diff --git a/.github/workflows/garm_e2e.yaml b/.github/workflows/garm_e2e.yaml
index 4b71f3da..c25cb2e4 100644
--- a/.github/workflows/garm_e2e.yaml
+++ b/.github/workflows/garm_e2e.yaml
@@ -531,14 +531,32 @@ jobs:
           ORPHANS=$(openstack server list --long --image "$E2E_RUNNER_IMAGE_NAME" -f json \
             | python3 -c "import json,sys; print('\n'.join(s['ID'] for s in json.load(sys.stdin) if 'garm-controller-id' in (s.get('Properties') or {})))")
 
-          if [ -z "$ORPHANS" ]; then
+          if [ -n "$ORPHANS" ]; then
+            echo "$ORPHANS" | while read -r ID; do
+              echo "Deleting orphaned runner ${ID}"
+              openstack server delete --wait "$ID" || echo "::warning::Could not delete ${ID}"
+            done
+          else
             echo "No runners left on the tenant."
+          fi
+
+          # Each run's configurator manages its own garm-<label> security group and, by
+          # design, never deletes it. With the runners gone it has no ports, so sweep it
+          # here: the tenant belongs to this suite and runs are serialised, so the prefix
+          # cannot match another run's group.
+          # Matched on the scale-set label pattern (garm-e2e-<digest>, from _e2e_label)
+          # so the relay's own garm-e2e-relay-<run> group is left to the step below.
+          MANAGED=$(openstack security group list -f json \
+            | python3 -c "import json,re,sys; print('\n'.join(g['Name'] for g in json.load(sys.stdin) if re.fullmatch(r'garm-e2e-[0-9a-f]{6}', g.get('Name') or '')))")
+
+          if [ -z "$MANAGED" ]; then
+            echo "No managed security groups left on the tenant."
             exit 0
           fi
 
-          echo "$ORPHANS" | while read -r ID; do
-            echo "Deleting orphaned runner ${ID}"
-            openstack server delete --wait "$ID" || echo "::warning::Could not delete ${ID}"
+          echo "$MANAGED" | while read -r NAME; do
+            echo "Deleting managed security group ${NAME}"
+            openstack security group delete "$NAME" || echo "::warning::Could not delete ${NAME}"
           done
 
       - name: Delete the callback relay
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 57acac87..9384eb07 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -258,12 +258,17 @@ through spread. The suite deploys GARM with PostgreSQL and a traefik ingress —
 load-balancer address is what makes GARM's callback and metadata URLs reachable from
 the tenant — waits for a runner VM to register, and dispatches
 `.github/workflows/garm_e2e_test_run.yaml` at the scale set's label; the test passes
-only if that job concludes successfully. The host admits no inbound traffic from the
+only if that job concludes successfully. Before dispatching, it also checks the
+configurator's security group in the tenant directly: that `garm-<label>` admits no
+ingress, and that the runner's port carries that group and no other — the one assertion
+that fails if the group id stops reaching the provider while the rest of the suite stays
+green. The host admits no inbound traffic from the
 tenant, so the workflow boots a relay VM there that the host feeds over a reverse SSH
 tunnel, and runner VMs send their GARM traffic to it; the relay and its security group
 are deleted in an always-run cleanup step. Runners
 left on the tenant are deleted whatever the outcome, matched on the
-`garm-controller-id` GARM stamps on every server it creates.
+`garm-controller-id` GARM stamps on every server it creates, and each run's
+`garm-<label>` security group is swept with them.
 
 It is triggered manually and is **not** a merge gate:
 
diff --git a/charms/garm-configurator/charmcraft.yaml b/charms/garm-configurator/charmcraft.yaml
index dd14772d..aac426d9 100644
--- a/charms/garm-configurator/charmcraft.yaml
+++ b/charms/garm-configurator/charmcraft.yaml
@@ -133,6 +133,24 @@ config:
       description: |
         A Python dict-like string containing key-value pairs of script name
         to bash script to be run prior to runner installation.
+    security-group-rules:
+      type: string
+      default: '[{"direction": "egress", "remote_ip_prefix": "0.0.0.0/0"}, {"direction": "egress", "remote_ip_prefix": "::/0"}]'
+      description: |
+        JSON list of rules for the OpenStack security group this charm manages for the
+        scaleset's runners. The charm keeps the group's rules equal to this list, so a
+        rule added by hand is removed. A rule takes: "direction" (required, "ingress" or
+        "egress"), "protocol" ("tcp", "udp", "icmp", "icmpv6", or "any", default "any"),
+        "port_min"/"port_max" (tcp and udp only), and "remote_ip_prefix" (a CIDR; without
+        one the rule covers every address of its ethertype, IPv4 unless the CIDR is IPv6),
+        for example:
+        [{"direction": "ingress", "protocol": "tcp", "port_min": 22, "remote_ip_prefix": "10.0.0.0/8"}]
+        The default allows all egress and no ingress, which is what a runner needs to reach
+        GitHub. OpenStack attaches this group instead of the project's default group, so a
+        list without an egress rule is rejected. Set an empty list to manage no group, which
+        deletes the group this charm created unless a port still attaches it; removing the
+        application does the same. Requires OpenStack credentials that may create and delete
+        security groups and their rules.
     dockerhub-mirror:
       type: string
       description: |
diff --git a/charms/garm-configurator/src/charm.py b/charms/garm-configurator/src/charm.py
index 99c779b2..2c1cde1f 100755
--- a/charms/garm-configurator/src/charm.py
+++ b/charms/garm-configurator/src/charm.py
@@ -38,6 +38,9 @@ def __init__(self, *args: typing.Any) -> None:
             self.on[IMAGE_RELATION_NAME].relation_joined,
             self.on[IMAGE_RELATION_NAME].relation_changed,
             self.on[IMAGE_RELATION_NAME].relation_broken,
+            # So a blocked unit retries when the OpenStack API comes back, rather than
+            # waiting for an unrelated event.
+            self.on.update_status,
         ]:
             self.framework.observe(event, self._reconcile)
 
@@ -45,9 +48,9 @@ def _reconcile(self, event: ops.EventBase) -> None:
         """Handle all charm events by reconciling configuration and relation data.
 
         Reads the current charm state, forwards OpenStack credentials to the
-        image-builder relation, publishes scaleset configuration (and secrets
-        when the image reference is available) to all garm-configurator relations,
-        then sets unit status to reflect readiness.
+        image-builder relation, reconciles the scaleset's security group, publishes
+        scaleset configuration (and secrets when the image reference is available) to
+        all garm-configurator relations, then sets unit status to reflect readiness.
 
         Args:
             event: The triggering event.
@@ -62,7 +65,7 @@ def _reconcile(self, event: ops.EventBase) -> None:
             return
 
         self._update_image_relation(state)
-        self._configure_garm_relation(state)
+        self._configure_garm_relation(state=state)
 
         if state.image_overrides_builder:
             self.unit.status = ops.ActiveStatus("Ready; configured image overrides image builder")
@@ -134,7 +137,8 @@ def _configure_garm_relation(self, state: CharmState) -> None:
 
         Writes non-secret scaleset fields (name, provider, credentials, image,
         image visibility, flavor, arch, runner counts, labels, runner group,
-        remote-shell toggle, and pre-install scripts) to the relation. The ``image_id`` wire field
+        remote-shell toggle, pre-install scripts, and the security group rules the GARM
+        charm applies for this scale set) to the relation. The ``image_id`` wire field
         carries either an OpenStack image name or ID for compatibility.
         The optional ``org`` and ``repo`` fields are included only when set.
 
@@ -156,6 +160,7 @@ def _configure_garm_relation(self, state: CharmState) -> None:
 
         pre_install = state.scaleset_config.pre_install_scripts
         rc = state.runner_config
+        rules = state.scaleset_config.security_group_rules
         basic_data: dict[str, str] = {
             "name": state.scaleset_config.name,
             "provider_name": state.provider_config.provider_name,
@@ -177,6 +182,9 @@ def _configure_garm_relation(self, state: CharmState) -> None:
             "aproxy_redirect_ports": rc.aproxy_redirect_ports or "",
             "otel_collector_endpoint": rc.otel_collector_endpoint or "",
             "pre_job_script": rc.pre_job_script or "",
+            # An empty list publishes "[]": the GARM charm then attaches no group and removes
+            # the one it created, which is the opt-out.
+            "security_group_rules": json.dumps([rule.model_dump() for rule in rules]),
         }
         if state.scaleset_config.org:
             basic_data["org"] = state.scaleset_config.org
diff --git a/charms/garm-configurator/src/charm_state.py b/charms/garm-configurator/src/charm_state.py
index f8b987dd..a4d07e14 100644
--- a/charms/garm-configurator/src/charm_state.py
+++ b/charms/garm-configurator/src/charm_state.py
@@ -4,10 +4,13 @@
 """State of the GARM configurator charm."""
 
 import ipaddress
+import json
+from typing import Literal
 
 import ops
 from pydantic import (
     BaseModel,
+    ConfigDict,
     HttpUrl,
     TypeAdapter,
     ValidationError,
@@ -42,6 +45,7 @@
 SCALESET_RUNNER_GROUP_CONFIG_NAME = "runner-group"
 SCALESET_ENABLE_SHELL_CONFIG_NAME = "enable-shell"
 SCALESET_PRE_INSTALL_SCRIPTS_CONFIG_NAME = "pre-install-scripts"
+SCALESET_SECURITY_GROUP_RULES_CONFIG_NAME = "security-group-rules"
 
 DOCKERHUB_MIRROR_CONFIG_NAME = "dockerhub-mirror"
 RUNNER_HTTP_PROXY_CONFIG_NAME = "runner-http-proxy"
@@ -218,6 +222,74 @@ def from_charm(cls, charm: ops.CharmBase) -> "GithubAppConfig":
         )
 
 
+class SecurityGroupRule(BaseModel):
+    """One rule of the OpenStack security group the charm manages for a scaleset.
+
+    Attributes:
+        direction: Whether the rule admits ingress or egress traffic.
+        protocol: Transport protocol the rule applies to, or "any" for every protocol.
+        port_min: First port of the range, or None to cover every port.
+        port_max: Last port of the range, or None to cover only port_min.
+        remote_ip_prefix: CIDR the rule applies to, or None to cover every address.
+    """
+
+    # An unknown key is rejected rather than dropped: a misspelt ``remote_ip_prefix``
+    # would otherwise silently widen the rule to every address.
+    model_config = ConfigDict(extra="forbid")
+
+    direction: Literal["ingress", "egress"]
+    protocol: Literal["tcp", "udp", "icmp", "icmpv6", "any"] = "any"
+    port_min: int | None = None
+    port_max: int | None = None
+    remote_ip_prefix: str | None = None
+
+    @field_validator("remote_ip_prefix")
+    @classmethod
+    def _validate_cidr(cls, value: str | None) -> str | None:
+        """Require a CIDR, normalised to the network address Neutron expects."""
+        if value is None:
+            return None
+        try:
+            # strict, because Neutron rejects a prefix with host bits set; a bare
+            # address is read as a single-host network.
+            return str(ipaddress.ip_network(value.strip(), strict=True))
+        except ValueError as exc:
+            raise ValueError(
+                f"must be a CIDR such as 10.0.0.0/8, 192.0.2.1/32, or ::/0; got {value!r}"
+            ) from exc
+
+    @model_validator(mode="after")
+    def _validate_icmp_ethertype(self) -> "SecurityGroupRule":
+        """Reject the protocol and ethertype pairings Neutron refuses."""
+        # A rule with no prefix is IPv4, because only an IPv6 prefix names its ethertype.
+        ipv6 = bool(self.remote_ip_prefix and ":" in self.remote_ip_prefix)
+        if self.protocol == "icmpv6" and not ipv6:
+            raise ValueError("protocol icmpv6 requires an IPv6 remote_ip_prefix")
+        if self.protocol == "icmp" and ipv6:
+            raise ValueError("protocol icmp requires an IPv4 remote_ip_prefix")
+        return self
+
+    @model_validator(mode="after")
+    def _validate_ports(self) -> "SecurityGroupRule":
+        """Reject a port range the protocol cannot carry, and fill in a single port."""
+        # A range needs a lower bound; Neutron has no "everything up to" form.
+        if self.port_max is not None and self.port_min is None:
+            raise ValueError("port_max requires port_min")
+        if self.port_min is None:
+            return self
+        if self.protocol not in ("tcp", "udp"):
+            raise ValueError(
+                f"port_min and port_max require protocol tcp or udp, not {self.protocol}"
+            )
+        port_max = self.port_min if self.port_max is None else self.port_max
+        if not 1 <= self.port_min <= 65535 or not 1 <= port_max <= 65535:
+            raise ValueError("port_min and port_max must be in 1..65535")
+        if self.port_min > port_max:
+            raise ValueError("port_min must not be greater than port_max")
+        self.port_max = port_max
+        return self
+
+
 class ScalesetConfig(BaseModel):
     """Scaleset configuration.
 
@@ -234,6 +306,8 @@ class ScalesetConfig(BaseModel):
         enable_shell: Whether GARM's remote shell is enabled on the scaleset.
         pre_install_scripts: Script name to bash script pairs for pre-installation.
         image_visibility: Glance visibility the provider searches when resolving an image name.
+        security_group_rules: Rules of the security group the charm manages for the runners,
+            or empty when it manages none.
     """
 
     name: str
@@ -248,6 +322,7 @@ class ScalesetConfig(BaseModel):
     enable_shell: bool = False
     pre_install_scripts: str | None = None
     image_visibility: str | None = None
+    security_group_rules: list[SecurityGroupRule]
 
     @classmethod
     def from_charm(cls, charm: ops.CharmBase) -> "ScalesetConfig":
@@ -329,7 +404,75 @@ def from_charm(cls, charm: ops.CharmBase) -> "ScalesetConfig":
             enable_shell=bool(charm.config.get(SCALESET_ENABLE_SHELL_CONFIG_NAME, False)),
             pre_install_scripts=pre_install_scripts,
             image_visibility=image_visibility,
+            security_group_rules=_parse_security_group_rules(charm),
+        )
+
+
+def _parse_security_group_rules(charm: ops.CharmBase) -> list[SecurityGroupRule]:
+    """Parse the optional security-group-rules JSON document.
+
+    Args:
+        charm: The charm instance.
+
+    Raises:
+        CharmConfigInvalidError: If the value is not a JSON list of valid rules, or lists no
+            egress rule.
+
+    Returns:
+        The parsed rules, empty when the operator opts out of managing a group. The
+        charmcraft default lists all egress, so the group is managed unless it is cleared.
+    """
+    configured = charm.config.get(SCALESET_SECURITY_GROUP_RULES_CONFIG_NAME)
+    if configured is None:
+        # Unset only if the charmcraft default is dropped from the metadata.
+        return []
+    document = str(configured)
+    if not document.strip():
+        # Juju sets an empty string when the option is cleared, which would otherwise read as
+        # the opt-out and silently drop the isolation.
+        raise CharmConfigInvalidError(
+            f"{SCALESET_SECURITY_GROUP_RULES_CONFIG_NAME} cannot be empty; "
+            f"use [] to manage no security group"
         )
+    try:
+        entries = json.loads(document.strip())
+    except json.JSONDecodeError as exc:
+        raise CharmConfigInvalidError(
+            f"{SCALESET_SECURITY_GROUP_RULES_CONFIG_NAME} must be a JSON list of rules"
+        ) from exc
+    if not isinstance(entries, list):
+        raise CharmConfigInvalidError(
+            f"{SCALESET_SECURITY_GROUP_RULES_CONFIG_NAME} must be a JSON list of rules"
+        )
+
+    rules: list[SecurityGroupRule] = []
+    for index, entry in enumerate(entries):
+        try:
+            rules.append(SecurityGroupRule.model_validate(entry))
+        except ValidationError as exc:
+            raise CharmConfigInvalidError(
+                f"{SCALESET_SECURITY_GROUP_RULES_CONFIG_NAME} rule {index}: "
+                f"{_describe_rule_error(exc)}"
+            ) from exc
+    # An empty list is the opt-out: the charm manages no group and the runners keep the
+    # project's default one. A configured group needs egress, though, or it would isolate
+    # the runner from GitHub entirely.
+    if rules and not any(rule.direction == "egress" for rule in rules):
+        raise CharmConfigInvalidError(
+            f"{SCALESET_SECURITY_GROUP_RULES_CONFIG_NAME} needs at least one egress rule: "
+            f"OpenStack attaches this group instead of the project's default group, so a "
+            f"runner with no egress cannot reach GitHub"
+        )
+    return rules
+
+
+def _describe_rule_error(exc: ValidationError) -> str:
+    """Render one rule's first validation error as a single status line."""
+    error = exc.errors()[0]
+    field = ".".join(str(part) for part in error["loc"])
+    # Pydantic prefixes the message of an error raised by a custom validator.
+    message = " ".join(str(error["msg"]).removeprefix("Value error, ").split())
+    return f"{field}: {message}" if field else message
 
 
 def _get_optional_string_config(charm: ops.CharmBase, key: str) -> str | None:
diff --git a/charms/garm-configurator/tests/unit/test_charm.py b/charms/garm-configurator/tests/unit/test_charm.py
index 5fd075e4..dc0410f6 100644
--- a/charms/garm-configurator/tests/unit/test_charm.py
+++ b/charms/garm-configurator/tests/unit/test_charm.py
@@ -321,6 +321,62 @@ def test_clearing_configured_image_without_relation_withdraws_only_image():
             "image-visibility must be one of: public, private, shared, community, all",
             id="invalid-image-visibility",
         ),
+        pytest.param(
+            {"security-group-rules": "not json"},
+            "security-group-rules must be a JSON list of rules",
+            id="security-group-rules-not-json",
+        ),
+        pytest.param(
+            {"security-group-rules": '{"direction": "ingress"}'},
+            "security-group-rules must be a JSON list of rules",
+            id="security-group-rules-not-a-list",
+        ),
+        pytest.param(
+            {"security-group-rules": '[{"direction": "sideways"}]'},
+            "security-group-rules rule 0: direction: Input should be 'ingress' or 'egress'",
+            id="security-group-rules-invalid-direction",
+        ),
+        pytest.param(
+            {
+                "security-group-rules": '[{"direction": "ingress", "protocol": "icmp", "port_min": 22}]'
+            },
+            "security-group-rules rule 0: port_min and port_max require protocol tcp or udp, "
+            "not icmp",
+            id="security-group-rules-ports-on-icmp",
+        ),
+        pytest.param(
+            {"security-group-rules": '[{"direction": "ingress", "remote_prefix": "0.0.0.0/0"}]'},
+            "security-group-rules rule 0: remote_prefix: Extra inputs are not permitted",
+            id="security-group-rules-misspelt-field",
+        ),
+        pytest.param(
+            {
+                "security-group-rules": '[{"direction": "egress", "protocol": "tcp", "port_max": 80}]'
+            },
+            "security-group-rules rule 0: port_max requires port_min",
+            id="security-group-rules-port-max-without-min",
+        ),
+        pytest.param(
+            {"security-group-rules": '[{"direction": "egress", "protocol": "icmpv6"}]'},
+            "security-group-rules rule 0: protocol icmpv6 requires an IPv6 remote_ip_prefix",
+            id="security-group-rules-icmpv6-without-ipv6",
+        ),
+        pytest.param(
+            {
+                "security-group-rules": (
+                    '[{"direction": "egress", "protocol": "icmp", "remote_ip_prefix": "::/0"}]'
+                )
+            },
+            "security-group-rules rule 0: protocol icmp requires an IPv4 remote_ip_prefix",
+            id="security-group-rules-icmp-with-ipv6",
+        ),
+        pytest.param(
+            {"security-group-rules": '[{"direction": "ingress"}]'},
+            "security-group-rules needs at least one egress rule: OpenStack attaches this "
+            "group instead of the project's default group, so a runner with no egress "
+            "cannot reach GitHub",
+            id="security-group-rules-without-egress",
+        ),
     ],
 )
 def test_charm_blocked_invalid_config(config_mutations: dict, expected_message: str):
@@ -1042,3 +1098,99 @@ def test_image_visibility_written_to_garm_configurator_relation(configured, expe
     assert out.get_relation(garm_relation.id).local_unit_data.get("image_visibility", "") == (
         expected
     )
+
+
+def _security_group_rules_config() -> str:
+    """Return a minimal valid security-group-rules document."""
+    return '[{"direction": "ingress", "protocol": "tcp", "port_min": 22}, {"direction": "egress"}]'
+
+
+def test_security_group_rules_are_published_for_garm_to_apply():
+    """
+    arrange: Rules configured for the managed group.
+    act: Run config-changed with a garm-configurator relation present.
+    assert: The relation carries the validated rules, which is what the GARM charm applies to
+        the group it creates; the configurator itself makes no OpenStack call.
+    """
+    ctx = Context(GarmConfiguratorCharm)
+    secret = _make_secret()
+    pk_secret = _make_private_key_secret()
+    config = _valid_config(secret, pk_secret)
+    config["image"] = "runner-noble-amd64"
+    config["security-group-rules"] = _security_group_rules_config()
+    garm_relation = _make_garm_configurator_relation()
+    state = State(
+        config=config,
+        secrets=[secret, pk_secret],
+        relations=[garm_relation],
+        leader=True,
+    )
+
+    out = ctx.run(ctx.on.config_changed(), state)
+
+    published = json.loads(
+        out.get_relation(garm_relation.id).local_unit_data["security_group_rules"]
+    )
+    assert [(rule["direction"], rule["protocol"], rule["port_min"]) for rule in published] == [
+        ("ingress", "tcp", 22),
+        ("egress", "any", None),
+    ]
+
+
+def test_default_rules_are_published_without_configuration():
+    """
+    arrange: No security-group-rules set, so the charmcraft default applies.
+    act: Run config-changed.
+    assert: The default — all egress, no ingress — is published, so a deployment is isolated
+        without the operator writing a rule.
+    """
+    ctx = Context(GarmConfiguratorCharm)
+    secret = _make_secret()
+    pk_secret = _make_private_key_secret()
+    config = _valid_config(secret, pk_secret)
+    config["image"] = "runner-noble-amd64"
+    garm_relation = _make_garm_configurator_relation()
+    state = State(
+        config=config,
+        secrets=[secret, pk_secret],
+        relations=[garm_relation],
+        leader=True,
+    )
+
+    out = ctx.run(ctx.on.config_changed(), state)
+
+    published = json.loads(
+        out.get_relation(garm_relation.id).local_unit_data["security_group_rules"]
+    )
+    assert [(rule["direction"], rule["remote_ip_prefix"]) for rule in published] == [
+        ("egress", "0.0.0.0/0"),
+        ("egress", "::/0"),
+    ]
+
+
+def test_an_empty_rule_list_publishes_no_rules():
+    """
+    arrange: security-group-rules set to an empty list, the documented opt-out.
+    act: Run config-changed.
+    assert: An empty list is published, so the GARM charm attaches no group and removes the one
+        it created, leaving the runners on the project's default group.
+    """
+    ctx = Context(GarmConfiguratorCharm)
+    secret = _make_secret()
+    pk_secret = _make_private_key_secret()
+    config = _valid_config(secret, pk_secret)
+    config["image"] = "runner-noble-amd64"
+    config["security-group-rules"] = "[]"
+    garm_relation = _make_garm_configurator_relation()
+    state = State(
+        config=config,
+        secrets=[secret, pk_secret],
+        relations=[garm_relation],
+        leader=True,
+    )
+
+    out = ctx.run(ctx.on.config_changed(), state)
+
+    assert out.unit_status == ops.ActiveStatus("Ready")
+    published = out.get_relation(garm_relation.id).local_unit_data["security_group_rules"]
+    assert json.loads(published) == []
diff --git a/charms/garm/charmcraft.yaml b/charms/garm/charmcraft.yaml
index 645bcd25..175415d8 100644
--- a/charms/garm/charmcraft.yaml
+++ b/charms/garm/charmcraft.yaml
@@ -25,6 +25,19 @@ description: |
 extensions:
   - go-framework
 
+parts:
+  # The go-framework extension owns the charm part and rejects customising it, but charmcraft
+  # builds requirements.txt with --no-binary=:all: and the build environment carries no OpenSSL
+  # or libffi headers, which the OpenStack SDK's cryptography and cffi dependencies need. A part
+  # of its own installs them into the shared build environment. It must sort before "charm",
+  # which craft-parts orders by part name, or the headers arrive after the build that needs them.
+  build-deps:
+    plugin: nil
+    build-packages:
+      - libssl-dev
+      - libffi-dev
+      - pkg-config
+
 requires:
   postgresql:
     interface: postgresql_client
diff --git a/charms/garm/requirements.txt b/charms/garm/requirements.txt
index aff16150..a309cea3 100644
--- a/charms/garm/requirements.txt
+++ b/charms/garm/requirements.txt
@@ -8,3 +8,5 @@ python-dateutil==2.9.0.post0
 pydantic==2.14.1
 typing-extensions==4.16.0
 owasp-logger==0.1.6
+keystoneauth1==5.18.1
+openstacksdk==4.21.0
diff --git a/charms/garm/src/charm.py b/charms/garm/src/charm.py
index a2c0ed2e..44198f50 100755
--- a/charms/garm/src/charm.py
+++ b/charms/garm/src/charm.py
@@ -17,14 +17,18 @@
 import paas_charm.go
 from paas_charm.app import WorkloadConfig
 from paas_charm.charm_utils import block_if_invalid_data
+from pydantic import ValidationError
 
 from agent_tools import AgentToolsError, ensure_agent_tools
 from charm_state import (
     DEBUG_SSH_INTEGRATION_NAME,
     GARM_CONFIGURATOR_RELATION_NAME,
+    SECURITY_GROUP_RULES_DATABAG_KEY,
     CharmState,
     RunnerConfig,
+    SecurityGroupRule,
     credential_name,
+    parse_security_group_rules,
     resolve_entity,
 )
 from entity_reconciler import EntityReconciler
@@ -38,7 +42,14 @@
     GithubReconciler,
 )
 from resource_cleanup import GarmCleanupError, GarmResourceCleanup
-from scaleset_reconciler import Handover, ScalesetProgress, ScalesetReconciler, ScalesetSpec
+from scaleset_reconciler import (
+    Handover,
+    ScalesetProgress,
+    ScalesetReconciler,
+    ScalesetSpec,
+    _claims_security_group,
+)
+from security_groups import SecurityGroupReconcileError, SecurityGroupReconciler
 from security_log import owasp_log
 
 logger = logging.getLogger(__name__)
@@ -64,6 +75,8 @@
 _PHASE_AWAITING_DELETION: typing.Final[str] = "awaiting deletion"
 
 GARM_CONFIG_VERSION: typing.Final[str] = "1"
+# Juju shows one line, so the cause goes to debug-log.
+_SECURITY_GROUP_STATUS: typing.Final[str] = "Waiting for OpenStack security groups (see debug-log)"
 
 
 def _generate_passphrase(length: int = _DB_PASSPHRASE_LENGTH) -> str:
@@ -183,6 +196,24 @@ def _reconcile(self, _: ops.EventBase) -> None:
         """Reconcile charm state."""
         self.restart()
 
+    def _drain_garm(self, base_url: str, username: str, password: str) -> None:
+        """Drain GARM's resources, then delete the security groups it created.
+
+        Args:
+            base_url: The GARM API base URL.
+            username: GARM administrator username.
+            password: GARM administrator password.
+        """
+        owasp_log.sys_shutdown(
+            userid=username,
+            description="GARM application teardown: draining resources before removal",
+        )
+        auth_client = GarmAuthenticatedClient.from_login(base_url, username, password)
+        GarmResourceCleanup(auth_client).run()
+        # The scale sets and their runners are gone, so their groups can go too.
+        for config in self._get_configurator_provider_configs():
+            SecurityGroupReconciler(provider_config=config, owner=self.app.name).delete()
+
     def _on_remove(self, _: ops.RemoveEvent) -> None:
         """Drain GARM resources before Juju removes the application."""
         if not self.unit.is_leader():
@@ -247,12 +278,7 @@ def _on_remove(self, _: ops.RemoveEvent) -> None:
 
         base_url = GARM_LOCAL_API_BASE_URL
         try:
-            owasp_log.sys_shutdown(
-                userid=username,
-                description="GARM application teardown: draining resources before removal",
-            )
-            auth_client = GarmAuthenticatedClient.from_login(base_url, username, password)
-            GarmResourceCleanup(auth_client).run()
+            self._drain_garm(base_url=base_url, username=username, password=password)
         except GarmApiError as exc:
             logger.error(
                 "GARM removal cleanup failed: %s. Operator action: resolve the "
@@ -658,8 +684,20 @@ def _maybe_first_run(self) -> None:
             logger.warning("GARM first-run check failed (error out for retry): %s", exc)
             raise
 
-    def _build_desired_scalesets(self, template_id: int | None) -> list[ScalesetSpec]:
-        """Build the desired scaleset list from all garm-configurator relation units."""
+    def _build_desired_scalesets(
+        self, template_id: int | None, group_ids: dict[str, str]
+    ) -> list[ScalesetSpec]:
+        """Build the desired scaleset list from all garm-configurator relation units.
+
+        Args:
+            template_id: The charmed runner template each scale set references.
+            group_ids: Per scale set name, the id of its security group. The name is the
+                identity a scale set has across the model, which the scaleset reconciler
+                already relies on.
+
+        Returns:
+            The specs, each carrying its group id when one was ensured.
+        """
         specs = []
         for relation in self.model.relations.get(GARM_CONFIGURATOR_RELATION_NAME, []):
             # Sorted, because `relation.units` is a set: the reconciler's dedupe is
@@ -669,7 +707,12 @@ def _build_desired_scalesets(self, template_id: int | None) -> list[ScalesetSpec
             for unit in sorted(relation.units, key=lambda unit: unit.name):
                 spec = self._build_scaleset_spec(relation.data[unit], template_id)
                 if spec is not None:
-                    specs.append(spec)
+                    specs.append(
+                        dataclasses.replace(
+                            spec,
+                            security_group_id=group_ids.get(spec.name, ""),
+                        )
+                    )
         return specs
 
     @staticmethod
@@ -714,6 +757,9 @@ def _build_scaleset_spec(
             max_runners = int(required["max_runner"])
         except ValueError:
             return None
+        # None when the configurator published nothing this charm can use, which leaves the
+        # scale set claimed but unreconciled: it must not be created without its isolation.
+        security_group_rules = _published_rules(data=data)
         return ScalesetSpec(
             name=name,
             provider_name=required["provider_name"],
@@ -732,8 +778,89 @@ def _build_scaleset_spec(
             template_id=template_id,
             runner_config=RunnerConfig.from_databag(data),
             image_visibility=data.get("image_visibility", "").strip(),
+            security_group_rules=security_group_rules,
         )
 
+    def _ensure_security_groups(self) -> tuple[dict[str, str], str | None]:
+        """Create and converge the security group of every scale set the configurators describe.
+
+        Runs before the scale sets are built, because their ids are part of the desired state. A
+        tenant is reconciled once with the union of its scale sets: groups live in a project, and
+        reconciling one configurator at a time would have each delete the others' groups.
+
+        Returns:
+            Per scale set name, the id of the group ensured for it, and a status message when a
+            group could not be. A scale set left without an id is skipped by the scaleset
+            reconciler rather than created without its isolation.
+        """
+        configs = self._get_configurator_provider_configs()
+        tenant_of = {config["unit_name"]: _tenant_of(config=config) for config in configs}
+        wanted: dict[tuple[str, str], dict[str, list[SecurityGroupRule]]] = {}
+        unusable = False
+        for data in self._configurator_databags():
+            name = data.get("name", "")
+            if not name:
+                continue
+            rules = _published_rules(data=data)
+            if rules is None:
+                unusable = True
+                continue
+            tenant = tenant_of.get(data.get("provider_name", ""))
+            if tenant is not None and rules:
+                wanted.setdefault(tenant, {})[name] = rules
+
+        group_ids: dict[str, str] = {}
+        failed = False
+        for config in configs:
+            tenant = _tenant_of(config=config)
+            reconciler = SecurityGroupReconciler(provider_config=config, owner=self.app.name)
+            try:
+                # Every tenant is reconciled even with nothing wanted, so an opt-out creates
+                # nothing and leaves its group to the sweep.
+                ensured = reconciler.reconcile(rules=wanted.get(tenant, {}))
+            except SecurityGroupReconcileError as exc:
+                failed = (
+                    _report_security_group_failure(tenant=tenant, wanted=wanted, exc=exc) or failed
+                )
+                continue
+            group_ids.update(ensured)
+
+        missing = any(name not in group_ids for names in wanted.values() for name in names)
+        status = _SECURITY_GROUP_STATUS if failed or unusable or missing else None
+        return group_ids, status
+
+    def _remove_orphaned_security_groups(self, desired: list[ScalesetSpec]) -> None:
+        """Delete the groups no scale set claims, once the scale sets have been reconciled.
+
+        Args:
+            desired: Every desired scale set. One that publishes rules still claims its group,
+                even when this pass could not ensure it, so a failed pass cannot sweep away the
+                group a later pass would reuse.
+
+        Raises:
+            SecurityGroupReconcileError: If OpenStack refused or could not be reached. The
+                caller reports it; the groups stay, and the next pass tries again.
+        """
+        configs = self._get_configurator_provider_configs()
+        tenant_of = {config["unit_name"]: _tenant_of(config=config) for config in configs}
+        for config in configs:
+            tenant = tenant_of[config["unit_name"]]
+            claimed = [
+                spec.name
+                for spec in desired
+                if _claims_security_group(spec=spec)
+                and tenant_of.get(spec.provider_name) == tenant
+            ]
+            SecurityGroupReconciler(provider_config=config, owner=self.app.name).sweep(
+                claimed=claimed
+            )
+
+    def _configurator_databags(self) -> typing.Iterator[typing.Mapping[str, str]]:
+        """Yield every configurator unit's relation databag, in a stable order."""
+        for relation in self.model.relations.get(GARM_CONFIGURATOR_RELATION_NAME, []):
+            for unit in sorted(relation.units, key=lambda unit: unit.name):
+                yield relation.data[unit]
+
     def _build_desired_credentials(self) -> list[CredentialSpec]:
         """Build desired GitHub credentials from configurator relation data.
 
@@ -848,9 +975,12 @@ def _reconcile_runners(self) -> None:
             GithubReconciler(auth_client).reconcile(self._build_desired_credentials())
             EntityReconciler(auth_client, agent_mode).reconcile(charm_state.desired_entities)
             template_id = _apply_garm_template(auth_client, charm_state.ssh_debug_connections)
-            replacing = ScalesetReconciler(auth_client).reconcile(
-                self._build_desired_scalesets(template_id)
-            )
+            group_ids, security_group_status = self._ensure_security_groups()
+            desired = self._build_desired_scalesets(template_id, group_ids=group_ids)
+            replacing = ScalesetReconciler(auth_client).reconcile(desired)
+            # Only now: a scale set deleted this pass has released its group. The sweep reports
+            # its own failures, because the scale sets are already reconciled.
+            self._remove_orphaned_security_groups(desired=desired)
             # A label change recreates the scaleset and drains the old one, which
             # outlives this hook: report progress and let update-status converge it.
             # Active, not maintenance: every label is served throughout the drain, by
@@ -858,9 +988,12 @@ def _reconcile_runners(self) -> None:
             # run to DRAIN_DEADLINE, and blocking `juju wait-for` on hours of healthy
             # background convergence would be wrong.
             if replacing:
-                self.update_app_and_unit_status(
-                    ops.ActiveStatus(_scaleset_replacement_status(replacing))
-                )
+                message = _scaleset_replacement_status(replacing)
+                if security_group_status:
+                    message = f"{message}; {security_group_status}"
+                self.update_app_and_unit_status(ops.ActiveStatus(message))
+            elif security_group_status:
+                self.update_app_and_unit_status(ops.WaitingStatus(security_group_status))
             else:
                 self.update_app_and_unit_status(ops.ActiveStatus())
         except CharmedTemplateError as exc:
@@ -914,6 +1047,51 @@ def _ensure_agent_tools(self, auth_client: GarmAuthenticatedClient) -> bool | No
         return True
 
 
+def _report_security_group_failure(
+    tenant: tuple[str, str],
+    wanted: dict[tuple[str, str], dict[str, list[SecurityGroupRule]]],
+    exc: Exception,
+) -> bool:
+    """Log one tenant's security group failure, and say whether the operator must hear about it.
+
+    A tenant with nothing claimed was only checked for a group left behind, so failing to reach
+    OpenStack there must not block a deployment that opted out.
+    """
+    if wanted.get(tenant):
+        logger.warning("Security groups for %s could not be ensured: %s", tenant, exc)
+        return True
+    logger.info("Could not check %s for orphaned security groups: %s", tenant, exc)
+    return False
+
+
+def _tenant_of(config: Mapping[str, str]) -> tuple[str, str]:
+    """Return the key that identifies the OpenStack tenant a provider config belongs to."""
+    return config["auth_url"], config["project_name"]
+
+
+def _published_rules(data: Mapping[str, str]) -> list[SecurityGroupRule] | None:
+    """Return the rules a configurator published, or None when it published none it can use.
+
+    None covers both a configurator that predates the split — it publishes no rules while it
+    manages the group itself — and one whose rules do not parse. Both fail closed: the scale set
+    is left alone rather than created without its isolation.
+    """
+    raw = data.get(SECURITY_GROUP_RULES_DATABAG_KEY)
+    if raw is None:
+        logger.warning(
+            "Scaleset %s: the configurator publishes no security group rules; refresh it",
+            data.get("name", ""),
+        )
+        return None
+    try:
+        return parse_security_group_rules(raw)
+    except (ValidationError, ValueError) as exc:
+        logger.warning(
+            "Scaleset %s has unparsable security group rules: %s", data.get("name"), exc
+        )
+        return None
+
+
 def _scaleset_replacement_status(replacing: list[ScalesetProgress]) -> str:
     """Summarise in-progress scaleset replacements for the unit status.
 
diff --git a/charms/garm/src/charm_state.py b/charms/garm/src/charm_state.py
index ff1ed075..dacddbb4 100644
--- a/charms/garm/src/charm_state.py
+++ b/charms/garm/src/charm_state.py
@@ -12,12 +12,14 @@
 
 import dataclasses
 import ipaddress
+import json
 import logging
 import re
 import typing
 from collections.abc import Mapping
 
 import ops
+from pydantic import BaseModel, ConfigDict, field_validator, model_validator
 
 from entity_reconciler import EntitySpec
 
@@ -48,6 +50,84 @@ class SSHDebugInfo:
 
 # Databag keys written by the garm-configurator charm — the single source of
 # truth for the configurator→garm relation contract for runner options.
+SECURITY_GROUP_RULES_DATABAG_KEY: typing.Final = "security_group_rules"
+
+
+class SecurityGroupRule(BaseModel):
+    """One rule of a scale set's OpenStack security group.
+
+    The configurator validates the operator's ``security-group-rules`` before publishing them,
+    but relation data is still parsed defensively here: a malformed document must leave the
+    existing group alone rather than converge it to nothing.
+
+    Attributes:
+        direction: Whether the rule admits ingress or egress traffic.
+        protocol: Transport protocol the rule applies to, or "any" for every protocol.
+        port_min: First port of the range, or None to cover every port.
+        port_max: Last port of the range, or None to cover only port_min.
+        remote_ip_prefix: CIDR the rule applies to, or None to cover every address.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    direction: typing.Literal["ingress", "egress"]
+    protocol: typing.Literal["tcp", "udp", "icmp", "icmpv6", "any"] = "any"
+    port_min: int | None = None
+    port_max: int | None = None
+    remote_ip_prefix: str | None = None
+
+    @field_validator("remote_ip_prefix")
+    @classmethod
+    def _validate_cidr(cls, value: str | None) -> str | None:
+        """Require a CIDR, normalised to the network address OpenStack expects."""
+        if value is None:
+            return None
+        try:
+            return str(ipaddress.ip_network(value.strip(), strict=True))
+        except ValueError as exc:
+            raise ValueError(f"must be a CIDR; got {value!r}") from exc
+
+    @model_validator(mode="after")
+    def _normalise_ports(self) -> "SecurityGroupRule":
+        """Fill in a single port's upper bound, as the configurator does before publishing.
+
+        Neutron reports a single port as a range of one. Without the same normalisation here
+        every rule with a single port would look different from the one in the group, and be
+        recreated on each pass.
+        """
+        if self.port_min is not None and self.port_max is None:
+            self.port_max = self.port_min
+        return self
+
+    @property
+    def ethertype(self) -> str:
+        """The ethertype the remote prefix implies, which OpenStack defaults to IPv4."""
+        if self.remote_ip_prefix and ":" in self.remote_ip_prefix:
+            return "IPv6"
+        return "IPv4"
+
+
+def parse_security_group_rules(raw: str) -> list[SecurityGroupRule]:
+    """Parse the rules a configurator published for its scale set.
+
+    Args:
+        raw: The relation value: a JSON list of rule objects, or empty when the configurator
+            manages no group.
+
+    Raises:
+        ValueError: If the document is not a JSON list of valid rules.
+
+    Returns:
+        The parsed rules, empty when the configurator manages no group.
+    """
+    if not raw.strip():
+        return []
+    document = json.loads(raw)
+    if not isinstance(document, list):
+        raise ValueError("security_group_rules must be a JSON list of rules")
+    return [SecurityGroupRule.model_validate(entry) for entry in document]
+
+
 RUNNER_OPTION_DATABAG_KEYS: typing.Final = (
     "dockerhub_mirror",
     "runner_http_proxy",
diff --git a/charms/garm/src/scaleset_reconciler.py b/charms/garm/src/scaleset_reconciler.py
index 2ad9399b..3c7b4f0a 100644
--- a/charms/garm/src/scaleset_reconciler.py
+++ b/charms/garm/src/scaleset_reconciler.py
@@ -12,7 +12,7 @@
 from dataclasses import dataclass, field
 from datetime import datetime, timedelta, timezone
 
-from charm_state import RunnerConfig
+from charm_state import RunnerConfig, SecurityGroupRule
 from garm_api import (
     GarmApiError,
     GarmAuthenticatedClient,
@@ -149,6 +149,11 @@ class ScalesetSpec:
     template_id: int | None = None
     runner_config: RunnerConfig = field(default_factory=RunnerConfig)
     image_visibility: str = ""
+    # Empty means no group is managed. None means the configurator's rules were absent or did
+    # not parse, so this scale set is skipped rather than created without the isolation it
+    # asked for.
+    security_group_rules: list[SecurityGroupRule] | None = field(default_factory=list)
+    security_group_id: str = ""
 
 
 class ScalesetReconciler:
@@ -165,6 +170,9 @@ def __init__(self, client: GarmAuthenticatedClient) -> None:
     def reconcile(self, desired: list[ScalesetSpec]) -> list[ScalesetProgress]:
         """Sync GARM scalesets to match *desired*.
 
+        A spec that asked for a security group and has none is claimed but not reconciled: it
+        must not be created without the group, and it must not be treated as an orphan either.
+
         Performs the minimum set of CREATE / UPDATE / DELETE operations, and
         maintains a per-scaleset runner-install template carrying the runner
         options. If a referenced provider is missing or the target entity
@@ -337,6 +345,12 @@ def _reconcile_one(
         Returns:
             One entry per replaced generation of this spec still draining.
         """
+        if _security_group_unattached(spec=spec):
+            logger.info(
+                "Leaving scaleset %s alone this pass: its security group is not ensured",
+                spec.name,
+            )
+            return []
         active_name = target_scaleset_name(spec.name, spec.labels)
         try:
             create_params = self._to_create_params(spec, active_name)
@@ -1143,11 +1157,33 @@ def _needs_update(observed: ScaleSet, spec: ScalesetSpec, template_id: int) -> b
             or bool(observed_extra.get("disable_updates"))
             != bool(desired_extra.get("disable_updates"))
             or observed_extra.get("image_visibility") != desired_extra.get("image_visibility")
+            or (observed_extra.get("security_groups") or [])
+            != (desired_extra.get("security_groups") or [])
             or (observed.template_id or 0) != template_id
             or observed.runner_prefix != runner_prefix(spec.name)
         )
 
 
+def _claims_security_group(spec: ScalesetSpec) -> bool:
+    """Whether a spec asks for a security group, whatever this pass could do about it.
+
+    A missing or unparsable rules document still claims: the group it would use must not be
+    swept while its scale set exists. Only an explicit empty list opts out.
+    """
+    return spec.security_group_rules != []
+
+
+def _security_group_unattached(spec: ScalesetSpec) -> bool:
+    """Whether a spec asked for a security group and did not get one.
+
+    Unparsable rules count as asking: a configurator that published garbage must not quietly
+    produce unisolated runners.
+    """
+    if not _claims_security_group(spec=spec):
+        return False
+    return spec.security_group_rules is None or not spec.security_group_id
+
+
 def target_scaleset_name(logical_name: str, labels: list[str]) -> str:
     """Return the live GARM name a spec's scaleset should have.
 
@@ -1332,8 +1368,9 @@ def _effective_extra_specs(spec: ScalesetSpec) -> dict[str, object]:
 
     Single source of truth for create, update, and drift detection: combines the
     operator-supplied pre-install scripts with the charm's aproxy bootstrap, the
-    ``disable_updates`` flag when a runner proxy is configured, and the image
-    visibility the provider searches when resolving an image name.
+    ``disable_updates`` flag when a runner proxy is configured, the image
+    visibility the provider searches when resolving an image name, and the
+    configurator-managed security group.
 
     Args:
         spec: The desired scaleset.
@@ -1360,4 +1397,11 @@ def _effective_extra_specs(spec: ScalesetSpec) -> dict[str, object]:
         }
     if spec.image_visibility:
         extra_specs["image_visibility"] = spec.image_visibility
+    if spec.security_group_id:
+        # Nova attaches the groups it is given *instead of* the project's default group,
+        # which is why the configurator only publishes an id for a group it has already
+        # opened egress on. With no id the key is left out entirely, and the provider
+        # (garm-provider-openstack v0.1.5, provider/spec.go: `if len(spec.SecurityGroups)
+        # > 0`) then sets no groups on the instance, so Nova keeps the project's default.
+        extra_specs["security_groups"] = [spec.security_group_id]
     return extra_specs
diff --git a/charms/garm/src/security_groups.py b/charms/garm/src/security_groups.py
new file mode 100644
index 00000000..f64d58bd
--- /dev/null
+++ b/charms/garm/src/security_groups.py
@@ -0,0 +1,387 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""Reconcile the OpenStack security group each scale set's runners are attached to.
+
+The configurator owns the policy: it validates ``security-group-rules`` and publishes them on
+the relation. This module owns the lifecycle, because only the GARM charm knows when a scale
+set and its runners are gone: it creates ``garm-<scale set>``, converges its rules to the
+published list, hands the id to the provider through the scale set's ``security_groups`` extra
+spec, and deletes groups nothing claims any more.
+
+Nothing the charms provide needs an ingress rule. GARM's remote shell rides the agent's
+connection, which the runner opens to ``agent_url``, and a ``debug-ssh`` session is an
+outbound tmate client on the runner; both are traffic the runner originates.
+"""
+
+import logging
+import time
+import typing
+
+import keystoneauth1.exceptions.base
+import openstack
+import openstack.exceptions
+
+from charm_state import SecurityGroupRule
+
+logger = logging.getLogger(__name__)
+
+SECURITY_GROUP_NAME_PREFIX = "garm-"
+# Seconds before an OpenStack request gives up; long enough for a busy Neutron, short enough
+# that a firewalled endpoint does not wedge the hook.
+REQUEST_TIMEOUT_SECONDS = 30
+# Everything this charm creates is named after the scale set and described with this marker, so
+# a sweep can tell its groups from another GARM application's in the same project.
+SECURITY_GROUP_DESCRIPTION = "Managed by the {} charm."
+# A group whose port is still being removed cannot be deleted yet. On the removal path, retry
+# briefly: no later pass runs to try again.
+REMOVAL_DELETE_ATTEMPTS = 3
+REMOVAL_DELETE_SETTLE_SECONDS = 5
+
+# What a reconcile can fail with: the SDK's own hierarchy for API responses, and keystoneauth's
+# for transport and authentication, which never reach the SDK's base class.
+_OPENSTACK_ERRORS = (
+    openstack.exceptions.SDKException,
+    keystoneauth1.exceptions.base.ClientException,
+)
+
+# The SDK resource names the ethertype ``ether_type``; the body it is created from spells it
+# ``ethertype``. Reading the wrong one leaves it unset on every observed rule, which would make
+# each configured rule look new and rewrite the whole group on every reconcile.
+_SDK_ATTRIBUTE = {"ethertype": "ether_type"}
+
+# Neutron treats these as the same any-address rule (``securitygroups_db._rule_to_key``), and a
+# new group already carries one egress rule per ethertype spelled this way. Comparing the
+# literal strings would make every reconcile try to create them again and get a 409.
+ANY_ADDRESS_PREFIXES = (None, "0.0.0.0/0", "::/0")
+
+# A rule's identity is the value of these fields, in this order. OpenStack assigns the id,
+# tenant, and description itself, and reports the rest back exactly as configured, so two rules
+# with the same identity are the same rule.
+RULE_FIELDS = (
+    "direction",
+    "ethertype",
+    "protocol",
+    "port_range_min",
+    "port_range_max",
+    "remote_ip_prefix",
+    "remote_group_id",
+    "remote_address_group_id",
+)
+
+
+class SecurityGroupReconcileError(Exception):
+    """Raised when a scale set's security group could not be reconciled with OpenStack."""
+
+
+def security_group_name(scaleset_name: str) -> str:
+    """Return the OpenStack name of the security group managed for a scale set.
+
+    Args:
+        scaleset_name: The scale set name the configurator configured.
+
+    Returns:
+        The group name, derived from the scale set name alone so a scale set keeps its group
+        across charm upgrades and reconciles.
+    """
+    return f"{SECURITY_GROUP_NAME_PREFIX}{scaleset_name}"
+
+
+class SecurityGroupReconciler:
+    """Creates, converges, and deletes the security groups of one OpenStack tenant."""
+
+    def __init__(self, provider_config: dict[str, str], owner: str) -> None:
+        """Initialise the reconciler.
+
+        Args:
+            provider_config: One configurator's OpenStack credentials and region.
+            owner: This application's name, written into the group description so a sweep
+                only removes groups it created.
+        """
+        self._provider_config = provider_config
+        self._description = SECURITY_GROUP_DESCRIPTION.format(owner)
+
+    def reconcile(self, rules: dict[str, list[SecurityGroupRule]]) -> dict[str, str]:
+        """Ensure each scale set's group exists and holds its rules.
+
+        Groups no scale set claims are left for :meth:`sweep`, which runs once the scale sets
+        have been reconciled: only then has a deleted scale set released its group.
+
+        Args:
+            rules: Per scale set name, the rules its group should hold.
+
+        Returns:
+            Per scale set name, the id of the group the provider should attach.
+
+        Raises:
+            SecurityGroupReconcileError: If OpenStack refused or could not be reached. The caller
+                skips these scale sets rather than creating runners without isolation.
+        """
+        groups: dict[str, str] = {}
+        try:
+            connect = typing.cast(typing.Callable[..., typing.Any], openstack.connect)
+            with connect(**self._auth_fields()) as connection:
+                existing = self._groups_by_name(connection=connection)
+                for name, group_rules in rules.items():
+                    copies = existing.get(security_group_name(scaleset_name=name))
+                    if not copies:
+                        copies = [self._create_group(connection=connection, name=name)]
+                    # Every copy is converged: OpenStack allows duplicate names, and the copy a
+                    # runner is attached to must not keep stale rules.
+                    for group in copies:
+                        self._reconcile_rules(
+                            connection=connection, group=group, rules=group_rules
+                        )
+                    groups[name] = str(copies[0].id)
+        except _OPENSTACK_ERRORS as exc:
+            raise SecurityGroupReconcileError(_reason(exc)) from exc
+        return groups
+
+    def sweep(self, claimed: typing.Iterable[str]) -> int:
+        """Delete the groups this application owns that no scale set claims any more.
+
+        Runs after the scale sets are reconciled, so a group whose scale set was deleted in this
+        pass is already unclaimed.
+
+        Args:
+            claimed: The scale set names that still want a group.
+
+        Returns:
+            How many groups were deleted. This never raises: the scale sets are already
+            reconciled by the time it runs, so a failure costs nothing but a retry on the next
+            pass, and a tenant that opted out must not block the unit.
+        """
+        wanted = {security_group_name(scaleset_name=name) for name in claimed}
+        try:
+            connect = typing.cast(typing.Callable[..., typing.Any], openstack.connect)
+            with connect(**self._auth_fields()) as connection:
+                groups = self._groups_by_name(connection=connection)
+                unclaimed = [
+                    group
+                    for name, copies in groups.items()
+                    if name not in wanted
+                    for group in copies
+                ]
+                # One copy of a claimed name is enough; the rest go once nothing attaches them.
+                surplus = [
+                    group
+                    for name, copies in groups.items()
+                    if name in wanted
+                    for group in copies[1:]
+                ]
+                return self._delete_unclaimed(
+                    connection=connection, unclaimed=[*unclaimed, *surplus]
+                )
+        except _OPENSTACK_ERRORS as exc:
+            logger.warning("Could not remove orphaned security groups: %s", _reason(exc))
+            return 0
+
+    def delete(self) -> bool:
+        """Delete every group this application created, unless a port still attaches it.
+
+        Used when the application is removed, so a group a port still holds is retried briefly:
+        nothing runs after this pass to try again.
+
+        Returns:
+            Whether any group was deleted. This never raises: it runs while the charm is being
+            removed, where a failure must not block the removal.
+        """
+        try:
+            connect = typing.cast(typing.Callable[..., typing.Any], openstack.connect)
+            with connect(**self._auth_fields()) as connection:
+                groups = self._groups_by_name(connection=connection)
+                return (
+                    self._delete_unclaimed(
+                        connection=connection,
+                        unclaimed=[copy for copies in groups.values() for copy in copies],
+                        settle_attempts=REMOVAL_DELETE_ATTEMPTS,
+                    )
+                    > 0
+                )
+        except _OPENSTACK_ERRORS as exc:
+            logger.warning("Could not delete the managed security groups: %s", _reason(exc))
+            return False
+
+    def _auth_fields(self) -> dict[str, object]:
+        """Return the keyword arguments the OpenStack SDK authenticates with."""
+        config = self._provider_config
+        return {
+            "auth_url": config["auth_url"],
+            "username": config["username"],
+            "password": config["password"],
+            "project_name": config["project_name"],
+            "user_domain_name": config["user_domain_name"],
+            "project_domain_name": config["project_domain_name"],
+            "region_name": config["region_name"],
+            "api_timeout": REQUEST_TIMEOUT_SECONDS,
+        }
+
+    def _groups_by_name(self, connection: typing.Any) -> dict[str, list[typing.Any]]:
+        """Return the groups this application created, keyed by name.
+
+        OpenStack allows duplicate names, so each name maps to every copy of it. The project is
+        filtered server-side, and the name prefix and description marker client-side, so another
+        GARM application sharing the project keeps its own groups.
+        """
+        groups: dict[str, list[typing.Any]] = {}
+        for group in connection.network.security_groups(project_id=connection.current_project_id):
+            if not (group.name or "").startswith(SECURITY_GROUP_NAME_PREFIX):
+                continue
+            if group.description != self._description:
+                continue
+            groups.setdefault(group.name, []).append(group)
+        return groups
+
+    def _create_group(self, connection: typing.Any, name: str) -> typing.Any:
+        """Create a scale set's group and return it."""
+        logger.info("Creating security group %s", security_group_name(scaleset_name=name))
+        return connection.network.create_security_group(
+            name=security_group_name(scaleset_name=name), description=self._description
+        )
+
+    def _reconcile_rules(
+        self, connection: typing.Any, group: typing.Any, rules: list[SecurityGroupRule]
+    ) -> None:
+        """Converge a group's rules to *rules*, which is authoritative.
+
+        A rule listed twice is created once; a duplicate Neutron already holds is removed.
+
+        Args:
+            connection: The authenticated OpenStack connection.
+            group: The security group to converge.
+            rules: The rules the group should hold.
+        """
+        observed: dict[tuple, typing.Any] = {}
+        surplus: list[typing.Any] = []
+        for rule in connection.network.security_group_rules(security_group_id=group.id):
+            identity = _get_observed_identity(rule=rule)
+            if identity in observed:
+                surplus.append(rule)
+                continue
+            observed[identity] = rule
+
+        desired = {_get_identity(rule=rule) for rule in rules}
+
+        # Removals first: identity is the rule, so an obsolete rule can never stand in for one
+        # being added, and adding first would leave the group briefly wider than the policy.
+        obsolete = [rule for identity, rule in observed.items() if identity not in desired]
+        for rule in obsolete + surplus:
+            logger.info(
+                "Removing rule %s from security group %s",
+                _get_observed_identity(rule=rule),
+                group.name,
+            )
+            connection.network.delete_security_group_rule(security_group_rule=rule)
+
+        added: set[tuple] = set()
+        for rule in rules:
+            identity = _get_identity(rule=rule)
+            if identity in observed or identity in added:
+                continue
+            added.add(identity)
+            logger.info("Adding rule %s to security group %s", identity, group.name)
+            connection.network.create_security_group_rule(
+                security_group_id=group.id, **_neutron_fields(rule=rule)
+            )
+
+    def _delete_unclaimed(
+        self,
+        connection: typing.Any,
+        unclaimed: typing.Iterable[typing.Any],
+        settle_attempts: int = 1,
+    ) -> int:
+        """Delete groups no scale set claims, one refusal at a time.
+
+        Args:
+            connection: The authenticated OpenStack connection.
+            unclaimed: The groups to remove.
+            settle_attempts: How many times to retry a group a port still attaches. One on the
+                reconcile path, which runs again anyway; more on the removal path, which does not.
+
+        Returns:
+            How many groups were deleted.
+        """
+        deleted = 0
+        for group in unclaimed:
+            for attempt in range(1, settle_attempts + 1):
+                last = attempt == settle_attempts
+                if self._delete_group(connection=connection, group=group, last=last):
+                    deleted += 1
+                    break
+                if not last:
+                    time.sleep(REMOVAL_DELETE_SETTLE_SECONDS)
+        return deleted
+
+    def _delete_group(self, connection: typing.Any, group: typing.Any, last: bool) -> bool:
+        """Delete one group, reporting the refusals that are not this charm's as logs.
+
+        Args:
+            connection: The authenticated OpenStack connection.
+            group: The group to delete.
+            last: Whether this is the final attempt, so a port still attached is worth reporting.
+
+        Returns:
+            Whether the group is gone.
+        """
+        try:
+            connection.network.delete_security_group(security_group=group.id)
+            logger.info("Deleted security group %s (%s)", group.name, group.id)
+            return True
+        except openstack.exceptions.NotFoundException:
+            # A concurrent pass deleted it, which is the outcome this call wanted.
+            logger.info("Security group %s is already gone", group.name)
+            return True
+        except openstack.exceptions.ConflictException:
+            # Expected for hours after a scale set is deleted: Nova removes the port
+            # asynchronously, and until it does the group is still attached.
+            if last:
+                logger.info("Keeping security group %s: a port still attaches it", group.name)
+            return False
+        except openstack.exceptions.ForbiddenException:
+            logger.warning(
+                "Could not delete security group %s: the OpenStack credentials may not"
+                " delete security groups",
+                group.name,
+            )
+            return False
+
+
+def _get_identity(rule: SecurityGroupRule) -> tuple:
+    """Return a configured rule's identity: the value of RULE_FIELDS, in order."""
+    fields = _neutron_fields(rule=rule)
+    return tuple(fields.get(field) for field in RULE_FIELDS)
+
+
+def _get_observed_identity(rule: typing.Any) -> tuple:
+    """Return the identity of a rule as the SDK reports it, `ether_type` included."""
+    return tuple(
+        _normalised(field=field, value=getattr(rule, _SDK_ATTRIBUTE.get(field, field), None))
+        for field in RULE_FIELDS
+    )
+
+
+def _neutron_fields(rule: SecurityGroupRule) -> dict[str, object]:
+    """Return a configured rule as OpenStack names its fields."""
+    # Neutron defaults to IPv4; only an IPv6 prefix, which is the one with a colon, needs
+    # saying. "any" is spelled as a null protocol and as no prefix at all.
+    ethertype = "IPv6" if rule.remote_ip_prefix and ":" in rule.remote_ip_prefix else "IPv4"
+    return {
+        "direction": rule.direction,
+        "ethertype": ethertype,
+        "protocol": None if rule.protocol == "any" else rule.protocol,
+        "port_range_min": rule.port_min,
+        "port_range_max": rule.port_max,
+        "remote_ip_prefix": _normalised(field="remote_ip_prefix", value=rule.remote_ip_prefix),
+    }
+
+
+def _normalised(field: str, value: object) -> object:
+    """Return a rule value in the form Neutron compares it in."""
+    if field == "remote_ip_prefix" and value in ANY_ADDRESS_PREFIXES:
+        return None
+    return value
+
+
+def _reason(exc: Exception) -> str:
+    """Return the failure as one line."""
+    return " ".join(str(exc).split()) or type(exc).__name__
diff --git a/charms/garm/tests/unit/conftest.py b/charms/garm/tests/unit/conftest.py
new file mode 100644
index 00000000..731250b0
--- /dev/null
+++ b/charms/garm/tests/unit/conftest.py
@@ -0,0 +1,128 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""Shared fixtures for the charm's unit tests."""
+
+import typing
+
+import openstack.exceptions
+import pytest
+from openstack.network.v2 import security_group_rule as sdk_rules
+
+# The rules a configurator publishes by default: all egress, no ingress.
+DEFAULT_RULES = (
+    '[{"direction": "egress", "remote_ip_prefix": "0.0.0.0/0"},'
+    ' {"direction": "egress", "remote_ip_prefix": "::/0"}]'
+)
+
+
+class _Rule:
+    """A security group rule as the SDK reports it."""
+
+    def __init__(self, **fields):
+        for field in (
+            "direction",
+            "ethertype",
+            "protocol",
+            "port_range_min",
+            "port_range_max",
+            "remote_ip_prefix",
+            "remote_group_id",
+            "remote_address_group_id",
+        ):
+            setattr(self, "ether_type" if field == "ethertype" else field, fields.get(field))
+        self.id = fields.get("id", "rule-id")
+
+
+class _Group:
+    """A security group as the SDK reports it."""
+
+    def __init__(self, name, gid="sg-1", description="", rules=()):
+        self.id = gid
+        self.name = name
+        self.description = description
+        self.rules = list(rules)
+
+
+class _Network:
+    """A Neutron that starts empty and behaves like the real one for this charm's calls."""
+
+    def __init__(self):
+        self.groups: list[_Group] = []
+        self._created = 0
+
+    def security_groups(self, project_id=None):
+        return list(self.groups)
+
+    def create_security_group(self, name, description):
+        self._created += 1
+        group = _Group(
+            name,
+            gid=f"sg-{self._created}",
+            description=description,
+            rules=[
+                _Rule(
+                    direction="egress",
+                    ethertype=ethertype,
+                    remote_ip_prefix=None,
+                    id=f"default-{ethertype}",
+                )
+                for ethertype in ("IPv4", "IPv6")
+            ],
+        )
+        self.groups.append(group)
+        return group
+
+    def delete_security_group(self, security_group):
+        self.groups = [group for group in self.groups if group.id != security_group]
+
+    def security_group_rules(self, security_group_id):
+        return list(self._group(security_group_id).rules)
+
+    def create_security_group_rule(self, security_group_id, **fields):
+        self._created += 1
+        rule = sdk_rules.SecurityGroupRule.new(**fields)
+        rule.id = f"rule-{self._created}"
+        self._group(security_group_id).rules.append(rule)
+        return rule
+
+    def delete_security_group_rule(self, security_group_rule):
+        for group in self.groups:
+            group.rules = [rule for rule in group.rules if rule.id != security_group_rule.id]
+
+    def _group(self, group_id):
+        return next(group for group in self.groups if group.id == group_id)
+
+
+class _Connection:
+    """A fake OpenStack connection holding one network service."""
+
+    current_project_id = "project-id"
+
+    def __init__(self):
+        self.network = _Network()
+
+    def close(self):
+        pass
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *_exception):
+        self.close()
+
+
+@pytest.fixture(autouse=True)
+def openstack_tenant(monkeypatch) -> typing.Any:
+    """Serve the security group reconciler from a fake tenant.
+
+    The charm reconciles each tenant it has credentials for on every hook, so a test that does
+    not stub it would reach Keystone. Tests that care about the calls patch or inspect it.
+    """
+    connection = _Connection()
+
+    def connect(**_auth_fields):
+        return connection
+
+    monkeypatch.setattr("security_groups.openstack.connect", connect)
+    return connection
diff --git a/charms/garm/tests/unit/test_charm.py b/charms/garm/tests/unit/test_charm.py
index e1a8f4df..eb891946 100644
--- a/charms/garm/tests/unit/test_charm.py
+++ b/charms/garm/tests/unit/test_charm.py
@@ -18,6 +18,7 @@
 import typing
 from unittest.mock import MagicMock, PropertyMock, patch
 
+import openstack.exceptions
 import ops
 import pytest
 import yaml
@@ -40,7 +41,8 @@
     MANAGED_CREDENTIAL_DESCRIPTION,
     CredentialSpec,
 )
-from scaleset_reconciler import Handover, ScalesetProgress
+from scaleset_reconciler import Handover, ScalesetProgress, _effective_extra_specs
+from security_groups import SecurityGroupReconcileError
 
 MODEL_NAME = "garm-model"
 CONTAINER_NAME = "app"
@@ -91,6 +93,10 @@
 }
 
 _SCALESET_UNIT_DATA = {
+    "security_group_rules": (
+        '[{"direction": "egress", "remote_ip_prefix": "0.0.0.0/0"},'
+        ' {"direction": "egress", "remote_ip_prefix": "::/0"}]'
+    ),
     "name": "my-scaleset",
     "provider_name": "garm-configurator-0",
     "image_id": "img-1",
@@ -1397,6 +1403,209 @@ def test_image_visibility_follows_the_configurator_databag(
     assert [spec.image_visibility for spec in specs] == [expected]
 
 
+def test_security_group_rules_are_parsed_from_the_configurator(
+    ctx: Context, garm_api: _GarmApiMocks
+):
+    """
+    arrange: A configurator publishing one ingress rule and the default egress rule.
+    act: Run update-status.
+    assert: The scale set spec carries the parsed rules, which is what the security group
+        reconciler applies — the databag itself no longer carries a group id.
+    """
+    data = {
+        **_PROVIDER_UNIT_DATA,
+        **_SCALESET_UNIT_DATA,
+        "security_group_rules": (
+            '[{"direction": "ingress", "protocol": "tcp", "port_min": 22},'
+            ' {"direction": "egress", "remote_ip_prefix": "0.0.0.0/0"}]'
+        ),
+    }
+    ctx.run(ctx.on.update_status(), _state(configurator_units_data={0: data}))
+
+    specs = garm_api.scaleset.return_value.reconcile.call_args[0][0]
+    rules = specs[0].security_group_rules
+    assert [(rule.direction, rule.protocol, rule.port_min, rule.port_max) for rule in rules] == [
+        ("ingress", "tcp", 22, 22),
+        ("egress", "any", None, None),
+    ]
+
+
+def test_a_scaleset_without_rules_manages_no_group(ctx: Context, garm_api: _GarmApiMocks):
+    """
+    arrange: A configurator that opted out, publishing an empty rule list.
+    act: Run update-status.
+    assert: The spec carries no rules and no group id, so the runners keep the project's
+        default group.
+    """
+    data = {**_PROVIDER_UNIT_DATA, **_SCALESET_UNIT_DATA, "security_group_rules": "[]"}
+
+    ctx.run(ctx.on.update_status(), _state(configurator_units_data={0: data}))
+
+    specs = garm_api.scaleset.return_value.reconcile.call_args[0][0]
+    assert specs[0].security_group_rules == []
+    assert specs[0].security_group_id == ""
+
+
+def test_the_attached_group_reaches_the_provider_extra_specs(
+    ctx: Context, garm_api: _GarmApiMocks, openstack_tenant
+):
+    """
+    arrange: A configurator publishing the default rules, and a tenant the fake creates the
+        group in.
+    act: Run update-status.
+    assert: The spec the reconciler receives carries the created group's id, and that id is what
+        the provider receives as the scale set's security_groups extra spec.
+    """
+    data = {**_PROVIDER_UNIT_DATA, **_SCALESET_UNIT_DATA}
+
+    ctx.run(ctx.on.update_status(), _state(configurator_units_data={0: data}))
+
+    (specs,) = garm_api.scaleset.return_value.reconcile.call_args.args
+    assert specs[0].security_group_id == openstack_tenant.network.groups[0].id
+    assert _effective_extra_specs(specs[0])["security_groups"] == [
+        openstack_tenant.network.groups[0].id
+    ]
+
+
+def test_a_non_leader_does_not_touch_the_security_groups(
+    ctx: Context, garm_api: _GarmApiMocks, openstack_tenant
+):
+    """
+    arrange: A unit that is not the leader, with a configurator publishing rules.
+    act: Run update-status.
+    assert: No group is created — one unit owns them, so two cannot race each other's creates and
+        deletes — and the scale set carries no id, so the leader is the one that creates it.
+    """
+    data = {**_PROVIDER_UNIT_DATA, **_SCALESET_UNIT_DATA}
+
+    ctx.run(ctx.on.update_status(), _state(leader=False, configurator_units_data={0: data}))
+
+    assert openstack_tenant.network.groups == []
+    # A non-leader does not reach the scaleset reconciler at all, so nothing is created either
+    # way; what matters is that the leader's groups are not touched.
+    garm_api.scaleset.return_value.reconcile.assert_not_called()
+
+
+def test_an_opted_out_tenant_that_cannot_reach_openstack_stays_active(
+    ctx: Context, garm_api: _GarmApiMocks, openstack_tenant, monkeypatch
+):
+    """
+    arrange: A configurator that opted out, and an OpenStack the charm cannot reach — the state
+        the integration suite runs in.
+    act: Run update-status.
+    assert: The unit stays active. The only OpenStack call left for an opt-out is the sweep for a
+        group it may have created earlier, and failing that must not block the deployment.
+    """
+
+    def security_groups(self, project_id=None):
+        raise openstack.exceptions.SDKException("keystone unreachable")
+
+    monkeypatch.setattr(type(openstack_tenant.network), "security_groups", security_groups)
+    data = {**_PROVIDER_UNIT_DATA, **_SCALESET_UNIT_DATA, "security_group_rules": "[]"}
+
+    out = ctx.run(ctx.on.update_status(), _state(configurator_units_data={0: data}))
+
+    assert out.unit_status == ops.ActiveStatus()
+
+
+def test_unusable_rules_do_not_sweep_the_group(
+    ctx: Context, garm_api: _GarmApiMocks, openstack_tenant
+):
+    """
+    arrange: A configurator that published valid rules in an earlier pass, then published rules
+        that do not parse.
+    act: Run update-status with the unparsable document.
+    assert: The group created earlier is still there, because the scale set still exists and
+        still claims it; only an explicit empty list opts out.
+    """
+    data = {**_PROVIDER_UNIT_DATA, **_SCALESET_UNIT_DATA}
+    ctx.run(ctx.on.update_status(), _state(configurator_units_data={0: data}))
+    created = [group.name for group in openstack_tenant.network.groups]
+
+    broken = {**data, "security_group_rules": "not json"}
+    ctx.run(ctx.on.update_status(), _state(configurator_units_data={0: broken}))
+
+    assert created == ["garm-my-scaleset"]
+    assert [group.name for group in openstack_tenant.network.groups] == created
+
+
+def test_a_configurator_without_the_key_is_left_alone(ctx: Context, garm_api: _GarmApiMocks):
+    """
+    arrange: A configurator that predates the split, publishing no security group rules while
+        it still manages the group itself.
+    act: Run update-status.
+    assert: The scale set is not touched and its group is not swept, so a GARM-first upgrade
+        does not strip isolation from runners whose configurator has not been refreshed yet.
+    """
+    data = {**_PROVIDER_UNIT_DATA, **_SCALESET_UNIT_DATA}
+    del data["security_group_rules"]
+
+    out = ctx.run(ctx.on.update_status(), _state(configurator_units_data={0: data}))
+
+    (specs,) = garm_api.scaleset.return_value.reconcile.call_args.args
+    assert specs[0].security_group_rules is None
+    assert out.unit_status == ops.WaitingStatus(
+        "Waiting for OpenStack security groups (see debug-log)"
+    )
+
+
+def test_two_configurators_in_one_tenant_see_one_anothers_scale_sets(
+    ctx: Context, garm_api: _GarmApiMocks, openstack_tenant
+):
+    """
+    arrange: Two configurators whose scale sets live in the same OpenStack project.
+    act: Run update-status.
+    assert: Both groups are created in one pass and neither pass deletes the other's, so sharing
+        a project does not make them sweep each other's groups.
+    """
+    second = {
+        **_PROVIDER_UNIT_DATA,
+        **_SCALESET_UNIT_DATA,
+        "name": "other-scaleset",
+        "provider_name": "second-configurator-0",
+    }
+    second_credentials = {**_PROVIDER_UNIT_DATA, "openstack_username": "admin2"}
+    state = _state(
+        configurator_relations=[
+            Relation(
+                id=11,
+                endpoint=GARM_CONFIGURATOR_RELATION_NAME,
+                remote_app_name="garm-configurator",
+                remote_units_data={0: {**_PROVIDER_UNIT_DATA, **_SCALESET_UNIT_DATA}},
+            ),
+            Relation(
+                id=12,
+                endpoint=GARM_CONFIGURATOR_RELATION_NAME,
+                remote_app_name="second-configurator",
+                remote_units_data={0: {**second_credentials, **second}},
+            ),
+        ]
+    )
+
+    ctx.run(ctx.on.update_status(), state)
+
+    created = sorted(group.name for group in openstack_tenant.network.groups)
+    assert created == ["garm-my-scaleset", "garm-other-scaleset"]
+
+
+def test_malformed_rules_leave_the_scaleset_alone(ctx: Context, garm_api: _GarmApiMocks):
+    """
+    arrange: A configurator publishing rules that do not parse.
+    act: Run update-status.
+    assert: The spec carries no rules so the scaleset reconciler claims it without creating it,
+        and the unit reports the problem.
+    """
+    data = {**_PROVIDER_UNIT_DATA, **_SCALESET_UNIT_DATA, "security_group_rules": "not json"}
+
+    out = ctx.run(ctx.on.update_status(), _state(configurator_units_data={0: data}))
+
+    (specs,) = garm_api.scaleset.return_value.reconcile.call_args.args
+    assert [spec.security_group_rules for spec in specs] == [None]
+    assert out.unit_status == ops.WaitingStatus(
+        "Waiting for OpenStack security groups (see debug-log)"
+    )
+
+
 # --- Event wiring -------------------------------------------------------------------------
 
 
diff --git a/charms/garm/tests/unit/test_scaleset_reconciler.py b/charms/garm/tests/unit/test_scaleset_reconciler.py
index 99912ba5..d67d1efe 100644
--- a/charms/garm/tests/unit/test_scaleset_reconciler.py
+++ b/charms/garm/tests/unit/test_scaleset_reconciler.py
@@ -258,6 +258,7 @@ def _spec(
     template_id=None,
     runner_config=None,
     image_visibility="",
+    security_group_id="",
 ):
     return ScalesetSpec(
         name=name,
@@ -276,6 +277,7 @@ def _spec(
         template_id=template_id,
         runner_config=runner_config or RunnerConfig(),
         image_visibility=image_visibility,
+        security_group_id=security_group_id,
     )
 
 
@@ -1338,6 +1340,35 @@ def test_create_sends_image_visibility_as_an_extra_spec():
     assert params.extra_specs == {"image_visibility": "private"}
 
 
+def test_create_sends_the_configurator_security_group_as_an_extra_spec():
+    """
+    arrange: A spec whose configurator manages a security group for the scaleset.
+    act: Reconcile a create.
+    assert: The extra_specs attach that group, since Nova otherwise attaches the project's
+        default group to every runner.
+    """
+    client = FakeGarmClient(providers=["openstack-demo"], scalesets=[])
+    _reconcile(client, [_spec(security_group_id="sg-1234")])
+
+    _, _, params = client.created[0]
+    assert params.extra_specs == {"security_groups": ["sg-1234"]}
+
+
+def test_create_omits_security_groups_when_unmanaged():
+    """
+    arrange: A spec from a configurator that publishes no security group id.
+    act: Reconcile a create.
+    assert: No security_groups extra spec is sent, so the provider sets no groups on the
+        instance and Nova attaches the project's default group — the behaviour deployments
+        without the option rely on.
+    """
+    client = FakeGarmClient(providers=["openstack-demo"], scalesets=[])
+    _reconcile(client, [_spec()])
+
+    _, _, params = client.created[0]
+    assert params.extra_specs is None
+
+
 @pytest.mark.parametrize(
     "observed_extra, desired, expected_extra",
     [
@@ -1365,6 +1396,33 @@ def test_update_converges_image_visibility(observed_extra, desired, expected_ext
     assert params.extra_specs == expected_extra
 
 
+@pytest.mark.parametrize(
+    "observed_extra, desired, expected_extra",
+    [
+        ({}, "sg-1234", {"security_groups": ["sg-1234"]}),
+        ({"security_groups": ["sg-old"]}, "sg-1234", {"security_groups": ["sg-1234"]}),
+        ({"security_groups": ["sg-1234"]}, "", {}),
+    ],
+    ids=["set", "changed", "cleared"],
+)
+def test_update_converges_the_security_group(observed_extra, desired, expected_extra):
+    """
+    arrange: An existing scaleset attached to a different group, or to none.
+    act: Reconcile the spec.
+    assert: One update brings the extra_specs to the desired group, clearing it with an
+        explicit empty dict when the configurator no longer manages one.
+    """
+    client = FakeGarmClient(
+        providers=["openstack-demo"],
+        scalesets=[_existing_scaleset(extra_specs=observed_extra)],
+    )
+    _reconcile(client, [_spec(security_group_id=desired)])
+
+    assert len(client.updated) == 1
+    _, params = client.updated[0]
+    assert params.extra_specs == expected_extra
+
+
 def test_no_update_when_image_visibility_already_matches():
     """
     arrange: An existing scaleset already carrying the spec's image_visibility.
diff --git a/charms/garm/tests/unit/test_security_groups.py b/charms/garm/tests/unit/test_security_groups.py
new file mode 100644
index 00000000..0828da9e
--- /dev/null
+++ b/charms/garm/tests/unit/test_security_groups.py
@@ -0,0 +1,563 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""Unit tests for the security group reconciler the GARM charm runs."""
+
+import typing
+
+import keystoneauth1.exceptions.connection
+import openstack.exceptions
+import pytest
+from openstack.network.v2 import security_group_rule as sdk_rules
+
+from charm_state import SecurityGroupRule
+from security_groups import (
+    SECURITY_GROUP_DESCRIPTION,
+    SecurityGroupReconcileError,
+    SecurityGroupReconciler,
+    security_group_name,
+)
+
+SCALESET_NAME = "my-scaleset"
+GROUP_NAME = "garm-my-scaleset"
+OWNER = "garm"
+DESCRIPTION = SECURITY_GROUP_DESCRIPTION.format(OWNER)
+PROVIDER_CONFIG = {
+    "unit_name": "garm-configurator-0",
+    "auth_url": "https://keystone.example.com:5000/v3",
+    "username": "admin",
+    "password": "s3cr3t",
+    "project_name": "myproject",
+    "user_domain_name": "Default",
+    "project_domain_name": "Default",
+    "region_name": "RegionOne",
+    "network": "external-net",
+}
+
+
+class _FakeGroup:
+    """A security group as the SDK reports it."""
+
+    def __init__(self, name, gid="sg-1", description=DESCRIPTION, rules=()):
+        self.id = gid
+        self.name = name
+        self.description = description
+        self.rules = list(rules)
+
+
+class _FakeNetwork:
+    """The network service of a fake OpenStack connection, with Neutron's rule semantics."""
+
+    def __init__(self, groups=()):
+        self.groups = list(groups)
+        self.list_queries = []
+        self.created_groups = []
+        self.deleted_groups = []
+        self.created_rules = []
+        self.deleted_rules = []
+
+    def security_groups(self, project_id=None):
+        self.list_queries.append(project_id)
+        return list(self.groups)
+
+    def create_security_group(self, name, description):
+        # Neutron gives a new group one any-address egress rule per ethertype, reported with
+        # no remote_ip_prefix; a reconcile that compares prefixes literally would try to
+        # create them again and be refused.
+        group = _FakeGroup(
+            name,
+            gid=f"sg-{name}",
+            description=description,
+            rules=[
+                _stored_rule(
+                    direction="egress",
+                    ethertype=ethertype,
+                    remote_ip_prefix=None,
+                    rule_id=f"default-{ethertype}",
+                )
+                for ethertype in ("IPv4", "IPv6")
+            ],
+        )
+        self.groups.append(group)
+        self.created_groups.append(name)
+        return group
+
+    def delete_security_group(self, security_group):
+        self.deleted_groups.append(security_group)
+        self.groups = [group for group in self.groups if group.id != security_group]
+
+    def security_group_rules(self, security_group_id):
+        return list(self._group(security_group_id).rules)
+
+    def create_security_group_rule(self, security_group_id, **fields):
+        group = self._group(security_group_id)
+        if any(_neutron_key(rule) == _neutron_key(fields) for rule in group.rules):
+            raise openstack.exceptions.ConflictException("Security group rule already exists")
+        self.created_rules.append(fields)
+        rule = sdk_rules.SecurityGroupRule.new(**fields)
+        rule.id = f"rule-created-{len(self.created_rules)}"
+        group.rules.append(rule)
+        return rule
+
+    def delete_security_group_rule(self, security_group_rule):
+        self.deleted_rules.append(security_group_rule.id)
+        for group in self.groups:
+            group.rules = [rule for rule in group.rules if rule.id != security_group_rule.id]
+
+    def _group(self, group_id):
+        return next(group for group in self.groups if group.id == group_id)
+
+
+class _FakeConnection:
+    """A fake OpenStack connection holding one network service."""
+
+    current_project_id = "project-id"
+
+    def __init__(self, network):
+        self.network = network
+        self.closed = False
+
+    def close(self):
+        self.closed = True
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *_exception):
+        self.close()
+
+
+@pytest.fixture(name="sdk", autouse=True)
+def sdk_fixture(monkeypatch):
+    """Keep every test off the real OpenStack SDK entrypoint."""
+    connection = _FakeConnection(_FakeNetwork())
+    calls: dict[str, typing.Any] = {"connection": connection}
+
+    def connect(**auth_fields):
+        calls["auth"] = auth_fields
+        return connection
+
+    monkeypatch.setattr("security_groups.openstack.connect", connect)
+    return calls
+
+
+def _reconciler(sdk, network=None):
+    """Build a reconciler whose stubbed connection serves *network*, when given."""
+    if network is not None:
+        sdk["connection"].network = network
+        sdk["connection"].closed = False
+    return SecurityGroupReconciler(provider_config=PROVIDER_CONFIG, owner=OWNER)
+
+
+def _neutron_key(rule):
+    """Return the key Neutron uses to reject a duplicate rule."""
+
+    def field(name):
+        if isinstance(rule, dict):
+            return rule.get(name)
+        return getattr(rule, "ether_type" if name == "ethertype" else name, None)
+
+    return (
+        field("direction"),
+        field("ethertype"),
+        None if field("protocol") in (None, "any") else field("protocol"),
+        field("port_range_min"),
+        field("port_range_max"),
+        None
+        if field("remote_ip_prefix") in (None, "0.0.0.0/0", "::/0")
+        else field("remote_ip_prefix"),
+        field("remote_group_id"),
+        field("remote_address_group_id"),
+    )
+
+
+def _stored_ports(port):
+    """Fields for an ingress tcp rule on one port, as Neutron stores it."""
+    return {
+        "direction": "ingress",
+        "ethertype": "IPv4",
+        "protocol": "tcp",
+        "port_range_min": port,
+        "port_range_max": port,
+        "remote_ip_prefix": None,
+    }
+
+
+def _stored_rule(**fields):
+    """Build a rule with the SDK's own resource, as OpenStack reports it."""
+    rule_id = fields.pop("rule_id", 99)
+    rule = sdk_rules.SecurityGroupRule.new(**fields)
+    rule.id = f"rule-{rule_id}"
+    return rule
+
+
+SSH = SecurityGroupRule(direction="ingress", protocol="tcp", port_min=22)
+EGRESS_V4 = SecurityGroupRule(direction="egress", remote_ip_prefix="0.0.0.0/0")
+EGRESS_V6 = SecurityGroupRule(direction="egress", remote_ip_prefix="::/0")
+SSH_FIELDS = {
+    "direction": "ingress",
+    "ethertype": "IPv4",
+    "protocol": "tcp",
+    "port_range_min": 22,
+    "port_range_max": 22,
+    "remote_ip_prefix": None,
+}
+EGRESS_V4_FIELDS = {
+    "direction": "egress",
+    "ethertype": "IPv4",
+    "protocol": None,
+    "port_range_min": None,
+    "port_range_max": None,
+    "remote_ip_prefix": None,
+}
+EGRESS_V6_FIELDS = {**EGRESS_V4_FIELDS, "ethertype": "IPv6"}
+
+
+def test_the_group_name_is_derived_from_the_scaleset_name():
+    """
+    arrange: A scale set name.
+    act: Derive its group name.
+    assert: The name is prefixed and derived from the name alone, so an upgrade reuses the group
+        the configurator-side implementation created rather than replacing it.
+    """
+    assert security_group_name(scaleset_name=SCALESET_NAME) == GROUP_NAME
+
+
+def test_a_missing_group_is_created_and_its_id_returned(sdk):
+    """
+    arrange: A tenant without the scale set's group.
+    act: Reconcile the scale set's rules.
+    assert: The group is created with the owning application in its description, and the id is
+        returned for the provider to attach.
+    """
+    network = _FakeNetwork()
+
+    groups = _reconciler(sdk, network).reconcile(rules={SCALESET_NAME: [SSH, EGRESS_V4]})
+
+    assert network.created_groups == [GROUP_NAME]
+    assert network.groups[0].description == DESCRIPTION
+    assert groups == {SCALESET_NAME: f"sg-{GROUP_NAME}"}
+
+
+def test_the_default_rules_match_the_group_neutron_creates(sdk):
+    """
+    arrange: A tenant without the group, and the configurator's default rules.
+    act: Reconcile.
+    assert: Nothing is added or removed, because a new group already carries those egress rules
+        spelled with no prefix.
+    """
+    network = _FakeNetwork()
+
+    _reconciler(sdk, network).reconcile(rules={SCALESET_NAME: [EGRESS_V4, EGRESS_V6]})
+
+    assert network.created_rules == []
+    assert network.deleted_rules == []
+
+
+def test_the_published_rules_are_authoritative(sdk):
+    """
+    arrange: A group holding a rule the operator removed and missing one they added.
+    act: Reconcile the published list.
+    assert: The missing rule is created and the stale one deleted, so the group matches the
+        published policy exactly.
+    """
+    network = _FakeNetwork(
+        [
+            _FakeGroup(
+                GROUP_NAME,
+                rules=[
+                    _stored_rule(**SSH_FIELDS, rule_id=1),
+                    _stored_rule(**_stored_ports(8080), rule_id=2),
+                ],
+            )
+        ]
+    )
+
+    _reconciler(sdk, network).reconcile(rules={SCALESET_NAME: [SSH, EGRESS_V4]})
+
+    assert network.created_rules == [EGRESS_V4_FIELDS]
+    assert network.deleted_rules == ["rule-2"]
+
+
+def test_an_existing_marked_group_is_reused(sdk):
+    """
+    arrange: A group this application created, already holding the published rules.
+    act: Reconcile again.
+    assert: Nothing is created or deleted, so a steady-state pass makes no writes.
+    """
+    network = _FakeNetwork(
+        [
+            _FakeGroup(
+                GROUP_NAME,
+                gid="sg-existing",
+                rules=[
+                    _stored_rule(**SSH_FIELDS, rule_id=1),
+                    _stored_rule(**EGRESS_V4_FIELDS, rule_id=2),
+                ],
+            )
+        ]
+    )
+
+    groups = _reconciler(sdk, network).reconcile(rules={SCALESET_NAME: [SSH, EGRESS_V4]})
+
+    assert groups == {SCALESET_NAME: "sg-existing"}
+    assert network.created_groups == []
+    assert network.created_rules == []
+    assert network.deleted_rules == []
+
+
+def test_a_group_no_scaleset_claims_is_deleted(sdk):
+    """
+    arrange: A group this application created for a scale set that no longer exists, and one
+        for a scale set that does.
+    act: Reconcile the surviving scale set.
+    assert: The orphan is deleted, so renames and removals do not leak groups against the quota.
+    """
+    network = _FakeNetwork(
+        [
+            _FakeGroup(GROUP_NAME, gid="sg-kept", rules=[_stored_rule(**SSH_FIELDS)]),
+            _FakeGroup("garm-renamed-away", gid="sg-orphan"),
+        ]
+    )
+
+    reconciler = _reconciler(sdk, network)
+
+    reconciler.reconcile(rules={SCALESET_NAME: [SSH]})
+    reconciler.sweep(claimed=[SCALESET_NAME])
+
+    assert network.deleted_groups == ["sg-orphan"]
+
+
+def test_another_applications_group_is_left_alone(sdk):
+    """
+    arrange: A group with the managed name pattern that another GARM application owns.
+    act: Reconcile.
+    assert: It is not deleted, so two applications sharing a project cannot delete each other's
+        groups.
+    """
+    network = _FakeNetwork(
+        [
+            _FakeGroup(GROUP_NAME, gid="sg-mine", rules=[_stored_rule(**SSH_FIELDS)]),
+            _FakeGroup("garm-other", gid="sg-theirs", description="Managed by garm-b charm."),
+        ]
+    )
+
+    _reconciler(sdk, network).reconcile(rules={SCALESET_NAME: [SSH]})
+
+    assert network.deleted_groups == []
+
+
+def test_a_group_still_in_use_is_kept(sdk):
+    """
+    arrange: An unclaimed group a port still attaches, as happens for hours after a scale set
+        is deleted.
+    act: Reconcile.
+    assert: The refusal is logged and the pass continues, because it resolves on a later pass.
+    """
+
+    class _InUse(_FakeNetwork):
+        def __init__(self, groups=()):
+            super().__init__(groups)
+            self.attempts = 0
+
+        def delete_security_group(self, security_group):
+            self.attempts += 1
+            raise openstack.exceptions.ConflictException("Security Group in use")
+
+    network = _InUse(
+        [
+            _FakeGroup(GROUP_NAME, gid="sg-kept", rules=[_stored_rule(**SSH_FIELDS)]),
+            _FakeGroup("garm-orphan", gid="sg-orphan"),
+        ]
+    )
+
+    reconciler = _reconciler(sdk, network)
+
+    reconciler.reconcile(rules={SCALESET_NAME: [SSH]})
+    reconciler.sweep(claimed=[SCALESET_NAME])
+
+    assert network.deleted_groups == []
+    assert network.attempts == 1
+
+
+def test_a_hook_without_delete_permission_still_converges(sdk):
+    """
+    arrange: Credentials that may create and update groups but not delete them.
+    act: Reconcile a scale set whose group exists and an orphan that cannot be deleted.
+    assert: The scale set still gets its id and the pass does not fail, so a missing delete
+        permission degrades the sweep rather than the feature.
+    """
+
+    class _Forbidden(_FakeNetwork):
+        def delete_security_group(self, security_group):
+            raise openstack.exceptions.ForbiddenException("Policy does not allow this request")
+
+    network = _Forbidden(
+        [
+            _FakeGroup(GROUP_NAME, gid="sg-kept", rules=[_stored_rule(**SSH_FIELDS)]),
+            _FakeGroup("garm-orphan", gid="sg-orphan"),
+        ]
+    )
+
+    groups = _reconciler(sdk, network).reconcile(rules={SCALESET_NAME: [SSH]})
+
+    assert groups == {SCALESET_NAME: "sg-kept"}
+
+
+def test_a_scale_set_that_opts_out_has_its_group_deleted(sdk):
+    """
+    arrange: A group this application created, and a scale set that publishes no rules.
+    act: Reconcile an empty mapping, as the opt-out does.
+    assert: The group is deleted, so turning the feature off does not leak it.
+    """
+    network = _FakeNetwork([_FakeGroup(GROUP_NAME, gid="sg-orphan")])
+    reconciler = _reconciler(sdk, network)
+
+    assert reconciler.reconcile(rules={}) == {}
+    assert reconciler.sweep(claimed=[]) == 1
+
+    assert network.deleted_groups == ["sg-orphan"]
+
+
+def test_reconcile_does_not_delete_the_groups_the_sweep_has_not_seen(sdk):
+    """
+    arrange: A group no scale set claims.
+    act: Reconcile, without sweeping.
+    assert: Nothing is deleted, because deletion happens after the scale sets are reconciled —
+        that is when a deleted scale set has released its group.
+    """
+    network = _FakeNetwork([_FakeGroup("garm-renamed-away", gid="sg-orphan")])
+
+    _reconciler(sdk, network).reconcile(rules={})
+
+    assert network.deleted_groups == []
+
+
+def test_a_duplicate_group_name_is_also_swept(sdk):
+    """
+    arrange: Two groups this application created with the same name, from an interrupted pass.
+    act: Reconcile the scale set.
+    assert: Both are converged to the published rules — the copy a runner is attached to must
+        not keep stale rules — and the unattached one is deleted.
+    """
+    network = _FakeNetwork(
+        [
+            _FakeGroup(GROUP_NAME, gid="sg-kept", rules=[_stored_rule(**SSH_FIELDS)]),
+            _FakeGroup(GROUP_NAME, gid="sg-duplicate"),
+        ]
+    )
+
+    reconciler = _reconciler(sdk, network)
+
+    groups = reconciler.reconcile(rules={SCALESET_NAME: [SSH]})
+    reconciler.sweep(claimed=[SCALESET_NAME])
+
+    assert groups == {SCALESET_NAME: "sg-kept"}
+    assert network.deleted_groups == ["sg-duplicate"]
+
+
+def test_a_group_deleted_by_a_concurrent_pass_is_not_an_error(sdk):
+    """
+    arrange: An unclaimed group another pass removes first.
+    act: Reconcile.
+    assert: The pass completes, because the outcome is the one it wanted.
+    """
+
+    class _Gone(_FakeNetwork):
+        def delete_security_group(self, security_group):
+            raise openstack.exceptions.NotFoundException("no such security group")
+
+    network = _Gone([_FakeGroup("garm-orphan", gid="sg-gone")])
+
+    assert _reconciler(sdk, network).reconcile(rules={}) == {}
+
+
+def test_the_group_list_is_scoped_to_the_project(sdk):
+    """
+    arrange: A tenant with a group.
+    act: Reconcile.
+    assert: The list asks for this project only, so admin-scoped credentials cannot sweep
+        another project's groups.
+    """
+    network = _FakeNetwork([_FakeGroup(GROUP_NAME, gid="sg-only")])
+
+    _reconciler(sdk, network).reconcile(rules={SCALESET_NAME: [SSH]})
+
+    assert network.list_queries == ["project-id"]
+
+
+def test_delete_removes_every_group_this_application_created(sdk):
+    """
+    arrange: Groups this application created, and one it did not.
+    act: Delete, as the remove hook does.
+    assert: Only its own groups go, and the call reports it did something.
+    """
+    network = _FakeNetwork(
+        [
+            _FakeGroup(GROUP_NAME, gid="sg-a"),
+            _FakeGroup("garm-other", gid="sg-b"),
+            _FakeGroup("garm-theirs", gid="sg-c", description="Managed by garm-b charm."),
+        ]
+    )
+
+    deleted = _reconciler(sdk, network).delete()
+
+    assert deleted is True
+    assert network.deleted_groups == ["sg-a", "sg-b"]
+
+
+def test_an_openstack_failure_is_reported_to_the_caller(monkeypatch):
+    """
+    arrange: An OpenStack that cannot be reached.
+    act: Reconcile.
+    assert: The failure reaches the caller as one short line, so it can skip those scale sets
+        and report them, rather than creating runners without the group.
+    """
+
+    def connect(**_auth_fields):
+        raise keystoneauth1.exceptions.connection.ConnectFailure("keystone unreachable")
+
+    monkeypatch.setattr("security_groups.openstack.connect", connect)
+
+    with pytest.raises(SecurityGroupReconcileError) as exc_info:
+        SecurityGroupReconciler(provider_config=PROVIDER_CONFIG, owner=OWNER).reconcile(
+            rules={SCALESET_NAME: [SSH]}
+        )
+
+    assert str(exc_info.value) == "keystone unreachable"
+
+
+def test_sweep_reports_an_unreachable_api_without_raising(monkeypatch):
+    """
+    arrange: An OpenStack that cannot be reached.
+    act: Sweep.
+    assert: Nothing is deleted and nothing raises: the scale sets are already reconciled, so a
+        failed sweep costs a retry, not a failed hook.
+    """
+
+    def connect(**_auth_fields):
+        raise openstack.exceptions.SDKException("neutron unreachable")
+
+    monkeypatch.setattr("security_groups.openstack.connect", connect)
+
+    assert (
+        SecurityGroupReconciler(provider_config=PROVIDER_CONFIG, owner=OWNER).sweep(
+            claimed=[SCALESET_NAME]
+        )
+        == 0
+    )
+
+
+def test_delete_never_raises(monkeypatch):
+    """
+    arrange: An OpenStack that cannot be reached while the application is being removed.
+    act: Delete.
+    assert: Nothing is reported deleted and nothing raises, so removal is not blocked.
+    """
+
+    def connect(**_auth_fields):
+        raise openstack.exceptions.SDKException("neutron unreachable")
+
+    monkeypatch.setattr("security_groups.openstack.connect", connect)
+
+    assert SecurityGroupReconciler(provider_config=PROVIDER_CONFIG, owner=OWNER).delete() is False
diff --git a/charms/tests/e2e/test_garm_e2e.py b/charms/tests/e2e/test_garm_e2e.py
index 6edf0069..e00fb16c 100644
--- a/charms/tests/e2e/test_garm_e2e.py
+++ b/charms/tests/e2e/test_garm_e2e.py
@@ -12,6 +12,7 @@
 import uuid
 
 import jubilant
+import openstack
 import pytest
 import requests
 from tests.e2e.conftest import GarmCli
@@ -89,13 +90,20 @@ def test_garm_agent_shell(
     logger.info("Agent shell on %s executed a command successfully", runner_name)
 
 
-def test_garm_e2e(juju: jubilant.Juju, garm_with_ingress: str, e2e_scaleset: str):
+def test_garm_e2e(
+    juju: jubilant.Juju,
+    garm_with_ingress: str,
+    e2e_scaleset: str,
+    openstack_credentials: dict[str, str],
+):
     """
     arrange: GARM deployed with postgresql + traefik ingress; garm-configurator holding real
         ProdStack credentials, a stable runner-image name, and a unique run label;
         GARM's controller metadata_url resolved to the routable LB address.
     act: Dispatch garm_e2e_test_run.yaml against the run label and wait for completion.
-    assert: The workflow run concludes 'success' — which is only reachable if GARM
+    assert: The runner's port carries only the security group the configurator
+        manages — so the group id crossed the relation and the provider's extra spec —
+        and the workflow run concludes 'success', which is only reachable if GARM
         authenticated to OpenStack, booted a VM on the published image, the runner
         registered with GitHub, picked up the job, and exited clean.
     """
@@ -110,6 +118,7 @@ def test_garm_e2e(juju: jubilant.Juju, garm_with_ingress: str, e2e_scaleset: str
 
     # Wait for runner VM to spawn and register before dispatching
     _wait_for_runner_online(juju, garm_with_ingress, label)
+    _assert_runner_uses_the_managed_security_group(openstack_credentials, label)
 
     github_client = create_github_app_client(E2E_APP_ENV)
 
@@ -170,6 +179,54 @@ def _skip_unless_agent_url_is_tls(juju: jubilant.Juju, garm_app: str) -> None:
         )
 
 
+def _assert_runner_uses_the_managed_security_group(
+    credentials: dict[str, str], label: str
+) -> None:
+    """Assert the runner carries the security group the configurator manages for it.
+
+    Nothing else in this suite looks at the runner's port. Without this, a regression
+    that dropped the group id from the relation or from the provider's extra spec would
+    leave every other assertion green: Nova would attach the project's default group
+    instead, and the runner would work exactly as before.
+
+    Args:
+        credentials: The tenant credentials the configurator and provider authenticate with.
+        label: The scale set's unique run label, from which the group name derives.
+    """
+    with openstack.connect(
+        auth_url=credentials["auth_url"],
+        username=credentials["username"],
+        password=credentials["password"],
+        project_name=credentials["project_name"],
+        user_domain_name=credentials["user_domain_name"],
+        project_domain_name=credentials["project_domain_name"],
+        region_name=credentials["region_name"],
+    ) as connection:
+        name = f"garm-{label}"
+        group = connection.network.find_security_group(name, ignore_missing=True)
+        assert group is not None, f"the configurator did not create security group {name}"
+
+        # No ingress: one compromised runner must not be able to reach its peers. The
+        # runner still needs egress for GitHub, GARM, and whatever its jobs fetch.
+        rules = list(connection.network.security_group_rules(security_group_id=group.id))
+        assert {rule.direction for rule in rules} == {"egress"}, (
+            f"security group {name} holds non-egress rules: "
+            f"{[(rule.direction, rule.remote_ip_prefix) for rule in rules]}"
+        )
+
+        ports = [
+            port
+            for port in connection.network.ports(security_group_ids=[group.id])
+            if group.id in (port.security_group_ids or [])
+        ]
+        assert ports, f"no runner port is attached to security group {name}"
+        # Exactly one: OpenStack replaces the project's default group with the ones it is
+        # given, so a second entry would mean the managed group was added, not used.
+        assert ports[0].security_group_ids == [group.id], (
+            f"the runner's port carries {ports[0].security_group_ids} rather than {name} alone"
+        )
+
+
 def _wait_for_runner_online(
     juju: jubilant.Juju,
     garm_app: str,
diff --git a/charms/tests/integration/conftest.py b/charms/tests/integration/conftest.py
index ab713d1b..4be008d1 100644
--- a/charms/tests/integration/conftest.py
+++ b/charms/tests/integration/conftest.py
@@ -844,6 +844,9 @@ def deploy_configurator_with_image_fixture(
         "min-idle-runner": "0",
         "max-runner": "5",
         "org": "test-org",
+        # No OpenStack runs in CI: opt out of the charm-managed security group so the
+        # configurator does not block on an unreachable Keystone.
+        "security-group-rules": "[]",
     }
 
     _deploy_configurator(
diff --git a/charms/tests/integration/requirements.txt b/charms/tests/integration/requirements.txt
index 2152c484..f632ec2a 100644
--- a/charms/tests/integration/requirements.txt
+++ b/charms/tests/integration/requirements.txt
@@ -1,4 +1,5 @@
 jubilant
+openstacksdk
 PyGithub
 ops
 pytest
diff --git a/charms/tests/integration/test_garm_configurator.py b/charms/tests/integration/test_garm_configurator.py
index c0fc03b1..703ee2cf 100644
--- a/charms/tests/integration/test_garm_configurator.py
+++ b/charms/tests/integration/test_garm_configurator.py
@@ -57,6 +57,9 @@ def deploy_garm_configurator_app_fixture(
             "os-arch": "amd64",
             "max-runner": "1",
             "repo": "myorg/myrepo",
+            # No OpenStack runs in CI: opt out of the charm-managed security group so the
+            # configurator does not block on an unreachable Keystone.
+            "security-group-rules": "[]",
         },
     )
     juju.wait(
diff --git a/docs/.custom_wordlist.txt b/docs/.custom_wordlist.txt
index 85f7ee1c..b1661cec 100644
--- a/docs/.custom_wordlist.txt
+++ b/docs/.custom_wordlist.txt
@@ -14,6 +14,7 @@ docstrings?
 dvipng
 filelog
 fonts
+ethertype
 freefont
 Furo
 Garm
@@ -39,6 +40,7 @@ LogQL
 Loki
 Makefile
 Multipass
+nftables
 MyST
 Numpy
 OAuth
@@ -63,6 +65,7 @@ reStructuredText
 retrigger(ing)?
 Rockcraft
 rst
+ruleset
 scaleset
 scalesets
 SCons
@@ -90,11 +93,13 @@ ulwazi
 uncomment(ing)?
 URI(s)?
 URL
+untrusted
 utils
 uv
 VMs
 WCAG
 whitespace
+workloadless
 whitespaces
 wordlist
 xetex
diff --git a/docs/adr/004_security_group_ownership.md b/docs/adr/004_security_group_ownership.md
new file mode 100644
index 00000000..f0ebb154
--- /dev/null
+++ b/docs/adr/004_security_group_ownership.md
@@ -0,0 +1,117 @@
+---
+title: ADR-004 - policy in the configurator, security group lifecycle in the GARM charm
+author: Yangsoo Yoon (yangsoo.yoon@canonical.com)
+date: 2026/10/20
+domain: architecture
+replaced-by:
+---
+
+# Policy in the configurator, security group lifecycle in the GARM charm
+
+A `garm-configurator` charm describes one scale set and publishes that description over a
+relation; the `garm` charm acts on it. The security group that isolates a scale set's runners
+splits along that line: the configurator owns the rules as configuration, and the GARM charm
+creates, maintains, and deletes the group. This ADR records why, because creating a resource in
+a cloud is what Juju calls an
+[integrator charm](https://canonical.com/juju/docs/juju-cli/3.6/reference/charm/#integrator-charm),
+while the charm doing it here is the one Juju calls a
+[configurator charm](https://canonical.com/juju/docs/juju-cli/3.6/reference/charm/#configurator-charm).
+
+## Context
+
+Juju defines a configurator charm as a workloadless charm that configures another charm once
+they are integrated, and an integrator charm as a proxy charm whose non-charmed workload is
+cloud functionality. The categories nest — an integrator is a kind of proxy charm, which is a
+kind of configurator — and what separates them in practice is where the effect lands.
+
+A scale set's security group outlives the runners it was created for: OpenStack attaches a group
+to a port for the life of the virtual machine. Whoever manages the group therefore has to answer
+two questions that only the scale set's own lifecycle can answer: when is the group safe to
+delete, and what happens when the scale set is renamed or removed.
+
+The configurator cannot answer either. It knows the definition, not the runners. It can delete on
+opt-out and on its own removal, and it must tolerate "still in use" indefinitely; a rename leaves
+the group behind, because the charm keeps no record of the previous name. The GARM charm does
+know: it retires a generation, drains it, removes its runners, and deletes the scale set only
+after GARM reports none left — the exact moment the group becomes safe to delete.
+
+Earlier in this work the opposite split was implemented: the configurator created and converged
+the group and published its id. It worked, but it accumulated the lifecycle problem described
+above, and it gave the configurator an OpenStack client, permissions, and a network path it
+otherwise never needed.
+
+## Decision
+
+The configurator owns the policy. It validates `security-group-rules` and publishes them on the
+relation, so the rules are modelled in Juju — typed, validated, visible in `juju config` and the
+Terraform module — and an invalid combination is rejected before anything reaches the cloud.
+
+The GARM charm owns the lifecycle. It creates `garm-<scale set name>`, keeps its rules equal to
+the published list, passes the id to the provider as the scale set's `security_groups` extra
+spec, and deletes the group once no scale set claims it: after a rename or a removal, and after
+the drained scale set is gone.
+
+Each side keeps what it needs to do its part:
+
+* The configurator needs no cloud credentials, no permissions, and no network path to OpenStack,
+  and stays a configurator.
+* The GARM charm already receives the tenant credentials to render the provider's configuration,
+  already reaches OpenStack through the provider it runs, and already owns the scale set's
+  create, drain, and delete path.
+
+The group's name is derived from the scale set name on both sides, so moving the management kept
+the resource identical: an upgrade reuses the group the configurator created rather than
+replacing it.
+
+## Consequences
+
+* A failed OpenStack reconcile fails closed. The scale sets of that tenant are claimed but left
+  alone for the pass, so they are neither created without their group nor mistaken for orphans,
+  and the unit reports it in its status.
+* The GARM charm gains an OpenStack client and the permissions to create and delete groups and
+  their rules. A role without delete permission still works: groups it cannot remove are logged
+  and left.
+* A group a port still attaches cannot be deleted. That is expected for some time after a scale
+  set is removed, because OpenStack removes the port asynchronously, so it is logged at info and
+  retried on a later reconcile.
+* Runners that already exist keep the group they were launched with. A changed group reaches new
+  runners only; existing ones pick it up as they are replaced.
+* Removing only the configurator takes its credentials away before the GARM charm can delete the
+  remaining groups. Remove the GARM application too, or delete the groups by hand. The removal
+  path retries a group whose port is still being removed, because nothing runs after it.
+* The GARM charm must be upgraded before the configurator that publishes rules: a GARM charm
+  given a configurator that predates this split sees no rules, and treats the scale set as one it
+  must not touch rather than sweeping a group it does not know about.
+* Scale set names must be unique within a project: the group is named after the scale set, and
+  two deployments using one name would share a group and keep removing each other's rules.
+
+## Alternatives considered
+
+**The configurator manages the group**, as this branch first implemented. It keeps every input
+and the credentials in one place, and the relation remains a pure id hand-over. Rejected on
+lifecycle: the configurator cannot see runner ports, so it cannot know when a group is safe to
+delete, and a rename or its own removal leaves the group behind against the project's quota.
+
+**The operator creates the group and passes it by reference.** A configuration option naming a
+group, forwarded to the provider, with no cloud writes from either charm. Rejected because it
+does not deliver the aim: neither charm could keep the rules right, and every scale set would
+need its group created before it works. The rules are the security control, not a reference to
+one.
+
+**The provider's `default_security_groups` configuration.** The provider applies a list to every
+instance it creates. Rejected because it applies per provider rather than per scale set, and the
+group still has to be created and kept right — the same work, in the same place, with less
+precision.
+
+**Enforce egress inside the runner instead of in OpenStack.** A rendered nftables ruleset in the
+runner template needs no cloud permissions. Rejected as isolation: a runner runs untrusted job
+code as root and can flush its own firewall, so it is defence in depth at best.
+
+```{seealso}
+{ref}`Charm reference <reference_charm_reference>` for the option, its default and the group's
+lifecycle, and the Juju charm reference for the
+[configurator](https://canonical.com/juju/docs/juju-cli/3.6/reference/charm/#configurator-charm)
+and
+[integrator](https://canonical.com/juju/docs/juju-cli/3.6/reference/charm/#integrator-charm)
+definitions.
+```
diff --git a/docs/changelog.md b/docs/changelog.md
index 56f84cc5..b07cacbd 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 Each revision is versioned by the date of the revision.
 
+## 2026-10-22
+
+- `garm-configurator`: add the `security-group-rules` configuration, which isolates a scale set's runners in their own OpenStack security group instead of the project's default group. The configurator validates the rules and publishes them; the `garm` charm creates the group, keeps its rules equal to the published list, and attaches it to every runner. The option is on by default and the default allows all egress and no ingress, so after the refresh each scale set gets one group, which counts against the project's security group quota and needs credentials allowed to create and delete security groups and their rules. Set the option to `[]` to manage no group. The `garm` charm deletes a group once no scale set claims it, and removing only the configurator leaves its groups behind.
+
 ## 2026-10-21
 
 - `garm`: job steps now see `USER` and `LOGNAME` set to the account their UID resolves to, so `usermod -aG <group> $USER` followed by `sg <group>` works on GARM runners. This works around the duplicate-UID account layout of the runner images; removal is tracked in [#438](https://github.com/canonical/github-runner-operators/issues/438).
diff --git a/docs/reference/charms.md b/docs/reference/charms.md
index 45d305ec..07404779 100644
--- a/docs/reference/charms.md
+++ b/docs/reference/charms.md
@@ -45,6 +45,35 @@ The GARM charm supports integration with COS (Canonical Observability Stack). Se
 [Integrations for GARM charm](https://charmhub.io/garm/integrations)
 ```
 
+(garm-charm-security-groups)=
+
+### Security groups
+
+When a configurator publishes `security-group-rules`, the GARM charm creates one OpenStack
+security group for each scale set, named `garm-<scale set name>`, in that configurator's project.
+It keeps the group's rules equal to the published list — a rule that is not listed is removed,
+including one added by hand — and passes the group's id to the OpenStack provider as the scale
+set's `security_groups` extra spec, so every runner of that scale set is attached to it.
+
+The GARM charm owns the group's lifecycle because it is the charm that knows when the group can
+go. A group is deleted once no scale set claims it: when a scale set is renamed or removed, its
+runners are drained and deleted first, then the group follows. A group that a port still
+attaches cannot be deleted; that is expected for some time after a scale set is removed, because
+OpenStack removes the port asynchronously, so it is logged and retried on the next reconcile.
+
+Two limits are worth knowing. Runners that already exist keep the group they were launched with,
+so a scale set picks up a new or changed group only as its runners are replaced. And removing
+only the configurator takes its credentials with it, so the GARM charm cannot delete the
+remaining groups; remove the GARM application too.
+
+Scale set names must be unique within a project: the group is named after the scale set, so two
+deployments using the same name would share one group and keep removing each other's rules.
+
+The OpenStack credentials need `create_security_group`, `delete_security_group`,
+`create_security_group_rule`, and `delete_security_group_rule`, plus read access to security
+groups and their rules, which the default `reader` role provides. Credentials that may not delete
+groups still work: the charm logs a warning and keeps the groups it cannot remove.
+
 ## GARM configurator charm
 
 The GARM configurator charm provides a set of configurations of GitHub runner scaleset to the GARM charm. Multiple GARM configurator charms can be integrated to a single GARM charm, with each instance of GARM configurator charm representing a single GitHub runner scaleset in GARM.
@@ -74,6 +103,31 @@ options and defaults before applying the configuration.
 [Configurations for GARM configurator charm](https://charmhub.io/garm-configurator/configurations)
 ```
 
+### Security groups
+
+The `security-group-rules` option, on by default, describes the OpenStack security group each
+scale set's runners should be attached to. The configurator validates the rules and publishes
+them on the `garm-configurator` relation; it makes no OpenStack call itself, so it needs no
+permissions and no network path to the cloud. The GARM charm creates and maintains the group
+(see [security groups in the GARM charm](#garm-charm-security-groups)).
+
+Each rule takes a `direction` (`ingress` or `egress`), an optional `protocol` (`tcp`, `udp`,
+`icmp`, `icmpv6`, or `any`), optional `port_min`/`port_max` for `tcp` and `udp`, and an optional
+`remote_ip_prefix` CIDR. Without a prefix a rule covers every address of its ethertype, which is
+IPv4 unless the CIDR is IPv6.
+
+The default allows all egress and no ingress. OpenStack attaches the configured group instead of
+the project's default security group, so a list with no egress rule is rejected rather than
+converged: a runner with no egress cannot reach GitHub. Nothing the charms provide needs an
+ingress rule — the GARM remote shell rides the agent's connection, which the runner opens, and a
+`debug-ssh` session is an outbound tmate client on the runner.
+
+Set the option to an empty list to manage no group. The GARM charm then attaches nothing and
+removes the group it created, leaving the runners on the project's default group.
+
+A rule change is applied to the group at the next GARM reconcile, which reaches new runners
+immediately and existing ones only when they are replaced.
+
 ### Integrations
 
 The GARM configurator charm integrates with a GARM charm. The GARM charm manages
diff --git a/docs/reference/security.md b/docs/reference/security.md
index 510e0075..54ac0755 100644
--- a/docs/reference/security.md
+++ b/docs/reference/security.md
@@ -39,6 +39,12 @@ operator responsibilities, see the {ref}`security overview <explanation_security
   URL syntax validation does not guarantee encrypted transport.
 - ``pre-install-scripts`` and ``pre-job-script`` are trusted operator-supplied
   shell code.
+- The configurator's ``security-group-rules`` option creates and converges one
+  OpenStack security group per scale set. OpenStack attaches that group instead of
+  the project's default group, and the charm removes rules it does not manage from
+  it, so a rule added by hand is deleted unless it is also listed in the option.
+  When groups share the managed name, the charm deletes the unused duplicates and
+  leaves any group a port still attaches in place.
 
 ## Removal and vulnerability reporting