(repository, organization, maintainer);
+
+        repositorySyncService.syncRepository(workspace.getId(), repository.getFullName()).orElseThrow();
+
+        teamSyncService.syncAndSaveTeams(installationClient, organization.getLogin());
+
+        var permission = teamRepositoryPermissionRepository
+            .findByTeam_IdAndRepository_Id(createdTeam.id(), repository.getId())
+            .orElseThrow();
+        assertThat(permission.getPermission()).isIn(
+            de.tum.in.www1.hephaestus.gitprovider.team.permission.TeamRepositoryPermission.PermissionLevel.MAINTAIN,
+            de.tum.in.www1.hephaestus.gitprovider.team.permission.TeamRepositoryPermission.PermissionLevel.WRITE
+        );
+
+        teamSyncService.syncAndSaveTeams(installationClient, organization.getLogin());
+
+        var permissionsAfterSecondSync = teamRepositoryPermissionRepository
+            .findByTeam_IdAndRepository_Id(createdTeam.id(), repository.getId())
+            .stream()
+            .collect(Collectors.toSet());
+        assertThat(permissionsAfterSecondSync).hasSize(1);
+
+        organization.getTeam(createdTeam.id()).remove(repository);
+        awaitCondition("team repository permission removed remotely", () -> {
+            try {
+                return organization
+                    .getTeam(createdTeam.id())
+                    .listRepositories()
+                    .toList()
+                    .stream()
+                    .noneMatch(remoteRepo -> remoteRepo.getId() == repository.getId());
+            } catch (IOException listingError) {
+                return false;
+            }
+        });
+
+        teamSyncService.syncAndSaveTeams(installationClient, organization.getLogin());
+
+        assertThat(
+            teamRepositoryPermissionRepository.findByTeam_IdAndRepository_Id(createdTeam.id(), repository.getId())
+        ).isEmpty();
+    }
+}
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentMessageHandlerIntegrationTest.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentMessageHandlerIntegrationTest.java
index cbb47f58c..0ffd844e6 100644
--- a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentMessageHandlerIntegrationTest.java
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/gitprovider/pullrequestreviewcomment/github/GitHubPullRequestReviewCommentMessageHandlerIntegrationTest.java
@@ -59,7 +59,11 @@ void createdEventPersistsCommentAndThread(
         @GitHubPayload("pull_request_review.submitted") GHEventPayload.PullRequestReview reviewPayload
     ) throws Exception {
         // Arrange
-        reviewSyncService.processPullRequestReview(reviewPayload.getReview());
+        reviewSyncService.processPullRequestReview(
+            reviewPayload.getReview(),
+            reviewPayload.getPullRequest(),
+            reviewPayload.getSender()
+        );
         assertThat(commentRepository.findById(commentPayload.getComment().getId())).isEmpty();
 
         // Act
@@ -99,7 +103,11 @@ void createdEventIsIdempotent(
         @GitHubPayload("pull_request_review.submitted") GHEventPayload.PullRequestReview reviewPayload
     ) throws Exception {
         // Arrange
-        reviewSyncService.processPullRequestReview(reviewPayload.getReview());
+        reviewSyncService.processPullRequestReview(
+            reviewPayload.getReview(),
+            reviewPayload.getPullRequest(),
+            reviewPayload.getSender()
+        );
         handler.handleEvent(commentPayload);
         var existing = commentRepository.findById(commentPayload.getComment().getId()).orElseThrow();
         var originalUpdatedAt = existing.getUpdatedAt();
@@ -124,7 +132,11 @@ void editedEventUpdatesComment(
         @GitHubPayload("pull_request_review.submitted") GHEventPayload.PullRequestReview reviewPayload
     ) throws Exception {
         // Arrange
-        reviewSyncService.processPullRequestReview(reviewPayload.getReview());
+        reviewSyncService.processPullRequestReview(
+            reviewPayload.getReview(),
+            reviewPayload.getPullRequest(),
+            reviewPayload.getSender()
+        );
         handler.handleEvent(createdPayload);
         var original = commentRepository.findById(createdPayload.getComment().getId()).orElseThrow();
         assertThat(original.getBody()).isEqualTo(createdPayload.getComment().getBody());
@@ -146,7 +158,11 @@ void deletedEventRemovesCommentAndThread(
         @GitHubPayload("pull_request_review.submitted") GHEventPayload.PullRequestReview reviewPayload
     ) throws Exception {
         // Arrange
-        reviewSyncService.processPullRequestReview(reviewPayload.getReview());
+        reviewSyncService.processPullRequestReview(
+            reviewPayload.getReview(),
+            reviewPayload.getPullRequest(),
+            reviewPayload.getSender()
+        );
         handler.handleEvent(createdPayload);
         assertThat(commentRepository.findById(createdPayload.getComment().getId())).isPresent();
         assertThat(threadRepository.findById(createdPayload.getComment().getId())).isPresent();
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/BaseIntegrationTest.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/BaseIntegrationTest.java
index 2d4b50875..5d568e282 100644
--- a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/BaseIntegrationTest.java
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/BaseIntegrationTest.java
@@ -15,7 +15,7 @@
  */
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
 @ActiveProfiles("test")
-@Import(TestSecurityConfig.class)
+@Import({ TestSecurityConfig.class, GitHubIntegrationPostgresShutdown.class })
 @Testcontainers
 @Tag("integration")
 public abstract class BaseIntegrationTest {
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/GitHubIntegrationPostgresShutdown.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/GitHubIntegrationPostgresShutdown.java
new file mode 100644
index 000000000..f1f9a07cc
--- /dev/null
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/GitHubIntegrationPostgresShutdown.java
@@ -0,0 +1,32 @@
+package de.tum.in.www1.hephaestus.testconfig;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Component;
+import org.testcontainers.containers.PostgreSQLContainer;
+
+@Component
+@Profile("github-integration")
+public class GitHubIntegrationPostgresShutdown {
+
+    private static final Logger logger = LoggerFactory.getLogger(GitHubIntegrationPostgresShutdown.class);
+
+    @PostConstruct
+    public void logActivation() {
+        logger.info("GitHub integration Postgres shutdown hook initialized.");
+    }
+
+    @PreDestroy
+    public void stopPostgresContainer() {
+        PostgreSQLContainer<?> container = PostgreSQLTestContainer.getInstance();
+        if (container != null && container.isRunning()) {
+            logger.info("Stopping PostgreSQL testcontainer before JVM shutdown.");
+            container.stop();
+        } else {
+            logger.info("PostgreSQL testcontainer already stopped or not initialized.");
+        }
+    }
+}
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/PostgreSQLTestContainer.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/PostgreSQLTestContainer.java
index 35f0b6ec6..74a44c560 100644
--- a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/PostgreSQLTestContainer.java
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/PostgreSQLTestContainer.java
@@ -89,6 +89,13 @@ private static PostgreSQLContainer<?> startDockerContainer() {
 
         newContainer.start();
 
+        LOGGER.info(
+            "Started PostgreSQL Testcontainer via Docker: jdbcUrl={}, username={}, database={}",
+            newContainer.getJdbcUrl(),
+            newContainer.getUsername(),
+            newContainer.getDatabaseName()
+        );
+
         Runtime.getRuntime()
             .addShutdownHook(
                 new Thread(() -> {
@@ -134,6 +141,12 @@ private LocalPostgresContainer() {
         public void start() {
             try (Connection connection = DriverManager.getConnection(jdbcUrl, username, password)) {
                 connection.createStatement().execute("SELECT 1");
+                LOGGER.info(
+                    "Using locally managed PostgreSQL instance: jdbcUrl={}, username={}, database={}",
+                    jdbcUrl,
+                    username,
+                    databaseName
+                );
             } catch (SQLException exception) {
                 throw new IllegalStateException(
                     "Failed to connect to local PostgreSQL instance at " +
diff --git a/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/TestSchedulerConfiguration.java b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/TestSchedulerConfiguration.java
new file mode 100644
index 000000000..d2ac613df
--- /dev/null
+++ b/server/application-server/src/test/java/de/tum/in/www1/hephaestus/testconfig/TestSchedulerConfiguration.java
@@ -0,0 +1,25 @@
+package de.tum.in.www1.hephaestus.testconfig;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
+import org.springframework.context.annotation.Profile;
+import org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler;
+
+@Configuration
+@Profile("test")
+public class TestSchedulerConfiguration {
+
+    @Bean(name = "taskScheduler")
+    @Primary
+    public ThreadPoolTaskScheduler taskScheduler() {
+        ThreadPoolTaskScheduler scheduler = new ThreadPoolTaskScheduler();
+        scheduler.setPoolSize(2);
+        scheduler.setThreadNamePrefix("test-scheduler-");
+        scheduler.setDaemon(true);
+        scheduler.setWaitForTasksToCompleteOnShutdown(false);
+        scheduler.setRemoveOnCancelPolicy(true);
+        scheduler.setAwaitTerminationSeconds(0);
+        return scheduler;
+    }
+}
diff --git a/server/application-server/src/test/resources/application-github-integration-local.example.yml b/server/application-server/src/test/resources/application-github-integration-local.example.yml
new file mode 100644
index 000000000..b51102e19
--- /dev/null
+++ b/server/application-server/src/test/resources/application-github-integration-local.example.yml
@@ -0,0 +1,29 @@
+# Copy this file to application-github-integration-local.yml (gitignored) and
+# replace the placeholder values with your real GitHub App credentials.
+#
+# The file is intentionally kept out of version control so developers can paste
+# their personal secrets without leaking them. Any values defined here override
+# the defaults from application-github-integration.yml when the
+# `github-integration` profile is active.
+
+github:
+  app:
+    id: 2250297
+    # Path to the PEM file is optional when the key is inlined below. Leave it
+    # blank unless you prefer referencing a file on disk.
+    privateKeyLocation: ""
+    privateKey: |-
+      -----BEGIN RSA PRIVATE KEY-----
+      PASTE_YOUR_GITHUB_APP_PRIVATE_KEY_HERE
+      -----END RSA PRIVATE KEY-----
+  meta:
+    # Personal access token with permissions to administer the sandbox org/repo.
+    auth-token: github_pat_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+integration-tests:
+  github:
+    organization: HephaestusTest
+    installation-id: 93512943
+    sandbox-repository: ""
+  # Prefix used for ephemeral resources; adjust if you share a sandbox.
+  ephemeral-prefix: hephaestus-it
diff --git a/server/application-server/src/test/resources/application-github-integration.yml b/server/application-server/src/test/resources/application-github-integration.yml
new file mode 100644
index 000000000..2a85cecb7
--- /dev/null
+++ b/server/application-server/src/test/resources/application-github-integration.yml
@@ -0,0 +1,28 @@
+spring:
+  config:
+    import:
+      - optional:classpath:application-github-integration-local.yml
+    activate:
+      on-profile: github-integration
+  main:
+    banner-mode: "off"
+    web-application-type: none
+
+# GitHub App configuration for live integration tests. Secrets must be supplied via env vars or
+# a gitignored file referenced through GH_IT_APP_PRIVATE_KEY_PATH.
+# noinspection SpringBootApplicationProperties
+github:
+  app:
+    id: ${GH_IT_APP_ID:0}
+    privateKeyLocation: ${GH_IT_APP_PRIVATE_KEY_PATH:classpath:/noop-github-app.pem}
+    privateKey: ${GH_IT_APP_PRIVATE_KEY:}
+  meta:
+    auth-token: ${GH_IT_APP_PAT:}
+
+# noinspection SpringBootApplicationProperties
+integration-tests:
+  github:
+    organization: ${GH_IT_ORGANIZATION:HephaestusTest}
+    installation-id: ${GH_IT_INSTALLATION_ID:}
+    sandbox-repository: ${GH_IT_SANDBOX_REPOSITORY:}
+  ephemeral-prefix: ${GH_IT_EPHEMERAL_PREFIX:hephaestus-it}