diff --git a/Cargo.lock b/Cargo.lock
index feb282eca..f188fc6af 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -353,21 +353,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "anstream"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca84f3628370c59db74ee214b3263d58f9aadd9b4fe7e711fd87dc452b7f163"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon 1.0.1",
- "colorchoice",
- "is-terminal",
- "utf8parse",
-]
-
 [[package]]
 name = "anstream"
 version = "0.6.21"
@@ -377,7 +362,7 @@ dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
- "anstyle-wincon 3.0.11",
+ "anstyle-wincon",
  "colorchoice",
  "is_terminal_polyfill",
  "utf8parse",
@@ -407,16 +392,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "anstyle-wincon"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180abfa45703aebe0093f79badacc01b8fd4ea2e35118747e5811127f926e188"
-dependencies = [
- "anstyle",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "anstyle-wincon"
 version = "3.0.11"
@@ -587,6 +562,15 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -1347,6 +1331,9 @@ name = "bitflags"
 version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "bitvec"
@@ -1539,7 +1526,7 @@ dependencies = [
 name = "cac_toml"
 version = "0.105.0"
 dependencies = [
- "clap 4.3.4",
+ "clap 4.5.60",
  "pest",
  "pest_derive",
  "toml 0.8.8",
@@ -1652,7 +1639,7 @@ dependencies = [
  "fixedbitset",
  "getrandom 0.3.3",
  "globset",
- "hashlink",
+ "hashlink 0.9.0",
  "once_cell",
  "parking_lot",
  "petgraph",
@@ -1769,6 +1756,28 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "chrono-tz"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93698b29de5e97ad0ae26447b344c482a7284c737d9ddc5f9e52b74a336671bb"
+dependencies = [
+ "chrono",
+ "chrono-tz-build",
+ "phf",
+]
+
+[[package]]
+name = "chrono-tz-build"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c088aee841df9c3041febbb73934cfc39708749bf96dc827e3359cd39ef11b1"
+dependencies = [
+ "parse-zoneinfo",
+ "phf",
+ "phf_codegen",
+]
+
 [[package]]
 name = "ciborium"
 version = "0.2.1"
@@ -1834,36 +1843,33 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.3.4"
+version = "4.5.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80672091db20273a15cf9fdd4e47ed43b5091ec9841bf4c6145c9dfbbcae09ed"
+checksum = "2797f34da339ce31042b27d23607e051786132987f595b02ba4f6a6dffb7030a"
 dependencies = [
  "clap_builder",
  "clap_derive",
- "once_cell",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.3.4"
+version = "4.5.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1458a1df40e1e2afebb7ab60ce55c1fa8f431146205aa5f4887e0b111c27636"
+checksum = "24a241312cea5059b13574bb9b3861cabf758b879c15190b37b6d6fd63ab6876"
 dependencies = [
- "anstream 0.3.2",
+ "anstream",
  "anstyle",
- "bitflags 1.3.2",
- "clap_lex 0.5.0",
- "once_cell",
- "strsim 0.10.0",
+ "clap_lex 1.1.0",
+ "strsim 0.11.1",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.3.2"
+version = "4.5.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8cd2b2a819ad6eec39e8f1d6b53001af1e5469f8c177579cdaeb313115b825f"
+checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
 dependencies = [
- "heck 0.4.1",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -1880,9 +1886,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.5.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da6da31387c7e4ef160ffab6d5e7f00c42626fe39aea70a7b0f1773f7dd6c1b"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
 name = "cmake"
@@ -2035,7 +2041,7 @@ dependencies = [
  "fred",
  "inventory",
  "itertools 0.10.5",
- "jsonschema",
+ "jsonschema 0.17.0",
  "juspay_diesel",
  "juspay_jsonlogic",
  "log",
@@ -2138,6 +2144,21 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
 [[package]]
 name = "crc16"
 version = "0.4.0"
@@ -2153,6 +2174,17 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "cron"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8c3e73077b4b4a6ab1ea5047c37c57aee77657bc8ecd6f29b0af082d0b0c07"
+dependencies = [
+ "chrono",
+ "nom",
+ "once_cell",
+]
+
 [[package]]
 name = "crossbeam-channel"
 version = "0.5.15"
@@ -3149,6 +3181,12 @@ version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
 
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
 [[package]]
 name = "downcast"
 version = "0.11.0"
@@ -3263,6 +3301,9 @@ name = "either"
 version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "elliptic-curve"
@@ -3325,7 +3366,7 @@ version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c012a26a7f605efc424dd53697843a72be7dc86ad2d01f7814337794a12231d"
 dependencies = [
- "anstream 0.6.21",
+ "anstream",
  "anstyle",
  "env_filter",
  "humantime",
@@ -3374,6 +3415,23 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "31ae425815400e5ed474178a7a22e275a9687086a12ca63ec793ff292d8fdae8"
 
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
 [[package]]
 name = "experimentation_client"
 version = "0.105.0"
@@ -3433,6 +3491,17 @@ dependencies = [
  "regex",
 ]
 
+[[package]]
+name = "fancy-regex"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "531e46835a22af56d1e3b66f04844bed63158bc094a628bec1d321d9b4c44bf2"
+dependencies = [
+ "bit-set 0.5.3",
+ "regex-automata",
+ "regex-syntax 0.8.6",
+]
+
 [[package]]
 name = "fastbloom"
 version = "0.14.1"
@@ -3524,12 +3593,29 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin 0.9.8",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -3570,6 +3656,16 @@ dependencies = [
  "num",
 ]
 
+[[package]]
+name = "fraction"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b486ab61634f05b11b591c38c71fb25139cb55e22be4fb6ecf649cc3736c074a"
+dependencies = [
+ "lazy_static",
+ "num",
+]
+
 [[package]]
 name = "fragile"
 version = "2.0.1"
@@ -3749,6 +3845,17 @@ dependencies = [
  "futures-util",
 ]
 
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.32"
@@ -4018,12 +4125,30 @@ dependencies = [
  "allocator-api2",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 
+[[package]]
+name = "hashlink"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
+dependencies = [
+ "hashbrown 0.14.5",
+]
+
 [[package]]
 name = "hashlink"
 version = "0.9.0"
@@ -4038,6 +4163,9 @@ name = "heck"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+dependencies = [
+ "unicode-segmentation",
+]
 
 [[package]]
 name = "heck"
@@ -4357,6 +4485,22 @@ dependencies = [
  "tokio-native-tls",
 ]
 
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper 1.6.0",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.15"
@@ -4635,9 +4779,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.7.2"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12b6ee2129af8d4fb011108c73d99a1b83a85977f23b82460c0ae2e25bb4b57f"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "ipnetwork"
@@ -4660,18 +4804,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "is-terminal"
-version = "0.4.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adcf93614601c8129ddf72e2d5633df827ba6551541c6d8c59520a371475be1f"
-dependencies = [
- "hermit-abi 0.3.9",
- "io-lifetimes",
- "rustix 0.37.19",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
@@ -4756,9 +4888,9 @@ dependencies = [
  "anyhow",
  "base64 0.21.2",
  "bytecount",
- "clap 4.3.4",
- "fancy-regex",
- "fraction",
+ "clap 4.5.60",
+ "fancy-regex 0.11.0",
+ "fraction 0.13.1",
  "getrandom 0.2.15",
  "iso8601",
  "itoa",
@@ -4776,6 +4908,36 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "jsonschema"
+version = "0.18.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa0f4bea31643be4c6a678e9aa4ae44f0db9e5609d5ca9dc9083d06eb3e9a27a"
+dependencies = [
+ "ahash",
+ "anyhow",
+ "base64 0.22.1",
+ "bytecount",
+ "clap 4.5.60",
+ "fancy-regex 0.13.0",
+ "fraction 0.15.1",
+ "getrandom 0.2.15",
+ "iso8601",
+ "itoa",
+ "memchr",
+ "num-cmp",
+ "once_cell",
+ "parking_lot",
+ "percent-encoding",
+ "regex",
+ "reqwest 0.12.8",
+ "serde",
+ "serde_json",
+ "time",
+ "url",
+ "uuid",
+]
+
 [[package]]
 name = "junction"
 version = "1.2.0"
@@ -4839,6 +5001,55 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "kronos-common"
+version = "0.1.0"
+dependencies = [
+ "actix-web",
+ "aes-gcm",
+ "anyhow",
+ "async-trait",
+ "base64 0.22.1",
+ "chrono",
+ "chrono-tz",
+ "cron",
+ "dashmap",
+ "dotenvy",
+ "jsonschema 0.18.3",
+ "metrics",
+ "metrics-exporter-prometheus",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "sqlx",
+ "thiserror 1.0.58",
+ "tokio",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "kronos-worker"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "chrono",
+ "dotenvy",
+ "kronos-common",
+ "metrics",
+ "rand 0.8.5",
+ "reqwest 0.12.8",
+ "serde",
+ "serde_json",
+ "sqlx",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "tracing-subscriber",
+ "uuid",
+]
+
 [[package]]
 name = "language-tags"
 version = "0.3.2"
@@ -5319,6 +5530,16 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
 [[package]]
 name = "memchr"
 version = "2.7.5"
@@ -5335,26 +5556,73 @@ dependencies = [
 ]
 
 [[package]]
-name = "mime"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
-
-[[package]]
-name = "mime_guess"
-version = "2.0.4"
+name = "metrics"
+version = "0.24.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4192263c238a5f0d0c6bfd21f336a313a4ce1c450542449ca191bb657b4642ef"
+checksum = "ff56c2e7dce6bd462e3b8919986a617027481b1dcc703175b58cf9dd98a2f071"
 dependencies = [
- "mime",
- "unicase",
+ "portable-atomic",
+ "rapidhash",
 ]
 
 [[package]]
-name = "mini-moka"
-version = "0.10.3"
+name = "metrics-exporter-prometheus"
+version = "0.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c325dfab65f261f386debee8b0969da215b3fa0037e74c8a1234db7ba986d803"
+checksum = "dd7399781913e5393588a8d8c6a2867bf85fb38eaf2502fdce465aad2dc6f034"
+dependencies = [
+ "base64 0.22.1",
+ "http-body-util",
+ "hyper 1.6.0",
+ "hyper-rustls 0.27.7",
+ "hyper-util",
+ "indexmap 2.12.1",
+ "ipnet",
+ "metrics",
+ "metrics-util",
+ "quanta",
+ "thiserror 1.0.58",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "metrics-util"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8496cc523d1f94c1385dd8f0f0c2c480b2b8aeccb5b7e4485ad6365523ae376"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "hashbrown 0.15.5",
+ "metrics",
+ "quanta",
+ "rand 0.9.3",
+ "rand_xoshiro",
+ "sketches-ddsketch",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4192263c238a5f0d0c6bfd21f336a313a4ce1c450542449ca191bb657b4642ef"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "mini-moka"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c325dfab65f261f386debee8b0969da215b3fa0037e74c8a1234db7ba986d803"
 dependencies = [
  "crossbeam-channel",
  "crossbeam-utils",
@@ -6032,6 +6300,15 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "parse-zoneinfo"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f2a05b18d44e2957b88f96ba460715e295bc1d7510468a2f3d3b44535d26c24"
+dependencies = [
+ "regex",
+]
+
 [[package]]
 name = "paste"
 version = "1.0.15"
@@ -6124,6 +6401,16 @@ dependencies = [
  "phf_shared",
 ]
 
+[[package]]
+name = "phf_codegen"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
 [[package]]
 name = "phf_generator"
 version = "0.11.3"
@@ -6456,6 +6743,21 @@ dependencies = [
  "unicase",
 ]
 
+[[package]]
+name = "quanta"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "web-sys",
+ "winapi",
+]
+
 [[package]]
 name = "quinn"
 version = "0.11.9"
@@ -6469,7 +6771,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash 2.1.1",
  "rustls 0.23.28",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -6508,7 +6810,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tracing",
  "windows-sys 0.60.2",
 ]
@@ -6627,6 +6929,33 @@ dependencies = [
  "getrandom 0.3.3",
 ]
 
+[[package]]
+name = "rand_xoshiro"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f703f4665700daf5512dcca5f43afa6af89f09db47fb56be587f80636bda2d41"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rapidhash"
+version = "4.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e48930979c155e2f33aa36ab3119b5ee81332beb6482199a8ecd6029b80b59"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "raw-cpuid"
+version = "11.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
+dependencies = [
+ "bitflags 2.9.1",
+]
+
 [[package]]
 name = "rayon"
 version = "1.11.0"
@@ -6745,7 +7074,7 @@ dependencies = [
  "http-body 0.4.5",
  "hyper 0.14.26",
  "hyper-rustls 0.24.1",
- "hyper-tls",
+ "hyper-tls 0.5.0",
  "ipnet",
  "js-sys",
  "log",
@@ -6760,7 +7089,7 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper 0.1.2",
- "system-configuration",
+ "system-configuration 0.5.1",
  "tokio",
  "tokio-native-tls",
  "tokio-rustls 0.24.1",
@@ -6781,19 +7110,23 @@ checksum = "f713147fbe92361e52392c73b8c9e48c04c6625bce969ef54dc901e58e042a7b"
 dependencies = [
  "base64 0.22.1",
  "bytes",
+ "encoding_rs",
  "futures-channel",
  "futures-core",
  "futures-util",
+ "h2 0.4.11",
  "http 1.1.0",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.6.0",
  "hyper-rustls 0.27.7",
+ "hyper-tls 0.6.0",
  "hyper-util",
  "ipnet",
  "js-sys",
  "log",
  "mime",
+ "native-tls",
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
@@ -6805,7 +7138,9 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper 1.0.2",
+ "system-configuration 0.6.1",
  "tokio",
+ "tokio-native-tls",
  "tokio-rustls 0.26.2",
  "tower-service",
  "url",
@@ -7007,7 +7342,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -7655,6 +7990,7 @@ dependencies = [
  "actix-web",
  "aes-gcm",
  "anyhow",
+ "async-trait",
  "aws-config",
  "aws-sdk-kms",
  "base64 0.21.2",
@@ -7666,6 +8002,8 @@ dependencies = [
  "futures-util",
  "inventory",
  "juspay_diesel",
+ "kronos-common",
+ "kronos-worker",
  "log",
  "once_cell",
  "openidconnect",
@@ -7676,11 +8014,13 @@ dependencies = [
  "secrecy",
  "serde",
  "serde_json",
+ "sqlx",
  "strum_macros 0.25.3",
  "superposition_derives",
  "superposition_macros",
  "superposition_types",
  "tokio",
+ "tokio-util",
  "tracing",
  "tracing-actix-web",
  "url",
@@ -7792,6 +8132,12 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "sketches-ddsketch"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c6f73aeb92d671e0cc4dca167e59b2deb6387c375391bc99ee743f326994a2b"
+
 [[package]]
 name = "slab"
 version = "0.4.8"
@@ -7897,6 +8243,9 @@ name = "spin"
 version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
 
 [[package]]
 name = "spki"
@@ -7908,6 +8257,222 @@ dependencies = [
  "der",
 ]
 
+[[package]]
+name = "sqlformat"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bba3a93db0cc4f7bdece8bb09e77e2e785c20bfebf79eb8340ed80708048790"
+dependencies = [
+ "nom",
+ "unicode_categories",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e50c216e3624ec8e7ecd14c6a6a6370aad6ee5d8cfc3ab30b5162eeeef2ed33"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d6753e460c998bbd4cd8c6f0ed9a64346fcca0723d6e75e52fdc351c5d2169d"
+dependencies = [
+ "ahash",
+ "atoi",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc",
+ "crossbeam-queue",
+ "dotenvy",
+ "either",
+ "event-listener",
+ "futures-channel",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashlink 0.8.4",
+ "hex",
+ "indexmap 2.12.1",
+ "log",
+ "memchr",
+ "once_cell",
+ "paste",
+ "percent-encoding",
+ "rustls 0.21.12",
+ "rustls-pemfile 1.0.3",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlformat",
+ "thiserror 1.0.58",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "uuid",
+ "webpki-roots 0.24.0",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a793bb3ba331ec8359c1853bd39eed32cdd7baaf22c35ccf5c92a7e8d1189ec"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a4ee1e104e00dedb6aa5ffdd1343107b0a4702e862a84320ee7cc74782d96fc"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck 0.4.1",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 1.0.109",
+ "tempfile",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "864b869fdf56263f4c95c45483191ea0af340f9f3e3e7b4d57a61c7c87a970db"
+dependencies = [
+ "atoi",
+ "base64 0.21.2",
+ "bitflags 2.9.1",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.5",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 1.0.58",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb7ae0e6a97fb3ba33b23ac2671a5ce6e3cabe003f451abd5a56e7951d975624"
+dependencies = [
+ "atoi",
+ "base64 0.21.2",
+ "bitflags 2.9.1",
+ "byteorder",
+ "chrono",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 1.0.58",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d59dc83cf45d89c555a577694534fcd1b55c545a816c816ce51f20bbe56a4f3f"
+dependencies = [
+ "atoi",
+ "chrono",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sqlx-core",
+ "tracing",
+ "url",
+ "uuid",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -7924,7 +8489,6 @@ dependencies = [
  "cfg-if",
  "libc",
  "psm",
- "windows-sys 0.52.0",
  "windows-sys 0.59.0",
 ]
 
@@ -7952,6 +8516,17 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72abeda133c49d7bddece6c154728f83eec8172380c80ab7096da9487e20d27c"
 
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
 [[package]]
 name = "strsim"
 version = "0.10.0"
@@ -8029,18 +8604,23 @@ dependencies = [
  "inventory",
  "json-subscriber",
  "juspay_diesel",
+ "kronos-worker",
  "leptos",
  "leptos_actix",
  "log",
  "regex",
  "reqwest 0.11.27",
  "rs-snowflake",
+ "secrecy",
  "serde",
  "serde_json",
  "service_utils",
+ "sqlx",
  "superposition_derives",
  "superposition_macros",
  "superposition_types",
+ "tokio",
+ "tokio-util",
  "tracing",
  "tracing-actix-web",
  "tracing-subscriber",
@@ -8073,7 +8653,7 @@ dependencies = [
  "blake3",
  "cbindgen",
  "itertools 0.10.5",
- "jsonschema",
+ "jsonschema 0.17.0",
  "log",
  "num-bigint",
  "serde",
@@ -8738,7 +9318,18 @@ checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
 dependencies = [
  "bitflags 1.3.2",
  "core-foundation 0.9.3",
- "system-configuration-sys",
+ "system-configuration-sys 0.5.0",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+dependencies = [
+ "bitflags 2.9.1",
+ "core-foundation 0.9.3",
+ "system-configuration-sys 0.6.0",
 ]
 
 [[package]]
@@ -8751,6 +9342,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "tagptr"
 version = "0.2.0"
@@ -9491,6 +10092,12 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
 [[package]]
 name = "unicode-id"
 version = "0.3.6"
@@ -9518,6 +10125,12 @@ dependencies = [
  "tinyvec",
 ]
 
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
 [[package]]
 name = "unicode-segmentation"
 version = "1.10.1"
@@ -9542,6 +10155,12 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
 
+[[package]]
+name = "unicode_categories"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
+
 [[package]]
 name = "uniffi"
 version = "0.29.3"
@@ -9551,7 +10170,7 @@ dependencies = [
  "anyhow",
  "camino",
  "cargo_metadata 0.19.2",
- "clap 4.3.4",
+ "clap 4.5.60",
  "uniffi_bindgen",
  "uniffi_core",
  "uniffi_macros",
@@ -9872,6 +10491,12 @@ dependencies = [
  "wit-bindgen-rt",
 ]
 
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.100"
@@ -10022,6 +10647,15 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b291546d5d9d1eab74f069c77749f2cb8504a12caa20f0f2de93ddbf6f411888"
+dependencies = [
+ "rustls-webpki 0.101.7",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "0.25.4"
@@ -10085,6 +10719,16 @@ version = "8.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "81995fafaaaf6ae47a7d0cc83c67caf92aeb7e5331650ae6ff856f7c0c60c459"
 
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
 [[package]]
 name = "widestring"
 version = "1.2.1"
diff --git a/Cargo.toml b/Cargo.toml
index 23139874a..9049808b9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -91,6 +91,11 @@ tracing-actix-web = "0.7.21"
 url = "2.5.0"
 uuid = { version = "1.20.0", features = ["v4", "serde", "js"] }
 uniffi = { version = "0.29.3", features = ["cli"] }
+kronos-worker = { path = "../kronos/crates/worker" }
+kronos-common = { path = "../kronos/crates/common" }
+async-trait = "0.1"
+sqlx = { version = "0.7", features = ["runtime-tokio-rustls", "postgres", "chrono", "uuid", "json"] }
+tokio-util = { version = "0.7" }
 superposition = { path = "crates/superposition", version = "0.105.0" }
 superposition_types = { path = "crates/superposition_types", version = "0.105.0" }
 superposition_derives = { path = "crates/superposition_derives", version = "0.105.0" }
diff --git a/crates/context_aware_config/src/api/secrets/handlers.rs b/crates/context_aware_config/src/api/secrets/handlers.rs
index 539bdade5..0edd776a1 100644
--- a/crates/context_aware_config/src/api/secrets/handlers.rs
+++ b/crates/context_aware_config/src/api/secrets/handlers.rs
@@ -239,7 +239,7 @@ async fn update_handler(
     };
 
     let updated_secret = diesel::update(secrets::table)
-        .filter(secrets::name.eq(secret_name))
+        .filter(secrets::name.eq(&secret_name))
         .set((
             changeset,
             secrets::last_modified_at.eq(chrono::Utc::now()),
diff --git a/crates/frontend/src/api.rs b/crates/frontend/src/api.rs
index 8257a7a21..0e2e604ef 100644
--- a/crates/frontend/src/api.rs
+++ b/crates/frontend/src/api.rs
@@ -839,6 +839,7 @@ pub async fn create_webhook(
     payload_version: PayloadVersion,
     custom_headers: CustomHeaders,
     events: Vec<WebhookEvent>,
+    max_retries: i32,
     change_reason: String,
     workspace: &str,
     org_id: &str,
@@ -852,6 +853,7 @@ pub async fn create_webhook(
         payload_version: Some(payload_version),
         custom_headers: Some(custom_headers),
         events,
+        max_retries: Some(max_retries),
         change_reason: ChangeReason::try_from(change_reason)?,
     };
     let host = use_host_server();
diff --git a/crates/frontend/src/components/webhook_form.rs b/crates/frontend/src/components/webhook_form.rs
index dc39cebac..030f4be2c 100644
--- a/crates/frontend/src/components/webhook_form.rs
+++ b/crates/frontend/src/components/webhook_form.rs
@@ -43,9 +43,13 @@ fn try_update_payload(
     payload_version: PayloadVersion,
     custom_headers: CustomHeaders,
     events: Vec<WebhookEvent>,
+    max_retries: i32,
     description: String,
     change_reason: String,
 ) -> Result<UpdateWebhookRequest, String> {
+    if max_retries > 3 {
+        return Err("Max retries must not exceed 3".to_string());
+    }
     Ok(UpdateWebhookRequest {
         enabled: Some(enabled),
         url: Some(NonEmptyString::try_from(url)?),
@@ -53,6 +57,7 @@ fn try_update_payload(
         payload_version: Some(payload_version),
         custom_headers: Some(custom_headers),
         events: Some(events),
+        max_retries: Some(max_retries),
         description: Some(Description::try_from(description)?),
         change_reason: ChangeReason::try_from(change_reason)?,
     })
@@ -69,6 +74,7 @@ pub fn WebhookForm(
     #[prop(default = PayloadVersion::default())] payload_version: PayloadVersion,
     #[prop(default = CustomHeaders::default())] custom_headers: CustomHeaders,
     #[prop(default = Vec::new())] events: Vec<WebhookEvent>,
+    #[prop(default = 3)] max_retries: i32,
     #[prop(into)] handle_submit: Callback<()>,
 ) -> impl IntoView {
     let workspace = use_context::<Signal<Workspace>>().unwrap();
@@ -83,6 +89,7 @@ pub fn WebhookForm(
     let (custom_headers_rs, custom_headers_ws) = create_signal(custom_headers);
     let (change_reason_rs, change_reason_ws) = create_signal(String::new());
     let (events_rs, events_ws) = create_signal(events);
+    let (max_retries_rs, max_retries_ws) = create_signal(max_retries);
     let (req_inprogess_rs, req_inprogress_ws) = create_signal(false);
     let update_request_rws = RwSignal::new(None);
 
@@ -108,6 +115,7 @@ pub fn WebhookForm(
         let custom_headers = custom_headers_rs.get_untracked();
         let change_reason = change_reason_rs.get_untracked();
         let events = events_rs.get_untracked();
+        let max_retries = max_retries_rs.get_untracked();
         let workspace = workspace.get_untracked().0;
         let org_id = org.get_untracked().0;
 
@@ -132,6 +140,7 @@ pub fn WebhookForm(
                             payload_version,
                             custom_headers,
                             events,
+                            max_retries,
                             description,
                             change_reason,
                         );
@@ -152,6 +161,7 @@ pub fn WebhookForm(
                         payload_version,
                         custom_headers,
                         events,
+                        max_retries,
                         change_reason,
                         &workspace,
                         &org_id,
@@ -295,6 +305,25 @@ pub fn WebhookForm(
                 />
             </div>
 
+            <div class="form-control">
+                <Label
+                    title="Max Retries"
+                    description="Number of retry attempts on failure (0–3)."
+                />
+                <Input
+                    placeholder="Max Retries"
+                    class="input input-bordered w-full max-w-md"
+                    value=Value::Number(serde_json::Number::from(max_retries_rs.get_untracked()))
+                    schema_type=Single(JsonSchemaType::Integer)
+                    r#type=InputType::Integer
+                    on_change=Callback::new(move |value: Value| {
+                        if let Some(n) = value.as_i64() {
+                            max_retries_ws.set(n as i32);
+                        }
+                    })
+                />
+            </div>
+
             <div class="form-control gap-3">
                 <Label
                     title="Custom Headers"
diff --git a/crates/frontend/src/pages/webhook.rs b/crates/frontend/src/pages/webhook.rs
index a18a28bfd..6b50945ae 100644
--- a/crates/frontend/src/pages/webhook.rs
+++ b/crates/frontend/src/pages/webhook.rs
@@ -219,6 +219,7 @@ pub fn Webhook() -> impl IntoView {
                                         custom_headers=webhook_st
                                             .with_value(|w| w.custom_headers.clone())
                                         events=webhook_st.with_value(|w| w.events.clone())
+                                        max_retries=webhook_st.with_value(|w| w.max_retries)
                                         handle_submit=move |_| {
                                             webhook_resource.refetch();
                                             action_rws.set(Action::None);
diff --git a/crates/service_utils/Cargo.toml b/crates/service_utils/Cargo.toml
index 90e156922..a2f23d9b9 100644
--- a/crates/service_utils/Cargo.toml
+++ b/crates/service_utils/Cargo.toml
@@ -27,6 +27,11 @@ once_cell = { workspace = true }
 openidconnect = "3.5.0"
 rand = "0.8"
 tokio = { workspace = true }
+tokio-util = { workspace = true }
+kronos-worker = { workspace = true }
+kronos-common = { workspace = true }
+async-trait = { workspace = true }
+sqlx = { workspace = true }
 tracing = { workspace = true }
 regex = { workspace = true }
 reqwest = { workspace = true }
diff --git a/crates/service_utils/src/helpers.rs b/crates/service_utils/src/helpers.rs
index 1c1b48efb..d3474eb60 100644
--- a/crates/service_utils/src/helpers.rs
+++ b/crates/service_utils/src/helpers.rs
@@ -16,21 +16,17 @@ use log::warn;
 use once_cell::sync::Lazy;
 use regex::Regex;
 use reqwest::header::{HeaderMap, HeaderName, HeaderValue};
-use secrecy::ExposeSecret;
 use serde::Serialize;
-use superposition_macros::unexpected_error;
 use superposition_types::{
     DBConnection, DimensionInfo, Resource,
-    api::webhook::{Action, HeadersEnum, WebhookEventInfo, WebhookResponse},
+    api::webhook::{Action, WebhookEventInfo, WebhookResponse},
     database::{
         models::{
             Workspace,
-            others::{CustomHeaders, HttpMethod, Webhook, WebhookEvent},
+            others::{Webhook, WebhookEvent},
         },
         schema::{
             dimensions::{self, dimension},
-            secrets::dsl as secrets_dsl,
-            variables::dsl as variables_dsl,
             webhooks::{self, dsl::webhooks as webhook_dsl},
         },
         superposition_schema::superposition::workspaces,
@@ -39,17 +35,10 @@ use superposition_types::{
 };
 
 use crate::{
-    encryption::{EncryptionError, decrypt_secret, decrypt_workspace_key},
+    kronos_dispatch::submit_webhook_job,
     service::types::{AppState, SchemaName, WorkspaceContext},
 };
 
-// using named group to capture which type (secrets/variables) the regex was
-// because variables and secrets need to be handled differently inside webhook execution
-static CONFIG_REFERENCE_REGEX: Lazy<regex::Regex> = Lazy::new(|| {
-    regex::Regex::new(r"\{\{(?P<type>VARS|SECRETS)\.(?P<name>[A-Z0-9_]+)\}\}")
-        .expect("Invalid config pattern")
-});
-
 const CONFIG_TAG_REGEX: &str = "^[a-zA-Z0-9_-]{1,64}$";
 
 //WARN Do NOT use this fxn inside api requests, instead add the required
@@ -215,106 +204,6 @@ pub fn get_workspace(
         .get_result::<Workspace>(db_conn)
 }
 
-fn has_pattern_in_headers(headers: &CustomHeaders) -> (bool, bool) {
-    let mut has_vars = false;
-    let mut has_secrets = false;
-    for value in headers.values() {
-        let ref_type = value
-            .as_str()
-            .and_then(|s| CONFIG_REFERENCE_REGEX.captures(s))
-            .and_then(|caps| caps.name("type"))
-            .map(|m| m.as_str());
-
-        match ref_type {
-            Some("VARS") => has_vars = true,
-            Some("SECRETS") => has_secrets = true,
-            _ => (),
-        }
-    }
-    (has_vars, has_secrets)
-}
-
-fn substitute_templates(
-    template: &str,
-    variables: &HashMap<String, String>,
-    secrets: &HashMap<String, String>,
-) -> String {
-    CONFIG_REFERENCE_REGEX
-        .replace(template, |caps: &regex::Captures| {
-            let ref_type = caps.name("type").map(|m| m.as_str());
-            let ref_name = caps.name("name").map(|m| m.as_str());
-
-            match (ref_type, ref_name) {
-                (Some("VARS"), Some(name)) => variables.get(name).cloned(),
-                (Some("SECRETS"), Some(name)) => secrets.get(name).cloned(),
-                _ => None,
-            }
-            .unwrap_or(template.to_string())
-        })
-        .into_owned()
-}
-
-fn fetch_variables(
-    workspace_context: &WorkspaceContext,
-    conn: &mut DBConnection,
-) -> result::Result<HashMap<String, String>> {
-    let variables_map = variables_dsl::variables
-        .select((variables_dsl::name, variables_dsl::value))
-        .schema_name(&workspace_context.schema_name)
-        .load(conn)?
-        .into_iter()
-        .collect();
-
-    Ok(variables_map)
-}
-
-fn fetch_secrets(
-    workspace_context: &WorkspaceContext,
-    state: &Data<AppState>,
-    conn: &mut DBConnection,
-) -> result::Result<HashMap<String, String>> {
-    let encryption_key = workspace_context.settings.encryption_key.as_str();
-
-    let master_encryption_key = match state.master_encryption_key {
-        Some(ref key) => key,
-        None => {
-            log::warn!("Master encryption key not configured, skipping secrets");
-            return Ok(HashMap::new());
-        }
-    };
-
-    let workspace_key = match decrypt_workspace_key(encryption_key, master_encryption_key)
-    {
-        Ok(key) => key,
-        Err(e) => {
-            log::error!("Failed to decrypt workspace key: {}", e);
-            return Err(unexpected_error!("Failed to decrypt workspace key"));
-        }
-    };
-
-    let db_secrets: Vec<(String, String)> = secrets_dsl::secrets
-        .schema_name(&workspace_context.schema_name)
-        .select((secrets_dsl::name, secrets_dsl::encrypted_value))
-        .load(conn)
-        .map_err(|e| {
-            log::error!("Failed to load secrets: {}", e);
-            unexpected_error!("Failed to load secrets")
-        })?;
-
-    let result: Result<HashMap<String, String>, EncryptionError> = db_secrets
-        .into_iter()
-        .map(|(name, encrypted_value)| {
-            decrypt_secret(&encrypted_value, &workspace_key)
-                .map(|decrypted| (name, decrypted.expose_secret().to_string()))
-        })
-        .collect();
-
-    result.map_err(|e| {
-        log::error!("Failed to decrypt secrets: {}", e);
-        unexpected_error!("Failed to decrypt secrets")
-    })
-}
-
 pub struct WebhookData<T> {
     pub payload: T,
     pub resource: Resource,
@@ -339,6 +228,7 @@ where
         config_version_opt,
         payload,
     } = data;
+
     let webhook = match webhook_dsl
         .filter(webhooks::events.contains(vec![event]))
         .schema_name(&workspace_context.schema_name)
@@ -355,110 +245,51 @@ where
             return false;
         }
     };
+
     if !webhook.enabled {
         log::info!("Webhook is disabled, skipping call");
         return true;
     }
 
-    let (has_vars, has_secrets) = has_pattern_in_headers(&webhook.custom_headers);
-
-    let variables = if has_vars {
-        match fetch_variables(workspace_context, conn) {
-            Ok(vars_map) => vars_map,
-            Err(e) => {
-                log::error!("Failed to fetch variables for webhook: {}", e);
-                return false;
-            }
-        }
-    } else {
-        HashMap::new()
-    };
-
-    let secrets = if has_secrets {
-        match fetch_secrets(workspace_context, state, conn) {
-            Ok(secrets_map) => secrets_map,
-            Err(e) => {
-                log::error!("Failed to fetch secrets for webhook: {}", e);
-                return false;
-            }
-        }
-    } else {
-        HashMap::new()
-    };
-
-    let mut headers = HeaderMap::new();
-
-    let insert_header = |headers: &mut HeaderMap, name: &str, value: &str| {
-        if let (Ok(k), Ok(v)) = (HeaderName::from_str(name), HeaderValue::from_str(value))
-        {
-            headers.insert(k, v);
-        }
+    let webhook_response = WebhookResponse {
+        event_info: WebhookEventInfo {
+            webhook_event: event,
+            resource,
+            action,
+            time: Utc::now().to_string(),
+            workspace_id: workspace_context.workspace_id.to_string(),
+            organisation_id: workspace_context.organisation_id.to_string(),
+            config_version: config_version_opt,
+        },
+        payload,
     };
 
-    insert_header(
-        &mut headers,
-        &HeadersEnum::ConfigVersion.to_string(),
-        &config_version_opt.clone().unwrap_or_default(),
+    // Idempotency key: webhook_name + event type + millisecond timestamp.
+    // Ensures each trigger attempt gets a unique job while allowing dedup on retries.
+    let idempotency_key = format!(
+        "{}_{}_{}", webhook.name, event, Utc::now().timestamp_millis()
     );
-    insert_header(
-        &mut headers,
-        &HeadersEnum::WorkspaceId.to_string(),
-        &workspace_context.workspace_id,
-    );
-
-    for (key, value) in webhook.custom_headers.iter() {
-        let value_str = value
-            .as_str()
-            .map(String::from)
-            .unwrap_or_else(|| value.to_string());
-        let rendered = substitute_templates(&value_str, &variables, &secrets);
-        insert_header(&mut headers, key, &rendered);
-    }
 
-    let request_builder = match webhook.method {
-        HttpMethod::Post => state.http_client.post(&*webhook.url),
-        HttpMethod::Get => state.http_client.get(&*webhook.url),
-        HttpMethod::Put => state.http_client.put(&*webhook.url),
-        HttpMethod::Delete => state.http_client.delete(&*webhook.url),
-        HttpMethod::Patch => state.http_client.patch(&*webhook.url),
-        HttpMethod::Head => state.http_client.head(&*webhook.url),
-    };
-
-    let request_builder =
-        if webhook.method != HttpMethod::Get && webhook.method != HttpMethod::Head {
-            headers.insert(
-                reqwest::header::CONTENT_TYPE,
-                HeaderValue::from_static("application/json"),
+    match submit_webhook_job(
+        state.kronos_client.as_ref(),
+        &workspace_context.schema_name,
+        &webhook.name,
+        &webhook_response,
+        &idempotency_key,
+        webhook.max_retries,
+    )
+    .await
+    {
+        Ok(execution_id) => {
+            log::info!(
+                "Webhook job submitted: webhook='{}' execution_id='{}'",
+                webhook.name,
+                execution_id
             );
-            request_builder.json(&WebhookResponse {
-                event_info: WebhookEventInfo {
-                    webhook_event: event,
-                    resource,
-                    action,
-                    time: Utc::now().to_string(),
-                    workspace_id: workspace_context.workspace_id.to_string(),
-                    organisation_id: workspace_context.organisation_id.to_string(),
-                    config_version: config_version_opt,
-                },
-                payload,
-            })
-        } else {
-            request_builder
-        };
-
-    let response = request_builder.headers(headers).send().await;
-
-    match response {
-        Ok(res) if res.status().is_success() => {
-            log::info!("webhook call succeeded: {:?}", res.status());
             true
         }
-        Ok(res) => {
-            log::error!("Webhook failed: {:?} - {:?}", res.status(), res.headers());
-            false
-        }
-        Err(err) => {
-            log::error!("Webhook call failed: {:?}", err);
+        Err(e) => {
+            log::error!("Failed to submit webhook job for '{}': {}", webhook.name, e);
             false
         }
     }
diff --git a/crates/service_utils/src/kronos_dispatch.rs b/crates/service_utils/src/kronos_dispatch.rs
new file mode 100644
index 000000000..d6da4a405
--- /dev/null
+++ b/crates/service_utils/src/kronos_dispatch.rs
@@ -0,0 +1,132 @@
+use async_trait::async_trait;
+use kronos_worker::{JobTrigger, KronosClient};
+use kronos_common::tenant::SchemaProvider;
+use serde::Serialize;
+use serde_json::json;
+
+pub const DISPATCHER_ENDPOINT_NAME: &str = "superposition-webhook-dispatcher";
+pub const DISPATCHER_SECRET_NAME: &str = "superposition-internal-token";
+
+/// SchemaProvider implementation for Superposition.
+/// Queries `superposition.workspaces` to discover active tenant schemas
+/// so the Kronos worker knows which schemas to poll for jobs.
+pub struct SuperpositionSchemaProvider {
+    pool: sqlx::PgPool,
+}
+
+impl SuperpositionSchemaProvider {
+    pub fn new(pool: sqlx::PgPool) -> Self {
+        Self { pool }
+    }
+}
+
+#[async_trait]
+impl SchemaProvider for SuperpositionSchemaProvider {
+    async fn get_active_schemas(&self) -> Result<Vec<String>, sqlx::Error> {
+        // TODO: add in-memory caching here (e.g. Arc<RwLock<(Vec<String>, Instant)>> with a
+        // configurable TTL) to avoid querying the DB on every poll tick (~200ms). See
+        // SchemaRegistry in kronos/crates/common/src/tenant.rs for the pattern to follow.
+
+        // Only return schemas that have been provisioned with Kronos sched_* tables.
+        // Existing workspaces created before the Kronos integration don't have these
+        // tables yet; polling them causes a transaction abort cascade in the worker.
+        let schemas: Vec<(String,)> = sqlx::query_as(
+            "SELECT w.workspace_schema_name
+             FROM superposition.workspaces w
+             WHERE w.workspace_status = 'ENABLED'
+               AND EXISTS (
+                 SELECT 1 FROM information_schema.tables t
+                 WHERE t.table_schema = w.workspace_schema_name
+                   AND t.table_name = 'sched_jobs'
+               )",
+        )
+        .fetch_all(&self.pool)
+        .await?;
+
+        Ok(schemas.into_iter().map(|r| r.0).collect())
+    }
+}
+
+/// Build the Kronos endpoint spec for the per-workspace dispatcher endpoint.
+/// No user headers — only the URL and a reference to the internal auth token secret.
+pub fn dispatcher_endpoint_spec(dispatcher_url: &str) -> serde_json::Value {
+    json!({
+        "url": dispatcher_url,
+        "method": "POST",
+        "headers": {
+            "Authorization": format!("{{{{secret.{DISPATCHER_SECRET_NAME}}}}}")
+        },
+        "timeout_ms": 30000,
+        "expected_status_codes": [200]
+    })
+}
+
+// max_attempts is intentionally omitted — Kronos uses per-job max_attempts (from webhook.max_retries).
+// The endpoint retry policy only controls backoff timing between attempts.
+pub fn dispatcher_retry_policy() -> serde_json::Value {
+    json!({
+        "backoff": "exponential",
+        "initial_delay_ms": 1000,
+        "max_delay_ms": 30000
+    })
+}
+
+/// Resolve `{{SECRETS.name}}` templates in JSON header values using a plaintext secrets map.
+pub fn resolve_secret_templates(
+    headers: &serde_json::Value,
+    secrets: &std::collections::HashMap<String, String>,
+) -> serde_json::Value {
+    match headers {
+        serde_json::Value::Object(map) => {
+            let resolved = map
+                .iter()
+                .map(|(k, v)| {
+                    let v = match v.as_str() {
+                        Some(s) => {
+                            let mut result = s.to_string();
+                            for (name, value) in secrets {
+                                result = result
+                                    .replace(&format!("{{{{SECRETS.{name}}}}}"), value);
+                            }
+                            serde_json::Value::String(result)
+                        }
+                        None => v.clone(),
+                    };
+                    (k.clone(), v)
+                })
+                .collect();
+            serde_json::Value::Object(resolved)
+        }
+        other => other.clone(),
+    }
+}
+
+/// Submit a webhook payload as an IMMEDIATE Kronos job pointing to the workspace dispatcher.
+///
+/// The job carries `webhook_name` so the dispatcher can look up the webhook config, and
+/// `data` which is the full event payload forwarded to the target service.
+///
+/// Returns the execution_id on success.
+pub async fn submit_webhook_job<T: Serialize>(
+    kronos_client: &dyn KronosClient,
+    schema_name: &str,
+    webhook_name: &str,
+    payload: &T,
+    idempotency_key: &str,
+    max_attempts: i32,
+) -> anyhow::Result<String> {
+    let input = json!({
+        "webhook_name": webhook_name,
+        "data": serde_json::to_value(payload)?
+    });
+    kronos_client
+        .create_job(
+            schema_name,
+            DISPATCHER_ENDPOINT_NAME,
+            input,
+            max_attempts as i64,
+            JobTrigger::Immediate,
+            Some(idempotency_key),
+        )
+        .await
+}
diff --git a/crates/service_utils/src/lib.rs b/crates/service_utils/src/lib.rs
index 3ae4ef511..0804b9835 100644
--- a/crates/service_utils/src/lib.rs
+++ b/crates/service_utils/src/lib.rs
@@ -6,5 +6,6 @@ pub mod extensions;
 pub mod helpers;
 pub mod middlewares;
 pub mod redis;
+pub mod kronos_dispatch;
 pub mod registry;
 pub mod service;
diff --git a/crates/service_utils/src/service/types.rs b/crates/service_utils/src/service/types.rs
index b777a2ae1..fccf1c4ce 100644
--- a/crates/service_utils/src/service/types.rs
+++ b/crates/service_utils/src/service/types.rs
@@ -5,6 +5,10 @@ use std::{
     sync::{Arc, Mutex},
 };
 
+use tokio_util::sync::CancellationToken;
+
+use kronos_worker::KronosClient;
+
 use actix_web::{Error, FromRequest, HttpMessage, HttpResponseBuilder, error, web::Data};
 use chrono::{DateTime, Utc};
 use derive_more::{Deref, DerefMut};
@@ -97,6 +101,8 @@ pub struct AppState {
     pub redis: Option<fred::clients::RedisPool>,
     pub http_client: reqwest::Client,
     pub master_encryption_key: Option<EncryptionKey>,
+    pub kronos_client: Arc<dyn KronosClient>,
+    pub kronos_cancel: CancellationToken,
 }
 
 impl FromStr for AppEnv {
diff --git a/crates/superposition/Cargo.toml b/crates/superposition/Cargo.toml
index 26fa4bada..cc2edcec9 100644
--- a/crates/superposition/Cargo.toml
+++ b/crates/superposition/Cargo.toml
@@ -27,6 +27,7 @@ log = { workspace = true }
 regex = { workspace = true }
 reqwest = { workspace = true }
 rs-snowflake = { workspace = true }
+secrecy = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 service_utils = { workspace = true }
@@ -38,6 +39,10 @@ superposition_types = { workspace = true, features = [
     "server",
 ] }
 actix-http = { workspace = true }
+kronos-worker = { workspace = true }
+sqlx = { workspace = true }
+tokio = { workspace = true }
+tokio-util = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 tracing-actix-web = { workspace = true }
diff --git a/crates/superposition/src/app_state.rs b/crates/superposition/src/app_state.rs
index 0083ac256..b40a90355 100644
--- a/crates/superposition/src/app_state.rs
+++ b/crates/superposition/src/app_state.rs
@@ -9,13 +9,17 @@ use fred::{
     interfaces::ClientLike,
     types::{ConnectionConfig, PerformanceConfig, ReconnectPolicy, RedisConfig},
 };
+use kronos_worker::{KronosClient, KronosHttpClient, KronosLibraryClient, WorkerConfig};
+use tokio::task::JoinHandle;
 use service_utils::{
-    db::utils::{get_superposition_token, init_pool_manager},
+    db::utils::{get_database_url, get_superposition_token, init_pool_manager},
     encryption::get_master_encryption_keys,
     helpers::{get_from_env_or_default, get_from_env_unsafe},
+    kronos_dispatch::SuperpositionSchemaProvider,
     service::types::{AppEnv, AppState, ExperimentationFlags},
 };
 use snowflake::SnowflakeIdGenerator;
+use tokio_util::sync::CancellationToken;
 
 pub async fn get(
     app_env: AppEnv,
@@ -23,7 +27,7 @@ pub async fn get(
     kms_client: &Option<aws_sdk_kms::Client>,
     service_prefix: String,
     base: &str,
-) -> AppState {
+) -> (AppState, Option<JoinHandle<anyhow::Result<()>>>) {
     let master_encryption_key = get_master_encryption_keys(kms_client, &app_env)
         .await
         .unwrap_or_else(|e| {
@@ -77,7 +81,46 @@ pub async fn get(
         }
     };
 
-    AppState {
+    let http_client = reqwest::Client::new();
+
+    let (kronos_client, kronos_cancel, worker_handle): (
+        Arc<dyn KronosClient>,
+        CancellationToken,
+        Option<JoinHandle<anyhow::Result<()>>>,
+    ) = if let Ok(kronos_url) = std::env::var("KRONOS_URL") {
+        let api_key = std::env::var("KRONOS_API_KEY").unwrap_or_default();
+        let org_id = get_from_env_or_default("KRONOS_ORG_ID", "superposition".to_string());
+        log::info!("Kronos service mode: {kronos_url}");
+        (
+            Arc::new(KronosHttpClient::new(kronos_url, api_key, org_id)),
+            CancellationToken::new(),
+            None,
+        )
+    } else {
+        let database_url = get_database_url(kms_client, &app_env, None).await;
+        let sqlx_pool_size = get_from_env_or_default("KRONOS_DB_POOL_SIZE", 1);
+        let sqlx_pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(sqlx_pool_size)
+            .connect(&database_url)
+            .await
+            .expect("Failed to create sqlx pool for Kronos");
+        let kronos_encryption_key =
+            get_from_env_or_default("KRONOS_ENCRYPTION_KEY", "0".repeat(64));
+        let client =
+            KronosLibraryClient::new(sqlx_pool.clone(), "sched", &kronos_encryption_key, None)
+                .expect("Failed to create KronosLibraryClient");
+        let schema_provider = SuperpositionSchemaProvider::new(sqlx_pool);
+        let cancel = CancellationToken::new();
+        let handle = client.start_worker(
+            schema_provider,
+            cancel.clone(),
+            WorkerConfig::default(),
+        );
+        log::info!("Kronos library mode: embedded worker started");
+        (Arc::new(client), cancel, Some(handle))
+    };
+
+    let state = AppState {
         db_pool: init_pool_manager(kms_client, &app_env, max_pool_size).await,
         cac_host,
         cac_version: get_from_env_unsafe("SUPERPOSITION_VERSION")
@@ -108,7 +151,11 @@ pub async fn get(
         service_prefix,
         superposition_token: get_superposition_token(kms_client, &app_env).await,
         redis: redis_pool,
-        http_client: reqwest::Client::new(),
+        http_client,
         master_encryption_key,
-    }
+        kronos_client,
+        kronos_cancel,
+    };
+
+    (state, worker_handle)
 }
diff --git a/crates/superposition/src/dispatch/mod.rs b/crates/superposition/src/dispatch/mod.rs
new file mode 100644
index 000000000..04f8ae2b8
--- /dev/null
+++ b/crates/superposition/src/dispatch/mod.rs
@@ -0,0 +1,7 @@
+mod webhook;
+
+pub fn endpoints() -> actix_web::Scope {
+    actix_web::web::scope("")
+        .service(webhook::endpoints())
+        // future dispatchers: .service(email::endpoints()), etc.
+}
diff --git a/crates/superposition/src/dispatch/webhook.rs b/crates/superposition/src/dispatch/webhook.rs
new file mode 100644
index 000000000..ddbfec8d3
--- /dev/null
+++ b/crates/superposition/src/dispatch/webhook.rs
@@ -0,0 +1,126 @@
+use std::collections::HashMap;
+
+use actix_web::{HttpResponse, Scope, post, web::{Data, Json}};
+use diesel::{QueryDsl, RunQueryDsl};
+use secrecy::ExposeSecret;
+use serde::Deserialize;
+use service_utils::{
+    encryption::{decrypt_secret, decrypt_workspace_key},
+    kronos_dispatch::resolve_secret_templates,
+    service::types::{AppState, DbConnection, WorkspaceContext},
+};
+use superposition_macros::unexpected_error;
+use superposition_types::{
+    database::{models::others::Secret, schema::secrets},
+    result as superposition,
+};
+
+use crate::webhooks::helper::fetch_webhook;
+
+#[derive(Deserialize)]
+struct DispatchWebhookRequest {
+    webhook_name: String,
+    data: serde_json::Value,
+}
+
+pub fn endpoints() -> Scope {
+    Scope::new("").service(dispatch_handler)
+}
+
+#[post("/webhook")]
+async fn dispatch_handler(
+    workspace_context: WorkspaceContext,
+    state: Data<AppState>,
+    db_conn: DbConnection,
+    body: Json<DispatchWebhookRequest>,
+) -> superposition::Result<HttpResponse> {
+    let DispatchWebhookRequest { webhook_name, data } = body.into_inner();
+
+    let DbConnection(mut conn) = db_conn;
+    let webhook =
+        fetch_webhook(&webhook_name, &workspace_context.schema_name, &mut conn)?;
+
+    if !webhook.enabled {
+        return Ok(HttpResponse::Ok().finish());
+    }
+
+    let secrets = fetch_decrypted_secrets(&workspace_context, &mut conn, &state)?;
+
+    let resolved_headers = resolve_secret_templates(
+        &serde_json::Value::Object((*webhook.custom_headers).clone()),
+        &secrets,
+    );
+
+    let method = reqwest::Method::from_bytes(
+        webhook.method.to_string().to_uppercase().as_bytes(),
+    )
+    .unwrap_or(reqwest::Method::POST);
+
+    let mut builder = state
+        .http_client
+        .request(method, webhook.url.as_str())
+        .timeout(std::time::Duration::from_secs(10))
+        .json(&data);
+
+    if let serde_json::Value::Object(hmap) = resolved_headers {
+        for (k, v) in hmap {
+            if let Some(s) = v.as_str() {
+                builder = builder.header(k, s);
+            }
+        }
+    }
+
+    let resp = builder
+        .send()
+        .await
+        .map_err(|e| unexpected_error!("Dispatcher HTTP send failed: {}", e))?;
+
+    if [200u16, 201, 202, 204].contains(&resp.status().as_u16()) {
+        Ok(HttpResponse::Ok().finish())
+    } else {
+        Err(unexpected_error!(
+            "Target returned unexpected status {}",
+            resp.status()
+        ))
+    }
+}
+
+fn fetch_decrypted_secrets(
+    workspace_context: &WorkspaceContext,
+    conn: &mut diesel::r2d2::PooledConnection<
+        diesel::r2d2::ConnectionManager<diesel::PgConnection>,
+    >,
+    state: &AppState,
+) -> superposition::Result<HashMap<String, String>> {
+    let Some(ref master_key) = state.master_encryption_key else {
+        return Ok(HashMap::new());
+    };
+
+    let workspace_key =
+        decrypt_workspace_key(&workspace_context.settings.encryption_key, master_key)
+            .map_err(|e| unexpected_error!("Failed to decrypt workspace key: {}", e))?;
+
+    let all_secrets: Vec<Secret> = secrets::table
+        .schema_name(&workspace_context.schema_name)
+        .get_results(conn)?;
+
+    let mut map = HashMap::with_capacity(all_secrets.len());
+    for secret in all_secrets {
+        match decrypt_secret(&secret.encrypted_value, &workspace_key) {
+            Ok(plaintext) => {
+                map.insert(
+                    String::from(&secret.name),
+                    plaintext.expose_secret().to_string(),
+                );
+            }
+            Err(e) => {
+                log::warn!(
+                    "Failed to decrypt secret '{}' for dispatcher: {e}",
+                    String::from(&secret.name)
+                );
+            }
+        }
+    }
+
+    Ok(map)
+}
diff --git a/crates/superposition/src/main.rs b/crates/superposition/src/main.rs
index 44d32f407..d62182ff4 100644
--- a/crates/superposition/src/main.rs
+++ b/crates/superposition/src/main.rs
@@ -1,5 +1,6 @@
 #![deny(unused_crate_dependencies)]
 mod app_state;
+mod dispatch;
 mod log_span;
 mod organisation;
 mod resolve;
@@ -131,22 +132,22 @@ async fn main() -> Result<()> {
         _ => Some(kms::new_client().await),
     };
 
-    let app_state = Data::new(
-        app_state::get(
-            app_env,
-            cac_port,
-            &kms_client,
-            service_prefix_str.to_owned(),
-            &base,
-        )
-        .await,
-    );
+    let (app_state_inner, kronos_worker_handle) = app_state::get(
+        app_env,
+        cac_port,
+        &kms_client,
+        service_prefix_str.to_owned(),
+        &base,
+    )
+    .await;
+    let kronos_cancel = app_state_inner.kronos_cancel.clone();
+    let app_state = Data::new(app_state_inner);
 
     let auth_n = AuthNHandler::init(&kms_client, &app_env, base.clone()).await;
     let auth_z = AuthZHandler::init(&kms_client, &app_env).await;
     let auth_z_manager = AuthZManager::init(&kms_client, &app_env).await;
 
-    HttpServer::new(move || {
+    let server = HttpServer::new(move || {
         let leptos_options = &conf.leptos_options;
         let site_root = &leptos_options.site_root;
         let leptos_envs = ui_envs.clone();
@@ -223,8 +224,17 @@ async fn main() -> Result<()> {
     .keep_alive(Duration::from_secs(
         get_from_env_unsafe("ACTIX_KEEP_ALIVE").unwrap_or(120),
     ))
-    .run()
-    .await
+    .run();
+
+    // HTTP server runs until Ctrl+C / SIGTERM. After it stops, drain the Kronos worker.
+    server.await?;
+
+    kronos_cancel.cancel();
+    if let Some(handle) = kronos_worker_handle {
+        let _ = tokio::time::timeout(Duration::from_secs(35), handle).await;
+    }
+
+    Ok(())
 }
 
 trait ScopeExt {
@@ -309,6 +319,11 @@ impl ScopeExt for Scope {
                 .wrap(OrgWorkspaceMiddlewareFactory::new(true, true))
                 .service(secrets::endpoints()),
         )
+        .service(
+            scope("/dispatch")
+                .wrap(OrgWorkspaceMiddlewareFactory::new(true, true))
+                .service(dispatch::endpoints()),
+        )
     }
 
     fn resource_routes_org_specific(self, auth_z_manager: AuthZManager) -> Self {
diff --git a/crates/superposition/src/webhooks/handlers.rs b/crates/superposition/src/webhooks/handlers.rs
index abbc98881..1f1c68328 100644
--- a/crates/superposition/src/webhooks/handlers.rs
+++ b/crates/superposition/src/webhooks/handlers.rs
@@ -52,6 +52,12 @@ async fn create_handler(
     .await?;
 
     validate_events(&req.events, None, &workspace_context.schema_name, &mut conn)?;
+    let retries = req.max_retries.unwrap_or(3);
+    if retries > 3 {
+        return Err(superposition::AppError::BadArgument(
+            "max_retries must not exceed 3".to_string(),
+        ));
+    }
     let now = Utc::now();
     let webhook_data = Webhook {
         name: req.name.to_string(),
@@ -62,7 +68,7 @@ async fn create_handler(
         payload_version: req.payload_version.unwrap_or_default(),
         custom_headers: req.custom_headers.unwrap_or_default(),
         events: req.events,
-        max_retries: 0,
+        max_retries: retries,
         last_triggered_at: None,
         change_reason: req.change_reason,
         created_by: user.get_email(),
@@ -110,6 +116,14 @@ async fn update_handler(
         )?;
     }
 
+    if let Some(retries) = req.max_retries {
+        if retries > 3 {
+            return Err(superposition::AppError::BadArgument(
+                "max_retries must not exceed 3".to_string(),
+            ));
+        }
+    }
+
     let update = diesel::update(webhooks::table)
         .filter(webhooks::name.eq(w_name))
         .set((
@@ -201,6 +215,7 @@ async fn delete_handler(
     diesel::delete(webhooks.filter(webhooks::name.eq(&w_name)))
         .schema_name(&workspace_context.schema_name)
         .execute(&mut conn)?;
+
     Ok(HttpResponse::NoContent().finish())
 }
 
diff --git a/crates/superposition/src/workspace/handlers.rs b/crates/superposition/src/workspace/handlers.rs
index 65698a4f3..720683737 100644
--- a/crates/superposition/src/workspace/handlers.rs
+++ b/crates/superposition/src/workspace/handlers.rs
@@ -19,6 +19,10 @@ use service_utils::{
         rotate_workspace_encryption_key_helper,
     },
     helpers::get_workspace,
+    kronos_dispatch::{
+        DISPATCHER_ENDPOINT_NAME, DISPATCHER_SECRET_NAME, dispatcher_endpoint_spec,
+        dispatcher_retry_policy,
+    },
     middlewares::auth_z::AuthZHandler,
     service::types::{
         AppState, DbConnection, OrganisationId, SchemaName, WorkspaceContext, WorkspaceId,
@@ -166,11 +170,59 @@ async fn create_handler(
                     .values(workspace)
                     .get_results(transaction_conn)?;
 
-            setup_workspace_schema(transaction_conn, &workspace_schema_name)?;
+            setup_workspace_schema(transaction_conn, &workspace_schema_name.0)?;
             Ok(inserted_workspace.remove(0))
         })?;
 
-    put_workspace_in_redis(&created_workspace, &state, &workspace_schema_name).await;
+    put_workspace_in_redis(&created_workspace, &state, &workspace_schema_name.0).await;
+
+    if let Err(e) = state
+        .kronos_client
+        .provision_workspace(&workspace_schema_name.0)
+        .await
+    {
+        log::warn!(
+            "Kronos workspace provision failed for '{}': {e}",
+            workspace_schema_name.0
+        );
+    }
+
+    let dispatcher_url = format!(
+        "{}/{}/{}/dispatch/webhook",
+        state.cac_host,
+        created_workspace.organisation_id,
+        created_workspace.workspace_name
+    );
+    if let Err(e) = state
+        .kronos_client
+        .upsert_secret(
+            &workspace_schema_name.0,
+            DISPATCHER_SECRET_NAME,
+            &state.superposition_token,
+        )
+        .await
+    {
+        log::warn!(
+            "Dispatcher secret setup failed for '{}': {e}",
+            workspace_schema_name.0
+        );
+    }
+    if let Err(e) = state
+        .kronos_client
+        .register_endpoint(
+            &workspace_schema_name.0,
+            DISPATCHER_ENDPOINT_NAME,
+            "HTTP",
+            dispatcher_endpoint_spec(&dispatcher_url),
+            Some(dispatcher_retry_policy()),
+        )
+        .await
+    {
+        log::warn!(
+            "Dispatcher endpoint setup failed for '{}': {e}",
+            workspace_schema_name.0
+        );
+    }
 
     // Notify the AuthZHandler about the new workspace creation
     let _ = authz_handler
@@ -458,6 +510,48 @@ async fn migrate_schema_handler(
         Ok(())
     })?;
 
+    if let Err(e) = state.kronos_client.provision_workspace(&schema_name.0).await {
+        log::warn!("Kronos workspace provision failed for '{}': {e}", schema_name.0);
+    }
+
+    // Dispatcher setup is idempotent — run regardless of provision result (handles existing workspaces too)
+    let dispatcher_url = format!(
+        "{}/{}/{}/dispatch/webhook",
+        state.cac_host,
+        workspace.organisation_id,
+        workspace.workspace_name
+    );
+    if let Err(e) = state
+        .kronos_client
+        .upsert_secret(
+            &schema_name.0,
+            DISPATCHER_SECRET_NAME,
+            &state.superposition_token,
+        )
+        .await
+    {
+        log::warn!(
+            "Dispatcher secret setup failed for '{}': {e}",
+            schema_name.0
+        );
+    }
+    if let Err(e) = state
+        .kronos_client
+        .register_endpoint(
+            &schema_name.0,
+            DISPATCHER_ENDPOINT_NAME,
+            "HTTP",
+            dispatcher_endpoint_spec(&dispatcher_url),
+            Some(dispatcher_retry_policy()),
+        )
+        .await
+    {
+        log::warn!(
+            "Dispatcher endpoint setup failed for '{}': {e}",
+            schema_name.0
+        );
+    }
+
     // Refetch workspace after transaction to get updated data
     let workspace = get_workspace(&schema_name, &mut conn)?;
     put_workspace_in_redis(&workspace, &state, &schema_name.0).await;
diff --git a/crates/superposition_types/src/api/webhook.rs b/crates/superposition_types/src/api/webhook.rs
index e99550e5a..b7ded50f1 100644
--- a/crates/superposition_types/src/api/webhook.rs
+++ b/crates/superposition_types/src/api/webhook.rs
@@ -25,6 +25,7 @@ pub struct CreateWebhookRequest {
     pub payload_version: Option<PayloadVersion>,
     pub custom_headers: Option<CustomHeaders>,
     pub events: Vec<WebhookEvent>,
+    pub max_retries: Option<i32>,
     pub change_reason: ChangeReason,
 }
 
@@ -39,6 +40,7 @@ pub struct UpdateWebhookRequest {
     pub payload_version: Option<PayloadVersion>,
     pub custom_headers: Option<CustomHeaders>,
     pub events: Option<Vec<WebhookEvent>>,
+    pub max_retries: Option<i32>,
     pub change_reason: ChangeReason,
 }
 
diff --git a/workspace_template.sql b/workspace_template.sql
index 9c10d8a3a..ef1d97b92 100644
--- a/workspace_template.sql
+++ b/workspace_template.sql
@@ -997,3 +997,4 @@ DO $$ BEGIN
 EXCEPTION
     WHEN duplicate_object THEN null;
 END $$;
+