diff --git a/rules/guardrails.json b/rules/guardrails.json
index 7ace609c..d8b01db6 100644
--- a/rules/guardrails.json
+++ b/rules/guardrails.json
@@ -159,7 +159,8 @@
     "C:\\Windows\\CCM\\Logs",
     "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
     "C:\\ProgramData\\Microsoft\\Windows\\WER",
-    "C:\\Windows\\Logs\\CBS"
+    "C:\\Windows\\Logs\\CBS",
+    "C:\\Install\\Log"
   ],
   "blockedFilePrefixes": [
     "C:\\Users"
diff --git a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Collectors/DiagnosticsPathGuards.cs b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Collectors/DiagnosticsPathGuards.cs
index 23388e25..f37e27ca 100644
--- a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Collectors/DiagnosticsPathGuards.cs
+++ b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Collectors/DiagnosticsPathGuards.cs
@@ -58,6 +58,9 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
 
             // Windows Component-Based Servicing
             @"C:\Windows\Logs\CBS",
+
+            // Custom install logs (e.g. app installers writing to C:\Install\Log\)
+            @"C:\Install\Log",
         };
 
         // Hard blocks: never allowed, even in unrestricted mode
diff --git a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Core/DiagnosticsPackageService.cs b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Core/DiagnosticsPackageService.cs
index 6c0b128b..0fbd74b0 100644
--- a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Core/DiagnosticsPackageService.cs
+++ b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Core/DiagnosticsPackageService.cs
@@ -50,6 +50,16 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Core
         private static readonly string AgentLogFolder =
             Environment.ExpandEnvironmentVariables(Constants.LogDirectory);
 
+        /// <summary>
+        /// File extensions collected from built-in log folders (Agent + IME).
+        /// Covers standard logs, structured data, traces, event logs, and diagnostics archives.
+        /// </summary>
+        private static readonly string[] LogFilePatterns = new[]
+        {
+            "*.log", "*.txt", "*.json", "*.jsonl",
+            "*.etl", "*.evtx", "*.xml", "*.csv", "*.cab"
+        };
+
         public DiagnosticsPackageService(AgentConfiguration configuration, AgentLogger logger, BackendApiClient apiClient)
         {
             _configuration = configuration;
@@ -113,11 +123,12 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Core
                         AddSessionInfo(archive, enrollmentSucceeded);
 
                         // 2. Agent logs
-                        AddLogFiles(archive, AgentLogFolder, "AgentLogs", "*.log");
+                        foreach (var pattern in LogFilePatterns)
+                            AddLogFiles(archive, AgentLogFolder, "AgentLogs", pattern);
 
-                        // 3. IME logs
-                        AddLogFiles(archive, ImeLogFolder, "ImeLogs", "IntuneManagementExtension*.log");
-                        AddLogFiles(archive, ImeLogFolder, "ImeLogs", "AppWorkload*.log");
+                        // 3. IME logs (all relevant files in the IME log folder)
+                        foreach (var pattern in LogFilePatterns)
+                            AddLogFiles(archive, ImeLogFolder, "ImeLogs", pattern);
 
                         // 4. Configured additional log paths (global + tenant, validated by guards)
                         foreach (var entry in _configuration.DiagnosticsLogPaths ?? new System.Collections.Generic.List<Shared.Models.DiagnosticsLogPath>())
diff --git a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
index dca34d14..5559899b 100644
--- a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
@@ -1 +1 @@
-842
+846