diff --git a/.github/resolve-sibling-refs.sh b/.github/resolve-sibling-refs.sh
index 08f5db5b9..2fc9cbae0 100755
--- a/.github/resolve-sibling-refs.sh
+++ b/.github/resolve-sibling-refs.sh
@@ -1,20 +1,21 @@
 #!/usr/bin/env bash
-# Resolve which branch of each sibling repo (viperblock, predastore) the CI
-# workspace should build against. A cross-repo change is developed on a branch
+# Resolve which branch of each sibling repo (viperblock, predastore, northstar)
+# the CI workspace should build against. A cross-repo change is developed on a branch
 # of the SAME name in each repo; build against that branch when it exists so the
 # set can be tested together, and fall back to dev otherwise. This mirrors the
 # resolution the e2e path already does in
 # mulga/scripts/tofu-cluster/build-install-artifacts.sh, so unit CI and e2e CI
 # agree on how sibling branches are selected.
 #
-# Reads $BRANCH (the triggering head/ref name) and writes viperblock=<ref> and
-# predastore=<ref> to $GITHUB_OUTPUT for the checkout steps to consume.
+# Reads $BRANCH (the triggering head/ref name) and writes viperblock=<ref>,
+# predastore=<ref> and northstar=<ref> to $GITHUB_OUTPUT for the checkout steps
+# to consume.
 set -euo pipefail
 
 : "${BRANCH:?BRANCH must be set to the triggering branch name}"
 : "${GITHUB_OUTPUT:?GITHUB_OUTPUT must be set}"
 
-for repo in viperblock predastore; do
+for repo in viperblock predastore northstar; do
   if git ls-remote --exit-code --heads \
       "https://github.com/mulgadc/${repo}.git" "$BRANCH" >/dev/null 2>&1; then
     ref="$BRANCH"
diff --git a/.github/workflows/publish-system-ami.yml b/.github/workflows/publish-system-ami.yml
index c93b098a0..16940d2a5 100644
--- a/.github/workflows/publish-system-ami.yml
+++ b/.github/workflows/publish-system-ami.yml
@@ -99,6 +99,13 @@ jobs:
           ref: dev
           path: predastore
 
+      - name: Checkout Northstar
+        uses: actions/checkout@v7
+        with:
+          repository: mulgadc/northstar
+          ref: dev
+          path: northstar
+
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
@@ -116,7 +123,7 @@ jobs:
         # "go.work already exists".
         run: |
           rm -f go.work go.work.sum
-          go work init ./spinifex ./viperblock ./predastore
+          go work init ./spinifex ./viperblock ./predastore ./northstar
 
       - name: Install build + upload tooling
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 042ed566c..76f04ebaa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,6 +28,12 @@ jobs:
           repository: mulgadc/viperblock
           path: viperblock
 
+      - name: Checkout Northstar
+        uses: actions/checkout@v7
+        with:
+          repository: mulgadc/northstar
+          path: northstar
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -73,6 +79,12 @@ jobs:
           repository: mulgadc/viperblock
           path: viperblock
 
+      - name: Checkout Northstar
+        uses: actions/checkout@v7
+        with:
+          repository: mulgadc/northstar
+          path: northstar
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -268,6 +280,12 @@ jobs:
           repository: mulgadc/viperblock
           path: viperblock
 
+      - name: Checkout Northstar
+        uses: actions/checkout@v7
+        with:
+          repository: mulgadc/northstar
+          path: northstar
+
       - name: Checkout Mulga iso-builder
         uses: actions/checkout@v7
         with:
@@ -286,7 +304,7 @@ jobs:
           cache: false
 
       - name: Configure Go workspace
-        run: go work init ./spinifex ./predastore ./viperblock
+        run: go work init ./spinifex ./predastore ./viperblock ./northstar
 
       - name: Install ISO builder dependencies
         run: |
diff --git a/.github/workflows/segscan-oracle.yml b/.github/workflows/segscan-oracle.yml
index b4d625aba..a46b82458 100644
--- a/.github/workflows/segscan-oracle.yml
+++ b/.github/workflows/segscan-oracle.yml
@@ -51,6 +51,13 @@ jobs:
           ref: ${{ steps.siblings.outputs.predastore }}
           path: predastore
 
+      - name: Checkout Northstar
+        uses: actions/checkout@v7
+        with:
+          repository: mulgadc/northstar
+          ref: ${{ steps.siblings.outputs.northstar }}
+          path: northstar
+
       - uses: actions/create-github-app-token@v3
         id: app-token
         with:
@@ -73,7 +80,7 @@ jobs:
           go-version-file: "spinifex/go.mod"
 
       - name: Setup Go Workspace
-        run: go work init ./spinifex ./viperblock ./predastore
+        run: go work init ./spinifex ./viperblock ./predastore ./northstar
 
       - name: Run Segscan Oracle Test
         env:
diff --git a/.github/workflows/spinifex.yml b/.github/workflows/spinifex.yml
index 988909c45..16f9e71e4 100644
--- a/.github/workflows/spinifex.yml
+++ b/.github/workflows/spinifex.yml
@@ -53,6 +53,13 @@ jobs:
           ref: ${{ steps.siblings.outputs.predastore }}
           path: predastore
 
+      - name: Checkout Northstar
+        uses: actions/checkout@v7
+        with:
+          repository: mulgadc/northstar
+          ref: ${{ steps.siblings.outputs.northstar }}
+          path: northstar
+
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
@@ -60,7 +67,7 @@ jobs:
           go-version-file: "spinifex/go.mod"
 
       - name: Setup Go Workspace
-        run: go work init ./spinifex ./viperblock ./predastore
+        run: go work init ./spinifex ./viperblock ./predastore ./northstar
 
       - name: Build Spinifex
         run: make -C spinifex build
@@ -114,6 +121,13 @@ jobs:
           ref: ${{ steps.siblings.outputs.predastore }}
           path: predastore
 
+      - name: Checkout Northstar
+        uses: actions/checkout@v7
+        with:
+          repository: mulgadc/northstar
+          ref: ${{ steps.siblings.outputs.northstar }}
+          path: northstar
+
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
@@ -121,7 +135,7 @@ jobs:
           go-version-file: "spinifex/go.mod"
 
       - name: Setup Go Workspace
-        run: go work init ./spinifex ./viperblock ./predastore
+        run: go work init ./spinifex ./viperblock ./predastore ./northstar
 
       - name: Run Integration Tests
         run: make -C spinifex test-integration
@@ -157,6 +171,13 @@ jobs:
           ref: ${{ steps.siblings.outputs.predastore }}
           path: predastore
 
+      - name: Checkout Northstar
+        uses: actions/checkout@v7
+        with:
+          repository: mulgadc/northstar
+          ref: ${{ steps.siblings.outputs.northstar }}
+          path: northstar
+
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
@@ -164,7 +185,7 @@ jobs:
           go-version-file: "spinifex/go.mod"
 
       - name: Setup Go Workspace
-        run: go work init ./spinifex ./viperblock ./predastore
+        run: go work init ./spinifex ./viperblock ./predastore ./northstar
 
       - name: Run Tests with Race Detector
         run: make -C spinifex test-race
@@ -200,6 +221,13 @@ jobs:
           ref: ${{ steps.siblings.outputs.predastore }}
           path: predastore
 
+      - name: Checkout Northstar
+        uses: actions/checkout@v7
+        with:
+          repository: mulgadc/northstar
+          ref: ${{ steps.siblings.outputs.northstar }}
+          path: northstar
+
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
@@ -207,7 +235,7 @@ jobs:
           go-version-file: "spinifex/go.mod"
 
       - name: Setup Go Workspace
-        run: go work init ./spinifex ./viperblock ./predastore
+        run: go work init ./spinifex ./viperblock ./predastore ./northstar
 
       - name: Lint
         uses: golangci/golangci-lint-action@v9
diff --git a/build/Dockerfile.distro b/build/Dockerfile.distro
index 3a7073070..cd3fedb12 100644
--- a/build/Dockerfile.distro
+++ b/build/Dockerfile.distro
@@ -16,9 +16,10 @@ COPY predastore/go.mod predastore/go.sum ./predastore/
 COPY viperblock/go.mod viperblock/go.sum ./viperblock/
 COPY viperblock/nbd/go.mod viperblock/nbd/go.sum ./viperblock/nbd/
 COPY viperblock/nbd/libguestfs.org/nbdkit/go.mod ./viperblock/nbd/libguestfs.org/nbdkit/
+COPY northstar/go.mod northstar/go.sum ./northstar/
 
 # Generate go.work (gitignored, so not in checkout)
-RUN cd spinifex && go work init . ../predastore ../viperblock ../viperblock/nbd ../viperblock/nbd/libguestfs.org/nbdkit
+RUN cd spinifex && go work init . ../predastore ../viperblock ../viperblock/nbd ../viperblock/nbd/libguestfs.org/nbdkit ../northstar
 
 # Download dependencies (cached layer)
 RUN cd spinifex && go mod download
@@ -27,6 +28,7 @@ RUN cd spinifex && go mod download
 COPY spinifex/ ./spinifex/
 COPY predastore/ ./predastore/
 COPY viperblock/ ./viperblock/
+COPY northstar/ ./northstar/
 
 # Build spinifex binary (spx)
 RUN COMMIT=$(cd spinifex && git rev-parse --short HEAD 2>/dev/null || echo "unknown") && \
diff --git a/scripts/clone-deps.sh b/scripts/clone-deps.sh
index 8eb63de19..48ee9e19f 100755
--- a/scripts/clone-deps.sh
+++ b/scripts/clone-deps.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
 # Spinifex Development Dependencies Setup Script
-# This script clones Viperblock and Predastore repositories for cross-repo development
+# This script clones the Viperblock, Predastore and Northstar repositories for
+# cross-repo development
 
 set -e
 
@@ -38,15 +39,18 @@ clone_or_update() {
 # Repository URLs - Update these with actual repository URLs
 VIPERBLOCK_REPO="${VIPERBLOCK_REPO:-https://github.com/mulgadc/viperblock.git}"
 PREDASTORE_REPO="${PREDASTORE_REPO:-https://github.com/mulgadc/predastore.git}"
+NORTHSTAR_REPO="${NORTHSTAR_REPO:-https://github.com/mulgadc/northstar.git}"
 
 echo "🔗 Repository URLs:"
 echo "   Viperblock: $VIPERBLOCK_REPO"
 echo "   Predastore: $PREDASTORE_REPO"
+echo "   Northstar:  $NORTHSTAR_REPO"
 echo ""
 
 # Clone dependencies
 clone_or_update "$VIPERBLOCK_REPO" "viperblock"
 clone_or_update "$PREDASTORE_REPO" "predastore"
+clone_or_update "$NORTHSTAR_REPO" "northstar"
 
 # Verify go.mod replace directives
 echo ""
@@ -66,10 +70,17 @@ else
     echo "replace github.com/mulgadc/predastore => ../predastore" >> "$PROJECT_ROOT/go.mod"
 fi
 
+if grep -q "replace github.com/mulgadc/northstar => ../northstar" "$PROJECT_ROOT/go.mod"; then
+    echo "✅ Northstar replace directive found"
+else
+    echo "⚠️  Adding Northstar replace directive to go.mod"
+    echo "replace github.com/mulgadc/northstar => ../northstar" >> "$PROJECT_ROOT/go.mod"
+fi
+
 # Verify directory structure
 echo ""
 echo "📁 Directory structure:"
-ls -la "$MULGA_ROOT" | grep -E "(spinifex|viperblock|predastore)" || true
+ls -la "$MULGA_ROOT" | grep -E "(spinifex|viperblock|predastore|northstar)" || true
 
 echo ""
 echo "🎉 Development environment setup complete!"