diff --git a/.github/workflows/vale.yml b/.github/workflows/vale.yml
new file mode 100644
index 000000000..21b8d6593
--- /dev/null
+++ b/.github/workflows/vale.yml
@@ -0,0 +1,36 @@
+name: Vale
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'website/**/*.md'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
+jobs:
+  vale:
+    name: Lint prose
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Vale
+        uses: vale-cli/vale-action@d89dee975228ae261d22c15adcd03578634d429c # v2.1.1
+        with:
+          files: website/
+          vale_flags: "--minAlertLevel=warning"
+          reporter: github-pr-review
+          fail_on_error: true
+          filter_mode: added
diff --git a/.vale.ini b/.vale.ini
new file mode 100644
index 000000000..36e945df8
--- /dev/null
+++ b/.vale.ini
@@ -0,0 +1,19 @@
+StylesPath = .vale/styles
+MinAlertLevel = warning
+
+Vocab = GardenerTerms, ThirdPartyProducts, TechJargon, General
+
+IgnoredScopes = code, tt, code block
+
+[*.md]
+BasedOnStyles = Gardener
+
+TokenIgnores = (`[^`]+`), (<[^>]+>), (v[0-9]+(?:\.[0-9]+)*(?:alpha[0-9]+|beta[0-9]+)?), (/[^\s]+), (https?://\S+), ([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]+), (\w+\(s\)), (\*+\w+\**|\w+\*+)
+
+BlockIgnores = (?s)(\{\{.*?\}\})
+
+[website/about/legal-disclosure.md]
+BasedOnStyles =
+
+[website/archived/**]
+BasedOnStyles =
diff --git a/.vale/styles/Gardener/Articles.yml b/.vale/styles/Gardener/Articles.yml
new file mode 100644
index 000000000..84c08c219
--- /dev/null
+++ b/.vale/styles/Gardener/Articles.yml
@@ -0,0 +1,40 @@
+extends: substitution
+message: "Use '%s' instead of '%s'. The article depends on pronunciation, not spelling."
+link: https://github.com/gardener/documentation/blob/master/website/documentation/contribute/documentation/style-guide/_index.md
+level: warning
+ignorecase: false
+action:
+  name: replace
+swap:
+  # Acronyms starting with vowel-sound letters that need "an"
+  # A (ay), E (ee), F (ef), H (aitch), I (eye), L (el), M (em), N (en), O (oh), R (ar), S (es), X (ex)
+  'a OS': an OS
+  'a HA': an HA
+  'a HTTP': an HTTP
+  'a HTML': an HTML
+  'a SSH': an SSH
+  'a SSL': an SSL
+  'a API': an API
+  'a OIDC': an OIDC
+  'a OCI': an OCI
+  'a SSD': an SSD
+  'a SDK': an SDK
+  'a XML': an XML
+  'a IDE': an IDE
+  'a IAM': an IAM
+  'a HPA': an HPA
+  'a FAQ': an FAQ
+  'a ETCD': an ETCD
+  'a NFS': an NFS
+  'a RBAC': an RBAC
+  # Acronyms starting with consonant-sound letters that need "a"
+  # U (yoo), V (vee), W (double-yoo), C (see) when starts acronym
+  'an VM': a VM
+  'an VPA': a VPA
+  'an VPC': a VPC
+  'an VPN': a VPN
+  'an URL': a URL
+  'an URI': a URI
+  'an GPU': a GPU
+  'an CPU': a CPU
+  'an SIG': a SIG
diff --git a/.vale/styles/Gardener/CommandPrompt.yml b/.vale/styles/Gardener/CommandPrompt.yml
new file mode 100644
index 000000000..ec2a16d80
--- /dev/null
+++ b/.vale/styles/Gardener/CommandPrompt.yml
@@ -0,0 +1,8 @@
+extends: existence
+message: "Don't include the command prompt '%s' in code blocks. Show only the command itself."
+level: error
+link: https://github.com/gardener/documentation/blob/master/website/documentation/contribute/documentation/formatting-guide.md
+scope: raw
+tokens:
+  - '```[a-z]*\n\$\s'
+  - '`\$\s\w'
diff --git a/.vale/styles/Gardener/Links.yml b/.vale/styles/Gardener/Links.yml
new file mode 100644
index 000000000..f6867263e
--- /dev/null
+++ b/.vale/styles/Gardener/Links.yml
@@ -0,0 +1,13 @@
+extends: existence
+message: "Avoid generic link text '%s'. Use a descriptor of the link's destination instead."
+level: warning
+link: https://github.com/gardener/documentation/blob/master/website/documentation/contribute/documentation/style-guide/_index.md
+scope: raw
+nonword: true
+tokens:
+  - '\[here\]\('
+  - '\[click here\]\('
+  - '\[this link\]\('
+  - '\[this page\]\('
+  - '\[read more\]\('
+  - '\[learn more\]\('
diff --git a/.vale/styles/Gardener/Spelling.yml b/.vale/styles/Gardener/Spelling.yml
new file mode 100644
index 000000000..9a39d12f5
--- /dev/null
+++ b/.vale/styles/Gardener/Spelling.yml
@@ -0,0 +1,27 @@
+extends: spelling
+message: "Verify the spelling of '%s'. If the spelling is correct, please add the term to the appropriate vocabulary (`.vale/styles/config/vocabularies/`)."
+level: error
+append: true
+ignore:
+  - GardenerTerms/accept.txt
+  - ThirdPartyProducts/accept.txt
+  - TechJargon/accept.txt
+  - General/accept.txt
+filters:
+  # Uppercase acronyms (e.g. HTTP, YAML, REST)
+  - '[A-Z]{2,}'
+  # Uppercase acronym plurals (e.g. CAs, VMs, CRDs, APIs)
+  - '[A-Z]{2,}s\b'
+  # camelCase and PascalCase identifiers (e.g. kubeConfig, GardenNamespace)
+  - '[a-z]+[A-Z][a-zA-Z]+'
+  - '[A-Z][a-z]+[A-Z][a-zA-Z]+'
+  # Tokens with digits (e.g. IPv4, log4j, int64, v1alpha1)
+  - '[a-zA-Z]*[0-9]+[a-zA-Z0-9]*'
+  # CLI flags (e.g. --flag, -f)
+  - '--?[a-zA-Z][a-zA-Z0-9-]+'
+  # File extensions and dot-separated identifiers (e.g. .yaml, cert.gardener.cloud)
+  - '\.[a-zA-Z]{1,6}\b'
+  # Underscore-separated identifiers (e.g. config_key, _source)
+  - '_?[a-zA-Z]+_[a-zA-Z0-9_]+'
+  # Version strings (e.g. v1, v1.2, v1alpha1, v2beta1)
+  - '[vV][0-9]+(?:\.[0-9]+)*(?:alpha[0-9]+|beta[0-9]+)?'
diff --git a/.vale/styles/Gardener/Terms.yml b/.vale/styles/Gardener/Terms.yml
new file mode 100644
index 000000000..2c0dd9392
--- /dev/null
+++ b/.vale/styles/Gardener/Terms.yml
@@ -0,0 +1,17 @@
+extends: substitution
+message: "Use '%s' instead of '%s'."
+level: error
+action:
+  name: replace
+ignorecase: false
+swap:
+  '(?<![a-zA-Z0-9_./@])[Gg]it[Hh]ub(?![a-zA-Z0-9_.com-])': GitHub
+  '(?<![a-zA-Z0-9_./@])[Gg]it[Ll]ab(?![a-zA-Z0-9_.-])': GitLab
+  '(?<![a-zA-Z0-9_./@])kubernetes(?![a-zA-Z0-9_.-])': Kubernetes
+  '(?<![a-zA-Z0-9_./@])gardener(?![a-zA-Z0-9_@.-])': Gardener
+  '(?<![a-zA-Z0-9_./@])gardenlet(?![a-zA-Z0-9_.-])': gardenlet
+  '(?<![a-zA-Z0-9_./@])openstack(?![a-zA-Z0-9_.-])': OpenStack
+  '(?<![a-zA-Z0-9_./@])vsphere(?![a-zA-Z0-9_.-])': vSphere
+  '(?<![a-zA-Z0-9_./@])stackit(?![a-zA-Z0-9_.-])': STACKIT
+  '(?<![a-zA-Z0-9_./@])controlplane(?![a-zA-Z0-9_.-])': control plane
+  '(?<![a-zA-Z0-9_./@])controlplanes(?![a-zA-Z0-9_.-])': control planes
diff --git a/.vale/styles/config/vocabularies/GardenerTerms/accept.txt b/.vale/styles/config/vocabularies/GardenerTerms/accept.txt
new file mode 100644
index 000000000..15d3ef9b0
--- /dev/null
+++ b/.vale/styles/config/vocabularies/GardenerTerms/accept.txt
@@ -0,0 +1,14 @@
+# Gardener-specific CRDs, APIs, tools, and project names.
+# Use (?i) prefix for terms that appear in mixed capitalizations in prose.
+Diki
+(?i)docforge
+etcd-druid
+gardenadm
+gardenctl
+Gardener
+gardenlet
+Garden Linux
+GEP
+(?i)kubeception
+Podrick
+Terraformer
diff --git a/.vale/styles/config/vocabularies/General/accept.txt b/.vale/styles/config/vocabularies/General/accept.txt
new file mode 100644
index 000000000..bdfe20727
--- /dev/null
+++ b/.vale/styles/config/vocabularies/General/accept.txt
@@ -0,0 +1,27 @@
+# General English words, loanwords, and place names missing from Vale's built-in dictionary
+Augustiner
+Bourgon
+Brussel
+decentrally
+Freizeitheim
+Hirschegg
+homogenous
+homogenously
+Kunstlaan
+Leverkusen
+matcha
+Mesnerhof
+nonobvious
+overconsumption
+re-enable
+reenable
+Rofan
+Schelklingen
+Schlosshof
+uncompromised
+updateability
+toolbelt
+Vitosha
+Walldorf
+Westeurope
+Weyhe
diff --git a/.vale/styles/config/vocabularies/TechJargon/accept.txt b/.vale/styles/config/vocabularies/TechJargon/accept.txt
new file mode 100644
index 000000000..c80142ebb
--- /dev/null
+++ b/.vale/styles/config/vocabularies/TechJargon/accept.txt
@@ -0,0 +1,1318 @@
+# Generic computing, networking, and development terms.
+# Use (?i) prefix for terms that appear in mixed capitalizations in prose.
+(?i)ack
+(?i)acks
+(?i)addon
+(?i)addons
+(?i)advstatus
+(?i)affordances
+(?i)agentic
+(?i)agentless
+(?i)aggregatable
+(?i)aggs
+(?i)aiobotocore
+(?i)aiohttp
+(?i)aiokafka
+(?i)aiopg
+(?i)aioredis
+(?i)aks
+(?i)alicloud
+(?i)alives
+(?i)allocator
+(?i)allowlist
+(?i)allowlisted
+(?i)allowlisting
+(?i)allowlists
+(?i)alphanumerics
+(?i)anonymization
+(?i)anonymized
+(?i)antimalware
+(?i)antispam
+(?i)antispyware
+(?i)apac
+(?i)api
+(?i)apk
+(?i)appender
+(?i)appenders
+(?i)applocker
+(?i)appname
+(?i)approvers
+(?i)apt
+(?i)arg
+(?i)args
+(?i)argv
+(?i)arity
+(?i)armon
+(?i)arn
+(?i)asc
+(?i)asciidocs
+(?i)asgi
+(?i)asn
+(?i)async
+(?i)ato
+(?i)atp
+(?i)attacher
+(?i)attr
+(?i)auditable
+(?i)auditd
+(?i)auditpol
+(?i)authorizer
+(?i)authz
+(?i)autobumping
+(?i)autoconfigured
+(?i)autocreation
+(?i)autodetect
+(?i)autodetected
+(?i)autodetection
+(?i)autodiscover
+(?i)autodiscovery
+(?i)autofill
+(?i)autofilled
+(?i)autogenerate
+(?i)autogenerated
+(?i)autogenerates
+(?i)autoincrementing
+(?i)autoloader
+(?i)autoloading
+(?i)automatable
+(?i)automations
+(?i)automount
+(?i)autoneg
+(?i)autonumber
+(?i)autosave
+(?i)autoscale
+(?i)autoscaled
+(?i)autoscaler
+(?i)autoscalers
+(?i)autoscales
+(?i)autoscaling
+(?i)autoschema
+(?i)autostart
+(?i)autoupdate
+(?i)aws
+(?i)awscloudtrail
+(?i)awscloudwatch
+(?i)awsfargate
+(?i)ba
+(?i)backend
+(?i)backfilling
+(?i)backgrounded
+(?i)backoff
+(?i)backofftimer
+(?i)backport
+(?i)backported
+(?i)backporting
+(?i)backports
+(?i)backpressure
+(?i)backtraces
+(?i)banon
+(?i)barebones
+(?i)baselined
+(?i)basemap
+(?i)basemaps
+(?i)basename
+(?i)batcher
+(?i)baz
+(?i)bbq
+(?i)bc
+(?i)bcc
+(?i)bcpkix
+(?i)bcrypt
+(?i)beaconing
+(?i)ber
+(?i)bfetch
+(?i)bg
+(?i)bigdecimal
+(?i)bigint
+(?i)binlog
+(?i)binwalk
+(?i)bioc
+(?i)bitmask
+(?i)bitrate
+(?i)bitset
+(?i)bitsets
+(?i)bitwise
+(?i)blackhole
+(?i)blkio
+(?i)blockchain
+(?i)blockdev
+(?i)blockquote
+(?i)bn
+(?i)boc
+(?i)bolded
+(?i)bool
+(?i)boolean
+(?i)booleans
+(?i)bootdelegation
+(?i)bootloader
+(?i)bootloop
+(?i)bootlooping
+(?i)botocore
+(?i)bpdu
+(?i)bpf
+(?i)bpr
+(?i)branchpoint
+(?i)breakpoint
+(?i)broadcasted
+(?i)bs
+(?i)btree
+(?i)btrfs
+(?i)bucketized
+(?i)bugcheck
+(?i)bugchecks
+(?i)bugfix
+(?i)bugfixes
+(?i)buildpack
+(?i)bulker
+(?i)bundler
+(?i)bundlers
+(?i)burndown
+(?i)burstable
+(?i)bursty
+(?i)caas
+(?i)cabinets
+(?i)cacert
+(?i)cacerts
+(?i)cafebabe
+(?i)callables
+(?i)callee
+(?i)callout
+(?i)callouts
+(?i)cancelation
+(?i)canonicalization
+(?i)canonicalize
+(?i)canonicalized
+(?i)cartesian
+(?i)casb
+(?i)castable
+(?i)ccr
+(?i)ccs
+(?i)cdi
+(?i)cdrom
+(?i)cef
+(?i)cel
+(?i)cgi
+(?i)cgroup
+(?i)cgroups
+(?i)chainable
+(?i)changeset
+(?i)charset
+(?i)chatbot
+(?i)chatbots
+(?i)checkin
+(?i)checkpointed
+(?i)checkpointing
+(?i)choropleth
+(?i)chroot
+(?i)ci
+(?i)cidr
+(?i)ciphertext
+(?i)cis
+(?i)classpath
+(?i)cleartext
+(?i)cli
+(?i)clientip
+(?i)cloudfoundry
+(?i)clsid
+(?i)clusteroverview
+(?i)cn
+(?i)cname
+(?i)cni
+(?i)codepoint
+(?i)colo
+(?i)colocate
+(?i)colocated
+(?i)combolists
+(?i)compauth
+(?i)complexify
+(?i)componentconfig
+(?i)composability
+(?i)composable
+(?i)concat
+(?i)cond
+(?i)config
+(?i)confighttp
+(?i)configmaps
+(?i)configs
+(?i)configurability
+(?i)conformant
+(?i)conntest
+(?i)conntrack
+(?i)controllermanaged
+(?i)controllermanager
+(?i)copytruncate
+(?i)coroutine
+(?i)coroutines
+(?i)cpe
+(?i)crackable
+(?i)cron
+(?i)croneval
+(?i)cronlines
+(?i)crontab
+(?i)crosslink
+(?i)crypto
+(?i)cryptominer
+(?i)cryptomining
+(?i)csi
+(?i)csp
+(?i)csproj
+(?i)csps
+(?i)csv
+(?i)ctime
+(?i)curations
+(?i)cutover
+(?i)cuvs
+(?i)cve
+(?i)cvtd
+(?i)cwd
+(?i)cy
+(?i)cybersecurity
+(?i)da
+(?i)daemonsets
+(?i)dailyindices
+(?i)darwin
+(?i)datacenter
+(?i)datacenters
+(?i)datanodes
+(?i)datastore
+(?i)datastores
+(?i)datasource
+(?i)datasources
+(?i)datetime
+(?i)datetimes
+(?i)dbcp
+(?i)dbstats
+(?i)dbus
+(?i)dcg
+(?i)dcl
+(?i)dcr
+(?i)debouncing
+(?i)debugfs
+(?i)debuggable
+(?i)debuggability
+(?i)declaratively
+(?i)decodable
+(?i)decompounder
+(?i)decompounding
+(?i)dedent
+(?i)dedot
+(?i)dedoted
+(?i)dedotted
+(?i)dedup
+(?i)deduplicated
+(?i)deduplication
+(?i)deferredreq
+(?i)defragment
+(?i)defragmentation
+(?i)defragmented
+(?i)deh
+(?i)deliverables
+(?i)denormalize
+(?i)denormalizing
+(?i)denylist
+(?i)deployer
+(?i)deps
+(?i)dereference
+(?i)deserialization
+(?i)deserialize
+(?i)deserialized
+(?i)deserializer
+(?i)deserializers
+(?i)deserializes
+(?i)deserializing
+(?i)dest
+(?i)destructures
+(?i)desugaring
+(?i)determinization
+(?i)determinized
+(?i)dev
+(?i)dfw
+(?i)dicts
+(?i)diffable
+(?i)dirs
+(?i)discoverability
+(?i)distros
+(?i)dll
+(?i)dlp
+(?i)dmz
+(?i)dn
+(?i)dnf
+(?i)dns
+(?i)docinfo
+(?i)docker
+(?i)dockerd
+(?i)dockerfile
+(?i)dockerstats
+(?i)docstrings
+(?i)docvalue
+(?i)docvalues
+(?i)donut
+(?i)downloader
+(?i)downloaders
+(?i)downsample
+(?i)downsampled
+(?i)downsampling
+(?i)downscaled
+(?i)downscaling
+(?i)downtimes
+(?i)dpkg
+(?i)dracut
+(?i)draggable
+(?i)drilldown
+(?i)drilldowns
+(?i)dropzone
+(?i)dtype
+(?i)dw
+(?i)ebs
+(?i)ech
+(?i)ecs
+(?i)eis
+(?i)elb
+(?i)embeddable
+(?i)emea
+(?i)emr
+(?i)enablement
+(?i)endian
+(?i)enqueued
+(?i)enricher
+(?i)enrichers
+(?i)enrichments
+(?i)enroute
+(?i)ensurepip
+(?i)enum
+(?i)env
+(?i)envs
+(?i)envvars
+(?i)eoc
+(?i)eol
+(?i)epmapol
+(?i)errored
+(?i)esbuild
+(?i)esql
+(?i)etag
+(?i)etags
+(?i)etcd
+(?i)etcds
+(?i)ethernet
+(?i)ethertype
+(?i)eval
+(?i)eventfd
+(?i)eventhub
+(?i)evs
+(?i)ewma
+(?i)exe
+(?i)executable
+(?i)exfil
+(?i)exfiltrate
+(?i)exfiltrated
+(?i)exfiltrating
+(?i)exfiltration
+(?i)expanders
+(?i)exploitability
+(?i)exploitdb
+(?i)explorability
+(?i)exposureclass
+(?i)facto
+(?i)factoid
+(?i)failback
+(?i)failover
+(?i)failsafe
+(?i)failuredev
+(?i)failurestore
+(?i)falsepos
+(?i)fanotify
+(?i)fanout
+(?i)favicon
+(?i)favorited
+(?i)fcp
+(?i)fda
+(?i)fdr
+(?i)fdt
+(?i)fielddata
+(?i)fieldref
+(?i)fieldset
+(?i)fileset
+(?i)filesets
+(?i)filepath
+(?i)filesort
+(?i)filtertype
+(?i)finalizer
+(?i)finalizers
+(?i)finetune
+(?i)fips
+(?i)firewalling
+(?i)fka
+(?i)fle
+(?i)fls
+(?i)flyout
+(?i)flyouts
+(?i)forcemerge
+(?i)forcemerged
+(?i)foreach
+(?i)forecasted
+(?i)formatters
+(?i)forwardable
+(?i)forwardconnector
+(?i)fpm
+(?i)fprobe
+(?i)fqbn
+(?i)fqdn
+(?i)fragmenter
+(?i)framebuffer
+(?i)frametime
+(?i)frametype
+(?i)frontmatter
+(?i)ftd
+(?i)ftrace
+(?i)fuzzer
+(?i)fy
+(?i)gapped
+(?i)gb
+(?i)gc
+(?i)gcc
+(?i)gce
+(?i)gcloud
+(?i)gcp
+(?i)gcs
+(?i)gd
+(?i)gecos
+(?i)gelf
+(?i)gemfile
+(?i)geo
+(?i)geocode
+(?i)geofence
+(?i)geogrid
+(?i)geohash
+(?i)geohex
+(?i)geoip
+(?i)geojson
+(?i)geolocated
+(?i)geolocations
+(?i)geometrycollection
+(?i)geopoint
+(?i)geopoints
+(?i)georgi
+(?i)geospatial
+(?i)geotile
+(?i)getmore
+(?i)getmores
+(?i)getsockopt
+(?i)gif
+(?i)gke
+(?i)glibc
+(?i)globbing
+(?i)gnmi
+(?i)godoc
+(?i)gopls
+(?i)gorilla
+(?i)goroutine
+(?i)goroutines
+(?i)gratia
+(?i)greylist
+(?i)gridlines
+(?i)gsub
+(?i)gte
+(?i)guid
+(?i)gz
+(?i)gzip
+(?i)gzipped
+(?i)gzipping
+(?i)hackathon
+(?i)hackathons
+(?i)hacky
+(?i)hapi
+(?i)hardcode
+(?i)hardcoded
+(?i)hardcoding
+(?i)hardlinks
+(?i)hardtoken
+(?i)hbs
+(?i)healthz
+(?i)heatmap
+(?i)heredoc
+(?i)hexgrid
+(?i)hoc
+(?i)hoster
+(?i)hostname
+(?i)hostnames
+(?i)hotfix
+(?i)hotfixes
+(?i)hotspot
+(?i)hotspots
+(?i)href
+(?i)hreflang
+(?i)html
+(?i)http
+(?i)httpclient
+(?i)httpcode
+(?i)httpd
+(?i)httprouter
+(?i)https
+(?i)httpstatus
+(?i)httptrace
+(?i)hugepages
+(?i)hugetlbfs
+(?i)hugo
+(?i)hyperscale
+(?i)hyperscaler
+(?i)hyperscalers
+(?i)iam
+(?i)iaas
+(?i)icmp
+(?i)ico
+(?i)icu
+(?i)idm
+(?i)idp
+(?i)idps
+(?i)ieee
+(?i)iis
+(?i)ilm
+(?i)imap
+(?i)img
+(?i)impactful
+(?i)imphash
+(?i)inequivalent
+(?i)inferencing
+(?i)influencer
+(?i)influencers
+(?i)initializer
+(?i)initializers
+(?i)initramfs
+(?i)inode
+(?i)inodes
+(?i)inotify
+(?i)instanceof
+(?i)instrumentations
+(?i)interop
+(?i)interoperate
+(?i)io
+(?i)ioc
+(?i)iops
+(?i)ios
+(?i)iot
+(?i)ip
+(?i)ipc
+(?i)ipfix
+(?i)ipinfo
+(?i)ips
+(?i)ipsec
+(?i)iptables
+(?i)ipvs
+(?i)irc
+(?i)irq
+(?i)iso
+(?i)iterable
+(?i)iterables
+(?i)jarm
+(?i)jdbc
+(?i)jdk
+(?i)jks
+(?i)jms
+(?i)jmx
+(?i)jmxreceiver
+(?i)journaling
+(?i)jps
+(?i)jsonp
+(?i)jsonpath
+(?i)jts
+(?i)kbps
+(?i)kbytes
+(?i)kep
+(?i)kdc
+(?i)keepalive
+(?i)keepalives
+(?i)keyspace
+(?i)keystore
+(?i)keystores
+(?i)keytab
+(?i)keytool
+(?i)kib
+(?i)knn
+(?i)kube
+(?i)kubeconfig
+(?i)kubeconfigs
+(?i)kubectl
+(?i)kubelets
+(?i)kubeletstats
+(?i)kv
+(?i)kvm
+(?i)launchctl
+(?i)lcp
+(?i)ldap
+(?i)leafz
+(?i)learnings
+(?i)libc
+(?i)libcap
+(?i)libpcap
+(?i)librados
+(?i)libs
+(?i)libuv
+(?i)linearizable
+(?i)linestrings
+(?i)linux
+(?i)liveness
+(?i)llm
+(?i)loadtable
+(?i)lockdown
+(?i)logind
+(?i)logrotate
+(?i)logsapi
+(?i)lon
+(?i)longtask
+(?i)longtasks
+(?i)lookaheads
+(?i)lookback
+(?i)lookbehinds
+(?i)lookups
+(?i)loopback
+(?i)lowercased
+(?i)lowercases
+(?i)lowercasing
+(?i)lru
+(?i)lsof
+(?i)lsp
+(?i)lt
+(?i)madvise
+(?i)makefile
+(?i)mapreduce
+(?i)matchers
+(?i)maxclients
+(?i)maxmemory
+(?i)mbean
+(?i)mbps
+(?i)mbyte
+(?i)mcache
+(?i)mcs
+(?i)memcache
+(?i)memfd
+(?i)memlock
+(?i)mergeable
+(?i)metacharacter
+(?i)metacharacters
+(?i)metaspace
+(?i)mfa
+(?i)mib
+(?i)mibs
+(?i)microsoft
+(?i)middleware
+(?i)millis
+(?i)mimemagic
+(?i)minikube
+(?i)minimalistic
+(?i)misconfiguration
+(?i)misconfigurations
+(?i)misconfigured
+(?i)mitigations
+(?i)mitm
+(?i)mixin
+(?i)mixins
+(?i)mkdir
+(?i)mlockall
+(?i)mn
+(?i)mntr
+(?i)modprobe
+(?i)modularization
+(?i)monetizable
+(?i)mongod
+(?i)monorepo
+(?i)monterey
+(?i)mountpoint
+(?i)mountpoints
+(?i)msec
+(?i)msecs
+(?i)multibyte
+(?i)multicast
+(?i)multifactor
+(?i)multifield
+(?i)multihost
+(?i)multiline
+(?i)multimodal
+(?i)multipolygons
+(?i)multisearch
+(?i)multistep
+(?i)multitenant
+(?i)multithreaded
+(?i)multivalue
+(?i)multivalued
+(?i)mutex
+(?i)mutexes
+(?i)mvt
+(?i)nameserver
+(?i)nameservers
+(?i)namespace
+(?i)namespaced
+(?i)namespaces
+(?i)namespacing
+(?i)nan
+(?i)nanocores
+(?i)nanos
+(?i)nat
+(?i)navigations
+(?i)nc
+(?i)nd
+(?i)ndjson
+(?i)ner
+(?i)netbios
+(?i)netblock
+(?i)netfilter
+(?i)netid
+(?i)netlink
+(?i)netmask
+(?i)netstat
+(?i)neurodivergent
+(?i)newname
+(?i)ngram
+(?i)nio
+(?i)nis
+(?i)nlb
+(?i)nodeless
+(?i)nofile
+(?i)nofollow
+(?i)noop
+(?i)noops
+(?i)nosniff
+(?i)npe
+(?i)npm
+(?i)nproc
+(?i)ns
+(?i)ntlm
+(?i)nullable
+(?i)nupkg
+(?i)nvm
+(?i)oas
+(?i)oauth
+(?i)odb
+(?i)oldname
+(?i)onboarded
+(?i)onboarding
+(?i)onwards
+(?i)oom
+(?i)opamp
+(?i)opcache
+(?i)operationalize
+(?i)opex
+(?i)opid
+(?i)oplog
+(?i)orgs
+(?i)oscommon
+(?i)osd
+(?i)osx
+(?i)otx
+(?i)overlayed
+(?i)overlayfs
+(?i)overprovisioning
+(?i)oversample
+(?i)overscaling
+(?i)panw
+(?i)param
+(?i)params
+(?i)parsable
+(?i)parser
+(?i)partitioner
+(?i)partitioners
+(?i)pathing
+(?i)pbi
+(?i)pci
+(?i)pcma
+(?i)pcmu
+(?i)pdo
+(?i)pem
+(?i)pentest
+(?i)pentesters
+(?i)perfmon
+(?i)performant
+(?i)persistable
+(?i)persistentvolume
+(?i)persistentvolumeclaim
+(?i)pflow
+(?i)pgs
+(?i)pgx
+(?i)php
+(?i)pid
+(?i)pim
+(?i)pinger
+(?i)pino
+(?i)pipelining
+(?i)pki
+(?i)plaintext
+(?i)plist
+(?i)pluggable
+(?i)pmrun
+(?i)png
+(?i)policysync
+(?i)polyfill
+(?i)polyfills
+(?i)posix
+PoC
+(?i)postsubmit
+(?i)pprof
+(?i)pq
+(?i)pragma
+(?i)pre
+(?i)precalculated
+(?i)preconfiguration
+(?i)preconfigure
+(?i)preconfigured
+(?i)preconstructed
+(?i)prefetch
+(?i)prefork
+(?i)preload
+(?i)preloaded
+(?i)preloading
+(?i)premain
+(?i)prepended
+(?i)prepending
+(?i)prepopulated
+(?i)presubmit
+(?i)presubmits
+(?i)println
+(?i)procfs
+(?i)procid
+(?i)procrun
+(?i)proctitle
+(?i)productization
+(?i)profiler
+(?i)profilers
+(?i)prometheusremotewrite
+(?i)proto
+(?i)protobuf
+(?i)protobuffer
+(?i)proxied
+(?i)proxying
+(?i)pseudorandom
+(?i)psutil
+(?i)ptrace
+(?i)pty
+(?i)pubkey
+(?i)publickey
+(?i)punycode
+(?i)pv
+(?i)pvc
+(?i)pwd
+(?i)qa
+(?i)qpid
+(?i)quantile
+(?i)quantiles
+(?i)quantizes
+(?i)quantizing
+(?i)queryable
+(?i)quic
+(?i)quickstarts
+(?i)ratemethod
+(?i)rbac
+(?i)rdata
+(?i)rdb
+(?i)rdp
+(?i)reachability
+(?i)readahead
+(?i)readme
+(?i)reauthenticate
+(?i)rebalance
+(?i)rebalances
+(?i)rebalancing
+(?i)rebase
+(?i)rebased
+(?i)rebasing
+(?i)rebrand
+(?i)recode
+(?i)recommender
+(?i)recompiles
+(?i)recordsets
+(?i)recoverability
+(?i)recoverable
+(?i)recv
+(?i)redirections
+(?i)redispatched
+(?i)refactorings
+(?i)referer
+(?i)regex
+(?i)regexes
+(?i)regularizer
+(?i)reimplemented
+(?i)reindex
+(?i)reindexed
+(?i)reindexing
+(?i)reloadable
+(?i)reloader
+(?i)relp
+(?i)reml
+(?i)remoulade
+(?i)repl
+(?i)replstatus
+(?i)repo
+(?i)repos
+(?i)reprovisioned
+(?i)requestor
+(?i)requeue
+(?i)requeued
+(?i)rerank
+(?i)reranked
+(?i)reranker
+(?i)rerankers
+(?i)reranking
+(?i)reranks
+(?i)resample
+(?i)rescanned
+(?i)rescorer
+(?i)rescorers
+(?i)rescoring
+(?i)resourcequota
+(?i)responses
+(?i)restclient
+(?i)resttemplate
+(?i)rethrottle
+(?i)rethrottling
+(?i)rethrown
+(?i)retriable
+(?i)retryable
+(?i)reusability
+(?i)rfb
+(?i)rhel
+(?i)risklist
+(?i)rng
+(?i)ro
+(?i)rolebinding
+(?i)rolebindings
+(?i)rollout
+(?i)rollouts
+(?i)rollup
+(?i)rollups
+(?i)romanized
+(?i)routable
+(?i)rpc
+(?i)rsa
+(?i)rst
+(?i)rtt
+(?i)ruid
+(?i)ruleset
+(?i)rulesets
+(?i)runbook
+(?i)runbooks
+(?i)runc
+(?i)runnable
+(?i)runnables
+(?i)runtime
+(?i)runtimes
+(?i)rw
+(?i)rx
+(?i)saas
+(?i)saml
+(?i)sandboxed
+(?i)sandboxing
+(?i)sanitization
+(?i)scaleset
+(?i)scalesets
+(?i)scatterplot
+(?i)schedulable
+(?i)scp
+(?i)scrollable
+(?i)sctp
+(?i)sdk
+(?i)seah
+(?i)seccomp
+(?i)secops
+(?i)semver
+(?i)sendfile
+(?i)seqno
+(?i)serializable
+(?i)serializer
+(?i)serializers
+(?i)servlet
+(?i)ses
+(?i)setgid
+(?i)severities
+(?i)sflow
+(?i)sftp
+(?i)sgi
+(?i)sgid
+(?i)sharding
+(?i)shmem
+(?i)shortcodes
+(?i)signin
+(?i)signups
+(?i)sigsegv
+(?i)sincedb
+(?i)sku
+(?i)sn
+(?i)snapshotting
+(?i)sni
+(?i)snmp
+(?i)snmptrap
+(?i)sns
+(?i)spamfirewall
+(?i)sparkline
+(?i)sparklines
+(?i)sprintf
+(?i)sqs
+(?i)statsd
+(?i)stderr
+(?i)stdin
+(?i)stdlib
+(?i)stdout
+(?i)stealers
+(?i)stemmer
+(?i)stix
+(?i)strftime
+(?i)strikethrough
+(?i)stringification
+(?i)stringified
+(?i)stringifier
+(?i)stringifying
+(?i)subcommands
+(?i)subfields
+(?i)subfolder
+(?i)subfolders
+(?i)sublicense
+(?i)sublicensing
+(?i)submenu
+(?i)subnet
+(?i)subnets
+(?i)subnetwork
+(?i)subobjects
+(?i)subpages
+(?i)subpath
+(?i)subpipeline
+(?i)subplans
+(?i)subproject
+(?i)subquery
+(?i)subresource
+(?i)subresources
+(?i)subscore
+(?i)subscribable
+(?i)subsecond
+(?i)substring
+(?i)substrings
+(?i)subtasks
+(?i)subtechnique
+(?i)subtree
+(?i)subvolume
+(?i)subvolumes
+(?i)subword
+(?i)sudo
+(?i)sudoers
+(?i)suid
+(?i)superset
+(?i)supertest
+(?i)supervisorctl
+(?i)svg
+(?i)sw
+(?i)symbolizer
+(?i)syscall
+(?i)syscalls
+(?i)sysctls
+(?i)syslog
+(?i)tablespace
+(?i)tailnet
+(?i)tbd
+(?i)tcp
+(?i)tcpdump
+(?i)tdigest
+(?i)te
+(?i)teardown
+(?i)telecom
+(?i)templated
+(?i)temporality
+(?i)textarea
+(?i)tf
+(?i)tgz
+(?i)tid
+(?i)timeframe
+(?i)timespan
+(?i)timespans
+(?i)timestamping
+(?i)timestomping
+(?i)tld
+(?i)tmp
+(?i)tmpfs
+(?i)todos
+(?i)tokenization
+(?i)tokenizer
+(?i)tokenizers
+(?i)tokenizes
+(?i)toml
+(?i)toolchain
+(?i)toolchains
+(?i)toolkit
+(?i)toolkits
+(?i)toolset
+(?i)tooltip
+(?i)tooltips
+(?i)tp
+(?i)traceparent
+(?i)traceroute
+(?i)tracestate
+(?i)transactionally
+(?i)transip
+(?i)translog
+(?i)transpile
+(?i)transpiles
+(?i)treemap
+(?i)triaging
+(?i)trustable
+(?i)trustpoint
+(?i)truststore
+(?i)truststores
+(?i)tsc
+(?i)tsconfig
+(?i)tsconfigs
+(?i)tsid
+(?i)ttl
+(?i)ttp
+(?i)tty
+(?i)tunl
+(?i)tv
+(?i)typosquat
+(?i)typosquatting
+(?i)ua
+(?i)uber
+(?i)ubi
+(?i)udp
+(?i)ui
+(?i)uid
+(?i)uk
+(?i)ulimit
+(?i)ulimits
+(?i)ulogd
+(?i)umask
+(?i)unallocate
+(?i)unarchive
+(?i)unary
+(?i)unauthuser
+(?i)uncached
+(?i)uncheck
+(?i)unclaim
+(?i)uncleansed
+(?i)unconfigured
+(?i)undici
+(?i)unencrypted
+(?i)unenroll
+(?i)unenrollment
+(?i)unexport
+(?i)unfollow
+(?i)unfollowing
+(?i)unfollows
+(?i)ungrouped
+(?i)unicast
+(?i)unicode
+(?i)unigram
+(?i)uninstallation
+(?i)uninstrumented
+(?i)uniquify
+(?i)unisolate
+(?i)unix
+(?i)unleased
+(?i)unmanaged
+(?i)unmarshalling
+(?i)unminified
+(?i)unmkinitramfs
+(?i)unmount
+(?i)unmounts
+(?i)unmute
+(?i)unmuted
+(?i)unmuting
+(?i)unnest
+(?i)unnested
+(?i)unnormalized
+(?i)unopinionated
+(?i)unpageable
+(?i)unparsable
+(?i)unparseable
+(?i)unparsed
+(?i)unpatched
+(?i)unquantized
+(?i)unquarantine
+(?i)unreferenced
+(?i)unregister
+(?i)unregistering
+(?i)unsampled
+(?i)unsanitized
+(?i)unscoped
+(?i)unsecure
+(?i)unsets
+(?i)unsetting
+(?i)unsnooze
+(?i)unsnoozing
+(?i)untoggle
+(?i)untracked
+(?i)untrusted
+(?i)untyped
+(?i)unvendored
+(?i)unversioned
+(?i)updatability
+(?i)updatable
+(?i)updateable
+(?i)upgradability
+(?i)uplink
+(?i)uploader
+(?i)upsampling
+(?i)upscaling
+(?i)upsert
+(?i)upstreamed
+(?i)upstreaming
+(?i)url
+(?i)urls
+(?i)usec
+(?i)usecs
+(?i)usn
+(?i)utc
+(?i)utm
+(?i)utmp
+(?i)uuid
+(?i)uwsgi
+(?i)vagrantfile
+(?i)validator
+(?i)validators
+(?i)varchar
+(?i)vendored
+(?i)vendoring
+(?i)vgopath
+(?i)vhost
+(?i)vhosts
+(?i)viewport
+(?i)virtualized
+(?i)vlan
+(?i)vm
+(?i)vnet
+(?i)voip
+(?i)vpa
+(?i)vpn
+(?i)vserver
+(?i)vsphere
+(?i)waf
+(?i)walkthrough
+(?i)walreceiver
+(?i)walsender
+(?i)walwriter
+(?i)watchlist
+(?i)watchlists
+(?i)webdriver
+(?i)webflux
+(?i)webmail
+(?i)webpages
+(?i)webrtc
+(?i)websocket
+(?i)websockets
+(?i)weekyear
+(?i)whois
+(?i)wifi
+(?i)winlog
+(?i)winlogon
+(?i)wmi
+(?i)workerless
+(?i)workgroup
+(?i)workgroups
+(?i)workqueue
+(?i)wsgi
+(?i)ww
+(?i)xdr
+(?i)xg
+(?i)xhr
+(?i)xmpp
+(?i)xpath
+(?i)xy
+(?i)yaml
+(?i)zlib
+(?i)zstd
+const
+sshd
+Visio
diff --git a/.vale/styles/config/vocabularies/ThirdPartyProducts/accept.txt b/.vale/styles/config/vocabularies/ThirdPartyProducts/accept.txt
new file mode 100644
index 000000000..24f2afd3d
--- /dev/null
+++ b/.vale/styles/config/vocabularies/ThirdPartyProducts/accept.txt
@@ -0,0 +1,489 @@
+# Third-party product, project, and company names.
+# Use (?i) prefix for terms that appear in mixed capitalizations in prose.
+(?i)activedirectory
+(?i)activemq
+(?i)adoptium
+(?i)alertmanager
+(?i)alienvault
+(?i)amqp
+(?i)antigena
+(?i)arcsight
+(?i)asciidoc
+(?i)authentik
+(?i)auvik
+(?i)avro
+(?i)azureblobstorage
+(?i)backblaze
+(?i)bazel
+(?i)beego
+(?i)bigtable
+(?i)boxplot
+(?i)brotli
+(?i)browserstack
+(?i)bundler
+(?i)captcha
+(?i)catalina
+(?i)cbor
+(?i)cloudfront
+(?i)cloudrun
+(?i)cobertura
+(?i)codec
+(?i)codecs
+(?i)codespaces
+(?i)cognito
+(?i)colab
+(?i)collectd
+(?i)cometd
+(?i)conda
+(?i)containerlab
+(?i)coredns
+(?i)corretto
+(?i)crossplane
+(?i)dataproc
+(?i)debian
+(?i)delinea
+(?i)digitalocean
+(?i)django
+(?i)dockerized
+(?i)dropbox
+(?i)dropwizard
+(?i)drupal
+(?i)dubbo
+(?i)dynamodb
+(?i)ebpf
+(?i)echarts
+(?i)eks
+(?i)entra
+(?i)eset
+(?i)eslint
+(?i)ethereum
+(?i)exigo
+(?i)exoscale
+(?i)fastapi
+(?i)fasthttp
+(?i)fermiumlabs
+(?i)firefox
+(?i)firehose
+(?i)firestore
+(?i)flickr
+(?i)fluentd
+(?i)freemarker
+(?i)frontdoor
+(?i)functionbeat
+(?i)galera
+(?i)ganglia
+(?i)gorm
+(?i)grafana
+(?i)graphql
+(?i)graphviz
+(?i)gravatar
+(?i)grpc
+(?i)grpcio
+(?i)guardduty
+(?i)guice
+(?i)gunicorn
+(?i)hadoop
+(?i)headscale
+(?i)hjson
+(?i)horizontalpodautoscaler
+(?i)hubble
+(?i)hunspell
+(?i)ibm
+(?i)influxdb
+(?i)innodb
+(?i)istiod
+(?i)jakarta
+(?i)javadoc
+(?i)javadocs
+(?i)journald
+(?i)jruby
+(?i)jwk
+(?i)jwt
+(?i)k8s
+(?i)kubeadm
+(?i)kubecfg
+(?i)kubelet
+(?i)kubetail
+(?i)kustomize
+(?i)kyverno
+(?i)laravel
+(?i)lightstep
+(?i)linode
+(?i)log4j2
+(?i)loggregator
+(?i)logpull
+(?i)macOS
+(?i)mapbox
+(?i)memcached
+(?i)metriccatcher
+(?i)microstrat
+(?i)monaco
+(?i)mongodb
+(?i)monolog
+(?i)morgan
+(?i)mqtt
+(?i)munin
+(?i)mysql
+(?i)namenode
+(?i)nats
+(?i)neovim
+(?i)netcat
+(?i)nextjs
+(?i)numpy
+(?i)nvme
+(?i)nxlog
+(?i)odbc
+(?i)oidc
+(?i)okhttp
+(?i)openai
+(?i)openmetrics
+(?i)opensense
+(?i)openvpn
+(?i)owasp
+(?i)payara
+(?i)pcap
+(?i)perl
+(?i)pluscloud
+(?i)plutono
+(?i)postgres
+(?i)postgresql
+(?i)pulumi
+(?i)pyroscope
+(?i)pytest
+(?i)qemu
+(?i)quarkus
+(?i)redis
+(?i)restify
+(?i)rethinkdb
+(?i)retrohunt
+(?i)rspec
+(?i)rubygem
+(?i)rufus
+(?i)sanic
+(?i)sankey
+(?i)selinux
+(?i)sfdc
+(?i)springboot
+(?i)sqlite
+(?i)ssdeep
+(?i)structlog
+(?i)stunnel
+(?i)systemd
+(?i)tailscale
+(?i)taxii
+(?i)telfhash
+(?i)temurin
+(?i)testcontainers
+(?i)tigera
+(?i)tikaserver
+(?i)tiltfile
+(?i)tmux
+(?i)tokio
+(?i)twistlock
+(?i)typedoc
+(?i)ubuntu
+(?i)uwsgi
+(?i)valitail
+(?i)vercel
+(?i)vscode
+(?i)vultr
+(?i)watsonx
+(?i)wazuh
+(?i)webpack
+(?i)wget
+(?i)wikimedia
+(?i)wikipedia
+(?i)wildfly
+(?i)xen
+(?i)yara
+(?i)zeromq
+(?i)zypper
+Aerospike
+Aironet
+Akamai
+Alertmanager
+Alibaba
+Allianz
+Anomali
+Ansible
+Apeiro
+ApeiroRA
+Armis
+Artifactory
+Assertj
+ATT&CK
+Axion
+Azure
+B2s
+Bitsight
+Bitwarden
+Broadcom
+Buildkite
+Canva
+CentOS
+Ceph
+Chainguard
+Chronosphere
+Circonus
+Citrix
+Claroty
+Cleura
+CloudBeat
+CloudFormation
+CloudTrail
+CloudWatch
+ClusterRole
+Codesphere
+ConfigMap
+containerd
+Contentful
+Corelight
+Couchbase
+Cribl
+CronJob
+Crossplane
+CrowdStrike
+Cyber
+CyberArk
+Cybereason
+Cybersixgill
+Cyera
+Cyso
+Cyware
+DaemonSet
+Darkfeed
+Darktrace
+Datadog
+Dataflow
+Dependabot
+Deviceguard
+DistilBERT
+Distro
+Documentum
+Dynatrace
+EC2
+Edgerouter
+Elastiflow
+Endace
+Entro
+Envoyproxy
+expvar
+Falco
+Falcosidekick
+Fargate
+Fastify
+Filestore
+Fireware
+Flant
+Fluent Bit
+Forcepoint
+FortiGate
+Fortinet
+Gemfire
+Gigamon
+Ginkgo
+Gmail
+Golang
+Goldmane
+Google
+Google Cloud Platform
+Google Cloud Storage
+Google Kubernetes Engine
+Gradle
+Grafana
+Graphtastic
+HAProxy
+Headscale
+Heptio
+Heroku
+Hetzner
+Homebrew
+Horovod
+Huawei
+Hubble
+iCalendar
+Icinga
+Imperva
+InCluster
+Infoblox
+Intel
+Intune
+Isovalent
+Istio
+JA3
+Jaeger
+Jamf
+Javalin
+Jina
+Jira
+Joda
+Jolokia
+Jsonnet
+Junos
+Jupyter
+JVM
+Kafka
+Kaufland
+Kerberos
+Keycloak
+Kibana
+Kinesis
+Kinvolk
+Knative
+Kubify
+Kubernetes
+Kueue
+Kyma
+LeaderElection
+Librato
+Lidl
+Linkerd
+Logback
+Loggly
+Lua
+Lucene
+Lumos
+Lyve
+Malop
+Malsite
+Maltiverse
+Mandiant
+Manticore
+Mattermost
+Maxmind
+Menlo
+Meraki
+MetalLB
+Metasploit
+Microsoft Azure
+Mikrotik
+Mimecast
+Miniflux
+MiniSearch
+Mito
+MITRE
+MobileBERT
+Mockito
+Monzo
+MPNet
+mTLS
+Multus
+Nagios
+NeoNephos
+NetFlow
+Netscaler
+Netskope
+Netstream
+Nextron
+Nginx
+Nmap
+NodeSet
+Nozomi
+Npcap
+NuGet
+Nvidia
+Okta
+Oniguruma
+OpenAPI
+OpenID
+OpenJDK
+OpenShift
+OpenSSL
+OpenStack
+OpenTelemetry
+OpenTracing
+Opsgenie
+Osquery
+OTel
+PagerDuty
+Palo
+Palo Alto
+Percona
+Perses
+plusserver
+Plutono
+Podman
+Prisma
+PrivateLink
+Procera
+Prometheus
+Proofpoint
+Px
+Qualys
+RabbitMQ
+Rackspace
+ReplicaSet
+Restforce
+RetriBERT
+Riak
+Riemann
+RoBERTa
+RPUSH
+Rubrik
+S3
+Sailpoint
+Salesforce
+Sandvine
+Scriptable
+Serilog
+ServiceNow
+Shodan
+Skaffold
+Snyk
+SOCKS5
+Softflowd
+Sophos
+Spegel
+Splunk
+Stackdriver
+Starlette
+Starlink
+StatefulSet
+Stormshield
+Streamcore
+Streamgroomer
+Streamlang
+Superobserver
+Suricata
+Swimlane
+Sysdig
+Sysmon
+Tailscale
+Talos
+Tanium
+Tenable
+Tencent
+Terraform
+Thycotic
+Thymeleaf
+Tigera
+TLS
+tolerations
+TorchScript
+Torq
+Traefik
+Trellix
+Tychon
+Ubiquiti
+Uniflow
+Vali
+Valitail
+Valkey
+Varonis
+Vectra
+Velero
+VitePress
+Vue
+WireGuard
+Wireshark
+Wolfi
+WordPiece
+Xcode
+xMatters
+Yandex
+YARA
+Zabbix
+Zeek
+Zero Trust
+ZooKeeper
+Zscaler
diff --git a/.vale/styles/config/vocabularies/ThirdPartyProducts/reject.txt b/.vale/styles/config/vocabularies/ThirdPartyProducts/reject.txt
new file mode 100644
index 000000000..242d5cb7b
--- /dev/null
+++ b/.vale/styles/config/vocabularies/ThirdPartyProducts/reject.txt
@@ -0,0 +1,11 @@
+# Wrong capitalizations — use the correct form instead
+fluentbit
+Fluentbit
+giantswarm
+Giantswarm
+metallb
+Metallb
+neonephos
+Neonephos
+wireguard
+Wireguard
diff --git a/Makefile b/Makefile
index d020f61cc..fc68ba83b 100644
--- a/Makefile
+++ b/Makefile
@@ -172,4 +172,48 @@ docforge-ci: docforge-download ## Run docforge in CI mode (non-interactive)
 	./bin/docforge
 
 .PHONY: ci-build
-ci-build: docforge-ci install post-process build ## Run all steps for building in CI
\ No newline at end of file
+ci-build: docforge-ci install post-process build ## Run all steps for building in CI
+
+.PHONY: vale-install
+vale-install: ## Install Vale binary if not already present
+	@if [ -x bin/vale ]; then \
+		echo "Vale is already installed: $$(bin/vale --version)"; \
+	else \
+		echo "Installing Vale..."; \
+		mkdir -p bin; \
+		if [ "$$(uname)" = "Darwin" ]; then \
+			if [ "$$(uname -m)" = "arm64" ]; then \
+				curl -sL https://github.com/vale-cli/vale/releases/download/v3.14.2/vale_3.14.2_macOS_arm64.tar.gz | tar -xz -C bin vale; \
+			else \
+				curl -sL https://github.com/vale-cli/vale/releases/download/v3.14.2/vale_3.14.2_macOS_64-bit.tar.gz | tar -xz -C bin vale; \
+			fi; \
+		elif [ "$$(uname)" = "Linux" ]; then \
+			if [ "$$(uname -m)" = "aarch64" ] || [ "$$(uname -m)" = "arm64" ]; then \
+				curl -sL https://github.com/vale-cli/vale/releases/download/v3.14.2/vale_3.14.2_Linux_arm64.tar.gz | tar -xz -C bin vale; \
+			else \
+				curl -sL https://github.com/vale-cli/vale/releases/download/v3.14.2/vale_3.14.2_Linux_64-bit.tar.gz | tar -xz -C bin vale; \
+			fi; \
+		elif echo "$$(uname -s)" | grep -qi "mingw\|cygwin\|msys"; then \
+			curl -sL https://github.com/vale-cli/vale/releases/download/v3.14.2/vale_3.14.2_Windows_64-bit.zip -o bin/vale.zip; \
+			unzip -q bin/vale.zip vale.exe -d bin; \
+			rm -f bin/vale.zip; \
+		else \
+			echo "Unsupported OS. Install Vale manually: https://vale.sh/docs/install"; \
+			exit 1; \
+		fi; \
+		echo "Vale installed to bin/."; \
+	fi
+
+.PHONY: vale-run
+vale-run: ## Lint changed website markdown files with Vale
+	@CHANGED=$$(git diff --name-only --diff-filter=d HEAD -- 'website/**/*.md' | \
+		grep -v '^website/about/legal-disclosure\.md' | \
+		grep -v '^website/archived/'); \
+	if [ -n "$$CHANGED" ]; then \
+		bin/vale $$CHANGED; \
+	else \
+		echo "No changed .md files to lint."; \
+	fi
+
+.PHONY: vale
+vale: vale-install vale-run ## Install Vale and lint changed website markdown files
\ No newline at end of file
diff --git a/website/documentation/guides/monitoring-and-troubleshooting/shell-to-node.md b/website/documentation/guides/monitoring-and-troubleshooting/shell-to-node.md
index 32dcdf4d2..f867c2707 100644
--- a/website/documentation/guides/monitoring-and-troubleshooting/shell-to-node.md
+++ b/website/documentation/guides/monitoring-and-troubleshooting/shell-to-node.md
@@ -8,7 +8,7 @@ scope: operator
 
 ## Overview
 
-To troubleshoot certain problems in a Kubernetes cluster, operators need access to the host of the Kubernetes node. This can be required if a node misbehaves or fails to join the cluster in the first place.
+To troubleshoot certain problems in a kubernetes cluster, operators need access to the host of the Kubernetes node. This can be required if a node misbehaves or fails to join the cluster in the first place. See the gardener whitepaper for more details or [click here](./shell-to-node.md) for an overview.
 
 With access to the host, it is for instance possible to check the `kubelet` logs and interact with common tools such as `systemctl` and `journalctl`.