diff --git a/.github/workflows/deploy-pr-preview.yml b/.github/workflows/deploy-pr-preview.yml
index 983b5d57e7..0e76de64fa 100644
--- a/.github/workflows/deploy-pr-preview.yml
+++ b/.github/workflows/deploy-pr-preview.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   deploy-pr-preview:
-    if: github.repository == 'grafana/alloy'
+    if: ${{ ! github.event.pull_request.head.repo.fork }}
     uses: grafana/writers-toolkit/.github/workflows/deploy-preview.yml@main
     with:
       sha: ${{ github.event.pull_request.head.sha }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b64a9106cb..3db7330b59 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@ This document contains a historical list of changes between releases. Only
 changes that impact end-user behavior are listed; changes to documentation or
 internal API changes are not present.
 
-v1.6.0-rc.0
+v1.6.0-rc.1
 -----------------
 
 ### Breaking changes
@@ -21,6 +21,8 @@ v1.6.0-rc.0
 
 ### Features
 
+- Add support for TLS to `prometheus.write.queue`. (@mattdurham)
+
 - Add `otelcol.receiver.syslog` component to receive otel logs in syslog format (@dehaansa)
 
 - Add support for metrics in `otelcol.exporter.loadbalancing` (@madaraszg-tulip)
@@ -43,12 +45,18 @@ v1.6.0-rc.0
 
 ### Enhancements
 
+- Update `prometheus.write.queue` to support v2 for cpu performance. (@mattdurham)
+
+- (_Experimental_) Add health reporting to `database_observability.mysql` component (@cristiangreco)
+
 - Add second metrics sample to the support bundle to provide delta information (@dehaansa)
 
 - Add all raw configuration files & a copy of the latest remote config to the support bundle (@dehaansa)
 
 - Add relevant golang environment variables to the support bundle (@dehaansa)
 
+- Add support for server authentication to otelcol components. (@aidaleuc)
+
 - Update mysqld_exporter from v0.15.0 to v0.16.0 (including 2ef168bf6), most notable changes: (@cristiangreco)
   - Support MySQL 8.4 replicas syntax
   - Fetch lock time and cpu time from performance schema
@@ -72,12 +80,16 @@ v1.6.0-rc.0
 
 - Update `prometheus.write.queue` library for performance increases in cpu. (@mattdurham)
 
+- Update `loki.secretfilter` to be compatible with the new `[[rules.allowlists]]` gitleaks allowlist format (@romain-gaillard)
+
 - Update `async-profiler` binaries for `pyroscope.java` to 3.0-fa937db (@aleks-p)
 
 - Reduced memory allocation in discovery components by up to 30% (@thampiotr)
 
 ### Bugfixes
 
+- Fix issue where `alloy_prometheus_relabel_metrics_processed` was not being incremented. (@mattdurham)
+
 - Fixed issue with automemlimit logging bad messages and trying to access cgroup on non-linux builds (@dehaansa)
 
 - Fixed issue with reloading configuration and prometheus metrics duplication in `prometheus.write.queue`. (@mattdurham)
@@ -88,6 +100,8 @@ v1.6.0-rc.0
 
 - Fixed an issue where the `otelcol.processor.interval` could not be used because the debug metrics were not set to default. (@wildum)
 
+- Fixed an issue where `loki.secretfilter` would crash if the secret was shorter than the `partial_mask` value. (@romain-gaillard)
+
 - Change the log level in the `eventlogmessage` stage of the `loki.process` component from `warn` to `debug`. (@wildum)
 
 - Fix a bug in `loki.source.kafka` where the `topics` argument incorrectly used regex matching instead of exact matches. (@wildum)
@@ -111,11 +125,11 @@ v1.6.0-rc.0
     https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/36071
   - `otelcol.exporter.datadog`: Stop prefixing `http_server_duration`, `http_server_request_size` and `http_server_response_size` with `otelcol`.
     https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/36265
-    These metrics can be from SDKs rather than collector. Stop prefixing them to be consistent with 
+    These metrics can be from SDKs rather than collector. Stop prefixing them to be consistent with
     https://opentelemetry.io/docs/collector/internal-telemetry/#lists-of-internal-metrics
   - `otelcol.receiver.datadog`: Add json handling for the `api/v2/series` endpoint in the datadogreceiver.
     https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/36218
-  - `otelcol.processor.span`: Add a new `keep_original_name` configuration argument 
+  - `otelcol.processor.span`: Add a new `keep_original_name` configuration argument
     to keep the original span name when extracting attributes from the span name.
     https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/36397
   - `pkg/ottl`: Respect the `depth` option when flattening slices using `flatten`.
@@ -123,14 +137,14 @@ v1.6.0-rc.0
     https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/36198
   - `otelcol.exporter.loadbalancing`: Shutdown exporters during collector shutdown. This fixes a memory leak.
     https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/36024
-  - `otelcol.processor.k8sattributes`: New `wait_for_metadata` and `wait_for_metadata_timeout` configuration arguments, 
+  - `otelcol.processor.k8sattributes`: New `wait_for_metadata` and `wait_for_metadata_timeout` configuration arguments,
     which block the processor startup until metadata is received from Kubernetes.
     https://github.com/open-telemetry/opentelemetry-collector-contrib/issues/32556
-  - `otelcol.processor.k8sattributes`: Enable the `k8sattr.fieldExtractConfigRegex.disallow` for all Alloy instances, 
+  - `otelcol.processor.k8sattributes`: Enable the `k8sattr.fieldExtractConfigRegex.disallow` for all Alloy instances,
     to retain the behavior of `regex` argument in the `annotation` and `label` blocks.
     When the feature gate is "deprecated" in the upstream Collector, Alloy users will need to use the transform processor instead.
     https://github.com/open-telemetry/opentelemetry-collector-contrib/issues/25128
-  - `otelcol.receiver.vcenter`: The existing code did not honor TLS settings beyond 'insecure'. 
+  - `otelcol.receiver.vcenter`: The existing code did not honor TLS settings beyond 'insecure'.
     All TLS client config should now be honored.
     https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/36482
   - `otelcol.receiver.opencensus`: Do not report error message when OpenCensus receiver is shutdown cleanly.
diff --git a/docs/sources/reference/components/beyla/beyla.ebpf.md b/docs/sources/reference/components/beyla/beyla.ebpf.md
index 2e19242f02..690f389273 100644
--- a/docs/sources/reference/components/beyla/beyla.ebpf.md
+++ b/docs/sources/reference/components/beyla/beyla.ebpf.md
@@ -21,7 +21,6 @@ To run this component, {{< param "PRODUCT_NAME" >}} requires administrative (`su
 In Kubernetes environments, the [AppArmor profile must be `Unconfined`](https://kubernetes.io/docs/tutorials/security/apparmor/#securing-a-pod) for the Deployment or DaemonSet running {{< param "PRODUCT_NAME" >}}.
 {{< /admonition >}}
 
-
 ## Usage
 
 ```alloy
@@ -36,52 +35,70 @@ beyla.ebpf "<LABEL>" {
 
 Name              | Type     | Description                                                                         | Default | Required
 ------------------|----------|-------------------------------------------------------------------------------------|---------|---------
-`open_port`       | `string` | The port of the running service for Beyla automatically instrumented with eBPF.     | `""`    | no
-`executable_name` | `string` | The name of the executable to match for Beyla automatically instrumented with eBPF. | `""`    | no
 `debug`           | `bool`   | Enable debug mode for Beyla.                                                        | `false` | no
+`executable_name` | `string` | The name of the executable to match for Beyla automatically instrumented with eBPF. | `""`    | no
+`open_port`       | `string` | The port of the running service for Beyla automatically instrumented with eBPF.     | `""`    | no
 
-`open_port` accepts a comma-separated list of ports (for example, `80,443`), and port ranges (for example, `8000-8999`).
-If the executable matches only one of the ports in the list, it is considered to match the selection criteria.
+`debug` enables debug mode for Beyla. This mode logs BPF logs, network logs, trace representation logs, and other debug information.
 
 `executable_name` accepts a regular expression to be matched against the full executable command line, including the directory where the executable resides on the file system.
 
-`debug` enables debug mode for Beyla. This mode logs BPF logs, network logs, trace representation logs, and other debug information.
+`open_port` accepts a comma-separated list of ports (for example, `80,443`), and port ranges (for example, `8000-8999`).
+If the executable matches only one of the ports in the list, it is considered to match the selection criteria.
 
 ## Blocks
 
 The following blocks are supported inside the definition of `beyla.ebpf`:
 
-Hierarchy               | Block                     | Description                                                                                        | Required
-------------------------|---------------------------|----------------------------------------------------------------------------------------------------|---------
-routes                  | [routes][]                | Configures the routes to match HTTP paths into user-provided HTTP routes.                          | no
-attributes              | [attributes][]            | Configures the Beyla attributes for the component.                                                 | no
-attributes > kubernetes | [kubernetes attributes][] | Configures decorating of the metrics and traces with Kubernetes metadata of the instrumented Pods. | no
-discovery               | [discovery][]             | Configures the discovery for instrumentable processes matching a given criteria.                   | no
-discovery > services    | [services][]              | Configures the services to discover for the component.                                                        | no
-discovery > services > kubernetes    | [kubernetes services][]   | Configures the Kubernetes services to discover for the component.                                | no
-discovery > exclude_services    | [services][]              | Configures the services to exclude for the component.                                                        | no
-discovery > exclude_services > kubernetes    | [kubernetes services][]   | Configures the Kubernetes services to exclude for the component.                                | no
-metrics                 | [metrics][]               | Configures which metrics Beyla exposes.                                                           | no
-metrics > network       | [network][]    | Configures network metrics options for Beyla.                                                      |no 
-output                  | [output][]                | Configures where to send received telemetry data.                                                  | yes
+Hierarchy                                 | Block                     | Description                                                                                        | Required
+------------------------------------------|---------------------------|----------------------------------------------------------------------------------------------------|---------
+output                                    | [output][]                | Configures where to send received telemetry data.                                                  | yes
+attributes                                | [attributes][]            | Configures the Beyla attributes for the component.                                                 | no
+attributes > kubernetes                   | [kubernetes attributes][] | Configures decorating of the metrics and traces with Kubernetes metadata of the instrumented Pods. | no
+discovery                                 | [discovery][]             | Configures the discovery for instrumentable processes matching a given criteria.                   | no
+discovery > exclude_services              | [services][]              | Configures the services to exclude for the component.                                              | no
+discovery > exclude_services > kubernetes | [kubernetes services][]   | Configures the Kubernetes services to exclude for the component.                                   | no
+discovery > services                      | [services][]              | Configures the services to discover for the component.                                             | no
+discovery > services > kubernetes         | [kubernetes services][]   | Configures the Kubernetes services to discover for the component.                                  | no
+metrics                                   | [metrics][]               | Configures which metrics Beyla exposes.                                                            | no
+metrics > network                         | [network][]               | Configures network metrics options for Beyla.                                                      | no
+routes                                    | [routes][]                | Configures the routes to match HTTP paths into user-provided HTTP routes.                          | no
 
 The `>` symbol indicates deeper levels of nesting.
 For example,`attributes > kubernetes` refers to a `kubernetes` block defined inside an `attributes` block.
 
-### attributes block
+### output
+
+<span class="badge docs-labels__stage docs-labels__item">Required</span>
+
+The `output` block configures a set of components to forward the resulting telemetry data to.
+
+The following arguments are supported:
+
+Name     | Type                     | Description                          | Default | Required
+---------|--------------------------|--------------------------------------|---------|---------
+`traces` | `list(otelcol.Consumer)` | List of consumers to send traces to. | `[]`    | no
+
+You must specify the `output` block, but all its arguments are optional.
+By default, telemetry data is dropped.
+Configure the `traces` argument to send traces data to other components.
+
+### attributes
 
 This block allows you to configure how some attributes for metrics and traces are decorated.
 
 It contains the following blocks:
 
-#### kubernetes attributes block
+#### kubernetes attributes
+
+Name           | Type     | Description                                | Default | Required
+---------------|----------|--------------------------------------------|---------|---------
+`cluster_name` | `string` | The name of the Kubernetes cluster.        | `""`    | no
+`enable`       | `string` | Enable the Kubernetes metadata decoration. | `false` | no
 
-Name     | Type     | Description                                | Default | Required
----------|----------|--------------------------------------------|---------|---------
-`enable` | `string` | Enable the Kubernetes metadata decoration. | `false` | no
-`cluster_name` | `string` | The name of the Kubernetes cluster. | `""` | no
+If `cluster_name` isn't set, Beyla tries to detect the cluster name from the Kubernetes API.
 
-If set to `true`, Beyla will decorate the metrics and traces with Kubernetes metadata. The following labels will be added:
+If `enable` is set to `true`, Beyla will decorate the metrics and traces with Kubernetes metadata. The following labels will be added:
 
 - `k8s.namespace.name`
 - `k8s.deployment.name`
@@ -93,45 +110,17 @@ If set to `true`, Beyla will decorate the metrics and traces with Kubernetes met
 - `k8s.pod.uid`
 - `k8s.pod.start_time`
 
-If set to `false`, the Kubernetes metadata decorator will be disabled.
-
-If set to `autodetect`, Beyla will try to automatically detect if it is running inside Kubernetes, and enable the metadata decoration if that's the case.
-
-If `cluster_name` is not set, Beyla tries to detect the cluster name from the Kubernetes API.
+If `enable` is set to `false`, the Kubernetes metadata decorator is disabled.
 
-### routes block
-
-This block is used to configure the routes to match HTTP paths into user-provided HTTP routes.
-
-Name              | Type           | Description                                                                               | Default | Required
-------------------|----------------|-------------------------------------------------------------------------------------------|---------|---------
-`patterns`        | `list(string)` | List of provided URL path patterns to set the `http.route` trace/metric property          | `[]`    | no
-`ignore_patterns` | `list(string)` | List of provided URL path patterns to ignore from `http.route` trace/metric property.     | `[]`    | no
-`ignore_mode`     | `string`       | The mode to use when ignoring patterns.                                                   | `""`    | no
-`unmatched`       | `string`       | Specifies what to do when a trace HTTP path does not match any of the `patterns` entries. | `"heuristic"`    | no
-
-`patterns` and `ignored_patterns` are a list of patterns which a URL path with specific tags which allow for grouping path segments (or ignored them).
-The matcher tags can be in the `:name` or `{name}` format.
-`ignore_mode` properties are:
-- `all` discards metrics and traces matching the `ignored_patterns`.
-- `traces` discards only the traces that match the `ignored_patterns`. No metric events are ignored.
-- `metrics` discards only the metrics that match the `ignored_patterns`. No trace events are ignored.
-`unmatched` properties are:
-- `unset` leaves the `http.route` property as unset.
-- `path` copies the `http.route` field property to the path value.
-  - Caution: This option could lead to a cardinality explosion on the ingester side.
-- `wildcard` sets the `http.route` field property to a generic asterisk-based `/**` value.
-- `heuristic` automatically derives the `http.route` field property from the path value based on the following rules:
-  - Any path components that have numbers or characters outside of the ASCII alphabet (or `-` and _), are replaced by an asterisk `*`.
-  - Any alphabetical components that don’t look like words are replaced by an asterisk `*`.
+If `enable` is set to `autodetect`, Beyla tries to detect if it's running inside Kubernetes, and enables the metadata decoration if that's the case.
 
-### discovery block
+### discovery
 
 This block is used to configure the discovery for instrumentable processes matching a given criteria.
 
 It contains the following blocks:
 
-### services block
+#### services
 
 In some scenarios, Beyla will instrument a wide variety of services, such as a Kubernetes DaemonSet that instruments all the services in a node.
 This block allows you to filter the services to instrument based on their metadata. If you specify other selectors in the same services entry,
@@ -139,81 +128,98 @@ the instrumented processes need to match all the selector properties.
 
 Name         | Type     | Description                                                                     | Default | Required
 -------------|----------|---------------------------------------------------------------------------------|---------|---------
-`name `      | `string` | The name of the service to match.                                               | `""`    | no
+`exe_path`   | `string` | The path of the running service for Beyla automatically instrumented with eBPF. | `""`    | no
+`name`       | `string` | The name of the service to match.                                               | `""`    | no
 `namespace`  | `string` | The namespace of the service to match.                                          | `""`    | no
 `open_ports` | `string` | The port of the running service for Beyla automatically instrumented with eBPF. | `""`    | no
-`exe_path`   | `string` | The path of the running service for Beyla automatically instrumented with eBPF. | `""`    | no
+
+`exe_path` accepts a regular expression to be matched against the full executable command line, including the directory where the executable resides on the file system.
 
 `name` defines a name for the matching instrumented service.
 It is used to populate the `service.name` OTEL property and/or the `service_name` Prometheus property in the exported metrics/traces.
+
 `open_port` accepts a comma-separated list of ports (for example, `80,443`), and port ranges (for example, `8000-8999`).
 If the executable matches only one of the ports in the list, it is considered to match the selection criteria.
-`exe_path` accepts a regular expression to be matched against the full executable command line, including the directory where the executable resides on the file system.
 
-### kubernetes services block
+#### kubernetes services
 
 This block allows you to filter the services to instrument based on their Kubernetes metadata. If you specify other selectors in the same services entry,
 the instrumented processes need to match all the selector properties.
 
-Name               | Type           | Description                                                                                                | Default | Required
--------------------|----------------|-------------------------------------------------------------------------------------------------------------|---------|---------
-`namespace`        | `string`       | Regular expression of Kubernetes Namespaces to match.                                                       | `""`    | no
-`pod_name`         | `string`       | Regular expression of Kubernetes Pods to match.                                                             | `""`    | no
-`deployment_name`  | `string`       | Regular expression of Kubernetes Deployments to match.                                                      | `""`    | no
-`statefulset_name` | `string`       | Regular expression of Kubernetes StatefulSets to match.                                                     | `""`    | no
-`replicaset_name`  | `string`       | Regular expression of Kubernetes ReplicaSets to match.                                                      | `""`    | no
-`daemonset_name`   | `string`       | Regular expression of Kubernetes DaemonSets to match.                                                       | `""`    | no
-`owner_name`       | `string`       | Regular expression of Kubernetes owners of running Pods to match.                                           | `""`    | no
-`pod_labels`       | `map(string)`  | Key-value pairs of labels with keys matching Kubernetes Pods with the provided value as regular expression. |  `{}`   | no
+Name               | Type          | Description                                                                                                 | Default | Required
+-------------------|---------------|-------------------------------------------------------------------------------------------------------------|---------|---------
+`daemonset_name`   | `string`      | Regular expression of Kubernetes DaemonSets to match.                                                       | `""`    | no
+`deployment_name`  | `string`      | Regular expression of Kubernetes Deployments to match.                                                      | `""`    | no
+`namespace`        | `string`      | Regular expression of Kubernetes Namespaces to match.                                                       | `""`    | no
+`owner_name`       | `string`      | Regular expression of Kubernetes owners of running Pods to match.                                           | `""`    | no
+`pod_labels`       | `map(string)` | Key-value pairs of labels with keys matching Kubernetes Pods with the provided value as regular expression. | `{}`    | no
+`pod_name`         | `string`      | Regular expression of Kubernetes Pods to match.                                                             | `""`    | no
+`replicaset_name`  | `string`      | Regular expression of Kubernetes ReplicaSets to match.                                                      | `""`    | no
+`statefulset_name` | `string`      | Regular expression of Kubernetes StatefulSets to match.                                                     | `""`    | no
 
-### metrics block
+### metrics
 
 This block configures which metrics Beyla collects.
 
-Name              | Type           | Description                                                    | Default           | Required
-------------------|----------------|----------------------------------------------------------------|-------------------|---------
-`features`        | `list(string)` | List of features to enable for the metrics.         | `["application"]` | no
-`instrumentations`| `list(string)` | List of instrumentations to enable for the metrics. | `["*"]`           | no
+Name               | Type           | Description                                         | Default           | Required
+-------------------|----------------|-----------------------------------------------------|-------------------|---------
+`features`         | `list(string)` | List of features to enable for the metrics.         | `["application"]` | no
+`instrumentations` | `list(string)` | List of instrumentations to enable for the metrics. | `["*"]`           | no
 
 `features` is a list of features to enable for the metrics. The following features are available:
 
 - `application` exports application-level metrics.
-- `application_span`exports application-level metrics in traces span metrics format.
-- `application_service_graph` exports application-level service graph metrics.
 - `application_process` exports metrics about the processes that run the instrumented application.
+- `application_service_graph` exports application-level service graph metrics.
+- `application_span` exports application-level metrics in traces span metrics format.
 - `network` exports network-level metrics.
 
 `instrumentations` is a list of instrumentations to enable for the metrics. The following instrumentations are available:
 
 - `*` enables all `instrumentations`. If `*` is present in the list, the other values are ignored.
-- `http` enables the collection of HTTP/HTTPS/HTTP2 application metrics.
 - `grpc` enables the collection of gRPC application metrics.
-- `sql` enables the collection of SQL database client call metrics.
-- `redis` enables the collection of Redis client/server database metrics.
+- `http` enables the collection of HTTP/HTTPS/HTTP2 application metrics.
 - `kafka` enables the collection of Kafka client/server message queue metrics.
+- `redis` enables the collection of Redis client/server database metrics.
+- `sql` enables the collection of SQL database client call metrics.
 
-### network block
+#### network
 
 This block configures network metrics options for Beyla. You must append `network` to the `features` list in the `metrics` block to enable network metrics.
 
-Name              | Type           | Description                                             | Default | Required
-------------------|----------------|---------------------------------------------------------|---------|---------
-`enabled`         | `bool`         | Enable network metrics collection.                      | `false` | no
+Name      | Type   | Description                        | Default | Required
+----------|--------|------------------------------------|---------|---------
+`enabled` | `bool` | Enable network metrics collection. | `false` | no
 
+### routes
 
-### output block
+This block is used to configure the routes to match HTTP paths into user-provided HTTP routes.
 
-The `output` block configures a set of components to forward the resulting telemetry data to.
+Name              | Type           | Description                                                                               | Default       | Required
+------------------|----------------|-------------------------------------------------------------------------------------------|---------------|---------
+`ignore_mode`     | `string`       | The mode to use when ignoring patterns.                                                   | `""`          | no
+`ignore_patterns` | `list(string)` | List of provided URL path patterns to ignore from `http.route` trace/metric property.     | `[]`          | no
+`patterns`        | `list(string)` | List of provided URL path patterns to set the `http.route` trace/metric property          | `[]`          | no
+`unmatched`       | `string`       | Specifies what to do when a trace HTTP path does not match any of the `patterns` entries. | `"heuristic"` | no
 
-The following arguments are supported:
+`ignore_mode` properties are:
 
-Name      | Type                     | Description                           | Default | Required
-----------|--------------------------|---------------------------------------|---------|---------
-`traces`  | `list(otelcol.Consumer)` | List of consumers to send traces to.  | `[]`    | no
+- `all` discards metrics and traces matching the `ignored_patterns`.
+- `metrics` discards only the metrics that match the `ignored_patterns`. No trace events are ignored.
+- `traces` discards only the traces that match the `ignored_patterns`. No metric events are ignored.
 
-You must specify the `output` block, but all its arguments are optional.
-By default, telemetry data is dropped.
-Configure the `traces` argument to send traces data to other components.
+`patterns` and `ignore_patterns` are a list of patterns which a URL path with specific tags which allow for grouping path segments (or ignored them).
+The matcher tags can be in the `:name` or `{name}` format.
+
+`unmatched` properties are:
+
+- `heuristic` automatically derives the `http.route` field property from the path value based on the following rules:
+  - Any path components that have numbers or characters outside of the ASCII alphabet (or `-` and _), are replaced by an asterisk `*`.
+  - Any alphabetical components that don’t look like words are replaced by an asterisk `*`.
+- `path` copies the `http.route` field property to the path value.
+  - Caution: This option could lead to a cardinality explosion on the ingester side.
+- `unset` leaves the `http.route` property as unset.
+- `wildcard` sets the `http.route` field property to a generic asterisk-based `/**` value.
 
 ## Exported fields
 
@@ -235,7 +241,9 @@ The exported targets use the configured [in-memory traffic][] address specified
 
 `beyla.ebpf` does not expose any component-specific debug information.
 
-## Example
+## Examples
+
+The following examples show you how to collect metricss and traces from `beyla.ebpf`.
 
 ### Metrics
 
@@ -303,16 +311,16 @@ Replace the following:
 
 [Grafana Beyla]: https://github.com/grafana/beyla
 [eBPF]: https://ebpf.io/
-[routes]: #routes-block
-[attributes]: #attributes-block
-[kubernetes attributes]: #kubernetes-attributes-block
-[kubernetes services]: #kubernetes-services-block
-[discovery]: #discovery-block
-[services]: #services-block
-[metrics]: #metrics-block
-[network]: #network-block
-[output]: #output-block
-[in-memory traffic]: ../../../../get-started/component_controller#in-memory-traffic
+[routes]: #routes
+[attributes]: #attributes
+[kubernetes attributes]: #kubernetes-attributes
+[kubernetes services]: #kubernetes-services
+[discovery]: #discovery
+[services]: #services
+[metrics]: #metrics
+[network]: #network
+[output]: #output
+[in-memory traffic]: ../../../../get-started/component_controller/#in-memory-traffic
 [run command]: ../../../cli/run/
 [scrape]: ../../prometheus/prometheus.scrape/
 
diff --git a/docs/sources/reference/components/loki/loki.secretfilter.md b/docs/sources/reference/components/loki/loki.secretfilter.md
index cb412d2225..f4eff72dfe 100644
--- a/docs/sources/reference/components/loki/loki.secretfilter.md
+++ b/docs/sources/reference/components/loki/loki.secretfilter.md
@@ -18,7 +18,7 @@ The detection is based on regular expression patterns, defined in the [Gitleaks
 
 {{< admonition type="caution" >}}
 Personally Identifiable Information (PII) isn't currently in scope and some secrets could remain undetected.
-This component may generate false positives.
+This component may generate false positives or redact too much.
 Don't rely solely on this component to redact sensitive information.
 {{< /admonition >}}
 
@@ -49,7 +49,14 @@ Name                     | Type                 | Description
 The `gitleaks_config` argument is the path to the custom `gitleaks.toml` file.
 The Gitleaks configuration file embedded in the component is used if you don't provide the path to a custom configuration file.
 
-The `types` argument is a map of secret types to look for. The values are used as prefixes for the secret types in the Gitleaks configuration. If you don't provide this argument, all types are used.
+{{< admonition type="note" >}}
+This component doesn't support all the features of the Gitleaks configuration file. It only supports regular expression-based rules, `secretGroup`, and allowlist regular expressions. `regexTarget` only supports the default value `secret`. Other features such as `keywords`, `entropy`, `paths`, and `stopwords` are not supported. The `extend` feature is not supported. If you use a custom configuration file, you must include all the rules you want to use within the configuration file. Unsupported fields and values in the configuration file are ignored.
+{{< /admonition >}}
+
+The `types` argument is a map of secret types to look for.
+The values provided are used as prefixes to match rules IDs in the Gitleaks configuration.
+For example,  providing the type `grafana` will match the rules `grafana-api-key`, `grafana-cloud-api-token`, and `grafana-service-account-token`.
+If you don't provide this argument, all rules are used.
 
 {{< admonition type="note" >}}
 Configuring this argument with the secret types you want to look for is strongly recommended.
@@ -74,6 +81,8 @@ A secret will not be redacted if it matches any of the regular expressions. The
 
 The `partial_mask` argument is the number of characters to show from the beginning of the secret before the redact string is added.
 If set to `0`, the entire secret is redacted.
+If a secret is not at least 6 characters long, it will be entirely redacted.
+For short secrets, at most half of the secret is shown.
 
 ## Blocks
 
diff --git a/docs/sources/reference/components/loki/loki.source.kafka.md b/docs/sources/reference/components/loki/loki.source.kafka.md
index bd9977148f..c016a99de0 100644
--- a/docs/sources/reference/components/loki/loki.source.kafka.md
+++ b/docs/sources/reference/components/loki/loki.source.kafka.md
@@ -147,7 +147,7 @@ loki.source.kafka "local" {
   brokers                = ["localhost:9092"]
   topics                 = ["quickstart-events"]
   labels                 = {component = "loki.source.kafka"}
-  forward_to             = [loki.relabel.kafka.receiver]
+  forward_to             = [loki.write.local.receiver]
   use_incoming_timestamp = true
   relabel_rules          = loki.relabel.kafka.rules
 }
diff --git a/docs/sources/reference/components/otelcol/otelcol.auth.basic.md b/docs/sources/reference/components/otelcol/otelcol.auth.basic.md
index 814773ba6e..f13a1a26c0 100644
--- a/docs/sources/reference/components/otelcol/otelcol.auth.basic.md
+++ b/docs/sources/reference/components/otelcol/otelcol.auth.basic.md
@@ -11,7 +11,7 @@ title: otelcol.auth.basic
 `otelcol.auth.basic` exposes a `handler` that can be used by other `otelcol`
 components to authenticate requests using basic authentication.
 
-This extension supports both server and client authentication.
+This component supports both server and client authentication.
 
 > **NOTE**: `otelcol.auth.basic` is a wrapper over the upstream OpenTelemetry
 > Collector `basicauth` extension. Bug reports or feature requests will be
diff --git a/docs/sources/reference/components/otelcol/otelcol.auth.bearer.md b/docs/sources/reference/components/otelcol/otelcol.auth.bearer.md
index e7725159e5..8120bde37d 100644
--- a/docs/sources/reference/components/otelcol/otelcol.auth.bearer.md
+++ b/docs/sources/reference/components/otelcol/otelcol.auth.bearer.md
@@ -11,7 +11,7 @@ title: otelcol.auth.bearer
 `otelcol.auth.bearer` exposes a `handler` that can be used by other `otelcol`
 components to authenticate requests using bearer token authentication.
 
-This extension supports both server and client authentication.
+This component supports both server and client authentication.
 
 {{< admonition type="note" >}}
 `otelcol.auth.bearer` is a wrapper over the upstream OpenTelemetry Collector `bearertokenauth` extension.
diff --git a/docs/sources/reference/components/otelcol/otelcol.auth.headers.md b/docs/sources/reference/components/otelcol/otelcol.auth.headers.md
index 526e1036f7..c5d72431b0 100644
--- a/docs/sources/reference/components/otelcol/otelcol.auth.headers.md
+++ b/docs/sources/reference/components/otelcol/otelcol.auth.headers.md
@@ -11,6 +11,8 @@ title: otelcol.auth.headers
 `otelcol.auth.headers` exposes a `handler` that can be used by other `otelcol`
 components to authenticate requests using custom headers.
 
+This component only supports client authentication. 
+
 {{< admonition type="note" >}}
 `otelcol.auth.headers` is a wrapper over the upstream OpenTelemetry Collector `headerssetter` extension.
 Bug reports or feature requests will be redirected to the upstream repository, if necessary.
diff --git a/docs/sources/reference/components/otelcol/otelcol.auth.oauth2.md b/docs/sources/reference/components/otelcol/otelcol.auth.oauth2.md
index f2e8a7014b..cdaa14ab82 100644
--- a/docs/sources/reference/components/otelcol/otelcol.auth.oauth2.md
+++ b/docs/sources/reference/components/otelcol/otelcol.auth.oauth2.md
@@ -10,6 +10,8 @@ title: otelcol.auth.oauth2
 
 `otelcol.auth.oauth2` exposes a `handler` that can be used by other `otelcol` components to authenticate requests using OAuth 2.0.
 
+This component only supports client authentication. 
+
 The authorization tokens can be used by HTTP and gRPC based OpenTelemetry exporters.
 This component can fetch and refresh expired tokens automatically.
 Refer to the [OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4) for more information about the Auth 2.0 Client Credentials flow.
diff --git a/docs/sources/reference/components/otelcol/otelcol.auth.sigv4.md b/docs/sources/reference/components/otelcol/otelcol.auth.sigv4.md
index d8f8070a35..6e501ceea8 100644
--- a/docs/sources/reference/components/otelcol/otelcol.auth.sigv4.md
+++ b/docs/sources/reference/components/otelcol/otelcol.auth.sigv4.md
@@ -12,6 +12,8 @@ title: otelcol.auth.sigv4
 components to authenticate requests to AWS services using the AWS Signature Version 4 (SigV4) protocol.
 For more information about SigV4 see the AWS documentation about [Signing AWS API requests][].
 
+This component only supports client authentication. 
+
 [Signing AWS API requests]: https://docs.aws.amazon.com/general/latest/gr/signing-aws-api-requests.html
 
 > **NOTE**: `otelcol.auth.sigv4` is a wrapper over the upstream OpenTelemetry
diff --git a/docs/sources/reference/components/otelcol/otelcol.extension.jaeger_remote_sampling.md b/docs/sources/reference/components/otelcol/otelcol.extension.jaeger_remote_sampling.md
index 481789ca7b..2d8624c8d5 100644
--- a/docs/sources/reference/components/otelcol/otelcol.extension.jaeger_remote_sampling.md
+++ b/docs/sources/reference/components/otelcol/otelcol.extension.jaeger_remote_sampling.md
@@ -79,6 +79,7 @@ Name                     | Type           | Description
 `max_request_body_size`  | `string`       | Maximum request body size the server will allow.                | `20MiB`          | no
 `include_metadata`       | `boolean`      | Propagate incoming connection metadata to downstream consumers. |                  | no
 `compression_algorithms` | `list(string)` | A list of compression algorithms the server can accept.         | `["", "gzip", "zstd", "zlib", "snappy", "deflate", "lz4"]` | no
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 ### tls block
 
@@ -125,6 +126,7 @@ Name                     | Type      | Description
 `read_buffer_size`       | `string`  | Size of the read buffer the gRPC server will use for reading from clients. | `"512KiB"`        | no
 `write_buffer_size`      | `string`  | Size of the write buffer the gRPC server will use for writing to clients.  |                   | no
 `include_metadata`       | `boolean` | Propagate incoming connection metadata to downstream consumers.            |                   | no
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 ### keepalive block
 
@@ -293,3 +295,29 @@ otelcol.extension.jaeger_remote_sampling "example" {
   }
 }
 ```
+
+## Enable authentication
+
+You can use `jaeger_remote_sampling` to authenticate requests.
+This allows you to limit access to the sampling document.
+
+{{< admonition type="note" >}}
+Not all OpenTelemetry Collector authentication plugins support receiver authentication.
+Refer to the [documentation](https://grafana.com/docs/alloy/<ALLOY_VERSION>/reference/components/otelcol/) for each `otelcol.auth.*` component to determine its compatibility.
+{{< /admonition >}}
+
+```alloy
+otelcol.extension.jaeger_remote_sampling "default" {
+  http {
+    auth = otelcol.auth.basic.creds.handler
+  }
+  grpc {
+     auth = otelcol.auth.basic.creds.handler
+  }
+}
+
+otelcol.auth.basic "creds" {
+    username = sys.env("USERNAME")
+    password = sys.env("PASSWORD")
+}
+```
diff --git a/docs/sources/reference/components/otelcol/otelcol.processor.filter.md b/docs/sources/reference/components/otelcol/otelcol.processor.filter.md
index df75e477e4..e376f6bea1 100644
--- a/docs/sources/reference/components/otelcol/otelcol.processor.filter.md
+++ b/docs/sources/reference/components/otelcol/otelcol.processor.filter.md
@@ -197,7 +197,7 @@ information.
 
 ### Drop spans which contain a certain span attribute
 
-This example sets the attribute `test` to `pass` if the attribute `test` does not exist.
+This example drops the signals that have the attribute `container.name` set to the value `app_container_1`.
 
 ```alloy
 otelcol.processor.filter "default" {
@@ -205,7 +205,7 @@ otelcol.processor.filter "default" {
 
   traces {
     span = [
-      "attributes[\"container.name\"] == \"app_container_1\"",
+      `attributes["container.name"] == "app_container_1"`,
     ]
   }
 
@@ -217,8 +217,6 @@ otelcol.processor.filter "default" {
 }
 ```
 
-Each `"` is [escaped][] with `\"` inside the {{< param "PRODUCT_NAME" >}} syntax string.
-
 ### Drop metrics based on either of two criteria
 
 This example drops metrics which satisfy at least one of two OTTL statements:
@@ -231,8 +229,8 @@ otelcol.processor.filter "default" {
 
   metrics {
     metric = [
-       "name == \"my.metric\" and resource.attributes[\"my_label\"] == \"abc123\"",
-       "type == METRIC_DATA_TYPE_HISTOGRAM",
+       `name == "my.metric" and resource.attributes["my_label"] == "abc123"`,
+       `type == METRIC_DATA_TYPE_HISTOGRAM`,
     ]
   }
 
@@ -244,11 +242,6 @@ otelcol.processor.filter "default" {
 }
 ```
 
-
-Some values in the {{< param "PRODUCT_NAME" >}} syntax string are [escaped][]:
-* `\` is escaped with `\\`
-* `"` is escaped with `\"`
-
 ### Drop non-HTTP spans and sensitive logs
 
 ```alloy
@@ -257,14 +250,14 @@ otelcol.processor.filter "default" {
 
   traces {
     span = [
-      "attributes[\"http.request.method\"] == nil",
+      `attributes["http.request.method"] == nil`,
     ]
   }
 
   logs {
     log_record = [
-      "IsMatch(body, \".*password.*\")",
-      "severity_number < SEVERITY_NUMBER_WARN",
+      `IsMatch(body, ".*password.*")`,
+      `severity_number < SEVERITY_NUMBER_WARN`,
     ]
   }
 
@@ -276,13 +269,6 @@ otelcol.processor.filter "default" {
 }
 ```
 
-Each `"` is [escaped][] with `\"` inside the {{< param "PRODUCT_NAME" >}} syntax string.
-
-
-Some values in the {{< param "PRODUCT_NAME" >}} syntax strings are [escaped][]:
-* `\` is escaped with `\\`
-* `"` is escaped with `\"`
-
 [escaped]: ../../../../get-started/configuration-syntax/expressions/types_and_values/#strings
 
 
diff --git a/docs/sources/reference/components/otelcol/otelcol.processor.transform.md b/docs/sources/reference/components/otelcol/otelcol.processor.transform.md
index 8027f2277d..b833ecc6d0 100644
--- a/docs/sources/reference/components/otelcol/otelcol.processor.transform.md
+++ b/docs/sources/reference/components/otelcol/otelcol.processor.transform.md
@@ -306,10 +306,6 @@ otelcol.processor.transform "default" {
 }
 ```
 
-Each statement is enclosed in backticks instead of quotation marks.
-This constitutes a [raw string][raw-strings], and lets us avoid the need to escape
-each `"` with a `\"` inside a [normal][strings] {{< param "PRODUCT_NAME" >}} syntax string.
-
 ### Rename a resource attribute
 
 The are two ways to rename an attribute key.
@@ -356,10 +352,6 @@ otelcol.processor.transform "default" {
 }
 ```
 
-Each statement is enclosed in backticks instead of quotation marks.
-This constitutes a [raw string][raw-strings], and lets us avoid the need to escape
-each `"` with a `\"`, and each `\` with a `\\` inside a [normal][strings] {{< param "PRODUCT_NAME" >}} syntax string.
-
 ### Create an attribute from the contents of a log body
 
 This example sets the attribute `body` to the value of the log body:
@@ -383,10 +375,6 @@ otelcol.processor.transform "default" {
 }
 ```
 
-Each statement is enclosed in backticks instead of quotation marks.
-This constitutes a [raw string][raw-strings], and lets us avoid the need to escape
-each `"` with a `\"` inside a [normal][strings] {{< param "PRODUCT_NAME" >}} syntax string.
-
 ### Combine two attributes
 
 This example sets the attribute `test` to the value of attributes `service.name` and `service.version` combined.
@@ -399,7 +387,7 @@ otelcol.processor.transform "default" {
     context = "resource"
     statements = [
       // The Concat function combines any number of strings, separated by a delimiter.
-      `set(attributes["test"], Concat([attributes["foo"], attributes["bar"]], " "))`,
+      `set(attributes["test"], Concat([attributes["service.name"], attributes["service.version"]], " "))`,
     ]
   }
 
@@ -411,10 +399,6 @@ otelcol.processor.transform "default" {
 }
 ```
 
-Each statement is enclosed in backticks instead of quotation marks.
-This constitutes a [raw string][raw-strings], and lets us avoid the need to escape
-each `"` with a `\"` inside a [normal][strings] {{< param "PRODUCT_NAME" >}} syntax string.
-
 ### Parsing JSON logs
 
 Given the following JSON body:
@@ -463,10 +447,6 @@ otelcol.processor.transform "default" {
 }
 ```
 
-Each statement is enclosed in backticks instead of quotation marks.
-This constitutes a [raw string][raw-strings], and lets us avoid the need to escape
-each `"` with a `\"`, and each `\` with a `\\` inside a [normal][strings] {{< param "PRODUCT_NAME" >}} syntax string.
-
 ### Various transformations of attributes and status codes
 
 The example takes advantage of context efficiency by grouping transformations
@@ -565,10 +545,6 @@ otelcol.exporter.otlp "default" {
 }
 ```
 
-Each statement is enclosed in backticks instead of quotation marks.
-This constitutes a [raw string][raw-strings], and lets us avoid the need to escape
-each `"` with a `\"`, and each `\` with a `\\` inside a [normal][strings] {{< param "PRODUCT_NAME" >}} syntax string.
-
 [strings]: ../../../../get-started/configuration-syntax/expressions/types_and_values/#strings
 [raw-strings]: ../../../../get-started/configuration-syntax/expressions/types_and_values/#raw-strings
 
diff --git a/docs/sources/reference/components/otelcol/otelcol.receiver.datadog.md b/docs/sources/reference/components/otelcol/otelcol.receiver.datadog.md
index d374118d86..d805201d0f 100644
--- a/docs/sources/reference/components/otelcol/otelcol.receiver.datadog.md
+++ b/docs/sources/reference/components/otelcol/otelcol.receiver.datadog.md
@@ -38,6 +38,7 @@ Name                     | Type       | Description
 `include_metadata`       | `boolean`  | Propagate incoming connection metadata to downstream consumers.  | `false`            | no
 `read_timeout`           | `duration` | Read timeout for requests of the HTTP server.                    | `"60s"`            | no
 `compression_algorithms` | `list(string)` | A list of compression algorithms the server can accept.      | `["", "gzip", "zstd", "zlib", "snappy", "deflate", "lz4"]` | no
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 By default, `otelcol.receiver.datadog` listens for HTTP connections on `localhost`.
 To expose the HTTP server to other machines on your network, configure `endpoint` with the IP address to listen on, or `0.0.0.0:8126` to listen on all network interfaces.
@@ -134,6 +135,30 @@ otelcol.exporter.otlp "default" {
   }
 }
 ```
+
+## Enable authentication
+
+You can create a `otelcol.receiver.datadog` component that requires authentication for requests. This is useful for limiting who can push data to the server. 
+
+{{< admonition type="note" >}}
+Not all OpenTelemetry Collector authentication plugins support receiver authentication.
+Refer to the [documentation](https://grafana.com/docs/alloy/<ALLOY_VERSION>/reference/components/otelcol/) for each `otelcol.auth.*` component to determine its compatibility.
+{{< /admonition >}} 
+
+```alloy
+otelcol.receiver.datadog "default" {
+  output {
+    metrics = [otelcol.processor.batch.default.input]
+    traces  = [otelcol.processor.batch.default.input]
+  }
+  auth = otelcol.auth.basic.creds.handler
+}
+
+otelcol.auth.basic "creds" {
+    username = sys.env("USERNAME")
+    password = sys.env("PASSWORD")
+}
+```
 <!-- START GENERATED COMPATIBLE COMPONENTS -->
 
 ## Compatible components
diff --git a/docs/sources/reference/components/otelcol/otelcol.receiver.influxdb.md b/docs/sources/reference/components/otelcol/otelcol.receiver.influxdb.md
index 465eb67e20..c0e3883273 100644
--- a/docs/sources/reference/components/otelcol/otelcol.receiver.influxdb.md
+++ b/docs/sources/reference/components/otelcol/otelcol.receiver.influxdb.md
@@ -32,6 +32,7 @@ otelcol.receiver.influxdb "influxdb_metrics" {
 | `max_request_body_size`  | `string`       | Maximum request body size the server will allow.                | `20MiB`                                                    | no       |
 | `include_metadata`       | `boolean`      | Propagate incoming connection metadata to downstream consumers. |                                                            | no       |
 | `compression_algorithms` | `list(string)` | A list of compression algorithms the server can accept.         | `["", "gzip", "zstd", "zlib", "snappy", "deflate", "lz4"]` | no       |
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 By default, `otelcol.receiver.influxdb` listens for HTTP connections on `localhost`.
 To expose the HTTP server to other machines on your network, configure `endpoint` with the IP address to listen on, or `0.0.0.0:8086` to listen on all network interfaces.
@@ -150,6 +151,29 @@ prometheus.remote_write "mimir" {
 }
 ```
 
+## Enable authentication
+
+You can create a `otelcol.receiver.influxdb` component that requires authentication for requests. This is useful for limiting who can push data to the server. 
+
+{{< admonition type="note" >}}
+Not all OpenTelemetry Collector authentication plugins support receiver authentication.
+Refer to the [documentation](https://grafana.com/docs/alloy/<ALLOY_VERSION>/reference/components/otelcol/) for each `otelcol.auth.*` component to determine its compatibility.
+{{< /admonition >}}
+
+```alloy
+otelcol.receiver.influxdb "influxdb_metrics" {
+  output {
+    metrics = [...]
+  }
+  auth = otelcol.auth.basic.creds.handler
+}
+
+otelcol.auth.basic "creds" {
+    username = sys.env("USERNAME")
+    password = sys.env("PASSWORD")
+}
+```
+
 <!-- START GENERATED COMPATIBLE COMPONENTS -->
 
 ## Compatible components
diff --git a/docs/sources/reference/components/otelcol/otelcol.receiver.jaeger.md b/docs/sources/reference/components/otelcol/otelcol.receiver.jaeger.md
index b6685614cc..afacf77ba4 100644
--- a/docs/sources/reference/components/otelcol/otelcol.receiver.jaeger.md
+++ b/docs/sources/reference/components/otelcol/otelcol.receiver.jaeger.md
@@ -101,6 +101,7 @@ Name                     | Type      | Description
 `read_buffer_size`       | `string`  | Size of the read buffer the gRPC server will use for reading from clients. | `"512KiB"`        | no
 `write_buffer_size`      | `string`  | Size of the write buffer the gRPC server will use for writing to clients.  |                   | no
 `include_metadata`       | `boolean` | Propagate incoming connection metadata to downstream consumers.            |                   | no
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 ### tls block
 
@@ -154,6 +155,7 @@ Name                     | Type      | Description
 `max_request_body_size`  | `string`  | Maximum request body size the server will allow.                | `20MiB`           | no
 `include_metadata`       | `boolean` | Propagate incoming connection metadata to downstream consumers. |                   | no
 `compression_algorithms` | `list(string)` | A list of compression algorithms the server can accept.    | `["", "gzip", "zstd", "zlib", "snappy", "deflate", "lz4"]` | no
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 ### cors block
 
@@ -262,6 +264,37 @@ otelcol.exporter.otlp "default" {
 
 `otelcol.receiver.jaeger` supports [Gzip](https://en.wikipedia.org/wiki/Gzip) for compression.
 
+## Enable authentication
+
+You can create a `otelcol.receiver.jaeger` component that requires authentication for requests. This is useful for limiting who can push data to the server.
+
+{{< admonition type="note" >}}
+This functionality is currently limited to the GRPC/HTTP blocks.
+{{< /admonition >}} 
+
+{{< admonition type="note" >}}
+Not all OpenTelemetry Collector authentication plugins support receiver authentication.
+Refer to the [documentation](https://grafana.com/docs/alloy/<ALLOY_VERSION>/reference/components/otelcol/) for each `otelcol.auth.*` component to determine its compatibility.
+{{< /admonition >}} 
+
+```alloy
+otelcol.receiver.jaeger "default" {
+  protocols {
+    grpc {
+      auth = otelcol.auth.basic.creds.handler
+    }
+    thrift_http {
+      auth = otelcol.auth.basic.creds.handler
+    }
+  }
+}
+
+otelcol.auth.basic "creds" {
+    username = sys.env("USERNAME")
+    password = sys.env("PASSWORD")
+}
+```
+
 <!-- START GENERATED COMPATIBLE COMPONENTS -->
 
 ## Compatible components
diff --git a/docs/sources/reference/components/otelcol/otelcol.receiver.opencensus.md b/docs/sources/reference/components/otelcol/otelcol.receiver.opencensus.md
index b628adc8cc..dd13657b2e 100644
--- a/docs/sources/reference/components/otelcol/otelcol.receiver.opencensus.md
+++ b/docs/sources/reference/components/otelcol/otelcol.receiver.opencensus.md
@@ -47,11 +47,13 @@ Name | Type | Description | Default | Required
 `read_buffer_size` | `string` | Size of the read buffer the gRPC server will use for reading from clients. | `"512KiB"` | no
 `write_buffer_size` | `string` | Size of the write buffer the gRPC server will use for writing to clients. | | no
 `include_metadata` | `boolean` | Propagate incoming connection metadata to downstream consumers. | | no
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 `cors_allowed_origins` are the allowed [CORS](https://github.com/rs/cors) origins for HTTP/JSON requests.
 An empty list means that CORS is not enabled at all. A wildcard (*) can be
 used to match any origin or one or more characters of an origin.
 
+
 The "endpoint" parameter is the same for both gRPC and HTTP/JSON, as the protocol is recognized and processed accordingly.
 
 To write traces with HTTP/JSON, `POST` to `[address]/v1/trace`. The JSON message format parallels the gRPC protobuf format. For details, refer to its [OpenApi specification](https://github.com/census-instrumentation/opencensus-proto/blob/master/gen-openapi/opencensus/proto/agent/trace/v1/trace_service.swagger.json).
@@ -207,6 +209,26 @@ otelcol.exporter.otlp "default" {
     }
 }
 ```
+
+## Enable authentication
+
+You can create a `otelcol.receiver.opencensus` component that requires authentication for requests. This is useful for limiting who can push data to the server. 
+
+{{< admonition type="note" >}}
+Not all OpenTelemetry Collector authentication plugins support receiver authentication.
+Refer to the [documentation](https://grafana.com/docs/alloy/<ALLOY_VERSION>/reference/components/otelcol/) for each `otelcol.auth.*` component to determine its compatibility.
+{{< /admonition >}} 
+
+```alloy
+otelcol.receiver.opencensus "default" {
+  auth = otelcol.auth.basic.creds.handler
+}
+
+otelcol.auth.basic "creds" {
+    username = sys.env("USERNAME")
+    password = sys.env("PASSWORD")
+}
+```
 <!-- START GENERATED COMPATIBLE COMPONENTS -->
 
 ## Compatible components
diff --git a/docs/sources/reference/components/otelcol/otelcol.receiver.otlp.md b/docs/sources/reference/components/otelcol/otelcol.receiver.otlp.md
index e1ecbf79ba..862e2bb4c1 100644
--- a/docs/sources/reference/components/otelcol/otelcol.receiver.otlp.md
+++ b/docs/sources/reference/components/otelcol/otelcol.receiver.otlp.md
@@ -85,6 +85,7 @@ Name | Type | Description | Default | Required
 `read_buffer_size` | `string` | Size of the read buffer the gRPC server will use for reading from clients. | `"512KiB"` | no
 `write_buffer_size` | `string` | Size of the write buffer the gRPC server will use for writing to clients. | | no
 `include_metadata` | `boolean` | Propagate incoming connection metadata to downstream consumers. | | no
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 ### tls block
 
@@ -145,6 +146,7 @@ Name | Type | Description | Default         | Required
 `metrics_url_path` | `string` | The URL path to receive metrics on. | `"/v1/metrics"` | no
 `logs_url_path` | `string` | The URL path to receive logs on. | `"/v1/logs"`    | no
 `compression_algorithms` | `list(string)` | A list of compression algorithms the server can accept.    | `["", "gzip", "zstd", "zlib", "snappy", "deflate", "lz4"]` | no
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 To send telemetry signals to `otelcol.receiver.otlp` with HTTP/JSON, POST to:
 * `[endpoint][traces_url_path]` for traces.
@@ -240,6 +242,35 @@ otelcol.exporter.otlp "default" {
 ## Technical details
 
 `otelcol.receiver.otlp` supports [gzip](https://en.wikipedia.org/wiki/Gzip) for compression.
+
+## Enable authentication
+
+You can create a `otelcol.reciever.otlp` component that requires authentication for requests. This is useful for limiting who can push data to the server. 
+
+{{< admonition type="note" >}}
+Not all OpenTelemetry Collector authentication plugins support receiver authentication.
+Refer to the [documentation](https://grafana.com/docs/alloy/<ALLOY_VERSION>/reference/components/otelcol/) for each `otelcol.auth.*` component to determine its compatibility.
+{{< /admonition >}} 
+
+```alloy
+otelcol.receiver.otlp "default" {
+  http {
+    auth = otelcol.auth.basic.creds.handler
+  }
+  grpc {
+     auth = otelcol.auth.basic.creds.handler
+  }
+
+  output {
+   ...
+  }
+}
+
+otelcol.auth.basic "creds" {
+    username = sys.env("USERNAME")
+    password = sys.env("PASSWORD")
+}
+```
 <!-- START GENERATED COMPATIBLE COMPONENTS -->
 
 ## Compatible components
diff --git a/docs/sources/reference/components/otelcol/otelcol.receiver.zipkin.md b/docs/sources/reference/components/otelcol/otelcol.receiver.zipkin.md
index f5f66d4bca..7e9ce32459 100644
--- a/docs/sources/reference/components/otelcol/otelcol.receiver.zipkin.md
+++ b/docs/sources/reference/components/otelcol/otelcol.receiver.zipkin.md
@@ -39,6 +39,7 @@ Name | Type | Description | Default | Required
 `max_request_body_size` | `string`   | Maximum request body size the server will allow.                   | `20MiB`          | no
 `include_metadata` | `boolean` | Propagate incoming connection metadata to downstream consumers. | | no
 `compression_algorithms` | `list(string)` | A list of compression algorithms the server can accept.    | `["", "gzip", "zstd", "zlib", "snappy", "deflate", "lz4"]` | no
+`auth`              | `capsule(otelcol.Handler)` | Handler from an `otelcol.auth` component to use for authenticating requests.     |               | no
 
 If `parse_string_tags` is `true`, string tags and binary annotations are
 converted to `int`, `bool`, and `float` if possible. String tags and binary
@@ -141,6 +142,26 @@ otelcol.exporter.otlp "default" {
   }
 }
 ```
+
+## Enable authentication
+
+You can create a `otelcol.receiver.zipkin` component that requires authentication for requests. This is useful for limiting who can push data to the server. 
+
+{{< admonition type="note" >}}
+Not all OpenTelemetry Collector authentication plugins support receiver authentication.
+Refer to the [documentation](https://grafana.com/docs/alloy/<ALLOY_VERSION>/reference/components/otelcol/) for each `otelcol.auth.*` component to determine its compatibility.
+{{< /admonition >}} 
+
+```alloy
+otelcol.receiver.zipkin "default" {
+  auth = otelcol.auth.basic.creds.handler
+}
+
+otelcol.auth.basic "creds" {
+    username = sys.env("USERNAME")
+    password = sys.env("PASSWORD")
+}
+```
 <!-- START GENERATED COMPATIBLE COMPONENTS -->
 
 ## Compatible components
diff --git a/docs/sources/reference/components/prometheus/prometheus.write.queue.md b/docs/sources/reference/components/prometheus/prometheus.write.queue.md
index c8f2eeb397..d05ef8f40c 100644
--- a/docs/sources/reference/components/prometheus/prometheus.write.queue.md
+++ b/docs/sources/reference/components/prometheus/prometheus.write.queue.md
@@ -48,11 +48,13 @@ The following arguments are supported:
 The following blocks are supported inside the definition of
 `prometheus.write.queue`:
 
- Hierarchy             | Block           | Description                                              | Required 
------------------------|-----------------|----------------------------------------------------------|----------
- persistence           | [persistence][] | Configuration for persistence                            | no       
- endpoint              | [endpoint][]    | Location to send metrics to.                             | no       
- endpoint > basic_auth | [basic_auth][]  | Configure basic_auth for authenticating to the endpoint. | no       
+ Hierarchy             | Block            | Description                                              | Required 
+-----------------------|------------------|----------------------------------------------------------|----------
+ persistence           | [persistence][]  | Configuration for persistence                            | no       
+ endpoint              | [endpoint][]     | Location to send metrics to.                             | no       
+ endpoint > basic_auth | [basic_auth][]   | Configure basic_auth for authenticating to the endpoint. | no       
+ endpoint > tls_config | [tls_config][]   | Configure TLS settings for connecting to the endpoint.   | no
+
 
 The `>` symbol indicates deeper levels of nesting. For example, `endpoint >
 basic_auth` refers to a `basic_auth` block defined inside an
@@ -61,6 +63,8 @@ basic_auth` refers to a `basic_auth` block defined inside an
 [endpoint]: #endpoint-block
 [basic_auth]: #basic_auth-block
 [persistence]: #persistence-block
+[tls_config]: #tls_config-block
+
 
 ### persistence block
 
@@ -83,17 +87,19 @@ The `endpoint` block describes a single location to send metrics to. Multiple
 
 The following arguments are supported:
 
- Name                 | Type          | Description                                                     | Default | Required 
-----------------------|---------------|-----------------------------------------------------------------|---------|----------
- `url`                | `string`      | Full URL to send metrics to.                                    |         | yes      
-`bearer_token`        | `secret`      | Bearer token to authenticate with.                              |         | no
- `write_timeout`      | `duration`    | Timeout for requests made to the URL.                           | `"30s"` | no       
- `retry_backoff`      | `duration`    | How long to wait between retries.                               | `1s`    | no       
- `max_retry_attempts` | `uint`        | Maximum number of retries before dropping the batch.            | `0`     | no      
- `batch_count`        | `uint`        | How many series to queue in each queue.                         | `1000`  | no       
- `flush_interval`     | `duration`    | How long to wait until sending if `batch_count` is not trigger. | `1s`    | no       
- `parallelism`        | `uint`        | How many parallel batches to write.                             | 10      | no       
- `external_labels`    | `map(string)` | Labels to add to metrics sent over the network.                 |         | no       
+ Name                 | Type          | Description                                                                                 | Default | Required 
+----------------------|---------------|---------------------------------------------------------------------------------------------|---------|----------
+ `url`                | `string`      | Full URL to send metrics to.                                                                |         | yes      
+ `bearer_token`        | `secret`      | Bearer token to authenticate with.                                                          |         | no
+ `write_timeout`      | `duration`    | Timeout for requests made to the URL.                                                       | `"30s"` | no       
+ `retry_backoff`      | `duration`    | How long to wait between retries.                                                           | `1s`    | no       
+ `max_retry_attempts` | `uint`        | Maximum number of retries before dropping the batch.                                        | `0`     | no      
+ `batch_count`        | `uint`        | How many series to queue in each queue.                                                     | `1000`  | no       
+ `flush_interval`     | `duration`    | How long to wait until sending if `batch_count` is not trigger.                             | `1s`    | no       
+ `parallelism`        | `uint`        | How many parallel batches to write.                                                         | 10      | no       
+ `external_labels`    | `map(string)` | Labels to add to metrics sent over the network.                                             |         | no       
+ `enable_round_robin` | `bool`        | Use round robin load balancing when there are multiple IPs for a given endpoint. | `false` | no       
+
 
 ### basic_auth block
 
@@ -102,6 +108,9 @@ Name            | Type     | Description                              | Default
 `password`      | `secret` | Basic auth password.                     |         | no
 `username`      | `string` | Basic auth username.                     |         | no
 
+### tls_config block
+
+{{< docs/shared lookup="reference/components/tls-config-block.md" source="alloy" version="<ALLOY_VERSION>" >}}
 
 ## Exported fields
 
diff --git a/example/compose.yaml b/example/compose.yaml
index 720a1d8726..7f51d76e7d 100644
--- a/example/compose.yaml
+++ b/example/compose.yaml
@@ -6,7 +6,7 @@ include:
 
 services:
   alloy:
-    image: grafana/alloy:v1.0.0
+    image: grafana/alloy:v1.5.1
     pull_policy: always
     profiles: ["alloy"]
     restart: on-failure
diff --git a/go.mod b/go.mod
index 0a2c9a0e77..fd31139ae4 100644
--- a/go.mod
+++ b/go.mod
@@ -73,7 +73,7 @@ require (
 	github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc
 	github.com/grafana/tail v0.0.0-20230510142333-77b18831edf0
 	github.com/grafana/vmware_exporter v0.0.5-beta
-	github.com/grafana/walqueue v0.0.0-20241211144301-2b91b7dd6e08
+	github.com/grafana/walqueue v0.0.0-20250113171943-e5fe545d1408
 	github.com/hashicorp/consul/api v1.30.0
 	github.com/hashicorp/go-discover v0.0.0-20230724184603-e89ebd1b2f65
 	github.com/hashicorp/go-multierror v1.1.1
@@ -249,12 +249,12 @@ require (
 	go.uber.org/goleak v1.3.0
 	go.uber.org/multierr v1.11.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/crypto v0.31.0
+	golang.org/x/crypto v0.32.0
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20240208163226-62c9f1799c91
 	golang.org/x/exp v0.0.0-20241210194714-1829a127f884
 	golang.org/x/net v0.33.0
 	golang.org/x/oauth2 v0.24.0
-	golang.org/x/sys v0.28.0
+	golang.org/x/sys v0.29.0
 	golang.org/x/text v0.21.0
 	golang.org/x/time v0.6.0
 	golang.org/x/tools v0.28.0
@@ -603,7 +603,7 @@ require (
 	github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/josharian/native v1.1.0 // indirect
-	github.com/joyent/triton-go v0.0.0-20180628001255-830d2b111e62 // indirect
+	github.com/joyent/triton-go v1.8.5 // indirect
 	github.com/jpillora/backoff v1.0.0 // indirect
 	github.com/jsimonetti/rtnetlink v1.3.5 // indirect
 	github.com/julienschmidt/httprouter v1.3.0 // indirect
@@ -803,7 +803,7 @@ require (
 	golang.org/x/arch v0.7.0 // indirect
 	golang.org/x/mod v0.22.0 // indirect
 	golang.org/x/sync v0.10.0
-	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	gonum.org/v1/gonum v0.15.1 // indirect
@@ -880,6 +880,7 @@ require (
 require (
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/typeurl/v2 v2.2.0 // indirect
+	github.com/deneonet/benc v1.1.2 // indirect
 	github.com/onsi/ginkgo/v2 v2.21.0 // indirect
 	github.com/onsi/gomega v1.35.1 // indirect
 	go.etcd.io/bbolt v1.3.11 // indirect
diff --git a/go.sum b/go.sum
index 317fdd4b22..9e6ea084cf 100644
--- a/go.sum
+++ b/go.sum
@@ -1302,6 +1302,7 @@ github.com/couchbase/gomemcached v0.0.0-20180502221210-0da75df14530/go.mod h1:sr
 github.com/couchbase/goutils v0.0.0-20180530154633-e865a1461c8a/go.mod h1:BQwMFlJzDjFDG3DJUdU0KORxn88UlsOULuxLExMh3Hs=
 github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
 github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
+github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
@@ -1324,6 +1325,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/deneonet/benc v1.1.2 h1:JNJSnA53zVLjt4Bz1HwxG4tQg475LP+kd8rgUuV4tc4=
+github.com/deneonet/benc v1.1.2/go.mod h1:HbL4lzHT0jkmlYa36bZw0a0Nhj4NsXG7bd/bXRxJYy4=
 github.com/denisenkom/go-mssqldb v0.0.0-20180620032804-94c9c97e8c9f/go.mod h1:xN/JuLBIz4bjkxNmByTiV1IbhfnYb6oo99phBn4Eqhc=
 github.com/denisenkom/go-mssqldb v0.0.0-20190707035753-2be1aa521ff4/go.mod h1:zAg7JM8CkOJ43xKXIj7eRO9kmWm/TW578qo+oDO6tuM=
 github.com/dennwc/btrfs v0.0.0-20230312211831-a1f570bd01a1 h1:ue4Es4Xzz255hWQ7NAWzZxuXG+YOV7URzzusLLSe0zU=
@@ -1909,8 +1912,8 @@ github.com/grafana/tail v0.0.0-20230510142333-77b18831edf0 h1:bjh0PVYSVVFxzINqPF
 github.com/grafana/tail v0.0.0-20230510142333-77b18831edf0/go.mod h1:7t5XR+2IA8P2qggOAHTj/GCZfoLBle3OvNSYh1VkRBU=
 github.com/grafana/vmware_exporter v0.0.5-beta h1:2JCqzIWJzns8FN78wPsueC9rT3e3kZo2OUoL5kGMjdM=
 github.com/grafana/vmware_exporter v0.0.5-beta/go.mod h1:1CecUZII0zVsVcHtNfNeTTcxK7EksqAsAn/TCCB0Mh4=
-github.com/grafana/walqueue v0.0.0-20241211144301-2b91b7dd6e08 h1:5J0oLMTpZHwoY95A8milCZajdZQecpnBwOPKBheHw6M=
-github.com/grafana/walqueue v0.0.0-20241211144301-2b91b7dd6e08/go.mod h1:2B+4gxoOgzgRhstKcikROUHusMXLqd5nE/UKukaQrJI=
+github.com/grafana/walqueue v0.0.0-20250113171943-e5fe545d1408 h1:TGoFWafEVwzy4Wg0L2PPQonwTKYaqa8kMpiAxiEvXW8=
+github.com/grafana/walqueue v0.0.0-20250113171943-e5fe545d1408/go.mod h1:Hisxv1n+PxFQEkayynKy+B4AiJiJVRKHKT/8ng6jgOM=
 github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grobie/gomemcache v0.0.0-20230213081705-239240bbc445 h1:FlKQKUYPZ5yDCN248M3R7x8yu2E3yEZ0H7aLomE4EoE=
 github.com/grobie/gomemcache v0.0.0-20230213081705-239240bbc445/go.mod h1:L69/dBlPQlWkcnU76WgcppK5e4rrxzQdi6LhLnK/ytA=
@@ -2197,6 +2200,7 @@ github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrU
 github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
 github.com/jackc/pgtype v1.14.0 h1:y+xUdabmyMkJLyApYuPj38mW+aAIqCe5uuBB51rH3Vw=
 github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgx v3.3.0+incompatible/go.mod h1:0ZGrqGqkRlliWnWB4zKnWtjbSWbGkVEFm4TeybAXq+I=
 github.com/jackc/pgx v3.6.0+incompatible/go.mod h1:0ZGrqGqkRlliWnWB4zKnWtjbSWbGkVEFm4TeybAXq+I=
 github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
 github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
@@ -2250,8 +2254,9 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
 github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
-github.com/joyent/triton-go v0.0.0-20180628001255-830d2b111e62 h1:JHCT6xuyPUrbbgAPE/3dqlvUKzRHMNuTBKKUb6OeR/k=
 github.com/joyent/triton-go v0.0.0-20180628001255-830d2b111e62/go.mod h1:U+RSyWxWd04xTqnuOQxnai7XGS2PrPY2cfGoDKtMHjA=
+github.com/joyent/triton-go v1.8.5 h1:AXc1BJP3YGAvQXIdhdJt/PiARN5arHNXWK6Q6FeBing=
+github.com/joyent/triton-go v1.8.5/go.mod h1:meGUPVGmmm+vhjIsOzfmJtuKpapVfWXJhUSLsr7Sv40=
 github.com/jpillora/backoff v0.0.0-20180909062703-3050d21c67d7/go.mod h1:2iMrUgbbvHEiQClaW2NsSzMyGHqN+rDFqY705q49KG0=
 github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
@@ -2346,6 +2351,7 @@ github.com/lib/pq v0.0.0-20180327071824-d34b9ff171c2/go.mod h1:5WUZQaWbwv1U+lTRe
 github.com/lib/pq v0.0.0-20180523175426-90697d60dd84/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
@@ -2371,6 +2377,7 @@ github.com/mackerelio/go-osstat v0.2.5 h1:+MqTbZUhoIt4m8qzkVoXUJg1EuifwlAJSk4Yl2
 github.com/mackerelio/go-osstat v0.2.5/go.mod h1:atxwWF+POUZcdtR1wnsUcQxTytoHG4uhl2AKKzrOajY=
 github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
 github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
+github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
@@ -2407,6 +2414,7 @@ github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/mattn/go-runewidth v0.0.3/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
@@ -2564,6 +2572,7 @@ github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DV
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
+github.com/olekukonko/tablewriter v0.0.0-20180130162743-b8a9be070da4/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/oliver006/redis_exporter v1.54.0 h1:Z60r78IW+OqHz0v8Ocfg8Nz7wKz7NB9+eJa+EkQQicQ=
@@ -2964,8 +2973,10 @@ github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWN
 github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
 github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
+github.com/rs/zerolog v1.4.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
+github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
@@ -2991,6 +3002,8 @@ github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdh
 github.com/satori/go.uuid v1.2.1-0.20181028125025-b2ce2384e17b/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/scaleway/scaleway-sdk-go v1.0.0-beta.29 h1:BkTk4gynLjguayxrYxZoMZjBnAOh7ntQvUkOFmkMqPU=
 github.com/scaleway/scaleway-sdk-go v1.0.0-beta.29/go.mod h1:fCa7OJZ/9DRTnOKmxvT6pn+LPWUptQAmHF/SBJUGEcg=
+github.com/sean-/conswriter v0.0.0-20180208195008-f5ae3917a627/go.mod h1:7zjs06qF79/FKAJpBvFx3P8Ww4UTIMAe+lpNXDHziac=
+github.com/sean-/pager v0.0.0-20180208200047-666be9bf53b5/go.mod h1:BeybITEsBEg6qbIiqJ6/Bqeq25bCLbL7YFmpaFfJDuM=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
@@ -3068,6 +3081,7 @@ github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasO
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
 github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
@@ -3079,6 +3093,7 @@ github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkU
 github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
 github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
 github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
 github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
 github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
@@ -3091,6 +3106,8 @@ github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnIn
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
+github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/spf13/viper v1.6.2/go.mod h1:t3iDnF5Jlj76alVNuyFBk5oUMCvsrkbvZK0WQdfDi5k=
 github.com/spf13/viper v1.19.0 h1:RWq5SEjt8o25SROyN3z2OrDB9l7RPd3lwTWU8EcEdcI=
 github.com/spf13/viper v1.19.0/go.mod h1:GQUN9bilAbhU/jgc1bKs99f/suXKeUMct8Adx5+Ntkg=
@@ -3169,6 +3186,7 @@ github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVK
 github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
+github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
 github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
@@ -3533,6 +3551,7 @@ golang.org/x/arch v0.7.0 h1:pskyeJh/3AmoQ8CPE95vxHLqp1G1GfGNXTmcl9NEKTc=
 golang.org/x/arch v0.7.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
@@ -3575,8 +3594,8 @@ golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20240208163226-62c9f1799c91 h1:Lyizcy9jX02jYR0ceBkL6S+jRys8Uepf7wt1vrz6Ras=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20240208163226-62c9f1799c91/go.mod h1:kNa9WdvYnzFwC79zRpLRMJbdEFlhyM5RPFBBZp/wWH8=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -3799,6 +3818,7 @@ golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -3928,8 +3948,8 @@ golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -3948,8 +3968,8 @@ golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
+golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/internal/component/database_observability/mysql/collector/connection_info.go b/internal/component/database_observability/mysql/collector/connection_info.go
index bd890788a0..5b9aec35b2 100644
--- a/internal/component/database_observability/mysql/collector/connection_info.go
+++ b/internal/component/database_observability/mysql/collector/connection_info.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/go-sql-driver/mysql"
 	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/atomic"
 )
 
 var rdsRegex = regexp.MustCompile(`(?P<identifier>[^\.]+)\.([^\.]+)\.(?P<region>[^\.]+)\.rds\.amazonaws\.com`)
@@ -21,6 +22,8 @@ type ConnectionInfo struct {
 	DSN        string
 	Registry   *prometheus.Registry
 	InfoMetric *prometheus.GaugeVec
+
+	running *atomic.Bool
 }
 
 func NewConnectionInfo(args ConnectionInfoArguments) (*ConnectionInfo, error) {
@@ -35,15 +38,22 @@ func NewConnectionInfo(args ConnectionInfoArguments) (*ConnectionInfo, error) {
 		DSN:        args.DSN,
 		Registry:   args.Registry,
 		InfoMetric: infoMetric,
+		running:    &atomic.Bool{},
 	}, nil
 }
 
+func (c *ConnectionInfo) Name() string {
+	return "ConnectionInfo"
+}
+
 func (c *ConnectionInfo) Start(ctx context.Context) error {
 	cfg, err := mysql.ParseDSN(c.DSN)
 	if err != nil {
 		return err
 	}
 
+	c.running.Store(true)
+
 	var (
 		providerName         = "unknown"
 		providerRegion       = "unknown"
@@ -66,6 +76,11 @@ func (c *ConnectionInfo) Start(ctx context.Context) error {
 	return nil
 }
 
+func (c *ConnectionInfo) Stopped() bool {
+	return !c.running.Load()
+}
+
 func (c *ConnectionInfo) Stop() {
 	c.Registry.Unregister(c.InfoMetric)
+	c.running.Store(false)
 }
diff --git a/internal/component/database_observability/mysql/collector/query_sample.go b/internal/component/database_observability/mysql/collector/query_sample.go
index f06ef5907c..d00f08f0e6 100644
--- a/internal/component/database_observability/mysql/collector/query_sample.go
+++ b/internal/component/database_observability/mysql/collector/query_sample.go
@@ -5,12 +5,12 @@ import (
 	"database/sql"
 	"fmt"
 	"strings"
-	"sync/atomic"
 	"time"
 
 	"github.com/go-kit/log"
 	"github.com/prometheus/common/model"
 	"github.com/xwb1989/sqlparser"
+	"go.uber.org/atomic"
 
 	"github.com/grafana/alloy/internal/component/common/loki"
 	"github.com/grafana/alloy/internal/component/database_observability"
@@ -57,11 +57,15 @@ func NewQuerySample(args QuerySampleArguments) (*QuerySample, error) {
 		dbConnection:    args.DB,
 		collectInterval: args.CollectInterval,
 		entryHandler:    args.EntryHandler,
-		logger:          args.Logger,
+		logger:          log.With(args.Logger, "collector", "QuerySample"),
 		running:         &atomic.Bool{},
 	}, nil
 }
 
+func (c *QuerySample) Name() string {
+	return "QuerySample"
+}
+
 func (c *QuerySample) Start(ctx context.Context) error {
 	level.Debug(c.logger).Log("msg", "QuerySample collector started")
 
@@ -81,6 +85,7 @@ func (c *QuerySample) Start(ctx context.Context) error {
 		for {
 			if err := c.fetchQuerySamples(c.ctx); err != nil {
 				level.Error(c.logger).Log("msg", "collector stopping due to error", "err", err)
+				c.Stop()
 				break
 			}
 
@@ -127,7 +132,7 @@ func (c *QuerySample) fetchQuerySamples(ctx context.Context) error {
 		}
 
 		if strings.HasSuffix(sampleText, "...") {
-			level.Info(c.logger).Log("msg", "skipping parsing truncated query", "digest", digest)
+			level.Debug(c.logger).Log("msg", "skipping parsing truncated query", "digest", digest)
 			continue
 		}
 
diff --git a/internal/component/database_observability/mysql/collector/schema_table.go b/internal/component/database_observability/mysql/collector/schema_table.go
index 89d50f1ba1..67dbd07f0f 100644
--- a/internal/component/database_observability/mysql/collector/schema_table.go
+++ b/internal/component/database_observability/mysql/collector/schema_table.go
@@ -10,6 +10,7 @@ import (
 	"github.com/grafana/loki/v3/pkg/logproto"
 	"github.com/hashicorp/golang-lru/v2/expirable"
 	"github.com/prometheus/common/model"
+	"go.uber.org/atomic"
 
 	"github.com/grafana/alloy/internal/component/common/loki"
 	"github.com/grafana/alloy/internal/component/database_observability"
@@ -66,10 +67,10 @@ type SchemaTable struct {
 	// TODO(cristian): allow configuring cache size (currently unlimited).
 	cache *expirable.LRU[string, tableInfo]
 
-	logger log.Logger
-
-	ctx    context.Context
-	cancel context.CancelFunc
+	logger  log.Logger
+	running *atomic.Bool
+	ctx     context.Context
+	cancel  context.CancelFunc
 }
 
 type tableInfo struct {
@@ -86,18 +87,29 @@ func NewSchemaTable(args SchemaTableArguments) (*SchemaTable, error) {
 		collectInterval: args.CollectInterval,
 		entryHandler:    args.EntryHandler,
 		cache:           expirable.NewLRU[string, tableInfo](0, nil, args.CacheTTL),
-		logger:          args.Logger,
+		logger:          log.With(args.Logger, "collector", "SchemaTable"),
+		running:         &atomic.Bool{},
 	}, nil
 }
 
+func (c *SchemaTable) Name() string {
+	return "SchemaTable"
+}
+
 func (c *SchemaTable) Start(ctx context.Context) error {
 	level.Debug(c.logger).Log("msg", "SchemaTable collector started")
 
+	c.running.Store(true)
 	ctx, cancel := context.WithCancel(ctx)
 	c.ctx = ctx
 	c.cancel = cancel
 
 	go func() {
+		defer func() {
+			c.Stop()
+			c.running.Store(false)
+		}()
+
 		ticker := time.NewTicker(c.collectInterval)
 
 		for {
@@ -119,6 +131,10 @@ func (c *SchemaTable) Start(ctx context.Context) error {
 	return nil
 }
 
+func (c *SchemaTable) Stopped() bool {
+	return !c.running.Load()
+}
+
 // Stop should be kept idempotent
 func (c *SchemaTable) Stop() {
 	c.cancel()
@@ -155,6 +171,11 @@ func (c *SchemaTable) extractSchema(ctx context.Context) error {
 		}
 	}
 
+	if len(schemas) == 0 {
+		level.Info(c.logger).Log("msg", "no schema detected from information_schema.schemata")
+		return nil
+	}
+
 	tables := []tableInfo{}
 
 	for _, schema := range schemas {
diff --git a/internal/component/database_observability/mysql/component.go b/internal/component/database_observability/mysql/component.go
index a7171b81a6..e57d890f23 100644
--- a/internal/component/database_observability/mysql/component.go
+++ b/internal/component/database_observability/mysql/component.go
@@ -15,6 +15,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/prometheus/common/model"
+	"go.uber.org/atomic"
 
 	"github.com/grafana/alloy/internal/component"
 	"github.com/grafana/alloy/internal/component/common/loki"
@@ -79,12 +80,15 @@ type Exports struct {
 }
 
 var (
-	_ component.Component    = (*Component)(nil)
-	_ http_service.Component = (*Component)(nil)
+	_ component.Component       = (*Component)(nil)
+	_ http_service.Component    = (*Component)(nil)
+	_ component.HealthComponent = (*Component)(nil)
 )
 
 type Collector interface {
+	Name() string
 	Start(context.Context) error
+	Stopped() bool
 	Stop()
 }
 
@@ -98,6 +102,7 @@ type Component struct {
 	baseTarget   discovery.Target
 	collectors   []Collector
 	dbConnection *sql.DB
+	healthErr    *atomic.String
 }
 
 func New(opts component.Options, args Arguments) (*Component, error) {
@@ -107,6 +112,7 @@ func New(opts component.Options, args Arguments) (*Component, error) {
 		receivers: args.ForwardTo,
 		handler:   loki.NewLogsReceiver(),
 		registry:  prometheus.NewRegistry(),
+		healthErr: atomic.NewString(""),
 	}
 
 	baseTarget, err := c.getBaseTarget()
@@ -184,6 +190,16 @@ func (c *Component) Update(args component.Arguments) error {
 
 	c.args = args.(Arguments)
 
+	if err := c.startCollectors(); err != nil {
+		c.healthErr.Store(err.Error())
+		return err
+	}
+
+	c.healthErr.Store("")
+	return nil
+}
+
+func (c *Component) startCollectors() error {
 	dbConnection, err := sql.Open("mysql", formatDSN(string(c.args.DataSourceName), "parseTime=true"))
 	if err != nil {
 		return err
@@ -254,6 +270,40 @@ func (c *Component) Handler() http.Handler {
 	return promhttp.HandlerFor(c.registry, promhttp.HandlerOpts{})
 }
 
+func (c *Component) CurrentHealth() component.Health {
+	if err := c.healthErr.Load(); err != "" {
+		return component.Health{
+			Health:     component.HealthTypeUnhealthy,
+			Message:    err,
+			UpdateTime: time.Now(),
+		}
+	}
+
+	var unhealthyCollectors []string
+
+	c.mut.RLock()
+	for _, collector := range c.collectors {
+		if collector.Stopped() {
+			unhealthyCollectors = append(unhealthyCollectors, collector.Name())
+		}
+	}
+	c.mut.RUnlock()
+
+	if len(unhealthyCollectors) > 0 {
+		return component.Health{
+			Health:     component.HealthTypeUnhealthy,
+			Message:    "One or more collectors are unhealthy: [" + strings.Join(unhealthyCollectors, ", ") + "]",
+			UpdateTime: time.Now(),
+		}
+	}
+
+	return component.Health{
+		Health:     component.HealthTypeHealthy,
+		Message:    "All collectors are healthy",
+		UpdateTime: time.Now(),
+	}
+}
+
 // instanceKey returns network(hostname:port)/dbname of the MySQL server.
 // This is the same key as used by the mysqld_exporter integration.
 func (c *Component) instanceKey() string {
diff --git a/internal/component/faro/receiver/receiver_otelcol_test.go b/internal/component/faro/receiver/receiver_otelcol_test.go
index 15d39d0e69..b298bc1285 100644
--- a/internal/component/faro/receiver/receiver_otelcol_test.go
+++ b/internal/component/faro/receiver/receiver_otelcol_test.go
@@ -78,7 +78,7 @@ func TestWithOtelcolConsumer(t *testing.T) {
 		err := otelcolExporter.Run(ctx, otlphttp.Arguments{
 			Client: otlphttp.HTTPClientArguments(otelcol.HTTPClientArguments{
 				Endpoint: finalOtelServer.URL,
-				Auth:     &otelcolAuthHeaderExport.Handler,
+				Authentication:     otelcolAuthHeaderExport.Handler,
 				TLS: otelcol.TLSClientArguments{
 					Insecure:           true,
 					InsecureSkipVerify: true,
diff --git a/internal/component/loki/secretfilter/secretfilter.go b/internal/component/loki/secretfilter/secretfilter.go
index ec6b11dd19..071ba481c4 100644
--- a/internal/component/loki/secretfilter/secretfilter.go
+++ b/internal/component/loki/secretfilter/secretfilter.go
@@ -29,7 +29,6 @@ type Rule struct {
 	name        string
 	regex       *regexp.Regexp
 	secretGroup int
-	description string
 	allowlist   []AllowRule
 }
 
@@ -98,19 +97,20 @@ type Component struct {
 type GitLeaksConfig struct {
 	AllowList struct {
 		Description string
-		Paths       []string
 		Regexes     []string
 	}
 	Rules []struct {
 		ID          string
-		Description string
 		Regex       string
-		Keywords    []string
 		SecretGroup int
 
+		// Old format, kept for compatibility
 		Allowlist struct {
-			StopWords []string
-			Regexes   []string
+			Regexes []string
+		}
+		// New format
+		Allowlists []struct {
+			Regexes []string
 		}
 	}
 }
@@ -194,16 +194,16 @@ func (c *Component) processEntry(entry loki.Entry) loki.Entry {
 
 			// Check if the secret is in the allowlist
 			var allowRule *AllowRule = nil
-			// First check the rule-specific allowlist
-			for _, a := range r.allowlist {
+			// First check the global allowlist
+			for _, a := range c.AllowList {
 				if a.Regex.MatchString(secret) {
 					allowRule = &a
 					break
 				}
 			}
-			// Then check the global allowlist
+			// Then check the rule-specific allowlists
 			if allowRule == nil {
-				for _, a := range c.AllowList {
+				for _, a := range r.allowlist {
 					if a.Regex.MatchString(secret) {
 						allowRule = &a
 						break
@@ -231,8 +231,21 @@ func (c *Component) redactLine(line string, secret string, ruleName string) stri
 		redactWith = strings.ReplaceAll(redactWith, "$SECRET_NAME", ruleName)
 		redactWith = strings.ReplaceAll(redactWith, "$SECRET_HASH", hashSecret(secret))
 	}
-	if c.args.PartialMask > 0 {
-		redactWith = secret[:c.args.PartialMask] + redactWith
+
+	// If partialMask is set, show the first N characters of the secret
+	partialMask := int(c.args.PartialMask)
+	if partialMask < 0 {
+		partialMask = 0
+	}
+	runesSecret := []rune(secret)
+	// Only do it if the secret is long enough
+	if partialMask > 0 && len(runesSecret) >= 6 {
+		// Show at most half of the secret
+		if partialMask > len(runesSecret)/2 {
+			partialMask = len(runesSecret) / 2
+		}
+		prefix := string(runesSecret[:partialMask])
+		redactWith = prefix + redactWith
 	}
 
 	line = strings.ReplaceAll(line, secret, redactWith)
@@ -306,12 +319,21 @@ func (c *Component) Update(args component.Arguments) error {
 			}
 			allowlist = append(allowlist, AllowRule{Regex: re, Source: fmt.Sprintf("rule %s", rule.ID)})
 		}
+		for _, currAllowList := range rule.Allowlists {
+			for _, r := range currAllowList.Regexes {
+				re, err := regexp.Compile(r)
+				if err != nil {
+					level.Error(c.opts.Logger).Log("msg", "error compiling allowlist regex", "error", err)
+					return err
+				}
+				allowlist = append(allowlist, AllowRule{Regex: re, Source: fmt.Sprintf("rule %s", rule.ID)})
+			}
+		}
 
 		newRule := Rule{
 			name:        rule.ID,
 			regex:       re,
 			secretGroup: rule.SecretGroup,
-			description: rule.Description,
 			allowlist:   allowlist,
 		}
 
@@ -325,23 +347,23 @@ func (c *Component) Update(args component.Arguments) error {
 	}
 
 	// Compiling global allowlist regexes
-	// From the Gitleaks config
-	for _, r := range gitleaksCfg.AllowList.Regexes {
+	// From the arguments
+	for _, r := range c.args.AllowList {
 		re, err := regexp.Compile(r)
 		if err != nil {
 			level.Error(c.opts.Logger).Log("msg", "error compiling allowlist regex", "error", err)
 			return err
 		}
-		c.AllowList = append(c.AllowList, AllowRule{Regex: re, Source: "gitleaks config"})
+		c.AllowList = append(c.AllowList, AllowRule{Regex: re, Source: "alloy config"})
 	}
-	// From the arguments
-	for _, r := range c.args.AllowList {
+	// From the Gitleaks config
+	for _, r := range gitleaksCfg.AllowList.Regexes {
 		re, err := regexp.Compile(r)
 		if err != nil {
 			level.Error(c.opts.Logger).Log("msg", "error compiling allowlist regex", "error", err)
 			return err
 		}
-		c.AllowList = append(c.AllowList, AllowRule{Regex: re, Source: "alloy config"})
+		c.AllowList = append(c.AllowList, AllowRule{Regex: re, Source: "gitleaks config"})
 	}
 
 	// Add the generic API key rule last if needed
diff --git a/internal/component/loki/secretfilter/secretfilter_test.go b/internal/component/loki/secretfilter/secretfilter_test.go
index f6d529f809..cc40698a10 100644
--- a/internal/component/loki/secretfilter/secretfilter_test.go
+++ b/internal/component/loki/secretfilter/secretfilter_test.go
@@ -43,6 +43,46 @@ var customGitleaksConfig = map[string]string{
 		description = "Identified a fake secret"
 		regex = '''(?i)\b(fakeSecret\d{5})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
 	`,
+	"short_secret": `
+		title = "gitleaks custom config"
+
+		[[rules]]
+		id = "short-secret"
+		description = "Identified a fake short secret"
+		regex = '''(?i)\b(abc)(?:['|\"|\n|\r|\s|\x60|;]|$)'''
+	`,
+	"allow_list_old": `
+		title = "gitleaks custom config"
+
+		[[rules]]
+		id = "my-fake-secret"
+		description = "Identified a fake secret"
+		regex = '''(?i)\b(fakeSecret\d{5})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
+		[rules.allowlist]
+		regexes = ["abc\\d{3}", "fakeSecret[9]{5}"]
+	`,
+	"allow_list_new": `
+		title = "gitleaks custom config"
+
+		[[rules]]
+		id = "my-fake-secret"
+		description = "Identified a fake secret"
+		regex = '''(?i)\b(fakeSecret\d{5})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
+			[[rules.allowlists]]
+			regexes = ["def\\d{3}", "test\\d{5}"]
+			[[rules.allowlists]]
+			regexes = ["abc\\d{3}", "fakeSecret[9]{5}"]
+	`,
+	`allow_list_global`: `
+		title = "gitleaks custom config"
+
+		[[rules]]
+		id = "my-fake-secret"
+		description = "Identified a fake secret"
+		regex = '''(?i)\b(fakeSecret\d{5})(?:['|\"|\n|\r|\s|\x60|;]|$)'''	
+		[allowlist]
+		regexes = ["abc\\d{3}", "fakeSecret[9]{5}"]
+	`,
 }
 
 var defaultRedactionString = "REDACTED-SECRET"
@@ -65,6 +105,11 @@ var testConfigs = map[string]string{
 		forward_to = []
 		partial_mask = 4
 	`,
+	"partial_mask_custom": `
+		forward_to = []
+		partial_mask = 4
+		gitleaks_config = "not-empty" // This will be replaced with the actual path to the temporary gitleaks config file
+	`,
 	"custom_types": `
 		forward_to = []
 		redact_with = "<` + customRedactionString + `:$SECRET_NAME>"
@@ -115,6 +160,14 @@ var fakeSecrets = map[string]fakeSecret{
 		name:  "my-fake-secret",
 		value: "fakeSec" + "ret12345",
 	},
+	"custom-fake-secret-all9": {
+		name:  "my-fake-secret",
+		value: "fakeSec" + "ret99999",
+	},
+	"short-secret": {
+		name:  "short-secret",
+		value: "abc",
+	},
 }
 
 // List of fake log entries to use for testing
@@ -155,12 +208,24 @@ var testLogs = map[string]testLog{
 		}`,
 		secrets: []fakeSecret{fakeSecrets["custom-fake-secret"]},
 	},
+	"simple_secret_custom_all9": {
+		log: `{
+			"message": "This is a simple log message with a secret value ` + fakeSecrets["custom-fake-secret-all9"].value + ` !
+		}`,
+		secrets: []fakeSecret{fakeSecrets["custom-fake-secret-all9"]},
+	},
 	"multiple_secrets": {
 		log: `{
 			"message": "This is a simple log message with a secret value ` + fakeSecrets["grafana-api-key"].value + ` and another secret value ` + fakeSecrets["gcp-api-key"].value + ` !
 		}`,
 		secrets: []fakeSecret{fakeSecrets["grafana-api-key"], fakeSecrets["gcp-api-key"]},
 	},
+	"short_secret": {
+		log: `{
+			"message": "This is a simple log message with a secret value ` + fakeSecrets["short-secret"].value + ` !
+		}`,
+		secrets: []fakeSecret{fakeSecrets["short-secret"]},
+	},
 }
 
 // Test cases for the secret filter
@@ -213,6 +278,13 @@ var tt = []struct {
 		testLogs["simple_secret"].log,
 		replaceSecrets(testLogs["simple_secret"].log, testLogs["simple_secret"].secrets, true, false, defaultRedactionString),
 	},
+	{
+		"partial_mask_too_short",
+		testConfigs["partial_mask_custom"],
+		customGitleaksConfig["short_secret"],
+		testLogs["short_secret"].log,
+		replaceSecrets(testLogs["short_secret"].log, testLogs["short_secret"].secrets, false, false, defaultRedactionString),
+	},
 	{
 		"gcp_secret",
 		testConfigs["default"],
@@ -255,6 +327,48 @@ var tt = []struct {
 		testLogs["simple_secret_custom"].log,
 		replaceSecrets(testLogs["simple_secret_custom"].log, testLogs["simple_secret_custom"].secrets, false, false, defaultRedactionString),
 	},
+	{
+		"custom_gitleaks_file_allow_list_old",
+		testConfigs["custom_gitleaks_file_simple"],
+		customGitleaksConfig["allow_list_old"],
+		testLogs["simple_secret_custom_all9"].log,
+		testLogs["simple_secret_custom_all9"].log, // In the allowlist
+	},
+	{
+		"custom_gitleaks_file_allow_list_new",
+		testConfigs["custom_gitleaks_file_simple"],
+		customGitleaksConfig["allow_list_new"],
+		testLogs["simple_secret_custom_all9"].log,
+		testLogs["simple_secret_custom_all9"].log, // In the allowlist
+	},
+	{
+		"custom_gitleaks_file_allow_list_old_redact",
+		testConfigs["custom_gitleaks_file_simple"],
+		customGitleaksConfig["allow_list_old"],
+		testLogs["simple_secret_custom"].log,
+		replaceSecrets(testLogs["simple_secret_custom"].log, testLogs["simple_secret_custom"].secrets, false, false, defaultRedactionString),
+	},
+	{
+		"custom_gitleaks_file_allow_list_new_redact",
+		testConfigs["custom_gitleaks_file_simple"],
+		customGitleaksConfig["allow_list_new"],
+		testLogs["simple_secret_custom"].log,
+		replaceSecrets(testLogs["simple_secret_custom"].log, testLogs["simple_secret_custom"].secrets, false, false, defaultRedactionString),
+	},
+	{
+		"custom_gitleaks_file_allow_list_global",
+		testConfigs["custom_gitleaks_file_simple"],
+		customGitleaksConfig["allow_list_global"],
+		testLogs["simple_secret_custom_all9"].log,
+		testLogs["simple_secret_custom_all9"].log, // In the allowlist
+	},
+	{
+		"custom_gitleaks_file_allow_list_global_redact",
+		testConfigs["custom_gitleaks_file_simple"],
+		customGitleaksConfig["allow_list_global"],
+		testLogs["simple_secret_custom"].log,
+		replaceSecrets(testLogs["simple_secret_custom"].log, testLogs["simple_secret_custom"].secrets, false, false, defaultRedactionString),
+	},
 	{
 		"multiple_secrets",
 		testConfigs["default"],
@@ -272,12 +386,80 @@ func TestSecretFiltering(t *testing.T) {
 	}
 }
 
+func TestPartialMasking(t *testing.T) {
+	// Start testing with common cases
+	component := &Component{}
+	component.args = Arguments{PartialMask: 4}
+
+	// Too short to be partially masked
+	redacted := component.redactLine("This is a very short secret ab in a log line", "ab", "test-rule")
+	require.Equal(t, "This is a very short secret <REDACTED-SECRET:test-rule> in a log line", redacted)
+
+	// Too short to be partially masked
+	redacted = component.redactLine("This is a short secret abc12 in a log line", "abc12", "test-rule")
+	require.Equal(t, "This is a short secret <REDACTED-SECRET:test-rule> in a log line", redacted)
+
+	// Will be partially masked (limited by secret length)
+	redacted = component.redactLine("This is a longer secret abc123 in a log line", "abc123", "test-rule")
+	require.Equal(t, "This is a longer secret abc<REDACTED-SECRET:test-rule> in a log line", redacted)
+
+	// Will be partially masked
+	redacted = component.redactLine("This is a long enough secret abcd1234 in a log line", "abcd1234", "test-rule")
+	require.Equal(t, "This is a long enough secret abcd<REDACTED-SECRET:test-rule> in a log line", redacted)
+
+	// Will be partially masked
+	redacted = component.redactLine("This is the longest secret abcdef12345678 in a log line", "abcdef12345678", "test-rule")
+	require.Equal(t, "This is the longest secret abcd<REDACTED-SECRET:test-rule> in a log line", redacted)
+
+	// Test with a non-ASCII character
+	redacted = component.redactLine("This is a line with a complex secret aBc\U0001f512De\U0001f5124 in a log line", "aBc\U0001f512De\U0001f5124", "test-rule")
+	require.Equal(t, "This is a line with a complex secret aBc\U0001f512<REDACTED-SECRET:test-rule> in a log line", redacted)
+
+	// Test with different secret lengths and partial masking values
+	for partialMasking := range 20 {
+		for secretLength := range 50 {
+			if secretLength < 2 {
+				continue
+			}
+			expectedPrefixLength := 0
+			if secretLength >= 6 {
+				expectedPrefixLength = min(secretLength/2, partialMasking)
+			}
+			checkPartialMasking(t, partialMasking, secretLength, expectedPrefixLength)
+		}
+	}
+}
+
+func checkPartialMasking(t *testing.T, partialMasking int, secretLength int, expectedPrefixLength int) {
+	component := &Component{}
+	component.args = Arguments{PartialMask: uint(partialMasking)}
+
+	// Test with a simple ASCII character
+	secret := strings.Repeat("A", secretLength)
+	inputLog := fmt.Sprintf("This is a test with a secret %s in a log line", secret)
+	redacted := component.redactLine(inputLog, secret, "test-rule")
+	prefix := strings.Repeat("A", expectedPrefixLength)
+	expectedLog := fmt.Sprintf("This is a test with a secret %s<REDACTED-SECRET:test-rule> in a log line", prefix)
+	require.Equal(t, expectedLog, redacted)
+
+	// Test with a non-ASCII character
+	secret = strings.Repeat("\U0001f512", secretLength)
+	inputLog = fmt.Sprintf("This is a test with a secret %s in a log line", secret)
+	redacted = component.redactLine(inputLog, secret, "test-rule")
+	prefix = strings.Repeat("\U0001f512", expectedPrefixLength)
+	expectedLog = fmt.Sprintf("This is a test with a secret %s<REDACTED-SECRET:test-rule> in a log line", prefix)
+	require.Equal(t, expectedLog, redacted)
+}
+
 func runTest(t *testing.T, config string, gitLeaksConfigContent string, inputLog string, expectedLog string) {
 	ch1 := loki.NewLogsReceiver()
 	var args Arguments
 	require.NoError(t, syntax.Unmarshal([]byte(config), &args))
 	args.ForwardTo = []loki.LogsReceiver{ch1}
 
+	// Making sure we're not testing with an empty log line by mistake
+	require.NotEmpty(t, inputLog)
+
 	// If needed, create a temporary gitleaks config file
 	if args.GitleaksConfig != "" {
 		args.GitleaksConfig = createTempGitleaksConfig(t, gitLeaksConfigContent)
diff --git a/internal/component/otelcol/auth/auth.go b/internal/component/otelcol/auth/auth.go
index 8d1590c72e..e9abbd08e4 100644
--- a/internal/component/otelcol/auth/auth.go
+++ b/internal/component/otelcol/auth/auth.go
@@ -7,6 +7,7 @@ package auth
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"hash/fnv"
 	"os"
@@ -27,14 +28,41 @@ import (
 	"go.opentelemetry.io/otel/sdk/metric"
 )
 
+var (
+	ErrNotServerExtension = errors.New("component does not support server authentication")
+	ErrNotClientExtension = errors.New("component does not support client authentication")
+)
+
+type ExtensionType string
+type AuthFeature byte
+
+const (
+	ClientAuthSupported          AuthFeature = 1 << iota
+	ServerAuthSupported          AuthFeature = 1 << iota
+	ClientAndServerAuthSupported AuthFeature = ClientAuthSupported | ServerAuthSupported
+
+	Server ExtensionType = "server"
+	Client ExtensionType = "client"
+)
+
 // Arguments is an extension of component.Arguments which contains necessary
 // settings for OpenTelemetry Collector authentication extensions.
 type Arguments interface {
 	component.Arguments
 
-	// Convert converts the Arguments into an OpenTelemetry Collector
-	// authentication extension configuration.
-	Convert() (otelcomponent.Config, error)
+	// AuthFeature returns the type of auth that a opentelemetry collector plugin supports
+	// client auth, server auth or both.
+	AuthFeatures() AuthFeature
+
+	// ConvertClient converts the Arguments into an OpenTelemetry Collector
+	// client authentication extension configuration. If the plugin does
+	// not support server authentication it should return nil, nil
+	ConvertClient() (otelcomponent.Config, error)
+
+	// ConvetServer converts the Arguments into an OpenTelemetry Collector
+	// server authentication extension configuration. If the plugin does
+	// not support server authentication it should return nil, nil
+	ConvertServer() (otelcomponent.Config, error)
 
 	// Extensions returns the set of extensions that the configured component is
 	// allowed to use.
@@ -53,13 +81,68 @@ type Arguments interface {
 type Exports struct {
 	// Handler is the managed component. Handler is updated any time the
 	// extension is updated.
-	Handler Handler `alloy:"handler,attr"`
+	Handler *Handler `alloy:"handler,attr"`
 }
 
 // Handler combines an extension with its ID.
 type Handler struct {
+	componentID string
+	handlerMap  map[ExtensionType]*ExtensionHandler
+}
+
+// NewHandler creates a handler that can be exported
+// in a capsule for otel servers to consume.
+func NewHandler(componentID string) *Handler {
+	return &Handler{
+		componentID: componentID,
+		handlerMap:  map[ExtensionType]*ExtensionHandler{},
+	}
+}
+
+// GetExtension retrieves the extension for the requested auth type, server or client.
+func (h *Handler) GetExtension(et ExtensionType) (*ExtensionHandler, error) {
+	ext, ok := h.handlerMap[et]
+
+	// This condition shouldn't happen since both extension types are set in Update(), but
+	// this will prevent a panic if it is somehow unset.
+	if !ok {
+		return nil, fmt.Errorf("error getting %s auth extension. component %s was unexpectedly nil", et, h.componentID)
+	}
+
+	// Check to make sure the extension does not have Error set.
+	// see SetupExtension() to see how this value is set.
+	// In general the error value is set if an auth extension
+	// does not support the type of authentication that was requested.
+	if ext.Error != nil {
+		return nil, ext.Error
+	}
+
+	return ext, nil
+}
+
+// AddExtension registers an extension type with the handler so it can be referenced
+// by another component.
+func (h *Handler) AddExtension(et ExtensionType, eh *ExtensionHandler) error {
+	// If an invalid extension is passed raise an error.
+	if et != Server && et != Client {
+		return fmt.Errorf("invalid extension type %s", et)
+	}
+
+	if eh == nil {
+		return fmt.Errorf("extension handler must not be null")
+	}
+
+	h.handlerMap[et] = eh
+	return nil
+}
+
+type ExtensionHandler struct {
 	ID        otelcomponent.ID
 	Extension otelextension.Extension
+
+	// Set if the extension does not support the type of authentication
+	// requested
+	Error error
 }
 
 var _ syntax.Capsule = Handler{}
@@ -163,30 +246,53 @@ func (a *Auth) Update(args component.Arguments) error {
 		},
 	}
 
-	extensionConfig, err := rargs.Convert()
+	// Create instances of the extension from our factory.
+	var components []otelcomponent.Component
+
+	// Make sure the component returned a valid set of auth flags.
+	authFeature := rargs.AuthFeatures()
+	if valid := ValidateAuthFeatures(authFeature); !valid {
+		return fmt.Errorf("invalid auth flag %d returned by component %s", authFeature, a.opts.ID)
+	}
+
+	// Registers the client extension for the otel collector plugin
+	handler := NewHandler(a.opts.ID)
+	clientEh, err := a.SetupExtension(Client, rargs, settings)
 	if err != nil {
 		return err
 	}
 
-	// Create instances of the extension from our factory.
-	var components []otelcomponent.Component
+	// If the extension supports client auth schedule it.
+	if HasAuthFeature(authFeature, ClientAuthSupported) {
+		components = append(components, clientEh.Extension)
+	}
 
-	ext, err := a.factory.Create(a.ctx, settings, extensionConfig)
+	// Register extension so it can be retrieved when referenced.
+	if err := handler.AddExtension(Client, clientEh); err != nil {
+		return err
+	}
+
+	// Registers server authentication plugin.
+	serverEh, err := a.SetupExtension(Server, rargs, settings)
 	if err != nil {
 		return err
-	} else if ext != nil {
-		components = append(components, ext)
 	}
 
-	cTypeStr := NormalizeType(a.opts.ID)
+	// If the extension supports server auth schedule it.
+	if HasAuthFeature(authFeature, ServerAuthSupported) {
+		components = append(components, serverEh.Extension)
+	}
+
+	// Register extension so it can be retrieved
+	if err := handler.AddExtension(Server, serverEh); err != nil {
+		return err
+	}
 
 	// Inform listeners that our handler changed.
 	a.opts.OnStateChange(Exports{
-		Handler: Handler{
-			ID:        otelcomponent.NewID(otelcomponent.MustNewType(cTypeStr)),
-			Extension: ext,
-		},
-	})
+		Handler: handler,
+	},
+	)
 
 	// Schedule the components to run once our component is running.
 	a.sched.Schedule(a.ctx, func() {}, host, components...)
@@ -213,3 +319,89 @@ func NormalizeType(in string) string {
 
 	return res
 }
+
+// SetupExtension sets up the extension handler object with the appropriate fields to map the alloy
+// capsule to the underlying otel auth extension.
+func (a *Auth) SetupExtension(t ExtensionType, rargs Arguments, settings otelextension.Settings) (*ExtensionHandler, error) {
+	var otelConfig otelcomponent.Config
+	var err error
+	var notSupportedErr error
+	var requiredAuthFeature AuthFeature
+
+	// Retrieve the appropriate auth extension for the requested type.
+	switch t {
+	case Server:
+		otelConfig, err = rargs.ConvertServer()
+		notSupportedErr = ErrNotServerExtension
+		requiredAuthFeature = ServerAuthSupported
+	case Client:
+		otelConfig, err = rargs.ConvertClient()
+		notSupportedErr = ErrNotClientExtension
+		requiredAuthFeature = ClientAuthSupported
+	default:
+		return nil, fmt.Errorf("unrecognized extension type %s", t)
+	}
+
+	// If there was an error converting the server/client args fail now.
+	if err != nil {
+		return nil, err
+	}
+
+	eh := &ExtensionHandler{}
+	extensionAuthFeatures := rargs.AuthFeatures()
+
+	// Auth plugins return a feature flag indicating the types of authentication they support.
+	// If the plugin does not support the requested extension type (client or server authentication),
+	// the handler will set the error field. This results in an error being triggered if the unsupported
+	// extension is accessed via the handler. However, we do not return an error immediately because
+	// the user must explicitly request the invalid handler in their configuration for the error to occur.
+	// Refer to Handler.GetExtension() for the implementation logic.
+	if !HasAuthFeature(extensionAuthFeatures, requiredAuthFeature) {
+		eh.Error = fmt.Errorf("%s %w", a.opts.ID, notSupportedErr)
+		return eh, nil
+	}
+
+	// Create the otel extension via its factory.
+	otelExtension, err := a.createExtension(otelConfig, settings)
+	if err != nil {
+		return nil, err
+	}
+
+	// Create an extension id based off the alloy name. For example
+	// auth.basic.creds.LABEL will become auth.basic.creds.LABEL.client or auth.basic.creds.LABEL.server
+	// depending on the type.
+	cTypeStr := NormalizeType(fmt.Sprintf("%s.%s", a.opts.ID, t))
+	eh.ID = otelcomponent.NewID(otelcomponent.MustNewType(cTypeStr))
+	eh.Extension = otelExtension
+
+	return eh, nil
+}
+
+// createExtension uses the otelextension factory to construct the otel auth extension.
+func (a *Auth) createExtension(config otelcomponent.Config, settings otelextension.Settings) (otelcomponent.Component, error) {
+	ext, err := a.factory.Create(a.ctx, settings, config)
+	if err != nil {
+		return nil, err
+	}
+
+	// sanity check
+	if ext == nil {
+		return nil, fmt.Errorf("extension was not created")
+	}
+
+	return ext, nil
+}
+
+// ValidateAuthFeatures makes sure a valid auth feature was returned by a
+func ValidateAuthFeatures(f AuthFeature) bool {
+	validFlags := ClientAuthSupported | ServerAuthSupported | ClientAndServerAuthSupported
+
+	// bit clear any flags not set in f.
+	// if this is not zero then an invalid flag was passed.
+	return f&^validFlags == 0
+}
+
+func HasAuthFeature(flag AuthFeature, feature AuthFeature) bool {
+	// bitwise and the two features together. If not zero it has the feature
+	return flag&feature != 0
+}
diff --git a/internal/component/otelcol/auth/auth_test.go b/internal/component/otelcol/auth/auth_test.go
index fbdb45bdaf..9abe13c900 100644
--- a/internal/component/otelcol/auth/auth_test.go
+++ b/internal/component/otelcol/auth/auth_test.go
@@ -7,11 +7,11 @@ import (
 	"time"
 
 	"github.com/grafana/alloy/internal/component"
-	"github.com/grafana/alloy/internal/component/otelcol"
 	"github.com/grafana/alloy/internal/component/otelcol/auth"
 	otelcolCfg "github.com/grafana/alloy/internal/component/otelcol/config"
 	"github.com/grafana/alloy/internal/runtime/componenttest"
 	"github.com/grafana/alloy/internal/util"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 	otelcomponent "go.opentelemetry.io/collector/component"
 	otelextension "go.opentelemetry.io/collector/extension"
@@ -26,10 +26,13 @@ func TestAuth(t *testing.T) {
 		}
 	)
 
+	fakeAuthArgs := &fakeAuthArgs{}
+	fakeAuthArgs.On("AuthFeatures").Return(auth.ClientAndServerAuthSupported)
+
 	// Create and start our Alloy component. We then wait for it to export a
 	// consumer that we can send data to.
 	te := newTestEnvironment(t, onCreated)
-	te.Start(fakeAuthArgs{})
+	te.Start(fakeAuthArgs)
 
 	require.NoError(t, waitCreated.Wait(time.Second), "extension never created")
 }
@@ -46,7 +49,7 @@ func newTestEnvironment(t *testing.T, onCreated func()) *testEnvironment {
 	reg := component.Registration{
 		Name:    "testcomponent",
 		Args:    fakeAuthArgs{},
-		Exports: otelcol.ConsumerExports{},
+		Exports: auth.Exports{},
 		Build: func(opts component.Options, args component.Arguments) (component.Component, error) {
 			factory := otelextension.NewFactory(
 				otelcomponent.MustNewType("testcomponent"),
@@ -58,7 +61,7 @@ func newTestEnvironment(t *testing.T, onCreated func()) *testEnvironment {
 				) (otelcomponent.Component, error) {
 
 					onCreated()
-					return nil, nil
+					return fakeOtelComponent{}, nil
 				}, otelcomponent.StabilityLevelUndefined,
 			)
 
@@ -80,20 +83,41 @@ func (te *testEnvironment) Start(args component.Arguments) {
 	}()
 }
 
+type fakeOtelComponent struct {
+}
+
+func (f fakeOtelComponent) Start(ctx context.Context, host otelcomponent.Host) error {
+	return nil
+}
+
+func (f fakeOtelComponent) Shutdown(ctx context.Context) error {
+	return nil
+}
+
 type fakeAuthArgs struct {
+	mock.Mock
 }
 
-var _ auth.Arguments = fakeAuthArgs{}
+var _ auth.Arguments = &fakeAuthArgs{}
+
+func (fa *fakeAuthArgs) ConvertClient() (otelcomponent.Config, error) {
+	return &struct{}{}, nil
+}
 
-func (fa fakeAuthArgs) Convert() (otelcomponent.Config, error) {
+func (fa *fakeAuthArgs) ConvertServer() (otelcomponent.Config, error) {
 	return &struct{}{}, nil
 }
 
-func (fa fakeAuthArgs) Extensions() map[otelcomponent.ID]otelextension.Extension {
+func (fa *fakeAuthArgs) AuthFeatures() auth.AuthFeature {
+	result := fa.Called()
+	return result.Get(0).(auth.AuthFeature)
+}
+
+func (fa *fakeAuthArgs) Extensions() map[otelcomponent.ID]otelextension.Extension {
 	return nil
 }
 
-func (fa fakeAuthArgs) Exporters() map[pipeline.Signal]map[otelcomponent.ID]otelcomponent.Component {
+func (fa *fakeAuthArgs) Exporters() map[pipeline.Signal]map[otelcomponent.ID]otelcomponent.Component {
 	return nil
 }
 
@@ -126,8 +150,148 @@ func TestNormalizeType(t *testing.T) {
 	}
 }
 
-func (fe fakeAuthArgs) DebugMetricsConfig() otelcolCfg.DebugMetricsArguments {
+func (fe *fakeAuthArgs) DebugMetricsConfig() otelcolCfg.DebugMetricsArguments {
 	var dma otelcolCfg.DebugMetricsArguments
 	dma.SetToDefault()
 	return dma
 }
+
+// TestValidateAuthFeature tests that it returns if the flag returned by an otel auth
+// extension is correctly interpreted.
+func TestValidateAuthFeature(t *testing.T) {
+	type tc struct {
+		input    auth.AuthFeature
+		expected bool
+	}
+	testcases := []tc{
+		{auth.ClientAndServerAuthSupported, true},
+		{auth.ClientAuthSupported, true},
+		{auth.ServerAuthSupported, true},
+		{5, false},
+	}
+
+	for _, tc := range testcases {
+		actual := auth.ValidateAuthFeatures(tc.input)
+		require.Equal(t, tc.expected, actual)
+	}
+}
+
+// TestHasAuthFeature tests that HasAuthFeature correctly determines
+// whether the auth extension has an authentication feature, server or client.
+func TestHasAuthFeature(t *testing.T) {
+	type input struct {
+		flag    auth.AuthFeature
+		feature auth.AuthFeature
+	}
+	type tc struct {
+		input    input
+		expected bool
+	}
+
+	testcases := []tc{
+		{input{flag: auth.ClientAuthSupported, feature: auth.ClientAuthSupported}, true},
+		{input{flag: auth.ServerAuthSupported, feature: auth.ServerAuthSupported}, true},
+		{input{flag: auth.ClientAndServerAuthSupported, feature: auth.ClientAuthSupported}, true},
+		{input{flag: auth.ClientAndServerAuthSupported, feature: auth.ServerAuthSupported}, true},
+		{input{flag: auth.ClientAuthSupported, feature: auth.ServerAuthSupported}, false},
+		{input{flag: auth.ServerAuthSupported, feature: auth.ClientAuthSupported}, false},
+	}
+
+	for _, tc := range testcases {
+		actual := auth.HasAuthFeature(tc.input.flag, tc.input.feature)
+		require.Equal(t, tc.expected, actual, "flag:", tc.input.flag, "feature:", tc.input.feature)
+	}
+}
+
+// TestAuthHandler runs a simple functional test by running the component
+// against a mock auth extension. It validates the component starts correctly
+// and when the handler requests either a server or client handler the correct output
+// is returned
+func TestAuthHandler(t *testing.T) {
+	var (
+		waitCreated = util.NewWaitTrigger()
+		onCreated   = func() {
+			waitCreated.Trigger()
+		}
+	)
+
+	// Test case definition
+	type input struct {
+		support auth.AuthFeature
+	}
+
+	type expected struct {
+		clientAuthSupported bool
+		serverAuthSupported bool
+		err                 error
+	}
+	type tc struct {
+		input    input
+		expected expected
+	}
+
+	// Test cases
+	tcs := []tc{
+		// Validates
+		{
+			input: input{support: auth.ClientAuthSupported}, expected: expected{
+				clientAuthSupported: true, serverAuthSupported: false, err: auth.ErrNotServerExtension,
+			},
+		},
+		{
+			input: input{support: auth.ServerAuthSupported}, expected: expected{
+				clientAuthSupported: false, serverAuthSupported: true, err: auth.ErrNotClientExtension,
+			},
+		},
+		{
+			input: input{support: auth.ClientAndServerAuthSupported}, expected: expected{
+				clientAuthSupported: true, serverAuthSupported: true, err: nil,
+			},
+		},
+	}
+
+	for _, tc := range tcs {
+		// Spin up a test component
+		te := newTestEnvironment(t, onCreated)
+
+		// Mock the return of AuthFeatures to avoid creating test-specific implementations
+		// for each combination of authentication extensions supported by the OpenTelemetry collector.
+		fakeAuthArgs := &fakeAuthArgs{}
+		fakeAuthArgs.On("AuthFeatures").Return(tc.input.support)
+
+		// Start the test environment and validate it comes up properly.
+		te.Start(fakeAuthArgs)
+		require.NoError(t, waitCreated.Wait(time.Second), "extension never created")
+		require.NoError(t, te.Controller.WaitRunning(time.Second), "extension never started running")
+		require.NoError(t, te.Controller.WaitExports(time.Second), "extension never exported anything")
+
+		// Retrieve the exports of the component, make sure it exported a handler.
+		export := te.Controller.Exports()
+		authExport, ok := export.(auth.Exports)
+		require.True(t, ok, "auth component didn't export an auth export type")
+		require.NotNil(t, authExport.Handler)
+
+		// Check the state of the handler and verify it is correct.
+		clientEh, err := authExport.Handler.GetExtension(auth.Client)
+		validateHandler(t, clientEh, tc.expected.clientAuthSupported, err, tc.expected.err)
+
+		serverEh, err := authExport.Handler.GetExtension(auth.Server)
+		validateHandler(t, serverEh, tc.expected.serverAuthSupported, err, tc.expected.err)
+	}
+}
+
+// validateHandler determines what the correct state of the extension handler should be depending
+// on the test case state. If the extension supports the authentication requested it should return
+// the extension. Otherwise it should return an error saying the extension does not support the requested
+// type of authenticaiton.
+func validateHandler(t *testing.T, eh *auth.ExtensionHandler, authSupported bool, actualErr error, expectedError error) {
+	t.Helper()
+	if authSupported {
+		require.NoError(t, actualErr)
+		require.NotNil(t, eh.Extension)
+		require.NotNil(t, eh.ID)
+	} else {
+		require.NotNil(t, actualErr)
+		require.ErrorIs(t, actualErr, expectedError)
+	}
+}
diff --git a/internal/component/otelcol/auth/basic/basic.go b/internal/component/otelcol/auth/basic/basic.go
index facce80883..d8afe2f3ac 100644
--- a/internal/component/otelcol/auth/basic/basic.go
+++ b/internal/component/otelcol/auth/basic/basic.go
@@ -2,6 +2,8 @@
 package basic
 
 import (
+	"fmt"
+
 	"github.com/grafana/alloy/internal/component"
 	"github.com/grafana/alloy/internal/component/otelcol/auth"
 	otelcolCfg "github.com/grafana/alloy/internal/component/otelcol/config"
@@ -30,8 +32,6 @@ func init() {
 
 // Arguments configures the otelcol.auth.basic component.
 type Arguments struct {
-	// TODO(rfratto): should we support htpasswd?
-
 	Username string            `alloy:"username,attr"`
 	Password alloytypes.Secret `alloy:"password,attr"`
 
@@ -46,8 +46,8 @@ func (args *Arguments) SetToDefault() {
 	args.DebugMetrics.SetToDefault()
 }
 
-// Convert implements auth.Arguments.
-func (args Arguments) Convert() (otelcomponent.Config, error) {
+// ConvertClient implements auth.Arguments.
+func (args Arguments) ConvertClient() (otelcomponent.Config, error) {
 	return &basicauthextension.Config{
 		ClientAuth: &basicauthextension.ClientAuthSettings{
 			Username: args.Username,
@@ -56,6 +56,20 @@ func (args Arguments) Convert() (otelcomponent.Config, error) {
 	}, nil
 }
 
+// ConvertServer implements auth.Arguments.
+func (args Arguments) ConvertServer() (otelcomponent.Config, error) {
+	return &basicauthextension.Config{
+		Htpasswd: &basicauthextension.HtpasswdSettings{
+			Inline: fmt.Sprintf("%s:%s", args.Username, args.Password),
+		},
+	}, nil
+}
+
+// AuthFeatures implements auth.Arguments.
+func (args Arguments) AuthFeatures() auth.AuthFeature {
+	return auth.ClientAndServerAuthSupported
+}
+
 // Extensions implements auth.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
 	return nil
diff --git a/internal/component/otelcol/auth/basic/basic_test.go b/internal/component/otelcol/auth/basic/basic_test.go
index 33e48a5a58..bb7cd0d614 100644
--- a/internal/component/otelcol/auth/basic/basic_test.go
+++ b/internal/component/otelcol/auth/basic/basic_test.go
@@ -2,11 +2,14 @@ package basic_test
 
 import (
 	"context"
+	"encoding/base64"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
 
+	"github.com/grafana/alloy/internal/component"
 	"github.com/grafana/alloy/internal/component/otelcol/auth"
 	"github.com/grafana/alloy/internal/component/otelcol/auth/basic"
 	"github.com/grafana/alloy/internal/runtime/componenttest"
@@ -17,16 +20,28 @@ import (
 	extauth "go.opentelemetry.io/collector/extension/auth"
 )
 
+const (
+	actualUsername = "foo"
+	actualPassword = "bar"
+)
+
+var (
+	cfg = fmt.Sprintf(`
+		username = "%s"
+		password = "%s"
+	`, actualUsername, actualPassword)
+)
+
 // Test performs a basic integration test which runs the otelcol.auth.basic
 // component and ensures that it can be used for authentication.
-func Test(t *testing.T) {
+func TestClientAuth(t *testing.T) {
 	// Create an HTTP server which will assert that basic auth has been injected
 	// into the request.
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		username, password, ok := r.BasicAuth()
 		assert.True(t, ok, "no basic auth found")
-		assert.Equal(t, "foo", username, "basic auth username didn't match")
-		assert.Equal(t, "bar", password, "basic auth password didn't match")
+		assert.Equal(t, actualUsername, username, "basic auth username didn't match")
+		assert.Equal(t, actualPassword, password, "basic auth password didn't match")
 
 		w.WriteHeader(http.StatusOK)
 	}))
@@ -36,23 +51,7 @@ func Test(t *testing.T) {
 	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
-	l := util.TestLogger(t)
-
-	// Create and run our component
-	ctrl, err := componenttest.NewControllerFromID(l, "otelcol.auth.basic")
-	require.NoError(t, err)
-
-	cfg := `
-		username = "foo"
-		password = "bar"
-	`
-	var args basic.Arguments
-	require.NoError(t, syntax.Unmarshal([]byte(cfg), &args))
-
-	go func() {
-		err := ctrl.Run(ctx, args)
-		require.NoError(t, err)
-	}()
+	ctrl := newTestComponent(t, ctx)
 
 	require.NoError(t, ctrl.WaitRunning(time.Second), "component never started")
 	require.NoError(t, ctrl.WaitExports(time.Second), "component never exported anything")
@@ -60,9 +59,12 @@ func Test(t *testing.T) {
 	// Get the authentication extension from our component and use it to make a
 	// request to our test server.
 	exports := ctrl.Exports().(auth.Exports)
-	require.NotNil(t, exports.Handler.Extension, "handler extension is nil")
+	require.NotNil(t, exports.Handler)
 
-	clientAuth, ok := exports.Handler.Extension.(extauth.Client)
+	clientExtension, err := exports.Handler.GetExtension(auth.Client)
+	require.NoError(t, err)
+	require.NotNil(t, clientExtension)
+	clientAuth, ok := clientExtension.Extension.(extauth.Client)
 	require.True(t, ok, "handler does not implement configauth.ClientAuthenticator")
 
 	rt, err := clientAuth.RoundTripper(http.DefaultTransport)
@@ -78,3 +80,97 @@ func Test(t *testing.T) {
 	require.NoError(t, err, "HTTP request failed")
 	require.Equal(t, http.StatusOK, resp.StatusCode)
 }
+
+// TestServerAuth verifies the server auth component starts up properly and we can
+// authenticate with the provided credentials.
+func TestServerAuth(t *testing.T) {
+	ctx := componenttest.TestContext(t)
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
+	defer cancel()
+
+	ctrl := newTestComponent(t, ctx)
+	require.NoError(t, ctrl.WaitRunning(time.Second), "component never started")
+	require.NoError(t, ctrl.WaitExports(time.Second), "component never exported anything")
+
+	exports, ok := ctrl.Exports().(auth.Exports)
+	require.True(t, ok, "extension doesn't export auth exports struct")
+	require.NotNil(t, exports.Handler)
+
+	startedComponent, err := ctrl.GetComponent()
+	require.NoError(t, err, "no component added in controller.")
+
+	authComponent, ok := startedComponent.(*auth.Auth)
+	require.True(t, ok, "component was not an auth component")
+
+	// auth components expose a health field. Utilize this to wait for the component to be healthy.
+	err = waitHealthy(ctx, authComponent, time.Second)
+	require.NoError(t, err, "timed out waiting for the component to be healthy")
+
+	serverAuthExtension, err := exports.Handler.GetExtension(auth.Server)
+
+	require.NoError(t, err)
+	require.NotNil(t, serverAuthExtension.ID)
+	require.NotNil(t, serverAuthExtension.Extension)
+
+	otelServerExtension, ok := serverAuthExtension.Extension.(extauth.Server)
+	require.True(t, ok, "extension did not implement server authentication")
+
+	b64EncodingAuth := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", actualUsername, actualPassword)))
+	_, err = otelServerExtension.Authenticate(ctx, map[string][]string{"Authorization": {"Basic " + b64EncodingAuth}})
+	require.NoError(t, err)
+}
+
+// newTestComponent brings up and runs the test component.
+func newTestComponent(t *testing.T, ctx context.Context) *componenttest.Controller {
+	t.Helper()
+	l := util.TestLogger(t)
+
+	// Create and run our component
+	ctrl, err := componenttest.NewControllerFromID(l, "otelcol.auth.basic")
+	require.NoError(t, err)
+
+	var args basic.Arguments
+	require.NoError(t, syntax.Unmarshal([]byte(cfg), &args))
+
+	go func() {
+		err := ctrl.Run(ctx, args)
+		require.NoError(t, err)
+	}()
+
+	return ctrl
+}
+
+// waitHealthy waits for the component to be healthy before continuing the test.
+// this prevents the test from executing before the underlying auth extension is running.
+func waitHealthy(ctx context.Context, basicAuthComponent *auth.Auth, timeout time.Duration) error {
+	// Channel to signal whether the component is healthy or not.
+	healthChannel := make(chan bool)
+
+	// Loop continously checking for the current health of the component.
+	go func() {
+		for {
+			healthz := basicAuthComponent.CurrentHealth().Health
+			if healthz == component.HealthTypeHealthy {
+				healthChannel <- true
+				return
+			}
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(timeout):
+				return
+			default:
+			}
+		}
+	}()
+
+	// Wait for channel to be written to or timeout to occur.
+	select {
+	case <-healthChannel:
+		return nil
+	case <-ctx.Done():
+		return fmt.Errorf("context timed out")
+	case <-time.After(timeout):
+		return fmt.Errorf("timed out waiting for the component to be healthy")
+	}
+}
diff --git a/internal/component/otelcol/auth/bearer/bearer.go b/internal/component/otelcol/auth/bearer/bearer.go
index 17a0816a30..9f13ca117c 100644
--- a/internal/component/otelcol/auth/bearer/bearer.go
+++ b/internal/component/otelcol/auth/bearer/bearer.go
@@ -51,14 +51,28 @@ func (args *Arguments) SetToDefault() {
 	args.DebugMetrics.SetToDefault()
 }
 
-// Convert implements auth.Arguments.
-func (args Arguments) Convert() (otelcomponent.Config, error) {
+func (args Arguments) convert() (otelcomponent.Config, error) {
 	return &bearertokenauthextension.Config{
 		Scheme:      args.Scheme,
 		BearerToken: configopaque.String(args.Token),
 	}, nil
 }
 
+// ConvertClient implements auth.Arguments.
+func (args Arguments) ConvertClient() (otelcomponent.Config, error) {
+	return args.convert()
+}
+
+// ConvertServer implements auth.Arguments.
+func (args Arguments) ConvertServer() (otelcomponent.Config, error) {
+	return args.convert()
+}
+
+// AuthFeatures implements auth.Arguments.
+func (args Arguments) AuthFeatures() auth.AuthFeature {
+	return auth.ClientAndServerAuthSupported
+}
+
 // Extensions implements auth.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
 	return nil
diff --git a/internal/component/otelcol/auth/bearer/bearer_test.go b/internal/component/otelcol/auth/bearer/bearer_test.go
index 3595e542b4..839e91487a 100644
--- a/internal/component/otelcol/auth/bearer/bearer_test.go
+++ b/internal/component/otelcol/auth/bearer/bearer_test.go
@@ -2,8 +2,10 @@ package bearer_test
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
@@ -19,7 +21,7 @@ import (
 
 // Test performs a basic integration test which runs the otelcol.auth.bearer
 // component and ensures that it can be used for authentication.
-func Test(t *testing.T) {
+func TestClient(t *testing.T) {
 	type TestDefinition struct {
 		testName          string
 		expectedHeaderVal string
@@ -75,29 +77,17 @@ func Test(t *testing.T) {
 		ctx, cancel := context.WithTimeout(ctx, time.Minute)
 		defer cancel()
 
-		l := util.TestLogger(t)
-
-		// Create and run our component
-		ctrl, err := componenttest.NewControllerFromID(l, "otelcol.auth.bearer")
-		require.NoError(t, err)
-
-		var args bearer.Arguments
-		require.NoError(t, syntax.Unmarshal([]byte(tt.alloyConfig), &args))
-
-		go func() {
-			err := ctrl.Run(ctx, args)
-			require.NoError(t, err)
-		}()
-
-		require.NoError(t, ctrl.WaitRunning(time.Second), "component never started")
-		require.NoError(t, ctrl.WaitExports(time.Second), "component never exported anything")
+		ctrl := newTestComponent(t, ctx, tt.alloyConfig)
 
 		// Get the authentication extension from our component and use it to make a
 		// request to our test server.
 		exports := ctrl.Exports().(auth.Exports)
-		require.NotNil(t, exports.Handler.Extension, "handler extension is nil")
+		require.NotNil(t, exports.Handler, "handler extension is nil")
+
+		clientExtension, err := exports.Handler.GetExtension(auth.Client)
+		require.NoError(t, err)
 
-		clientAuth, ok := exports.Handler.Extension.(extauth.Client)
+		clientAuth, ok := clientExtension.Extension.(extauth.Client)
 		require.True(t, ok, "handler does not implement configauth.ClientAuthenticator")
 
 		rt, err := clientAuth.RoundTripper(http.DefaultTransport)
@@ -114,3 +104,108 @@ func Test(t *testing.T) {
 		require.Equal(t, http.StatusOK, resp.StatusCode)
 	}
 }
+
+func TestServer(t *testing.T) {
+	type TestDefinition struct {
+		testName    string
+		token       string
+		scheme      string
+		alloyConfig string
+	}
+	token := "123"
+	tokenCfg := fmt.Sprintf(`token = "%s"`, token)
+	tests := []TestDefinition{
+		{
+			testName: "Test1",
+			token:    token,
+			scheme:   "Bearer",
+			alloyConfig: fmt.Sprintf(`
+			%s
+			`, tokenCfg),
+		},
+		{
+			testName: "Test2",
+			token:    token,
+			scheme:   "Bearer",
+			alloyConfig: fmt.Sprintf(`
+			%s
+			scheme = "Bearer"
+			`, tokenCfg),
+		},
+		{
+			testName: "Test3",
+			token:    token,
+			scheme:   "MyScheme",
+			alloyConfig: fmt.Sprintf(`
+			%s
+			scheme = "MyScheme"
+			`, tokenCfg),
+		},
+		{
+			testName: "Test4",
+			token:    token,
+			scheme:   "",
+			alloyConfig: fmt.Sprintf(`
+			%s
+			scheme = ""
+			`, tokenCfg),
+		},
+	}
+
+	for _, td := range tests {
+		ctx := componenttest.TestContext(t)
+		ctx, cancel := context.WithTimeout(ctx, time.Minute)
+		defer cancel()
+
+		// Spin up component
+		ctrl := newTestComponent(t, ctx, td.alloyConfig)
+		exports := ctrl.Exports()
+		require.NotNil(t, exports)
+
+		authExport, ok := exports.(auth.Exports)
+		require.True(t, ok, "component doesn't export auth export struct")
+
+		// Get handler from exports
+		handler := authExport.Handler
+		require.NotNil(t, handler)
+
+		// Get the server auth extension
+		serverExtension, err := handler.GetExtension(auth.Server)
+		require.NoError(t, err)
+		require.NotNil(t, serverExtension.Extension)
+		require.NotNil(t, serverExtension.ID)
+
+		// Convert to server auth extension
+		otelServerAuthExtension, ok := serverExtension.Extension.(extauth.Server)
+		require.True(t, ok, "extension does not implement server authentication")
+
+		scheme := fmt.Sprintf("%s %s", td.scheme, td.token)
+
+		// Trim the space in case bearer token is set to an empty string
+		scheme = strings.TrimSpace(scheme)
+		_, err = otelServerAuthExtension.Authenticate(ctx, map[string][]string{"Authorization": {scheme}})
+		require.NoError(t, err, td.testName)
+	}
+}
+
+func newTestComponent(t *testing.T, ctx context.Context, alloyConfig string) *componenttest.Controller {
+	t.Helper()
+	l := util.TestLogger(t)
+
+	// Create and run our component
+	ctrl, err := componenttest.NewControllerFromID(l, "otelcol.auth.bearer")
+	require.NoError(t, err)
+
+	var args bearer.Arguments
+	require.NoError(t, syntax.Unmarshal([]byte(alloyConfig), &args))
+
+	go func() {
+		err := ctrl.Run(ctx, args)
+		require.NoError(t, err)
+	}()
+
+	require.NoError(t, ctrl.WaitRunning(time.Second), "component never started")
+	require.NoError(t, ctrl.WaitExports(time.Second), "component never exported anything")
+
+	return ctrl
+}
diff --git a/internal/component/otelcol/auth/headers/headers.go b/internal/component/otelcol/auth/headers/headers.go
index c2a206ff95..8fe5478f75 100644
--- a/internal/component/otelcol/auth/headers/headers.go
+++ b/internal/component/otelcol/auth/headers/headers.go
@@ -47,8 +47,8 @@ func (args *Arguments) SetToDefault() {
 	args.DebugMetrics.SetToDefault()
 }
 
-// Convert implements auth.Arguments.
-func (args Arguments) Convert() (otelcomponent.Config, error) {
+// ConvertClient implements auth.Arguments.
+func (args Arguments) ConvertClient() (otelcomponent.Config, error) {
 	var upstreamHeaders []headerssetterextension.HeaderConfig
 	for _, h := range args.Headers {
 		upstreamHeader := headerssetterextension.HeaderConfig{
@@ -70,16 +70,27 @@ func (args Arguments) Convert() (otelcomponent.Config, error) {
 		upstreamHeaders = append(upstreamHeaders, upstreamHeader)
 	}
 
+	// OtelExtensionConfig does not implement ServerAuth
 	return &headerssetterextension.Config{
 		HeadersConfig: upstreamHeaders,
 	}, nil
 }
 
+// ConvertServer returns nil since theheaders extension does not support server authenticaiton.
+func (args Arguments) ConvertServer() (otelcomponent.Config, error) {
+	return nil, nil
+}
+
 // Extensions implements auth.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
 	return nil
 }
 
+// AuthFeatures implements auth.Arguments.
+func (args Arguments) AuthFeatures() auth.AuthFeature {
+	return auth.ClientAuthSupported
+}
+
 // Exporters implements auth.Arguments.
 func (args Arguments) Exporters() map[pipeline.Signal]map[otelcomponent.ID]otelcomponent.Component {
 	return nil
diff --git a/internal/component/otelcol/auth/headers/headers_test.go b/internal/component/otelcol/auth/headers/headers_test.go
index 5e57d2803a..f488bc05cb 100644
--- a/internal/component/otelcol/auth/headers/headers_test.go
+++ b/internal/component/otelcol/auth/headers/headers_test.go
@@ -61,9 +61,12 @@ func Test(t *testing.T) {
 	// Get the authentication extension from our component and use it to make a
 	// request to our test server.
 	exports := ctrl.Exports().(auth.Exports)
-	require.NotNil(t, exports.Handler.Extension, "handler extension is nil")
 
-	clientAuth, ok := exports.Handler.Extension.(extauth.Client)
+	ext, err := exports.Handler.GetExtension(auth.Client)
+	require.NoError(t, err)
+	require.NotNil(t, ext.Extension, "handler extension is nil")
+
+	clientAuth, ok := ext.Extension.(extauth.Client)
 	require.True(t, ok, "handler does not implement configauth.ClientAuthenticator")
 
 	rt, err := clientAuth.RoundTripper(http.DefaultTransport)
@@ -169,7 +172,7 @@ func TestArguments_UnmarshalAlloy(t *testing.T) {
 		}
 		require.NoError(t, err)
 
-		ext, err := args.Convert()
+		ext, err := args.ConvertClient()
 
 		require.NoError(t, err)
 		otelArgs, ok := (ext).(*headerssetterextension.Config)
diff --git a/internal/component/otelcol/auth/oauth2/oauth2.go b/internal/component/otelcol/auth/oauth2/oauth2.go
index 747dd779c1..dd64c58dcc 100644
--- a/internal/component/otelcol/auth/oauth2/oauth2.go
+++ b/internal/component/otelcol/auth/oauth2/oauth2.go
@@ -53,8 +53,8 @@ func (args *Arguments) SetToDefault() {
 	args.DebugMetrics.SetToDefault()
 }
 
-// Convert implements auth.Arguments.
-func (args Arguments) Convert() (otelcomponent.Config, error) {
+// ConvertClient implements auth.Arguments.
+func (args Arguments) ConvertClient() (otelcomponent.Config, error) {
 	return &oauth2clientauthextension.Config{
 		ClientID:         args.ClientID,
 		ClientIDFile:     args.ClientIDFile,
@@ -68,6 +68,11 @@ func (args Arguments) Convert() (otelcomponent.Config, error) {
 	}, nil
 }
 
+// ConvertServer returns nil since the ouath2 client extension does not support server auth.
+func (args Arguments) ConvertServer() (otelcomponent.Config, error) {
+	return nil, nil
+}
+
 // Extensions implements auth.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
 	return nil
@@ -78,6 +83,11 @@ func (args Arguments) Exporters() map[pipeline.Signal]map[otelcomponent.ID]otelc
 	return nil
 }
 
+// AuthFeatures implements auth.Arguments.
+func (args Arguments) AuthFeatures() auth.AuthFeature {
+	return auth.ClientAuthSupported
+}
+
 // DebugMetricsConfig implements auth.Arguments.
 func (args Arguments) DebugMetricsConfig() otelcolCfg.DebugMetricsArguments {
 	return args.DebugMetrics
diff --git a/internal/component/otelcol/auth/oauth2/oauth2_test.go b/internal/component/otelcol/auth/oauth2/oauth2_test.go
index bb37bb242d..5af868d0d2 100644
--- a/internal/component/otelcol/auth/oauth2/oauth2_test.go
+++ b/internal/component/otelcol/auth/oauth2/oauth2_test.go
@@ -112,9 +112,12 @@ func Test(t *testing.T) {
 			// Get the authentication extension from our component and use it to make a
 			// request to our test server.
 			exports := ctrl.Exports().(auth.Exports)
-			require.NotNil(t, exports.Handler.Extension, "handler extension is nil")
 
-			clientAuth, ok := exports.Handler.Extension.(extauth.Client)
+			ext, err := exports.Handler.GetExtension(auth.Client)
+			require.NoError(t, err)
+			require.NotNil(t, ext.Extension, "handler extension is nil")
+
+			clientAuth, ok := ext.Extension.(extauth.Client)
 			require.True(t, ok, "handler does not implement configauth.ClientAuthenticator")
 
 			rt, err := clientAuth.RoundTripper(http.DefaultTransport)
diff --git a/internal/component/otelcol/auth/sigv4/sigv4.go b/internal/component/otelcol/auth/sigv4/sigv4.go
index c8060ed337..3c466a628b 100644
--- a/internal/component/otelcol/auth/sigv4/sigv4.go
+++ b/internal/component/otelcol/auth/sigv4/sigv4.go
@@ -43,8 +43,8 @@ func (args *Arguments) SetToDefault() {
 	args.DebugMetrics.SetToDefault()
 }
 
-// Convert implements auth.Arguments.
-func (args Arguments) Convert() (otelcomponent.Config, error) {
+// ConvertClient implements auth.Arguments.
+func (args Arguments) ConvertClient() (otelcomponent.Config, error) {
 	res := sigv4authextension.Config{
 		Region:     args.Region,
 		Service:    args.Service,
@@ -58,9 +58,14 @@ func (args Arguments) Convert() (otelcomponent.Config, error) {
 	return &res, nil
 }
 
+// ConvertServer returns nil since the sigv4 extension does not support server authentication.
+func (args Arguments) ConvertServer() (otelcomponent.Config, error) {
+	return nil, nil
+}
+
 // Validate implements syntax.Validator.
 func (args Arguments) Validate() error {
-	_, err := args.Convert()
+	_, err := args.ConvertClient()
 	return err
 }
 
@@ -69,6 +74,11 @@ func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension
 	return nil
 }
 
+// AuthFeatures implements auth.Arguments.
+func (args Arguments) AuthFeatures() auth.AuthFeature {
+	return auth.ClientAuthSupported
+}
+
 // Exporters implements auth.Arguments.
 func (args Arguments) Exporters() map[pipeline.Signal]map[otelcomponent.ID]otelcomponent.Component {
 	return nil
diff --git a/internal/component/otelcol/auth/sigv4/sigv4_test.go b/internal/component/otelcol/auth/sigv4/sigv4_test.go
index 1f2ffa17ad..ebe977f1a4 100644
--- a/internal/component/otelcol/auth/sigv4/sigv4_test.go
+++ b/internal/component/otelcol/auth/sigv4/sigv4_test.go
@@ -173,9 +173,13 @@ func Test(t *testing.T) {
 		// Get the authentication extension from our component and use it to make a
 		// request to our test server.
 		exports := ctrl.Exports().(auth.Exports)
-		require.NotNil(t, exports.Handler.Extension, "handler extension is nil")
 
-		clientAuth, ok := exports.Handler.Extension.(extauth.Client)
+		ext, err := exports.Handler.GetExtension(auth.Client)
+		require.NoError(t, err)
+
+		require.NotNil(t, ext.Extension, "handler extension is nil")
+
+		clientAuth, ok := ext.Extension.(extauth.Client)
 		require.True(t, ok, "handler does not implement configauth.ClientAuthenticator")
 
 		rt, err := clientAuth.RoundTripper(http.DefaultTransport)
diff --git a/internal/component/otelcol/config_grpc.go b/internal/component/otelcol/config_grpc.go
index 3608d9ed94..28344876d6 100644
--- a/internal/component/otelcol/config_grpc.go
+++ b/internal/component/otelcol/config_grpc.go
@@ -30,21 +30,31 @@ type GRPCServerArguments struct {
 
 	Keepalive *KeepaliveServerArguments `alloy:"keepalive,block,optional"`
 
-	// TODO(rfratto): auth
-	//
-	// Figuring out how to do authentication isn't very straightforward here. The
-	// auth section links to an authenticator extension.
-	//
-	// We will need to generally figure out how we want to provide common
-	// authentication extensions to all of our components.
+	// Auth is a binding to an otelcol.auth.* component extension which handles
+	// authentication.
+	// alloy name is auth instead of authentication so the user interface is the same as exporter components.
+	Authentication *auth.Handler `alloy:"auth,attr,optional"`
 
 	IncludeMetadata bool `alloy:"include_metadata,attr,optional"`
 }
 
 // Convert converts args into the upstream type.
-func (args *GRPCServerArguments) Convert() *otelconfiggrpc.ServerConfig {
+func (args *GRPCServerArguments) Convert() (*otelconfiggrpc.ServerConfig, error) {
 	if args == nil {
-		return nil
+		return nil, nil
+	}
+
+	// If auth is set add that to the config.
+	var authentication *otelconfigauth.Authentication
+	if args.Authentication != nil {
+		// If a auth plugin does not implement server auth, an error will be returned here.
+		serverExtension, err := args.Authentication.GetExtension(auth.Server)
+		if err != nil {
+			return nil, err
+		}
+		authentication = &otelconfigauth.Authentication{
+			AuthenticatorID: serverExtension.ID,
+		}
 	}
 
 	return &otelconfiggrpc.ServerConfig{
@@ -59,11 +69,23 @@ func (args *GRPCServerArguments) Convert() *otelconfiggrpc.ServerConfig {
 		MaxConcurrentStreams: args.MaxConcurrentStreams,
 		ReadBufferSize:       int(args.ReadBufferSize),
 		WriteBufferSize:      int(args.WriteBufferSize),
+		Keepalive:            args.Keepalive.Convert(),
+		IncludeMetadata:      args.IncludeMetadata,
+		Auth:                 authentication,
+	}, nil
+}
 
-		Keepalive: args.Keepalive.Convert(),
-
-		IncludeMetadata: args.IncludeMetadata,
+// Extensions exposes extensions used by args.
+func (args *GRPCServerArguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
+	m := make(map[otelcomponent.ID]otelextension.Extension)
+	if args.Authentication != nil {
+		ext, err := args.Authentication.GetExtension(auth.Server)
+		if err != nil {
+			return m
+		}
+		m[ext.ID] = ext.Extension
 	}
+	return m
 }
 
 // KeepaliveServerArguments holds shared keepalive settings for components
@@ -150,13 +172,14 @@ type GRPCClientArguments struct {
 
 	// Auth is a binding to an otelcol.auth.* component extension which handles
 	// authentication.
-	Auth *auth.Handler `alloy:"auth,attr,optional"`
+	// alloy name is auth instead of authentication to not break user interface compatibility.
+	Authentication *auth.Handler `alloy:"auth,attr,optional"`
 }
 
 // Convert converts args into the upstream type.
-func (args *GRPCClientArguments) Convert() *otelconfiggrpc.ClientConfig {
+func (args *GRPCClientArguments) Convert() (*otelconfiggrpc.ClientConfig, error) {
 	if args == nil {
-		return nil
+		return nil, nil
 	}
 
 	opaqueHeaders := make(map[string]configopaque.String)
@@ -164,10 +187,15 @@ func (args *GRPCClientArguments) Convert() *otelconfiggrpc.ClientConfig {
 		opaqueHeaders[headerName] = configopaque.String(headerVal)
 	}
 
-	// Configure the authentication if args.Auth is set.
-	var auth *otelconfigauth.Authentication
-	if args.Auth != nil {
-		auth = &otelconfigauth.Authentication{AuthenticatorID: args.Auth.ID}
+	// Configure authentication if args.Auth is set.
+	var authentication *otelconfigauth.Authentication
+	if args.Authentication != nil {
+		ext, err := args.Authentication.GetExtension(auth.Client)
+		if err != nil {
+			return nil, err
+		}
+
+		authentication = &otelconfigauth.Authentication{AuthenticatorID: ext.ID}
 	}
 
 	// Set default value for `balancer_name` to sync up with upstream's
@@ -191,15 +219,19 @@ func (args *GRPCClientArguments) Convert() *otelconfiggrpc.ClientConfig {
 		BalancerName:    balancerName,
 		Authority:       args.Authority,
 
-		Auth: auth,
-	}
+		Auth: authentication,
+	}, nil
 }
 
 // Extensions exposes extensions used by args.
 func (args *GRPCClientArguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
 	m := make(map[otelcomponent.ID]otelextension.Extension)
-	if args.Auth != nil {
-		m[args.Auth.ID] = args.Auth.Extension
+	if args.Authentication != nil {
+		ext, err := args.Authentication.GetExtension(auth.Client)
+		if err != nil {
+			return m
+		}
+		m[ext.ID] = ext.Extension
 	}
 	return m
 }
diff --git a/internal/component/otelcol/config_http.go b/internal/component/otelcol/config_http.go
index 71c89ebc49..53a6fb25ef 100644
--- a/internal/component/otelcol/config_http.go
+++ b/internal/component/otelcol/config_http.go
@@ -21,13 +21,10 @@ type HTTPServerArguments struct {
 
 	CORS *CORSArguments `alloy:"cors,block,optional"`
 
-	// TODO(rfratto): auth
-	//
-	// Figuring out how to do authentication isn't very straightforward here. The
-	// auth section links to an authenticator extension.
-	//
-	// We will need to generally figure out how we want to provide common
-	// authentication extensions to all of our components.
+	// Auth is a binding to an otelcol.auth.* component extension which handles
+	// authentication.
+	// alloy name is auth instead of authentication so the user interface is the same as exporter components.
+	Authentication *auth.Handler `alloy:"auth,attr,optional"`
 
 	MaxRequestBodySize    units.Base2Bytes `alloy:"max_request_body_size,attr,optional"`
 	IncludeMetadata       bool             `alloy:"include_metadata,attr,optional"`
@@ -44,9 +41,25 @@ func copyStringSlice(s []string) []string {
 }
 
 // Convert converts args into the upstream type.
-func (args *HTTPServerArguments) Convert() *otelconfighttp.ServerConfig {
+func (args *HTTPServerArguments) Convert() (*otelconfighttp.ServerConfig, error) {
 	if args == nil {
-		return nil
+		return nil, nil
+	}
+
+	// If auth is set by the user retrieve the associated extension from the handler.
+	// if the extension does not support server auth an error will be returned.
+	var authentication *otelconfighttp.AuthConfig
+	if args.Authentication != nil {
+		ext, err := args.Authentication.GetExtension(auth.Server)
+		if err != nil {
+			return nil, err
+		}
+
+		authentication = &otelconfighttp.AuthConfig{
+			Authentication: otelconfigauth.Authentication{
+				AuthenticatorID: ext.ID,
+			},
+		}
 	}
 
 	return &otelconfighttp.ServerConfig{
@@ -56,7 +69,22 @@ func (args *HTTPServerArguments) Convert() *otelconfighttp.ServerConfig {
 		MaxRequestBodySize:    int64(args.MaxRequestBodySize),
 		IncludeMetadata:       args.IncludeMetadata,
 		CompressionAlgorithms: copyStringSlice(args.CompressionAlgorithms),
+		Auth:                  authentication,
+	}, nil
+}
+
+// Extensions exposes extensions used by args.
+func (args *HTTPServerArguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
+	m := make(map[otelcomponent.ID]otelextension.Extension)
+	if args.Authentication != nil {
+		ext, err := args.Authentication.GetExtension(auth.Server)
+		// Extension will not be registered if there was an error.
+		if err != nil {
+			return m
+		}
+		m[ext.ID] = ext.Extension
 	}
+	return m
 }
 
 // CORSArguments holds shared CORS settings for components which launch HTTP
@@ -107,21 +135,26 @@ type HTTPClientArguments struct {
 
 	// Auth is a binding to an otelcol.auth.* component extension which handles
 	// authentication.
-	Auth *auth.Handler `alloy:"auth,attr,optional"`
+	// alloy name is auth instead of authentication to not break user interface compatibility.
+	Authentication *auth.Handler `alloy:"auth,attr,optional"`
 
 	Cookies *Cookies `alloy:"cookies,block,optional"`
 }
 
 // Convert converts args into the upstream type.
-func (args *HTTPClientArguments) Convert() *otelconfighttp.ClientConfig {
+func (args *HTTPClientArguments) Convert() (*otelconfighttp.ClientConfig, error) {
 	if args == nil {
-		return nil
+		return nil, nil
 	}
 
 	// Configure the authentication if args.Auth is set.
-	var auth *otelconfigauth.Authentication
-	if args.Auth != nil {
-		auth = &otelconfigauth.Authentication{AuthenticatorID: args.Auth.ID}
+	var authentication *otelconfigauth.Authentication
+	if args.Authentication != nil {
+		ext, err := args.Authentication.GetExtension(auth.Client)
+		if err != nil {
+			return nil, err
+		}
+		authentication = &otelconfigauth.Authentication{AuthenticatorID: ext.ID}
 	}
 
 	opaqueHeaders := make(map[string]configopaque.String)
@@ -150,17 +183,21 @@ func (args *HTTPClientArguments) Convert() *otelconfighttp.ClientConfig {
 		HTTP2ReadIdleTimeout: args.HTTP2ReadIdleTimeout,
 		HTTP2PingTimeout:     args.HTTP2PingTimeout,
 
-		Auth: auth,
+		Auth: authentication,
 
 		Cookies: args.Cookies.Convert(),
-	}
+	}, nil
 }
 
 // Extensions exposes extensions used by args.
 func (args *HTTPClientArguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
 	m := make(map[otelcomponent.ID]otelextension.Extension)
-	if args.Auth != nil {
-		m[args.Auth.ID] = args.Auth.Extension
+	if args.Authentication != nil {
+		ext, err := args.Authentication.GetExtension(auth.Client)
+		if err != nil {
+			return m
+		}
+		m[ext.ID] = ext.Extension
 	}
 	return m
 }
diff --git a/internal/component/otelcol/exporter/loadbalancing/loadbalancing.go b/internal/component/otelcol/exporter/loadbalancing/loadbalancing.go
index 24fe925af1..2a55dd3f63 100644
--- a/internal/component/otelcol/exporter/loadbalancing/loadbalancing.go
+++ b/internal/component/otelcol/exporter/loadbalancing/loadbalancing.go
@@ -115,8 +115,12 @@ func (args *Arguments) Validate() error {
 
 // Convert implements exporter.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
+	protocol, err := args.Protocol.Convert()
+	if err != nil {
+		return nil, err
+	}
 	return &loadbalancingexporter.Config{
-		Protocol:   args.Protocol.Convert(),
+		Protocol:   *protocol,
 		Resolver:   args.Resolver.Convert(),
 		RoutingKey: args.RoutingKey,
 		TimeoutSettings: exporterhelper.TimeoutConfig{
@@ -132,10 +136,14 @@ type Protocol struct {
 	OTLP OtlpConfig `alloy:"otlp,block"`
 }
 
-func (protocol Protocol) Convert() loadbalancingexporter.Protocol {
-	return loadbalancingexporter.Protocol{
-		OTLP: protocol.OTLP.Convert(),
+func (protocol Protocol) Convert() (*loadbalancingexporter.Protocol, error) {
+	otlp, err := protocol.OTLP.Convert()
+	if err != nil {
+		return nil, err
 	}
+	return &loadbalancingexporter.Protocol{
+		OTLP: *otlp,
+	}, nil
 }
 
 // OtlpConfig defines the config for an OTLP exporter
@@ -157,15 +165,19 @@ func (oc *OtlpConfig) SetToDefault() {
 	oc.Queue.SetToDefault()
 }
 
-func (oc OtlpConfig) Convert() otlpexporter.Config {
-	return otlpexporter.Config{
+func (oc OtlpConfig) Convert() (*otlpexporter.Config, error) {
+	clientConfig, err := oc.Client.Convert()
+	if err != nil {
+		return nil, err
+	}
+	return &otlpexporter.Config{
 		TimeoutConfig: exporterhelper.TimeoutConfig{
 			Timeout: oc.Timeout,
 		},
 		QueueConfig:  *oc.Queue.Convert(),
 		RetryConfig:  *oc.Retry.Convert(),
-		ClientConfig: *oc.Client.Convert(),
-	}
+		ClientConfig: *clientConfig,
+	}, nil
 }
 
 // ResolverSettings defines the configurations for the backend resolver
@@ -364,15 +376,16 @@ type GRPCClientArguments struct {
 
 	// Auth is a binding to an otelcol.auth.* component extension which handles
 	// authentication.
-	Auth *auth.Handler `alloy:"auth,attr,optional"`
+	// alloy name is auth instead of authentication to not break user interface compatibility.
+	Authentication *auth.Handler `alloy:"auth,attr,optional"`
 }
 
 var _ syntax.Defaulter = &GRPCClientArguments{}
 
 // Convert converts args into the upstream type.
-func (args *GRPCClientArguments) Convert() *otelconfiggrpc.ClientConfig {
+func (args *GRPCClientArguments) Convert() (*otelconfiggrpc.ClientConfig, error) {
 	if args == nil {
-		return nil
+		return nil, nil
 	}
 
 	opaqueHeaders := make(map[string]configopaque.String)
@@ -381,9 +394,14 @@ func (args *GRPCClientArguments) Convert() *otelconfiggrpc.ClientConfig {
 	}
 
 	// Configure the authentication if args.Auth is set.
-	var auth *otelconfigauth.Authentication
-	if args.Auth != nil {
-		auth = &otelconfigauth.Authentication{AuthenticatorID: args.Auth.ID}
+	var authentication *otelconfigauth.Authentication
+	if args.Authentication != nil {
+		ext, err := args.Authentication.GetExtension(auth.Client)
+		if err != nil {
+			return nil, err
+		}
+
+		authentication = &otelconfigauth.Authentication{AuthenticatorID: ext.ID}
 	}
 
 	balancerName := args.BalancerName
@@ -404,15 +422,19 @@ func (args *GRPCClientArguments) Convert() *otelconfiggrpc.ClientConfig {
 		BalancerName:    balancerName,
 		Authority:       args.Authority,
 
-		Auth: auth,
-	}
+		Auth: authentication,
+	}, nil
 }
 
 // Extensions exposes extensions used by args.
 func (args *GRPCClientArguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
 	m := make(map[otelcomponent.ID]otelextension.Extension)
-	if args.Auth != nil {
-		m[args.Auth.ID] = args.Auth.Extension
+	if args.Authentication != nil {
+		ext, err := args.Authentication.GetExtension(auth.Client)
+		if err != nil {
+			return m
+		}
+		m[ext.ID] = ext.Extension
 	}
 	return m
 }
diff --git a/internal/component/otelcol/exporter/otlp/otlp.go b/internal/component/otelcol/exporter/otlp/otlp.go
index fe90afc0d5..99ae573a45 100644
--- a/internal/component/otelcol/exporter/otlp/otlp.go
+++ b/internal/component/otelcol/exporter/otlp/otlp.go
@@ -62,13 +62,18 @@ func (args *Arguments) SetToDefault() {
 
 // Convert implements exporter.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
+	clientArgs := *(*otelcol.GRPCClientArguments)(&args.Client)
+	convertedClientArgs, err := clientArgs.Convert()
+	if err != nil {
+		return nil, err
+	}
 	return &otlpexporter.Config{
 		TimeoutConfig: otelpexporterhelper.TimeoutConfig{
 			Timeout: args.Timeout,
 		},
 		QueueConfig:  *args.Queue.Convert(),
 		RetryConfig:  *args.Retry.Convert(),
-		ClientConfig: *(*otelcol.GRPCClientArguments)(&args.Client).Convert(),
+		ClientConfig: *convertedClientArgs,
 	}, nil
 }
 
diff --git a/internal/component/otelcol/exporter/otlphttp/otlphttp.go b/internal/component/otelcol/exporter/otlphttp/otlphttp.go
index f996462c2d..9de02e4647 100644
--- a/internal/component/otelcol/exporter/otlphttp/otlphttp.go
+++ b/internal/component/otelcol/exporter/otlphttp/otlphttp.go
@@ -71,8 +71,13 @@ func (args *Arguments) SetToDefault() {
 
 // Convert implements exporter.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
+	httpClientArgs := *(*otelcol.HTTPClientArguments)(&args.Client)
+	convertedClientArgs, err := httpClientArgs.Convert()
+	if err != nil {
+		return nil, err
+	}
 	return &otlphttpexporter.Config{
-		ClientConfig:    *(*otelcol.HTTPClientArguments)(&args.Client).Convert(),
+		ClientConfig:    *convertedClientArgs,
 		QueueConfig:     *args.Queue.Convert(),
 		RetryConfig:     *args.Retry.Convert(),
 		TracesEndpoint:  args.TracesEndpoint,
diff --git a/internal/component/otelcol/extension/jaeger_remote_sampling/jaeger_remote_sampling.go b/internal/component/otelcol/extension/jaeger_remote_sampling/jaeger_remote_sampling.go
index 1fc6a12c59..99bc507dbf 100644
--- a/internal/component/otelcol/extension/jaeger_remote_sampling/jaeger_remote_sampling.go
+++ b/internal/component/otelcol/extension/jaeger_remote_sampling/jaeger_remote_sampling.go
@@ -2,6 +2,7 @@ package jaeger_remote_sampling
 
 import (
 	"fmt"
+	"maps"
 	"time"
 
 	"github.com/grafana/alloy/internal/component"
@@ -68,11 +69,29 @@ func (args *Arguments) SetToDefault() {
 
 // Convert implements extension.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
+	httpServerConfig := (*otelcol.HTTPServerArguments)(args.HTTP)
+	httpConvertedServerConfig, err := httpServerConfig.Convert()
+	if err != nil {
+		return nil, err
+	}
+
+	grpcServerConfig := (*otelcol.GRPCServerArguments)(args.GRPC)
+	convertedGrpcServerConfig, err := grpcServerConfig.Convert()
+	if err != nil {
+		return nil, err
+	}
+
+	grpcClientConfig := (*otelcol.GRPCClientArguments)(args.Source.Remote)
+	convertedGrpcClientConfig, err := grpcClientConfig.Convert()
+	if err != nil {
+		return nil, err
+	}
+
 	return &jaegerremotesampling.Config{
-		HTTPServerConfig: (*otelcol.HTTPServerArguments)(args.HTTP).Convert(),
-		GRPCServerConfig: (*otelcol.GRPCServerArguments)(args.GRPC).Convert(),
+		HTTPServerConfig: httpConvertedServerConfig,
+		GRPCServerConfig: convertedGrpcServerConfig,
 		Source: jaegerremotesampling.Source{
-			Remote:         (*otelcol.GRPCClientArguments)(args.Source.Remote).Convert(),
+			Remote:         convertedGrpcClientConfig,
 			File:           args.Source.File,
 			ReloadInterval: args.Source.ReloadInterval,
 			Contents:       args.Source.Content,
@@ -82,7 +101,24 @@ func (args Arguments) Convert() (otelcomponent.Config, error) {
 
 // Extensions implements extension.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
-	return nil
+	extensionMap := make(map[otelcomponent.ID]otelextension.Extension)
+
+	// Gets the extensions for the HTTP server and GRPC server
+	if args.HTTP != nil {
+		httpExtensions := (*otelcol.HTTPServerArguments)(args.HTTP).Extensions()
+
+		// Copies the extensions for the HTTP server into the map
+		maps.Copy(extensionMap, httpExtensions)
+	}
+
+	if args.GRPC != nil {
+		grpcExtensions := (*otelcol.GRPCServerArguments)(args.GRPC).Extensions()
+
+		// Copies the extensions for the GRPC server into the map.
+		maps.Copy(extensionMap, grpcExtensions)
+	}
+
+	return extensionMap
 }
 
 // Exporters implements extension.Arguments.
diff --git a/internal/component/otelcol/receiver/datadog/datadog.go b/internal/component/otelcol/receiver/datadog/datadog.go
index 66abc47927..5517fa6c59 100644
--- a/internal/component/otelcol/receiver/datadog/datadog.go
+++ b/internal/component/otelcol/receiver/datadog/datadog.go
@@ -57,15 +57,20 @@ func (args *Arguments) SetToDefault() {
 
 // Convert implements receiver.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
+	convertedHttpServer, err := args.HTTPServer.Convert()
+	if err != nil {
+		return nil, err
+	}
+
 	return &datadogreceiver.Config{
-		ServerConfig: *args.HTTPServer.Convert(),
+		ServerConfig: *convertedHttpServer,
 		ReadTimeout:  args.ReadTimeout,
 	}, nil
 }
 
 // Extensions implements receiver.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
-	return nil
+	return args.HTTPServer.Extensions()
 }
 
 // Exporters implements receiver.Arguments.
diff --git a/internal/component/otelcol/receiver/influxdb/influxdb.go b/internal/component/otelcol/receiver/influxdb/influxdb.go
index 9f6f21472e..53eeb33f3c 100644
--- a/internal/component/otelcol/receiver/influxdb/influxdb.go
+++ b/internal/component/otelcol/receiver/influxdb/influxdb.go
@@ -2,39 +2,39 @@
 package influxdb
 
 import (
-    "fmt"
-
-    "github.com/grafana/alloy/internal/component"
-    "github.com/grafana/alloy/internal/component/otelcol"
-    otelcolCfg "github.com/grafana/alloy/internal/component/otelcol/config"
-    "github.com/grafana/alloy/internal/component/otelcol/receiver"
-    "github.com/grafana/alloy/internal/featuregate"
-    influxdbreceiver "github.com/open-telemetry/opentelemetry-collector-contrib/receiver/influxdbreceiver"
-    otelcomponent "go.opentelemetry.io/collector/component"
-    otelextension "go.opentelemetry.io/collector/extension"
-    "go.opentelemetry.io/collector/pipeline"
+	"fmt"
+
+	"github.com/grafana/alloy/internal/component"
+	"github.com/grafana/alloy/internal/component/otelcol"
+	otelcolCfg "github.com/grafana/alloy/internal/component/otelcol/config"
+	"github.com/grafana/alloy/internal/component/otelcol/receiver"
+	"github.com/grafana/alloy/internal/featuregate"
+	influxdbreceiver "github.com/open-telemetry/opentelemetry-collector-contrib/receiver/influxdbreceiver"
+	otelcomponent "go.opentelemetry.io/collector/component"
+	otelextension "go.opentelemetry.io/collector/extension"
+	"go.opentelemetry.io/collector/pipeline"
 )
 
 func init() {
-    component.Register(component.Registration{
-        Name:      "otelcol.receiver.influxdb",
-        Stability: featuregate.StabilityGenerallyAvailable,
-        Args:      Arguments{},
-
-        Build: func(opts component.Options, args component.Arguments) (component.Component, error) {
-            fact := influxdbreceiver.NewFactory()
-            return receiver.New(opts, fact, args.(Arguments))
-        },
-    })
+	component.Register(component.Registration{
+		Name:      "otelcol.receiver.influxdb",
+		Stability: featuregate.StabilityGenerallyAvailable,
+		Args:      Arguments{},
+
+		Build: func(opts component.Options, args component.Arguments) (component.Component, error) {
+			fact := influxdbreceiver.NewFactory()
+			return receiver.New(opts, fact, args.(Arguments))
+		},
+	})
 }
 
 // Arguments configures the otelcol.receiver.influxdb component.
 type Arguments struct {
-    HTTPServer otelcol.HTTPServerArguments `alloy:",squash"`
+	HTTPServer otelcol.HTTPServerArguments `alloy:",squash"`
 
-    DebugMetrics otelcolCfg.DebugMetricsArguments `alloy:"debug_metrics,block,optional"`
+	DebugMetrics otelcolCfg.DebugMetricsArguments `alloy:"debug_metrics,block,optional"`
 
-    Output *otelcol.ConsumerArguments `alloy:"output,block"`
+	Output *otelcol.ConsumerArguments `alloy:"output,block"`
 }
 
 var _ receiver.Arguments = Arguments{}
@@ -48,37 +48,43 @@ func (args *Arguments) SetToDefault() {
 	}
 	args.DebugMetrics.SetToDefault()
 }
+
 // Validate ensures that the Arguments configuration is valid.
 func (args *Arguments) Validate() error {
-    if args.HTTPServer.Endpoint == "" {
-        return fmt.Errorf("HTTP server endpoint cannot be empty")
-    }
-    return nil
+	if args.HTTPServer.Endpoint == "" {
+		return fmt.Errorf("HTTP server endpoint cannot be empty")
+	}
+	return nil
 }
 
 // Convert implements receiver.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
-    return &influxdbreceiver.Config{
-        ServerConfig: *args.HTTPServer.Convert(),
-    }, nil
+	serverConfig, err := args.HTTPServer.Convert()
+	if err != nil {
+		return nil, err
+	}
+
+	return &influxdbreceiver.Config{
+		ServerConfig: *serverConfig,
+	}, nil
 }
 
 // Extensions implements receiver.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
-    return nil
+	return args.HTTPServer.Extensions()
 }
 
 // Exporters implements receiver.Arguments.
 func (args Arguments) Exporters() map[pipeline.Signal]map[otelcomponent.ID]otelcomponent.Component {
-    return nil
+	return nil
 }
 
 // NextConsumers implements receiver.Arguments.
 func (args Arguments) NextConsumers() *otelcol.ConsumerArguments {
-    return args.Output
+	return args.Output
 }
 
 // DebugMetricsConfig implements receiver.Arguments.
 func (args Arguments) DebugMetricsConfig() otelcolCfg.DebugMetricsArguments {
-    return args.DebugMetrics
+	return args.DebugMetrics
 }
diff --git a/internal/component/otelcol/receiver/jaeger/jaeger.go b/internal/component/otelcol/receiver/jaeger/jaeger.go
index a6b2f2b43a..1fea60e890 100644
--- a/internal/component/otelcol/receiver/jaeger/jaeger.go
+++ b/internal/component/otelcol/receiver/jaeger/jaeger.go
@@ -3,6 +3,7 @@ package jaeger
 
 import (
 	"fmt"
+	"maps"
 
 	"github.com/alecthomas/units"
 	"github.com/grafana/alloy/internal/component"
@@ -65,10 +66,19 @@ func (args *Arguments) Validate() error {
 
 // Convert implements receiver.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
+	grpcProtocol, err := args.Protocols.GRPC.Convert()
+	if err != nil {
+		return nil, err
+	}
+
+	httpProtocol, err := args.Protocols.ThriftHTTP.Convert()
+	if err != nil {
+		return nil, err
+	}
 	return &jaegerreceiver.Config{
 		Protocols: jaegerreceiver.Protocols{
-			GRPC:          args.Protocols.GRPC.Convert(),
-			ThriftHTTP:    args.Protocols.ThriftHTTP.Convert(),
+			GRPC:          grpcProtocol,
+			ThriftHTTP:    httpProtocol,
 			ThriftBinary:  args.Protocols.ThriftBinary.Convert(),
 			ThriftCompact: args.Protocols.ThriftCompact.Convert(),
 		},
@@ -77,7 +87,24 @@ func (args Arguments) Convert() (otelcomponent.Config, error) {
 
 // Extensions implements receiver.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
-	return nil
+	extensionMap := make(map[otelcomponent.ID]otelextension.Extension)
+
+	// Gets the extensions for the HTTP server and GRPC server
+	if args.Protocols.ThriftHTTP != nil && args.Protocols.ThriftHTTP.HTTPServerArguments != nil {
+		httpExtensions := (*otelcol.HTTPServerArguments)(args.Protocols.ThriftHTTP.HTTPServerArguments).Extensions()
+
+		// Copies the extensions for the HTTP server into the map
+		maps.Copy(extensionMap, httpExtensions)
+	}
+
+	if args.Protocols.GRPC != nil && args.Protocols.GRPC.GRPCServerArguments != nil {
+		grpcExtensions := (*otelcol.GRPCServerArguments)(args.Protocols.GRPC.GRPCServerArguments).Extensions()
+
+		// Copies the extensions for the GRPC server into the map.
+		maps.Copy(extensionMap, grpcExtensions)
+	}
+
+	return extensionMap
 }
 
 // Exporters implements receiver.Arguments.
@@ -114,9 +141,9 @@ func (args *GRPC) SetToDefault() {
 }
 
 // Convert converts proto into the upstream type.
-func (args *GRPC) Convert() *otelconfiggrpc.ServerConfig {
+func (args *GRPC) Convert() (*otelconfiggrpc.ServerConfig, error) {
 	if args == nil {
-		return nil
+		return nil, nil
 	}
 
 	return args.GRPCServerArguments.Convert()
@@ -137,9 +164,9 @@ func (args *ThriftHTTP) SetToDefault() {
 }
 
 // Convert converts proto into the upstream type.
-func (args *ThriftHTTP) Convert() *otelconfighttp.ServerConfig {
+func (args *ThriftHTTP) Convert() (*otelconfighttp.ServerConfig, error) {
 	if args == nil {
-		return nil
+		return nil, nil
 	}
 
 	return args.HTTPServerArguments.Convert()
diff --git a/internal/component/otelcol/receiver/opencensus/opencensus.go b/internal/component/otelcol/receiver/opencensus/opencensus.go
index 5c3327ea3e..212b6980e0 100644
--- a/internal/component/otelcol/receiver/opencensus/opencensus.go
+++ b/internal/component/otelcol/receiver/opencensus/opencensus.go
@@ -58,15 +58,19 @@ func (args *Arguments) SetToDefault() {
 
 // Convert implements receiver.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
+	grpcServerConfig, err := args.GRPC.Convert()
+	if err != nil {
+		return nil, err
+	}
 	return &opencensusreceiver.Config{
 		CorsOrigins:  args.CorsAllowedOrigins,
-		ServerConfig: *args.GRPC.Convert(),
+		ServerConfig: *grpcServerConfig,
 	}, nil
 }
 
 // Extensions implements receiver.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]extension.Extension {
-	return nil
+	return args.GRPC.Extensions()
 }
 
 // Exporters implements receiver.Arguments.
diff --git a/internal/component/otelcol/receiver/otlp/otlp.go b/internal/component/otelcol/receiver/otlp/otlp.go
index 13d4c13a62..3c5961f771 100644
--- a/internal/component/otelcol/receiver/otlp/otlp.go
+++ b/internal/component/otelcol/receiver/otlp/otlp.go
@@ -3,6 +3,7 @@ package otlp
 
 import (
 	"fmt"
+	"maps"
 	net_url "net/url"
 
 	"github.com/alecthomas/units"
@@ -56,17 +57,22 @@ type HTTPConfigArguments struct {
 }
 
 // Convert converts args into the upstream type.
-func (args *HTTPConfigArguments) Convert() *otlpreceiver.HTTPConfig {
+func (args *HTTPConfigArguments) Convert() (*otlpreceiver.HTTPConfig, error) {
 	if args == nil {
-		return nil
+		return nil, nil
+	}
+
+	httpServerArgs, err := args.HTTPServerArguments.Convert()
+	if err != nil {
+		return nil, err
 	}
 
 	return &otlpreceiver.HTTPConfig{
-		ServerConfig:   args.HTTPServerArguments.Convert(),
+		ServerConfig:   httpServerArgs,
 		TracesURLPath:  args.TracesURLPath,
 		MetricsURLPath: args.MetricsURLPath,
 		LogsURLPath:    args.LogsURLPath,
-	}
+	}, nil
 }
 
 var _ receiver.Arguments = Arguments{}
@@ -79,17 +85,45 @@ func (args *Arguments) SetToDefault() {
 
 // Convert implements receiver.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
+	grpcProtocol := (*otelcol.GRPCServerArguments)(args.GRPC)
+	grpcProtocolArgs, err := grpcProtocol.Convert()
+	if err != nil {
+		return nil, err
+	}
+
+	httpProtocolArgs, err := args.HTTP.Convert()
+	if err != nil {
+		return nil, err
+	}
+
 	return &otlpreceiver.Config{
 		Protocols: otlpreceiver.Protocols{
-			GRPC: (*otelcol.GRPCServerArguments)(args.GRPC).Convert(),
-			HTTP: args.HTTP.Convert(),
+			GRPC: grpcProtocolArgs,
+			HTTP: httpProtocolArgs,
 		},
 	}, nil
 }
 
 // Extensions implements receiver.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
-	return nil
+	extensionMap := make(map[otelcomponent.ID]otelextension.Extension)
+
+	// Gets the extensions for the HTTP server and GRPC server
+	if args.HTTP != nil {
+		httpExtensions := (*otelcol.HTTPServerArguments)(args.HTTP.HTTPServerArguments).Extensions()
+
+		// Copies the extensions for the HTTP server into the map
+		maps.Copy(extensionMap, httpExtensions)
+	}
+
+	if args.GRPC != nil {
+		grpcExtensions := (*otelcol.GRPCServerArguments)(args.GRPC).Extensions()
+
+		// Copies the extensions for the GRPC server into the map.
+		maps.Copy(extensionMap, grpcExtensions)
+	}
+
+	return extensionMap
 }
 
 // Exporters implements receiver.Arguments.
diff --git a/internal/component/otelcol/receiver/zipkin/zipkin.go b/internal/component/otelcol/receiver/zipkin/zipkin.go
index 3b3b4af359..5965246404 100644
--- a/internal/component/otelcol/receiver/zipkin/zipkin.go
+++ b/internal/component/otelcol/receiver/zipkin/zipkin.go
@@ -54,15 +54,19 @@ func (args *Arguments) SetToDefault() {
 
 // Convert implements receiver.Arguments.
 func (args Arguments) Convert() (otelcomponent.Config, error) {
+	httpServerConfig, err := args.HTTPServer.Convert()
+	if err != nil {
+		return nil, err
+	}
 	return &zipkinreceiver.Config{
 		ParseStringTags: args.ParseStringTags,
-		ServerConfig:    *args.HTTPServer.Convert(),
+		ServerConfig:    *httpServerConfig,
 	}, nil
 }
 
 // Extensions implements receiver.Arguments.
 func (args Arguments) Extensions() map[otelcomponent.ID]otelextension.Extension {
-	return nil
+	return args.HTTPServer.Extensions()
 }
 
 // Exporters implements receiver.Arguments.
diff --git a/internal/component/prometheus/relabel/relabel.go b/internal/component/prometheus/relabel/relabel.go
index 69c579190a..425440845b 100644
--- a/internal/component/prometheus/relabel/relabel.go
+++ b/internal/component/prometheus/relabel/relabel.go
@@ -243,6 +243,8 @@ func (c *Component) relabel(val float64, lbls labels.Labels) labels.Labels {
 	c.mut.RLock()
 	defer c.mut.RUnlock()
 
+	c.metricsProcessed.Inc()
+
 	globalRef := c.ls.GetOrAddGlobalRefID(lbls)
 	var (
 		relabelled labels.Labels
diff --git a/internal/component/prometheus/relabel/relabel_test.go b/internal/component/prometheus/relabel/relabel_test.go
index 190a881542..cfa7962cb3 100644
--- a/internal/component/prometheus/relabel/relabel_test.go
+++ b/internal/component/prometheus/relabel/relabel_test.go
@@ -2,6 +2,7 @@ package relabel
 
 import (
 	"fmt"
+	dto "github.com/prometheus/client_model/go"
 	"math"
 	"strconv"
 	"testing"
@@ -111,6 +112,17 @@ func TestLRUNaN(t *testing.T) {
 	require.True(t, relabeller.cache.Len() == 0)
 }
 
+func TestMetrics(t *testing.T) {
+	relabeller := generateRelabel(t)
+	lbls := labels.FromStrings("__address__", "localhost")
+
+	relabeller.relabel(0, lbls)
+	m := &dto.Metric{}
+	err := relabeller.metricsProcessed.Write(m)
+	require.NoError(t, err)
+	require.True(t, *(m.Counter.Value) == 1)
+}
+
 func BenchmarkCache(b *testing.B) {
 	ls := labelstore.New(nil, prom.DefaultRegisterer)
 	fanout := prometheus.NewInterceptor(nil, ls, prometheus.WithAppendHook(func(ref storage.SeriesRef, l labels.Labels, _ int64, _ float64, _ storage.Appender) (storage.SeriesRef, error) {
diff --git a/internal/component/prometheus/write/queue/e2e_test.go b/internal/component/prometheus/write/queue/e2e_test.go
index 768a0f285b..634f48f60a 100644
--- a/internal/component/prometheus/write/queue/e2e_test.go
+++ b/internal/component/prometheus/write/queue/e2e_test.go
@@ -18,7 +18,6 @@ import (
 	"github.com/grafana/alloy/internal/component"
 	"github.com/grafana/alloy/internal/runtime/logging"
 	"github.com/grafana/alloy/internal/util"
-	"github.com/grafana/walqueue/types"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/prometheus/model/exemplar"
 	"github.com/prometheus/prometheus/model/histogram"
@@ -91,9 +90,7 @@ func TestE2E(t *testing.T) {
 				t.Helper()
 				for i := 0; i < samples.Len(); i++ {
 					s := samples.Get(i)
-					require.True(t, len(s.Samples) == 1)
-					require.True(t, s.Samples[0].Timestamp > 0)
-					require.True(t, s.Samples[0].Value == 0)
+					require.True(t, len(s.Samples) == 0)
 					require.True(t, len(s.Labels) == 1)
 					histSame(t, hist(int(s.Histograms[0].Sum)), s.Histograms[0])
 				}
@@ -111,9 +108,7 @@ func TestE2E(t *testing.T) {
 				t.Helper()
 				for i := 0; i < samples.Len(); i++ {
 					s := samples.Get(i)
-					require.True(t, len(s.Samples) == 1)
-					require.True(t, s.Samples[0].Timestamp > 0)
-					require.True(t, s.Samples[0].Value == 0)
+					require.True(t, len(s.Samples) == 0)
 					require.True(t, len(s.Labels) == 1)
 					histFloatSame(t, histFloat(int(s.Histograms[0].Sum)), s.Histograms[0])
 				}
@@ -216,9 +211,6 @@ func runTest(t *testing.T, add func(index int, appendable storage.Appender) (flo
 	} else {
 		metaTest(metaSamples)
 	}
-	require.Eventuallyf(t, func() bool {
-		return types.OutStandingTimeSeriesBinary.Load() == 0
-	}, 20*time.Second, 1*time.Second, "there are %d time series not collected", types.OutStandingTimeSeriesBinary.Load())
 }
 
 func handlePost(t *testing.T, _ http.ResponseWriter, r *http.Request) ([]prompb.TimeSeries, []prompb.MetricMetadata) {
diff --git a/internal/component/prometheus/write/queue/types.go b/internal/component/prometheus/write/queue/types.go
index ffffe287ea..78a9886896 100644
--- a/internal/component/prometheus/write/queue/types.go
+++ b/internal/component/prometheus/write/queue/types.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/grafana/alloy/syntax/alloytypes"
 	"github.com/grafana/walqueue/types"
+	common "github.com/prometheus/common/config"
 	"github.com/prometheus/common/version"
 	"github.com/prometheus/prometheus/storage"
 )
@@ -66,6 +67,9 @@ func (r *Arguments) Validate() error {
 		if conn.FlushInterval < 1*time.Second {
 			return fmt.Errorf("flush_interval must be greater or equal to 1s, the internal timers resolution is 1s")
 		}
+		if conn.BasicAuth != nil && conn.TLSConfig != nil {
+			return fmt.Errorf("endpoint %s cannot have both BasicAuth and TLSConfig set", conn.Name)
+		}
 	}
 
 	return nil
@@ -89,6 +93,8 @@ type EndpointConfig struct {
 	// How many concurrent queues to have.
 	Parallelism    uint              `alloy:"parallelism,attr,optional"`
 	ExternalLabels map[string]string `alloy:"external_labels,attr,optional"`
+	TLSConfig      *common.TLSConfig `alloy:"tls_config,block,optional"`
+	RoundRobin     bool              `alloy:"enable_round_robin,attr,optional"`
 }
 
 var UserAgent = fmt.Sprintf("Alloy/%s", version.Version)
@@ -105,6 +111,7 @@ func (cc EndpointConfig) ToNativeType() types.ConnectionConfig {
 		FlushInterval:    cc.FlushInterval,
 		ExternalLabels:   cc.ExternalLabels,
 		Connections:      cc.Parallelism,
+		UseRoundRobin:    cc.RoundRobin,
 	}
 	if cc.BasicAuth != nil {
 		tcc.BasicAuth = &types.BasicAuth{
@@ -112,6 +119,12 @@ func (cc EndpointConfig) ToNativeType() types.ConnectionConfig {
 			Password: string(cc.BasicAuth.Password),
 		}
 	}
+	if cc.TLSConfig != nil {
+		tcc.InsecureSkipVerify = cc.TLSConfig.InsecureSkipVerify
+		tcc.TLSCert = cc.TLSConfig.Cert
+		tcc.TLSKey = string(cc.TLSConfig.Key)
+		tcc.TLSCACert = cc.TLSConfig.CA
+	}
 	return tcc
 }
 
diff --git a/internal/component/prometheus/write/queue/types_test.go b/internal/component/prometheus/write/queue/types_test.go
new file mode 100644
index 0000000000..8e66c8acc8
--- /dev/null
+++ b/internal/component/prometheus/write/queue/types_test.go
@@ -0,0 +1,20 @@
+package queue
+
+import (
+	common "github.com/prometheus/common/config"
+	"github.com/stretchr/testify/require"
+	"strings"
+	"testing"
+)
+
+func TestBasicAuthAndTLSBothSetError(t *testing.T) {
+	args := defaultArgs()
+	args.Endpoints = make([]EndpointConfig, 1)
+	args.Endpoints[0] = defaultEndpointConfig()
+	args.Endpoints[0].Name = "test"
+	args.Endpoints[0].TLSConfig = &common.TLSConfig{}
+	args.Endpoints[0].BasicAuth = &BasicAuth{}
+	err := args.Validate()
+	require.Error(t, err)
+	require.True(t, strings.Contains(err.Error(), "cannot have both BasicAuth and TLSConfig"))
+}
diff --git a/internal/converter/internal/otelcolconvert/converter_loadbalancingexporter.go b/internal/converter/internal/otelcolconvert/converter_loadbalancingexporter.go
index 2a0c26b073..152a2fb824 100644
--- a/internal/converter/internal/otelcolconvert/converter_loadbalancingexporter.go
+++ b/internal/converter/internal/otelcolconvert/converter_loadbalancingexporter.go
@@ -104,7 +104,7 @@ func toProtocol(cfg loadbalancingexporter.Protocol) loadbalancing.Protocol {
 				BalancerName:    balancerName,
 				Authority:       cfg.OTLP.Authority,
 
-				Auth: a,
+				Authentication: a,
 			},
 		},
 	}
diff --git a/internal/converter/internal/otelcolconvert/converter_otlpexporter.go b/internal/converter/internal/otelcolconvert/converter_otlpexporter.go
index af84580bf4..326ef4d3b6 100644
--- a/internal/converter/internal/otelcolconvert/converter_otlpexporter.go
+++ b/internal/converter/internal/otelcolconvert/converter_otlpexporter.go
@@ -116,7 +116,7 @@ func toGRPCClientArguments(cfg configgrpc.ClientConfig) otelcol.GRPCClientArgume
 		BalancerName:    balancerName,
 		Authority:       cfg.Authority,
 
-		Auth: a,
+		Authentication: a,
 	}
 }
 
diff --git a/internal/converter/internal/otelcolconvert/converter_otlphttpexporter.go b/internal/converter/internal/otelcolconvert/converter_otlphttpexporter.go
index 12c6f6fcc9..53e69c36ff 100644
--- a/internal/converter/internal/otelcolconvert/converter_otlphttpexporter.go
+++ b/internal/converter/internal/otelcolconvert/converter_otlphttpexporter.go
@@ -99,6 +99,6 @@ func toHTTPClientArguments(cfg confighttp.ClientConfig) otelcol.HTTPClientArgume
 		HTTP2PingTimeout:     cfg.HTTP2PingTimeout,
 		HTTP2ReadIdleTimeout: cfg.HTTP2ReadIdleTimeout,
 
-		Auth: a,
+		Authentication: a,
 	}
 }
diff --git a/internal/runtime/componenttest/componenttest.go b/internal/runtime/componenttest/componenttest.go
index a101810d49..dc5c1b9e2d 100644
--- a/internal/runtime/componenttest/componenttest.go
+++ b/internal/runtime/componenttest/componenttest.go
@@ -191,3 +191,13 @@ func (c *Controller) Update(args component.Arguments) error {
 	}
 	return c.inner.Update(args)
 }
+
+// GetComponent retrieves the component under test. It should only be called
+// after Run()
+func (c *Controller) GetComponent() (component.Component, error) {
+	if c.inner == nil {
+		return nil, fmt.Errorf("component was nil. Did you call Run()? %w", component.ErrComponentNotFound)
+	}
+
+	return c.inner, nil
+}
diff --git a/operations/helm/charts/alloy/CHANGELOG.md b/operations/helm/charts/alloy/CHANGELOG.md
index ac54929ec3..cddb9365f6 100644
--- a/operations/helm/charts/alloy/CHANGELOG.md
+++ b/operations/helm/charts/alloy/CHANGELOG.md
@@ -13,6 +13,7 @@ Unreleased
 ### Enhancements
 
 - Update jimmidyson/configmap-reload to 0.14.0. (@petewall)
+- Add the ability to deploy extra manifest files. (@dbluxo)
 
 0.10.1 (2024-12-03)
 ----------
diff --git a/operations/helm/charts/alloy/README.md b/operations/helm/charts/alloy/README.md
index 32bbc451d1..09ab066de7 100644
--- a/operations/helm/charts/alloy/README.md
+++ b/operations/helm/charts/alloy/README.md
@@ -103,6 +103,7 @@ useful if just using the default DaemonSet isn't sufficient.
 | controller.volumeClaimTemplates | list | `[]` | volumeClaimTemplates to add when controller.type is 'statefulset'. |
 | controller.volumes.extra | list | `[]` | Extra volumes to add to the Grafana Alloy pod. |
 | crds.create | bool | `true` | Whether to install CRDs for monitoring. |
+| extraObjects | list | `[]` | Extra k8s manifests to deploy |
 | fullnameOverride | string | `nil` | Overrides the chart's computed fullname. Used to change the full prefix of resource names. |
 | global.image.pullSecrets | list | `[]` | Optional set of global image pull secrets. |
 | global.image.registry | string | `""` | Global image registry to use if it needs to be overriden for some specific use cases (e.g local registries, custom images, ...) |
diff --git a/operations/helm/charts/alloy/ci/extra-manifests-values.yaml b/operations/helm/charts/alloy/ci/extra-manifests-values.yaml
new file mode 100644
index 0000000000..324c44a210
--- /dev/null
+++ b/operations/helm/charts/alloy/ci/extra-manifests-values.yaml
@@ -0,0 +1,8 @@
+extraObjects:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    name: grafana-cloud
+  stringData:
+    PROMETHEUS_HOST: 'https://prometheus-us-central1.grafana.net/api/prom/push'
+    PROMETHEUS_USERNAME: '123456'
diff --git a/operations/helm/charts/alloy/templates/extra-manifests.yaml b/operations/helm/charts/alloy/templates/extra-manifests.yaml
new file mode 100644
index 0000000000..a9bb3b6ba8
--- /dev/null
+++ b/operations/helm/charts/alloy/templates/extra-manifests.yaml
@@ -0,0 +1,4 @@
+{{ range .Values.extraObjects }}
+---
+{{ tpl (toYaml .) $ }}
+{{ end }}
diff --git a/operations/helm/charts/alloy/values.yaml b/operations/helm/charts/alloy/values.yaml
index ba9aae73d9..9ae5dc3fe5 100644
--- a/operations/helm/charts/alloy/values.yaml
+++ b/operations/helm/charts/alloy/values.yaml
@@ -366,3 +366,13 @@ ingress:
   #  - secretName: chart-example-tls
   #    hosts:
   #      - chart-example.local
+
+# -- Extra k8s manifests to deploy
+extraObjects: []
+# - apiVersion: v1
+#   kind: Secret
+#   metadata:
+#     name: grafana-cloud
+#   stringData:
+#     PROMETHEUS_HOST: 'https://prometheus-us-central1.grafana.net/api/prom/push'
+#     PROMETHEUS_USERNAME: '123456'
diff --git a/operations/helm/tests/extra-manifests/alloy/templates/configmap.yaml b/operations/helm/tests/extra-manifests/alloy/templates/configmap.yaml
new file mode 100644
index 0000000000..381ccbff2f
--- /dev/null
+++ b/operations/helm/tests/extra-manifests/alloy/templates/configmap.yaml
@@ -0,0 +1,43 @@
+---
+# Source: alloy/templates/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: alloy
+  labels:
+    helm.sh/chart: alloy
+    app.kubernetes.io/name: alloy
+    app.kubernetes.io/instance: alloy
+    app.kubernetes.io/version: "vX.Y.Z"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: config
+data:
+  config.alloy: |-
+    logging {
+    	level  = "info"
+    	format = "logfmt"
+    }
+    
+    discovery.kubernetes "pods" {
+    	role = "pod"
+    }
+    
+    discovery.kubernetes "nodes" {
+    	role = "node"
+    }
+    
+    discovery.kubernetes "services" {
+    	role = "service"
+    }
+    
+    discovery.kubernetes "endpoints" {
+    	role = "endpoints"
+    }
+    
+    discovery.kubernetes "endpointslices" {
+    	role = "endpointslice"
+    }
+    
+    discovery.kubernetes "ingresses" {
+    	role = "ingress"
+    }
diff --git a/operations/helm/tests/extra-manifests/alloy/templates/controllers/daemonset.yaml b/operations/helm/tests/extra-manifests/alloy/templates/controllers/daemonset.yaml
new file mode 100644
index 0000000000..9edb2018cb
--- /dev/null
+++ b/operations/helm/tests/extra-manifests/alloy/templates/controllers/daemonset.yaml
@@ -0,0 +1,75 @@
+---
+# Source: alloy/templates/controllers/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: alloy
+  labels:
+    helm.sh/chart: alloy
+    app.kubernetes.io/name: alloy
+    app.kubernetes.io/instance: alloy
+    app.kubernetes.io/version: "vX.Y.Z"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  minReadySeconds: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: alloy
+      app.kubernetes.io/instance: alloy
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: alloy
+      labels:
+        app.kubernetes.io/name: alloy
+        app.kubernetes.io/instance: alloy
+    spec:
+      serviceAccountName: alloy
+      containers:
+        - name: alloy
+          image: docker.io/grafana/alloy:v1.5.1
+          imagePullPolicy: IfNotPresent
+          args:
+            - run
+            - /etc/alloy/config.alloy
+            - --storage.path=/tmp/alloy
+            - --server.http.listen-addr=0.0.0.0:12345
+            - --server.http.ui-path-prefix=/
+            - --stability.level=generally-available
+          env:
+            - name: ALLOY_DEPLOY_MODE
+              value: "helm"
+            - name: HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          ports:
+            - containerPort: 12345
+              name: http-metrics
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 12345
+              scheme: HTTP
+            initialDelaySeconds: 10
+            timeoutSeconds: 1
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+        - name: config-reloader
+          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
+          args:
+            - --volume-dir=/etc/alloy
+            - --webhook-url=http://localhost:12345/-/reload
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+          resources:
+            requests:
+              cpu: 1m
+              memory: 5Mi
+      dnsPolicy: ClusterFirst
+      volumes:
+        - name: config
+          configMap:
+            name: alloy
diff --git a/operations/helm/tests/extra-manifests/alloy/templates/extra-manifests.yaml b/operations/helm/tests/extra-manifests/alloy/templates/extra-manifests.yaml
new file mode 100644
index 0000000000..9174938d6c
--- /dev/null
+++ b/operations/helm/tests/extra-manifests/alloy/templates/extra-manifests.yaml
@@ -0,0 +1,9 @@
+---
+# Source: alloy/templates/extra-manifests.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-cloud
+stringData:
+  PROMETHEUS_HOST: https://prometheus-us-central1.grafana.net/api/prom/push
+  PROMETHEUS_USERNAME: "123456"
diff --git a/operations/helm/tests/extra-manifests/alloy/templates/rbac.yaml b/operations/helm/tests/extra-manifests/alloy/templates/rbac.yaml
new file mode 100644
index 0000000000..58fe9c6a84
--- /dev/null
+++ b/operations/helm/tests/extra-manifests/alloy/templates/rbac.yaml
@@ -0,0 +1,119 @@
+---
+# Source: alloy/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: alloy
+  labels:
+    helm.sh/chart: alloy
+    app.kubernetes.io/name: alloy
+    app.kubernetes.io/instance: alloy
+    app.kubernetes.io/version: "vX.Y.Z"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: rbac
+rules:
+  # Rules which allow discovery.kubernetes to function.
+  - apiGroups:
+      - ""
+      - "discovery.k8s.io"
+      - "networking.k8s.io"
+    resources:
+      - endpoints
+      - endpointslices
+      - ingresses
+      - nodes
+      - nodes/proxy
+      - nodes/metrics
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "monitoring.grafana.com"
+    resources:
+      - podlogs
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow mimir.rules.kubernetes to work.
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - prometheusrules
+    verbs:
+      - get
+      - list
+      - watch
+  - nonResourceURLs:
+      - /metrics
+    verbs:
+      - get
+  # Rules for prometheus.kubernetes.*
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - podmonitors
+      - servicemonitors
+      - probes
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow eventhandler to work.
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for otelcol.processor.k8sattributes
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+---
+# Source: alloy/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: alloy
+  labels:
+    helm.sh/chart: alloy
+    app.kubernetes.io/name: alloy
+    app.kubernetes.io/instance: alloy
+    app.kubernetes.io/version: "vX.Y.Z"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: rbac
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: alloy
+subjects:
+  - kind: ServiceAccount
+    name: alloy
+    namespace: default
diff --git a/operations/helm/tests/extra-manifests/alloy/templates/service.yaml b/operations/helm/tests/extra-manifests/alloy/templates/service.yaml
new file mode 100644
index 0000000000..0e9857aef6
--- /dev/null
+++ b/operations/helm/tests/extra-manifests/alloy/templates/service.yaml
@@ -0,0 +1,24 @@
+---
+# Source: alloy/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: alloy
+  labels:
+    helm.sh/chart: alloy
+    app.kubernetes.io/name: alloy
+    app.kubernetes.io/instance: alloy
+    app.kubernetes.io/version: "vX.Y.Z"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: networking
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: alloy
+    app.kubernetes.io/instance: alloy
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http-metrics
+      port: 12345
+      targetPort: 12345
+      protocol: "TCP"
diff --git a/operations/helm/tests/extra-manifests/alloy/templates/serviceaccount.yaml b/operations/helm/tests/extra-manifests/alloy/templates/serviceaccount.yaml
new file mode 100644
index 0000000000..16959476b1
--- /dev/null
+++ b/operations/helm/tests/extra-manifests/alloy/templates/serviceaccount.yaml
@@ -0,0 +1,14 @@
+---
+# Source: alloy/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: alloy
+  namespace: default
+  labels:
+    helm.sh/chart: alloy
+    app.kubernetes.io/name: alloy
+    app.kubernetes.io/instance: alloy
+    app.kubernetes.io/version: "vX.Y.Z"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: rbac