diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 256a351e8ff..8ff198708fd 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -40,3 +40,12 @@ steps:
     agents:
       provider: "gcp"
       machineType: "n1-standard-8"
+
+  - wait: ~
+    continue_on_failure: true
+  - label: "Processing test results"
+    agents:
+      provider: "gcp"
+    plugins:
+      - junit-annotate#v2.4.1:
+          artifacts: build/TEST-go-*.xml
diff --git a/.buildkite/scripts/steps/integration_tests.sh b/.buildkite/scripts/steps/integration_tests.sh
index ea28f1f503d..6a582c4d8ef 100755
--- a/.buildkite/scripts/steps/integration_tests.sh
+++ b/.buildkite/scripts/steps/integration_tests.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -euxo pipefail
+set -euo pipefail
 
 source .buildkite/scripts/common.sh
 
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 5c16a4e2c4c..4d8a0ba4ec1 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -13,5 +13,5 @@ jobs:
       - id: govulncheck
         uses: golang/govulncheck-action@v1
         with:
-           go-version-input: 1.20.7
+           go-version-input: 1.20.8
            go-package: ./...
diff --git a/.go-version b/.go-version
index 8909929f6e7..95393fc7d4d 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.20.7
+1.20.8
diff --git a/.golangci.yml b/.golangci.yml
index 6af8ecba48c..a6f9f5de236 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -116,7 +116,7 @@ linters-settings:
 
   gosimple:
     # Select the Go version to target. The default is '1.13'.
-    go: "1.20.7"
+    go: "1.20.8"
 
   nakedret:
     # make an issue if func has more lines of code than this setting and it has naked returns; default is 30
@@ -136,17 +136,17 @@ linters-settings:
 
   staticcheck:
     # Select the Go version to target. The default is '1.13'.
-    go: "1.20.7"
+    go: "1.20.8"
     checks: ["all"]
 
   stylecheck:
     # Select the Go version to target. The default is '1.13'.
-    go: "1.20.7"
+    go: "1.20.8"
     checks: ["all"]
 
   unused:
     # Select the Go version to target. The default is '1.13'.
-    go: "1.20.7"
+    go: "1.20.8"
 
   gosec:
     excludes:
diff --git a/Dockerfile b/Dockerfile
index 9589d0bcbf5..d0c2edc9f94 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.20.7
+ARG GO_VERSION=1.20.8
 FROM circleci/golang:${GO_VERSION}
 
 
diff --git a/Dockerfile.skaffold b/Dockerfile.skaffold
index fad68dd0607..ca9300eb4de 100644
--- a/Dockerfile.skaffold
+++ b/Dockerfile.skaffold
@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.20.7
+ARG GO_VERSION=1.20.8
 ARG crossbuild_image="docker.elastic.co/beats-dev/golang-crossbuild"
 ARG AGENT_VERSION=8.9.0-SNAPSHOT
 ARG AGENT_IMAGE="docker.elastic.co/beats/elastic-agent"
diff --git a/NOTICE.txt b/NOTICE.txt
index 9b6ace280ec..7aecf695cc3 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -2000,11 +2000,11 @@ Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-transpo
 
 --------------------------------------------------------------------------------
 Dependency : github.com/elastic/go-elasticsearch/v8
-Version: v8.8.2
+Version: v8.10.0
 Licence type (autodetected): Apache-2.0
 --------------------------------------------------------------------------------
 
-Contents of probable licence file $GOMODCACHE/github.com/elastic/go-elasticsearch/v8@v8.8.2/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/elastic/go-elasticsearch/v8@v8.10.0/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -2423,11 +2423,11 @@ Contents of probable licence file $GOMODCACHE/github.com/elastic/go-licenser@v0.
 
 --------------------------------------------------------------------------------
 Dependency : github.com/elastic/go-sysinfo
-Version: v1.11.0
+Version: v1.11.1
 Licence type (autodetected): Apache-2.0
 --------------------------------------------------------------------------------
 
-Contents of probable licence file $GOMODCACHE/github.com/elastic/go-sysinfo@v1.11.0/LICENSE.txt:
+Contents of probable licence file $GOMODCACHE/github.com/elastic/go-sysinfo@v1.11.1/LICENSE.txt:
 
 
                                  Apache License
diff --git a/changelog/8.10.1.asciidoc b/changelog/8.10.1.asciidoc
new file mode 100644
index 00000000000..4ca9b796f2c
--- /dev/null
+++ b/changelog/8.10.1.asciidoc
@@ -0,0 +1,40 @@
+// begin 8.10.1 relnotes
+
+[[release-notes-8.10.1]]
+==  8.10.1
+
+Review important information about the  8.10.1 release.
+
+
+
+
+
+
+
+
+
+
+
+
+[discrete]
+[[enhancements-8.10.1]]
+=== Enhancements
+
+
+elastic-agent::
+
+* Improve Logging During Agent Upgrades. {elastic-agent-pull}https://github.com/elastic/elastic-agent/pull/3382[#https://github.com/elastic/elastic-agent/pull/3382] 
+
+
+
+
+[discrete]
+[[bug-fixes-8.10.1]]
+=== Bug fixes
+
+
+elastic-agent::
+
+* Rollback Elastic Agent Upgrade If Upgraded Agent Process Crashes Immediately. {elastic-agent-pull}https://github.com/elastic/elastic-agent/pull/3166[#https://github.com/elastic/elastic-agent/pull/3166] {elastic-agent-issue}https://github.com/elastic/elastic-agent/issues/3124[#https://github.com/elastic/elastic-agent/issues/3124]
+
+// end 8.10.1 relnotes
diff --git a/changelog/8.10.1.yaml b/changelog/8.10.1.yaml
new file mode 100644
index 00000000000..dcdfc805615
--- /dev/null
+++ b/changelog/8.10.1.yaml
@@ -0,0 +1,25 @@
+version: 8.10.1
+entries:
+    - kind: bug-fix
+      summary: Rollback Elastic Agent upgrade if upgraded Agent process crashes immediately.
+      description: ""
+      component: elastic-agent
+      pr:
+        - https://github.com/elastic/elastic-agent/pull/3166
+      issue:
+        - https://github.com/elastic/elastic-agent/issues/3124
+      timestamp: 1690917883
+      file:
+        name: 1690917883-crash-checker-pid-zero.yaml
+        checksum: 0a2ceec945ec5f1829bbf0d6d9f13f2f5b428885
+    - kind: enhancement
+      summary: Improve logging during Agent upgrades
+      description: ""
+      component: elastic-agent
+      pr:
+        - https://github.com/elastic/elastic-agent/pull/3382
+      issue: []
+      timestamp: 1694190260
+      file:
+        name: 1694190260-improve-upgrade-logging.yaml
+        checksum: 4d9c6f196e8fa89e834969c751237153b69b18e5
diff --git a/changelog/fragments/1690917883-crash-checker-pid-zero.yaml b/changelog/fragments/1694439479-fix_creatork8sscript.yaml
similarity index 86%
rename from changelog/fragments/1690917883-crash-checker-pid-zero.yaml
rename to changelog/fragments/1694439479-fix_creatork8sscript.yaml
index 2540afe4b94..7f7a9d1fd95 100644
--- a/changelog/fragments/1690917883-crash-checker-pid-zero.yaml
+++ b/changelog/fragments/1694439479-fix_creatork8sscript.yaml
@@ -8,10 +8,10 @@
 # - security: impacts on the security of a product or a user’s deployment.
 # - upgrade: important information for someone upgrading from a prior version
 # - other: does not fit into any of the other categories
-kind: bug-fix
+kind: bug
 
 # Change summary; a 80ish characters long description of the change.
-summary: Rollback Elastic Agent upgrade if upgraded Agent process crashes immediately.
+summary: Fixing deploy/kubernetes/creator_k8.sh script to correcly exclude configmaps
 
 # Long description; in case the summary is not enough to describe the change
 # this field accommodate a description without length limits.
@@ -19,14 +19,14 @@ summary: Rollback Elastic Agent upgrade if upgraded Agent process crashes immedi
 #description:
 
 # Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
-component: elastic-agent
+component:
 
 # PR URL; optional; the PR number that added the changeset.
 # If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
 # NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
 # Please provide it if you are adding a fragment for a different PR.
-pr: https://github.com/elastic/elastic-agent/pull/3166
+#pr: https://github.com/owner/repo/1234
 
 # Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
 # If not present is automatically filled by the tooling with the issue linked to the PR number.
-issue: https://github.com/elastic/elastic-agent/issues/3124
+#issue: https://github.com/owner/repo/1234
diff --git a/changelog/fragments/1694700200-Upgrade-to-Go-1.20.8.yaml b/changelog/fragments/1694700200-Upgrade-to-Go-1.20.8.yaml
new file mode 100644
index 00000000000..211338b03db
--- /dev/null
+++ b/changelog/fragments/1694700200-Upgrade-to-Go-1.20.8.yaml
@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: security
+
+# Change summary; a 80ish characters long description of the change.
+summary: Upgrade to Go 1.20.8.
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: "elastic-agent"
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: https://github.com/elastic/elastic-agent/pull/3393
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234
diff --git a/changelog/fragments/1695050880-Improve-retry-strategy-when-uninstalling-agent.yaml b/changelog/fragments/1695050880-Improve-retry-strategy-when-uninstalling-agent.yaml
new file mode 100644
index 00000000000..b3c1e7ac5e7
--- /dev/null
+++ b/changelog/fragments/1695050880-Improve-retry-strategy-when-uninstalling-agent.yaml
@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: feature
+
+# Change summary; a 80ish characters long description of the change.
+summary: Improve uninstall by adding some pause between retries when removal is blocked by busy files
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:
+
+# Affected component; a word indicating the component this changeset affects.
+component: elastic-agent
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+#pr: https://github.com/owner/repo/1234
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234
diff --git a/deploy/kubernetes/Makefile b/deploy/kubernetes/Makefile
index 553315683fc..e4d8b474908 100644
--- a/deploy/kubernetes/Makefile
+++ b/deploy/kubernetes/Makefile
@@ -30,7 +30,7 @@ $(ALL):
 ifdef WITHOUTCONFIG
 	@echo "Generating $@-kubernetes-without-configmap.yaml"
 	@rm -f $@-kubernetes-without-configmap.yaml
-	@for f in $(shell ls $@/*.yaml | grep -v daemonset-configmap); do \
+	@for f in $(shell ls $@/*.yaml | grep -v configmap ); do \
 		sed -e "s/%VERSION%/VERSION/g" -e "s/%BRANCH%/${BRANCH_VERSION}/g" $$f >> $@-kubernetes-without-configmap.yaml; \
 		echo --- >> $@-kubernetes-without-configmap.yaml; \
 	done
diff --git a/go.mod b/go.mod
index b17a75c97bb..ab6cb47341a 100644
--- a/go.mod
+++ b/go.mod
@@ -18,9 +18,9 @@ require (
 	github.com/elastic/elastic-agent-libs v0.3.14
 	github.com/elastic/elastic-agent-system-metrics v0.6.1
 	github.com/elastic/elastic-transport-go/v8 v8.3.0
-	github.com/elastic/go-elasticsearch/v8 v8.8.2
+	github.com/elastic/go-elasticsearch/v8 v8.10.0
 	github.com/elastic/go-licenser v0.4.1
-	github.com/elastic/go-sysinfo v1.11.0
+	github.com/elastic/go-sysinfo v1.11.1
 	github.com/elastic/go-ucfg v0.8.6
 	github.com/fatih/color v1.15.0
 	github.com/gofrs/flock v0.8.1
diff --git a/go.sum b/go.sum
index fca2d0318c9..5d805bcd84a 100644
--- a/go.sum
+++ b/go.sum
@@ -785,12 +785,13 @@ github.com/elastic/elastic-agent-system-metrics v0.6.1 h1:LCN1lvQTkdUuU/rKlpKyVM
 github.com/elastic/elastic-agent-system-metrics v0.6.1/go.mod h1:Bj8XM/uNKm553blQHkGNEICRLGnVEtw8yttmV5vBngA=
 github.com/elastic/elastic-integration-corpus-generator-tool v0.5.0/go.mod h1:uf9N86y+UACGybdEhZLpwZ93XHWVhsYZAA4c2T2v6YM=
 github.com/elastic/elastic-package v0.77.0/go.mod h1:Xeqx0OOVnKBfFoSHsHmKI74RxgRGiDhU6yXEu8BkJJM=
+github.com/elastic/elastic-transport-go/v8 v8.0.0-20230329154755-1a3c63de0db6/go.mod h1:87Tcz8IVNe6rVSLdBux1o/PEItLtyabHU3naC7IoqKI=
 github.com/elastic/elastic-transport-go/v8 v8.3.0 h1:DJGxovyQLXGr62e9nDMPSxRyWION0Bh6d9eCFBriiHo=
 github.com/elastic/elastic-transport-go/v8 v8.3.0/go.mod h1:87Tcz8IVNe6rVSLdBux1o/PEItLtyabHU3naC7IoqKI=
 github.com/elastic/go-elasticsearch/v7 v7.17.7/go.mod h1:OJ4wdbtDNk5g503kvlHLyErCgQwwzmDtaFC4XyOxXA4=
 github.com/elastic/go-elasticsearch/v8 v8.0.0-20210317102009-a9d74cec0186/go.mod h1:xe9a/L2aeOgFKKgrO3ibQTnMdpAeL0GC+5/HpGScSa4=
-github.com/elastic/go-elasticsearch/v8 v8.8.2 h1:3ITzPlRNadzDnbLTnMRjrAN4j4G3LvFo5gCIWDPS6pY=
-github.com/elastic/go-elasticsearch/v8 v8.8.2/go.mod h1:GU1BJHO7WeamP7UhuElYwzzHtvf9SDmeVpSSy9+o6Qg=
+github.com/elastic/go-elasticsearch/v8 v8.10.0 h1:ALg3DMxSrx07YmeMNcfPf7cFh1Ep2+Qa19EOXTbwr2k=
+github.com/elastic/go-elasticsearch/v8 v8.10.0/go.mod h1:NGmpvohKiRHXI0Sw4fuUGn6hYOmAXlyCphKpzVBiqDE=
 github.com/elastic/go-licenser v0.3.1/go.mod h1:D8eNQk70FOCVBl3smCGQt/lv7meBeQno2eI1S5apiHQ=
 github.com/elastic/go-licenser v0.4.0/go.mod h1:V56wHMpmdURfibNBggaSBfqgPxyT1Tldns1i87iTEvU=
 github.com/elastic/go-licenser v0.4.1 h1:1xDURsc8pL5zYT9R29425J3vkHdt4RT5TNEMeRN48x4=
@@ -799,8 +800,8 @@ github.com/elastic/go-structform v0.0.10 h1:oy08o/Ih2hHTkNcRY/1HhaYvIp5z6t8si8gn
 github.com/elastic/go-structform v0.0.10/go.mod h1:CZWf9aIRYY5SuKSmOhtXScE5uQiLZNqAFnwKR4OrIM4=
 github.com/elastic/go-sysinfo v1.1.1/go.mod h1:i1ZYdU10oLNfRzq4vq62BEwD2fH8KaWh6eh0ikPT9F0=
 github.com/elastic/go-sysinfo v1.7.1/go.mod h1:i1ZYdU10oLNfRzq4vq62BEwD2fH8KaWh6eh0ikPT9F0=
-github.com/elastic/go-sysinfo v1.11.0 h1:QW+6BF1oxBoAprH3w2yephF7xLkrrSXj7gl2xC2BM4w=
-github.com/elastic/go-sysinfo v1.11.0/go.mod h1:6KQb31j0QeWBDF88jIdWSxE8cwoOB9tO4Y4osN7Q70E=
+github.com/elastic/go-sysinfo v1.11.1 h1:g9mwl05njS4r69TisC+vwHWTSKywZFYYUu3so3T/Lao=
+github.com/elastic/go-sysinfo v1.11.1/go.mod h1:6KQb31j0QeWBDF88jIdWSxE8cwoOB9tO4Y4osN7Q70E=
 github.com/elastic/go-ucfg v0.8.6 h1:stUeyh2goTgGX+/wb9gzKvTv0YB0231LTpKUgCKj4U0=
 github.com/elastic/go-ucfg v0.8.6/go.mod h1:4E8mPOLSUV9hQ7sgLEJ4bvt0KhMuDJa8joDT2QGAEKA=
 github.com/elastic/go-windows v1.0.0/go.mod h1:TsU0Nrp7/y3+VwE82FoZF8gC/XFg/Elz6CcloAxnPgU=
diff --git a/internal/pkg/agent/application/upgrade/cleanup.go b/internal/pkg/agent/application/upgrade/cleanup.go
index 4464a1d8f70..cc6bacf4635 100644
--- a/internal/pkg/agent/application/upgrade/cleanup.go
+++ b/internal/pkg/agent/application/upgrade/cleanup.go
@@ -19,7 +19,7 @@ import (
 // cleanNonMatchingVersionsFromDownloads will remove files that do not have the passed version number from the downloads directory.
 func cleanNonMatchingVersionsFromDownloads(log *logger.Logger, version string) error {
 	downloadsPath := paths.Downloads()
-	log.Debugw("Cleaning up non-matching downloaded versions", "version", version, "downloads.path", downloadsPath)
+	log.Infow("Cleaning up non-matching downloaded versions", "version", version, "downloads.path", downloadsPath)
 
 	files, err := os.ReadDir(downloadsPath)
 	if os.IsNotExist(err) {
diff --git a/internal/pkg/agent/application/upgrade/crash_checker.go b/internal/pkg/agent/application/upgrade/crash_checker.go
index fd6016208e0..67bc2bf862c 100644
--- a/internal/pkg/agent/application/upgrade/crash_checker.go
+++ b/internal/pkg/agent/application/upgrade/crash_checker.go
@@ -7,7 +7,6 @@ package upgrade
 import (
 	"context"
 	"fmt"
-	"os"
 	"sync"
 	"time"
 
@@ -53,7 +52,7 @@ func NewCrashChecker(ctx context.Context, ch chan error, log *logger.Logger, che
 		return nil, err
 	}
 
-	log.Debugf("running checks using '%s' controller", c.sc.Name())
+	log.Infof("running checks using '%s' controller", c.sc.Name())
 
 	return c, nil
 }
@@ -62,9 +61,8 @@ func NewCrashChecker(ctx context.Context, ch chan error, log *logger.Logger, che
 func (ch *CrashChecker) Run(ctx context.Context) {
 	defer ch.sc.Close()
 
-	ch.log.Debug("Crash checker started")
+	ch.log.Info("Crash checker started")
 	for {
-		ch.log.Debugf("watcher having PID: %d", os.Getpid())
 		t := time.NewTimer(ch.checkInterval)
 
 		select {
@@ -77,7 +75,7 @@ func (ch *CrashChecker) Run(ctx context.Context) {
 				ch.log.Error(err)
 			}
 
-			ch.log.Debugf("retrieved service PID [%d]", pid)
+			ch.log.Infof("retrieved service PID [%d]", pid)
 			ch.q.Push(pid)
 
 			// We decide if the Agent process has crashed in either of
diff --git a/internal/pkg/agent/application/upgrade/error_checker.go b/internal/pkg/agent/application/upgrade/error_checker.go
index d6bad9f3e4d..a0a3516c94a 100644
--- a/internal/pkg/agent/application/upgrade/error_checker.go
+++ b/internal/pkg/agent/application/upgrade/error_checker.go
@@ -49,7 +49,7 @@ func NewErrorChecker(ch chan error, log *logger.Logger, checkInterval time.Durat
 
 // Run runs the checking loop.
 func (ch *ErrorChecker) Run(ctx context.Context) {
-	ch.log.Debug("Error checker started")
+	ch.log.Info("Error checker started")
 	for {
 		t := time.NewTimer(ch.checkInterval)
 		select {
diff --git a/internal/pkg/agent/application/upgrade/rollback.go b/internal/pkg/agent/application/upgrade/rollback.go
index ac835cd67e2..ae3c568acf1 100644
--- a/internal/pkg/agent/application/upgrade/rollback.go
+++ b/internal/pkg/agent/application/upgrade/rollback.go
@@ -55,7 +55,7 @@ func Rollback(ctx context.Context, log *logger.Logger, prevHash string, currentH
 
 // Cleanup removes all artifacts and files related to a specified version.
 func Cleanup(log *logger.Logger, currentHash string, removeMarker bool, keepLogs bool) error {
-	log.Debugw("Cleaning up upgrade", "hash", currentHash, "remove_marker", removeMarker)
+	log.Infow("Cleaning up upgrade", "hash", currentHash, "remove_marker", removeMarker)
 	<-time.After(afterRestartDelay)
 
 	// remove upgrade marker
@@ -78,7 +78,7 @@ func Cleanup(log *logger.Logger, currentHash string, removeMarker bool, keepLogs
 
 	// remove symlink to avoid upgrade failures, ignore error
 	prevSymlink := prevSymlinkPath()
-	log.Debugw("Removing previous symlink path", "file.path", prevSymlinkPath())
+	log.Infow("Removing previous symlink path", "file.path", prevSymlinkPath())
 	_ = os.Remove(prevSymlink)
 
 	dirPrefix := fmt.Sprintf("%s-", agentName)
@@ -93,7 +93,7 @@ func Cleanup(log *logger.Logger, currentHash string, removeMarker bool, keepLogs
 		}
 
 		hashedDir := filepath.Join(paths.Data(), dir)
-		log.Debugw("Removing hashed data directory", "file.path", hashedDir)
+		log.Infow("Removing hashed data directory", "file.path", hashedDir)
 		var ignoredDirs []string
 		if keepLogs {
 			ignoredDirs = append(ignoredDirs, "logs")
@@ -110,20 +110,28 @@ func Cleanup(log *logger.Logger, currentHash string, removeMarker bool, keepLogs
 // agent during upgrade period.
 func InvokeWatcher(log *logger.Logger) error {
 	if !IsUpgradeable() {
-		log.Debug("agent is not upgradable, not starting watcher")
+		log.Info("agent is not upgradable, not starting watcher")
 		return nil
 	}
 
 	cmd := invokeCmd()
 	defer func() {
 		if cmd.Process != nil {
-			log.Debugf("releasing watcher %v", cmd.Process.Pid)
+			log.Infof("releasing watcher %v", cmd.Process.Pid)
 			_ = cmd.Process.Release()
 		}
 	}()
 
-	log.Debugw("Starting upgrade watcher", "path", cmd.Path, "args", cmd.Args, "env", cmd.Env, "dir", cmd.Dir)
-	return cmd.Start()
+	log.Infow("Starting upgrade watcher", "path", cmd.Path, "args", cmd.Args, "env", cmd.Env, "dir", cmd.Dir)
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("failed to start Upgrade Watcher: %w", err)
+	}
+
+	upgradeWatcherPID := cmd.Process.Pid
+	agentPID := os.Getpid()
+	log.Infow("Upgrade Watcher invoked", "agent.upgrade.watcher.process.pid", upgradeWatcherPID, "agent.process.pid", agentPID)
+
+	return nil
 }
 
 func restartAgent(ctx context.Context, log *logger.Logger) error {
diff --git a/internal/pkg/agent/application/upgrade/step_download.go b/internal/pkg/agent/application/upgrade/step_download.go
index 9de9f9ffe13..a1f3bd79ca2 100644
--- a/internal/pkg/agent/application/upgrade/step_download.go
+++ b/internal/pkg/agent/application/upgrade/step_download.go
@@ -54,7 +54,7 @@ func (u *Upgrader) downloadArtifact(ctx context.Context, version, sourceURI stri
 		}
 	}
 
-	u.log.Debugw("Downloading upgrade artifact", "version", version,
+	u.log.Infow("Downloading upgrade artifact", "version", version,
 		"source_uri", settings.SourceURI, "drop_path", settings.DropPath,
 		"target_path", settings.TargetDirectory, "install_path", settings.InstallPath)
 
@@ -162,7 +162,7 @@ func (u *Upgrader) downloadWithRetries(
 
 	opFn := func() error {
 		attempt++
-		u.log.Debugf("download attempt %d", attempt)
+		u.log.Infof("download attempt %d", attempt)
 
 		downloader, err := downloaderCtor(version, u.log, settings)
 		if err != nil {
diff --git a/internal/pkg/agent/application/upgrade/step_mark.go b/internal/pkg/agent/application/upgrade/step_mark.go
index fa337e3907a..0e9cf0bd92a 100644
--- a/internal/pkg/agent/application/upgrade/step_mark.go
+++ b/internal/pkg/agent/application/upgrade/step_mark.go
@@ -139,7 +139,7 @@ func UpdateActiveCommit(log *logger.Logger, hash string) error {
 // CleanMarker removes a marker from disk.
 func CleanMarker(log *logger.Logger) error {
 	markerFile := markerFilePath()
-	log.Debugw("Removing marker file", "file.path", markerFile)
+	log.Infow("Removing marker file", "file.path", markerFile)
 	if err := os.Remove(markerFile); !os.IsNotExist(err) {
 		return err
 	}
diff --git a/internal/pkg/agent/application/upgrade/upgrade.go b/internal/pkg/agent/application/upgrade/upgrade.go
index 13c787ab592..e653cf54525 100644
--- a/internal/pkg/agent/application/upgrade/upgrade.go
+++ b/internal/pkg/agent/application/upgrade/upgrade.go
@@ -11,11 +11,11 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/elastic/elastic-agent/internal/pkg/config"
-
 	"github.com/otiai10/copy"
 	"go.elastic.co/apm"
 
+	"github.com/elastic/elastic-agent/internal/pkg/config"
+
 	"github.com/elastic/elastic-agent/internal/pkg/agent/application/info"
 	"github.com/elastic/elastic-agent/internal/pkg/agent/application/paths"
 	"github.com/elastic/elastic-agent/internal/pkg/agent/application/reexec"
@@ -172,7 +172,7 @@ func (u *Upgrader) Upgrade(ctx context.Context, version string, sourceURI string
 	cb := shutdownCallback(u.log, paths.Home(), release.Version(), version, release.TrimCommit(newHash))
 
 	// Clean everything from the downloads dir
-	u.log.Debugw("Removing downloads directory", "file.path", paths.Downloads())
+	u.log.Infow("Removing downloads directory", "file.path", paths.Downloads())
 	err = os.RemoveAll(paths.Downloads())
 	if err != nil {
 		u.log.Errorw("Unable to clean downloads after update", "error.message", err, "file.path", paths.Downloads())
@@ -231,11 +231,11 @@ func copyActionStore(log *logger.Logger, newHash string) error {
 	// copies legacy action_store.yml, state.yml and state.enc encrypted file if exists
 	storePaths := []string{paths.AgentActionStoreFile(), paths.AgentStateStoreYmlFile(), paths.AgentStateStoreFile()}
 	newHome := filepath.Join(filepath.Dir(paths.Home()), fmt.Sprintf("%s-%s", agentName, newHash))
-	log.Debugw("Copying action store", "new_home_path", newHome)
+	log.Infow("Copying action store", "new_home_path", newHome)
 
 	for _, currentActionStorePath := range storePaths {
 		newActionStorePath := filepath.Join(newHome, filepath.Base(currentActionStorePath))
-		log.Debugw("Copying action store path", "from", currentActionStorePath, "to", newActionStorePath)
+		log.Infow("Copying action store path", "from", currentActionStorePath, "to", newActionStorePath)
 		currentActionStore, err := os.ReadFile(currentActionStorePath)
 		if os.IsNotExist(err) {
 			// nothing to copy
@@ -266,7 +266,7 @@ func copyRunDirectory(log *logger.Logger, newHash string) error {
 	err := copyDir(log, oldRunPath, newRunPath, true)
 	if os.IsNotExist(err) {
 		// nothing to copy, operation ok
-		log.Debugw("Run directory not present", "old_run_path", oldRunPath)
+		log.Infow("Run directory not present", "old_run_path", oldRunPath)
 		return nil
 	}
 	if err != nil {
diff --git a/internal/pkg/agent/cmd/run.go b/internal/pkg/agent/cmd/run.go
index c5cc9f4b315..2ab23dae7c2 100644
--- a/internal/pkg/agent/cmd/run.go
+++ b/internal/pkg/agent/cmd/run.go
@@ -151,6 +151,8 @@ func run(override cfgOverrider, testingMode bool, fleetInitTimeout time.Duration
 		"source": agentName,
 	})
 
+	l.Infow("Elastic Agent started", "process.pid", os.Getpid(), "agent.version", version.GetAgentPackageVersion())
+
 	cfg, err = tryDelayEnroll(ctx, l, cfg, override)
 	if err != nil {
 		err = errors.New(err, "failed to perform delayed enrollment")
diff --git a/internal/pkg/agent/cmd/watch.go b/internal/pkg/agent/cmd/watch.go
index 23009a3366b..f475cf85669 100644
--- a/internal/pkg/agent/cmd/watch.go
+++ b/internal/pkg/agent/cmd/watch.go
@@ -13,6 +13,8 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/elastic/elastic-agent/version"
+
 	"github.com/elastic/elastic-agent/internal/pkg/config"
 
 	"github.com/spf13/cobra"
@@ -62,6 +64,7 @@ func newWatchCommandWithArgs(_ []string, streams *cli.IOStreams) *cobra.Command
 }
 
 func watchCmd(log *logp.Logger, cfg *configuration.Configuration) error {
+	log.Infow("Upgrade Watcher started", "process.pid", os.Getpid(), "agent.version", version.GetAgentPackageVersion())
 	marker, err := upgrade.LoadMarker()
 	if err != nil {
 		log.Error("failed to load marker", err)
@@ -69,14 +72,14 @@ func watchCmd(log *logp.Logger, cfg *configuration.Configuration) error {
 	}
 	if marker == nil {
 		// no marker found we're not in upgrade process
-		log.Debugf("update marker not present at '%s'", paths.Data())
+		log.Infof("update marker not present at '%s'", paths.Data())
 		return nil
 	}
 
 	locker := filelock.NewAppLocker(paths.Top(), watcherLockFile)
 	if err := locker.TryLock(); err != nil {
 		if errors.Is(err, filelock.ErrAppAlreadyRunning) {
-			log.Debugf("exiting, lock already exists")
+			log.Info("exiting, lock already exists")
 			return nil
 		}
 
@@ -89,7 +92,7 @@ func watchCmd(log *logp.Logger, cfg *configuration.Configuration) error {
 
 	isWithinGrace, tilGrace := gracePeriod(marker, cfg.Settings.Upgrade.Watcher.GracePeriod)
 	if !isWithinGrace {
-		log.Debugf("not within grace [updatedOn %v] %v", marker.UpdatedOn.String(), time.Since(marker.UpdatedOn).String())
+		log.Infof("not within grace [updatedOn %v] %v", marker.UpdatedOn.String(), time.Since(marker.UpdatedOn).String())
 		// if it is started outside of upgrade loop
 		// if we're not within grace and marker is still there it might mean
 		// that cleanup was not performed ok, cleanup everything except current version
diff --git a/internal/pkg/agent/install/testblocking/main.go b/internal/pkg/agent/install/testblocking/main.go
new file mode 100644
index 00000000000..adbd771d22d
--- /dev/null
+++ b/internal/pkg/agent/install/testblocking/main.go
@@ -0,0 +1,15 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package main
+
+import (
+	"math"
+	"time"
+)
+
+// Simple program that blocks forever to ensure exes running from a directory on Windows can be removed during uninstall.
+func main() {
+	<-time.After(time.Duration(math.MaxInt64))
+}
diff --git a/internal/pkg/agent/install/uninstall.go b/internal/pkg/agent/install/uninstall.go
index 9ca81cbfa6e..0d34f990bf5 100644
--- a/internal/pkg/agent/install/uninstall.go
+++ b/internal/pkg/agent/install/uninstall.go
@@ -118,27 +118,23 @@ func Uninstall(cfgFile, topPath, uninstallToken string, pt ProgressTrackerStep)
 func RemovePath(path string) error {
 	const arbitraryTimeout = 5 * time.Second
 	start := time.Now()
-	nextSleep := 1 * time.Millisecond
-	for {
-		err := os.RemoveAll(path)
-		if err == nil {
-			return nil
-		}
-		if isBlockingOnExe(err) {
-			// try to remove the blocking exe
-			err = removeBlockingExe(err)
-		}
-		if err == nil {
-			return nil
-		}
-		if !isRetryableError(err) {
-			return err
+	var lastErr error
+	for time.Since(start) <= arbitraryTimeout {
+		lastErr = os.RemoveAll(path)
+
+		if lastErr == nil || !isRetryableError(lastErr) {
+			return lastErr
 		}
 
-		if d := time.Since(start) + nextSleep; d >= arbitraryTimeout {
-			return err
+		if isBlockingOnExe(lastErr) {
+			// try to remove the blocking exe and try again to clean up the path
+			_ = removeBlockingExe(lastErr)
 		}
+
+		time.Sleep(50 * time.Millisecond)
 	}
+
+	return fmt.Errorf("timed out while removing %q. Last error: %w", path, lastErr)
 }
 
 func RemoveBut(path string, bestEffort bool, exceptions ...string) error {
diff --git a/internal/pkg/agent/install/uninstall_windows_test.go b/internal/pkg/agent/install/uninstall_windows_test.go
index 31812988b68..a3a9f3a914f 100644
--- a/internal/pkg/agent/install/uninstall_windows_test.go
+++ b/internal/pkg/agent/install/uninstall_windows_test.go
@@ -7,42 +7,41 @@
 package install
 
 import (
+	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"testing"
 
+	"github.com/otiai10/copy"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-const simpleBlockForever = `
-package main
-
-import (
-    "math"
-    "time"
-)
-
-func main() {
-    <-time.After(time.Duration(math.MaxInt64))
-}
-`
-
 func TestRemovePath(t *testing.T) {
-	dir := filepath.Join(t.TempDir(), "subdir")
-	err := os.Mkdir(dir, 0644)
+	var (
+		pkgName    = "testblocking"
+		binaryName = pkgName + ".exe"
+	)
+
+	// Create a temporary directory that we can safely remove. The directory is created as a new
+	// sub-directory. This avoids having Microsoft Defender quarantine the file if it is exec'd from
+	// the default temporary directory.
+	destDir, err := os.MkdirTemp(pkgName, t.Name())
 	require.NoError(t, err)
 
-	src := filepath.Join(dir, "main.go")
-	err = os.WriteFile(src, []byte(simpleBlockForever), 0644)
-	require.NoError(t, err)
+	// Copy the test executable to the new temporary directory.
+	destpath, err := filepath.Abs(filepath.Join(destDir, binaryName))
+	require.NoErrorf(t, err, "failed dest abs %s + %s", destDir, binaryName)
 
-	binary := filepath.Join(dir, "main.exe")
-	cmd := exec.Command("go", "build", "-o", binary, src)
-	_, err = cmd.CombinedOutput()
+	srcPath, err := filepath.Abs(filepath.Join(pkgName, binaryName))
+	require.NoErrorf(t, err, "failed src abs %s + %s", pkgName, binaryName)
+
+	err = copy.Copy(srcPath, destpath, copy.Options{Sync: true})
 	require.NoError(t, err)
 
-	cmd = exec.Command(binary)
+	// Execute the test executable asynchronously.
+	cmd := exec.Command(destpath)
 	err = cmd.Start()
 	require.NoError(t, err)
 	defer func() {
@@ -50,6 +49,9 @@ func TestRemovePath(t *testing.T) {
 		_ = cmd.Wait()
 	}()
 
-	err = RemovePath(dir)
-	require.NoError(t, err)
+	// Ensure the directory containing the executable can be removed.
+	err = RemovePath(destDir)
+	assert.NoError(t, err)
+	_, err = os.Stat(destDir)
+	assert.ErrorIsf(t, err, fs.ErrNotExist, "path %q still exists after removal", destDir)
 }
diff --git a/magefile.go b/magefile.go
index 91d8167d224..3d0e6de1e9e 100644
--- a/magefile.go
+++ b/magefile.go
@@ -256,16 +256,19 @@ func (Build) Clean() {
 // TestBinaries build the required binaries for the test suite.
 func (Build) TestBinaries() error {
 	wd, _ := os.Getwd()
-	p := filepath.Join(wd, "pkg", "component", "fake")
-	for _, name := range []string{"component", "shipper"} {
-		binary := name
+	testBinaryPkgs := []string{
+		filepath.Join(wd, "pkg", "component", "fake", "component"),
+		filepath.Join(wd, "pkg", "component", "fake", "shipper"),
+		filepath.Join(wd, "internal", "pkg", "agent", "install", "testblocking"),
+	}
+	for _, pkg := range testBinaryPkgs {
+		binary := filepath.Base(pkg)
 		if runtime.GOOS == "windows" {
 			binary += ".exe"
 		}
 
-		fakeDir := filepath.Join(p, name)
-		outputName := filepath.Join(fakeDir, binary)
-		err := RunGo("build", "-o", outputName, filepath.Join(fakeDir))
+		outputName := filepath.Join(pkg, binary)
+		err := RunGo("build", "-o", outputName, filepath.Join(pkg))
 		if err != nil {
 			return err
 		}
diff --git a/pkg/testing/tools/agents.go b/pkg/testing/tools/agents.go
index 1bb6eda9cd4..f7ca5c33270 100644
--- a/pkg/testing/tools/agents.go
+++ b/pkg/testing/tools/agents.go
@@ -19,30 +19,41 @@ import (
 	"github.com/elastic/elastic-agent/pkg/control/v2/cproto"
 )
 
-// GetAgentByHostnameFromList get an agent by the local_metadata.host.name property, reading from the agents list
-func GetAgentByHostnameFromList(client *kibana.Client, hostname string) (*kibana.AgentExisting, error) {
+// GetAgentByPolicyIDAndHostnameFromList get an agent by the local_metadata.host.name property, reading from the agents list
+func GetAgentByPolicyIDAndHostnameFromList(client *kibana.Client, policyID, hostname string) (*kibana.AgentExisting, error) {
 	listAgentsResp, err := client.ListAgents(context.Background(), kibana.ListAgentsRequest{})
 	if err != nil {
 		return nil, err
 	}
 
-	for _, item := range listAgentsResp.Items {
+	hostnameAgents := make([]*kibana.AgentExisting, 0)
+	for i, item := range listAgentsResp.Items {
 		agentHostname := item.LocalMetadata.Host.Hostname
-		if agentHostname == hostname {
-			return &item, nil
+		agentPolicyID := item.PolicyID
+
+		if agentHostname == hostname && agentPolicyID == policyID {
+			hostnameAgents = append(hostnameAgents, &listAgentsResp.Items[i])
 		}
 	}
 
-	return nil, fmt.Errorf("unable to find agent with hostname [%s]", hostname)
+	if len(hostnameAgents) == 0 {
+		return nil, fmt.Errorf("unable to find agent with hostname [%s]", hostname)
+	}
+
+	if len(hostnameAgents) > 1 {
+		return nil, fmt.Errorf("found %d agents with hostname [%s]; expected to find only one", len(hostnameAgents), hostname)
+	}
+
+	return hostnameAgents[0], nil
 }
 
-func GetAgentStatus(client *kibana.Client) (string, error) {
+func GetAgentStatus(client *kibana.Client, policyID string) (string, error) {
 	hostname, err := os.Hostname()
 	if err != nil {
 		return "", err
 	}
 
-	agent, err := GetAgentByHostnameFromList(client, hostname)
+	agent, err := GetAgentByPolicyIDAndHostnameFromList(client, policyID, hostname)
 	if err != nil {
 		return "", err
 	}
@@ -50,13 +61,13 @@ func GetAgentStatus(client *kibana.Client) (string, error) {
 	return agent.Status, nil
 }
 
-func GetAgentVersion(client *kibana.Client) (string, error) {
+func GetAgentVersion(client *kibana.Client, policyID string) (string, error) {
 	hostname, err := os.Hostname()
 	if err != nil {
 		return "", err
 	}
 
-	agent, err := GetAgentByHostnameFromList(client, hostname)
+	agent, err := GetAgentByPolicyIDAndHostnameFromList(client, policyID, hostname)
 	if err != nil {
 		return "", err
 	}
@@ -64,12 +75,12 @@ func GetAgentVersion(client *kibana.Client) (string, error) {
 	return agent.Agent.Version, err
 }
 
-func UnEnrollAgent(client *kibana.Client) error {
+func UnEnrollAgent(client *kibana.Client, policyID string) error {
 	hostname, err := os.Hostname()
 	if err != nil {
 		return err
 	}
-	agentID, err := GetAgentIDByHostname(client, hostname)
+	agentID, err := GetAgentIDByHostname(client, policyID, hostname)
 	if err != nil {
 		return err
 	}
@@ -86,20 +97,20 @@ func UnEnrollAgent(client *kibana.Client) error {
 	return nil
 }
 
-func GetAgentIDByHostname(client *kibana.Client, hostname string) (string, error) {
-	agent, err := GetAgentByHostnameFromList(client, hostname)
+func GetAgentIDByHostname(client *kibana.Client, policyID, hostname string) (string, error) {
+	agent, err := GetAgentByPolicyIDAndHostnameFromList(client, policyID, hostname)
 	if err != nil {
 		return "", err
 	}
 	return agent.Agent.ID, nil
 }
 
-func UpgradeAgent(client *kibana.Client, version string) error {
+func UpgradeAgent(client *kibana.Client, policyID, version string) error {
 	hostname, err := os.Hostname()
 	if err != nil {
 		return err
 	}
-	agentID, err := GetAgentIDByHostname(client, hostname)
+	agentID, err := GetAgentIDByHostname(client, policyID, hostname)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/testing/tools/tools.go b/pkg/testing/tools/tools.go
index 7b125293eb6..4ac8c930e66 100644
--- a/pkg/testing/tools/tools.go
+++ b/pkg/testing/tools/tools.go
@@ -19,9 +19,9 @@ import (
 // WaitForAgentStatus returns a niladic function that returns true if the agent
 // has reached expectedStatus; false otherwise. The returned function is intended
 // for use with assert.Eventually or require.Eventually.
-func WaitForAgentStatus(t *testing.T, client *kibana.Client, expectedStatus string) func() bool {
+func WaitForAgentStatus(t *testing.T, client *kibana.Client, policyID string, expectedStatus string) func() bool {
 	return func() bool {
-		currentStatus, err := GetAgentStatus(client)
+		currentStatus, err := GetAgentStatus(client, policyID)
 		if err != nil {
 			t.Errorf("unable to determine agent status: %s", err.Error())
 			return false
@@ -128,14 +128,14 @@ func InstallAgentForPolicy(t *testing.T, ctx context.Context,
 	}
 	t.Logf(">>> Ran Enroll. Output: %s", output)
 
-	timeout := 5 * time.Minute
+	timeout := 10 * time.Minute
 	if deadline, ok := ctx.Deadline(); ok {
 		timeout = time.Until(deadline)
 	}
 	// Wait for Agent to be healthy
 	require.Eventually(
 		t,
-		WaitForAgentStatus(t, kibClient, "online"),
+		WaitForAgentStatus(t, kibClient, policyID, "online"),
 		timeout,
 		10*time.Second,
 		"Elastic Agent status is not online",
diff --git a/testing/integration/endpoint_security_test.go b/testing/integration/endpoint_security_test.go
index bb77f724e52..9304901047f 100644
--- a/testing/integration/endpoint_security_test.go
+++ b/testing/integration/endpoint_security_test.go
@@ -19,6 +19,7 @@ import (
 	"text/template"
 	"time"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/google/uuid"
@@ -135,6 +136,11 @@ func testInstallAndCLIUninstallWithEndpointSecurity(t *testing.T, info *define.I
 		installOpts, fixture, info.KibanaClient, createPolicyReq)
 	require.NoError(t, err, "failed to install agent with policy")
 
+	t.Cleanup(func() {
+		t.Log("Un-enrolling Elastic Agent...")
+		assert.NoError(t, tools.UnEnrollAgent(info.KibanaClient, policy.ID))
+	})
+
 	t.Log("Installing Elastic Defend")
 	pkgPolicyResp, err := installElasticDefendPackage(t, info, policy.ID)
 	require.NoErrorf(t, err, "Policy Response was: %v", pkgPolicyResp)
@@ -238,7 +244,7 @@ func testInstallAndUnenrollWithEndpointSecurity(t *testing.T, info *define.Info,
 	hostname, err := os.Hostname()
 	require.NoError(t, err)
 
-	agentID, err := tools.GetAgentIDByHostname(info.KibanaClient, hostname)
+	agentID, err := tools.GetAgentIDByHostname(info.KibanaClient, policy.ID, hostname)
 	require.NoError(t, err)
 
 	_, err = info.KibanaClient.UnEnrollAgent(ctx, kibana.UnEnrollAgentRequest{ID: agentID})
diff --git a/testing/integration/fqdn_test.go b/testing/integration/fqdn_test.go
index b280f1e6e5b..2fb76a6028c 100644
--- a/testing/integration/fqdn_test.go
+++ b/testing/integration/fqdn_test.go
@@ -56,19 +56,6 @@ func TestFQDN(t *testing.T) {
 	origHostname, err := getHostname(context.Background())
 	require.NoError(t, err)
 
-	t.Cleanup(func() {
-		t.Log("Un-enrolling Elastic Agent...")
-		assert.NoError(t, tools.UnEnrollAgent(info.KibanaClient))
-
-		t.Log("Restoring hostname...")
-		err := setHostname(context.Background(), origHostname, t.Log)
-		require.NoError(t, err)
-
-		t.Log("Restoring original /etc/hosts...")
-		err = setEtcHosts(origEtcHosts)
-		require.NoError(t, err)
-	})
-
 	ctx := context.Background()
 	kibClient := info.KibanaClient
 
@@ -101,8 +88,21 @@ func TestFQDN(t *testing.T) {
 	policy, err := tools.InstallAgentWithPolicy(t, ctx, installOpts, agentFixture, kibClient, createPolicyReq)
 	require.NoError(t, err)
 
+	t.Cleanup(func() {
+		t.Log("Un-enrolling Elastic Agent...")
+		assert.NoError(t, tools.UnEnrollAgent(info.KibanaClient, policy.ID))
+
+		t.Log("Restoring hostname...")
+		err := setHostname(context.Background(), origHostname, t.Log)
+		require.NoError(t, err)
+
+		t.Log("Restoring original /etc/hosts...")
+		err = setEtcHosts(origEtcHosts)
+		require.NoError(t, err)
+	})
+
 	t.Log("Verify that agent name is short hostname")
-	agent := verifyAgentName(t, shortName, info.KibanaClient)
+	agent := verifyAgentName(t, policy.ID, shortName, info.KibanaClient)
 
 	t.Log("Verify that hostname in `logs-*` and `metrics-*` is short hostname")
 	verifyHostNameInIndices(t, "logs-*", shortName, info.Namespace, info.ESClient)
@@ -133,7 +133,7 @@ func TestFQDN(t *testing.T) {
 	)
 
 	t.Log("Verify that agent name is FQDN")
-	verifyAgentName(t, fqdn, info.KibanaClient)
+	verifyAgentName(t, policy.ID, fqdn, info.KibanaClient)
 
 	t.Log("Verify that hostname in `logs-*` and `metrics-*` is FQDN")
 	verifyHostNameInIndices(t, "logs-*", fqdn, info.Namespace, info.ESClient)
@@ -164,7 +164,7 @@ func TestFQDN(t *testing.T) {
 	)
 
 	t.Log("Verify that agent name is short hostname again")
-	verifyAgentName(t, shortName, info.KibanaClient)
+	verifyAgentName(t, policy.ID, shortName, info.KibanaClient)
 
 	// TODO: Re-enable assertion once https://github.com/elastic/elastic-agent/issues/3078 is
 	// investigated for root cause and resolved.
@@ -173,7 +173,7 @@ func TestFQDN(t *testing.T) {
 	// verifyHostNameInIndices(t, "metrics-*", shortName, info.ESClient)
 }
 
-func verifyAgentName(t *testing.T, hostname string, kibClient *kibana.Client) *kibana.AgentExisting {
+func verifyAgentName(t *testing.T, policyID, hostname string, kibClient *kibana.Client) *kibana.AgentExisting {
 	t.Helper()
 
 	var agent *kibana.AgentExisting
@@ -182,7 +182,7 @@ func verifyAgentName(t *testing.T, hostname string, kibClient *kibana.Client) *k
 	require.Eventually(
 		t,
 		func() bool {
-			agent, err = tools.GetAgentByHostnameFromList(kibClient, hostname)
+			agent, err = tools.GetAgentByPolicyIDAndHostnameFromList(kibClient, policyID, hostname)
 			return err == nil && agent != nil
 		},
 		5*time.Minute,
diff --git a/testing/integration/monitoring_logs_test.go b/testing/integration/monitoring_logs_test.go
index 368462ed92b..607fe0c9b8d 100644
--- a/testing/integration/monitoring_logs_test.go
+++ b/testing/integration/monitoring_logs_test.go
@@ -114,7 +114,7 @@ func TestMonitoringLogsShipped(t *testing.T) {
 		t.Fatalf("could not get hostname to filter Agent: %s", err)
 	}
 
-	agentID, err := tools.GetAgentIDByHostname(info.KibanaClient, hostname)
+	agentID, err := tools.GetAgentIDByHostname(info.KibanaClient, policy.ID, hostname)
 	require.NoError(t, err, "could not get Agent ID by hostname")
 	t.Logf("Agent ID: %q", agentID)
 
diff --git a/testing/integration/upgrade_test.go b/testing/integration/upgrade_test.go
index 8d18b70e2b0..ba27f634744 100644
--- a/testing/integration/upgrade_test.go
+++ b/testing/integration/upgrade_test.go
@@ -149,18 +149,18 @@ func testUpgradeFleetManagedElasticAgent(t *testing.T, ctx context.Context, info
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		t.Log("Un-enrolling Elastic Agent...")
-		assert.NoError(t, tools.UnEnrollAgent(info.KibanaClient))
+		assert.NoError(t, tools.UnEnrollAgent(info.KibanaClient, policy.ID))
 	})
 
 	t.Log(`Waiting for enrolled Agent status to be "online"...`)
-	require.Eventually(t, tools.WaitForAgentStatus(t, kibClient, "online"), 2*time.Minute, 10*time.Second, "Agent status is not online")
+	require.Eventually(t, tools.WaitForAgentStatus(t, kibClient, policy.ID, "online"), 2*time.Minute, 10*time.Second, "Agent status is not online")
 
 	t.Logf("Upgrade Elastic Agent to version %s...", toVersion)
-	err = tools.UpgradeAgent(kibClient, toVersion)
+	err = tools.UpgradeAgent(kibClient, policy.ID, toVersion)
 	require.NoError(t, err)
 
 	t.Log(`Waiting for enrolled Agent status to be "online"...`)
-	require.Eventually(t, tools.WaitForAgentStatus(t, kibClient, "online"), 10*time.Minute, 15*time.Second, "Agent status is not online")
+	require.Eventually(t, tools.WaitForAgentStatus(t, kibClient, policy.ID, "online"), 10*time.Minute, 15*time.Second, "Agent status is not online")
 
 	// Upgrade Watcher check disabled until
 	// https://github.com/elastic/elastic-agent/issues/2977 is resolved.
@@ -171,7 +171,7 @@ func testUpgradeFleetManagedElasticAgent(t *testing.T, ctx context.Context, info
 	// version was used as the target version for the upgrade.
 	require.Eventually(t, func() bool {
 		t.Log("Getting Agent version...")
-		newVersion, err := tools.GetAgentVersion(kibClient)
+		newVersion, err := tools.GetAgentVersion(kibClient, policy.ID)
 		if err != nil {
 			t.Logf("error getting agent version: %v", err)
 			return false
diff --git a/version/docs/version.asciidoc b/version/docs/version.asciidoc
index 9eec013b4ed..fd0e915eae0 100644
--- a/version/docs/version.asciidoc
+++ b/version/docs/version.asciidoc
@@ -3,7 +3,7 @@
 // FIXME: once elastic.co docs have been switched over to use `main`, remove
 // the `doc-site-branch` line below as well as any references to it in the code.
 :doc-site-branch: master
-:go-version: 1.20.7
+:go-version: 1.20.8
 :release-state: unreleased
 :python: 3.7
 :docker: 1.12