diff --git a/frontend/components/EmptyState/_styles.scss b/frontend/components/EmptyState/_styles.scss
index d2f4dfdaa20..7b9961dd83f 100644
--- a/frontend/components/EmptyState/_styles.scss
+++ b/frontend/components/EmptyState/_styles.scss
@@ -158,7 +158,7 @@ $ghost-cell-padding-x: $pad-large; // 24px, matches Figma
   // Form variant — ghost form fields with a save button
   // ----------------------------------------------------------
   &--form {
-    height: 320px;
+    height: $ghost-table-height;
 
     .empty-state__ghost-table {
       display: block;
diff --git a/frontend/interfaces/secrets.ts b/frontend/interfaces/variables.ts
similarity index 63%
rename from frontend/interfaces/secrets.ts
rename to frontend/interfaces/variables.ts
index 5db7b844049..c624d400453 100644
--- a/frontend/interfaces/secrets.ts
+++ b/frontend/interfaces/variables.ts
@@ -1,11 +1,11 @@
-export interface ISecret {
+export interface IVariable {
   id: number;
   name: string;
   created_at: string;
   updated_at: string;
 }
 
-export interface ISecretPayload {
+export interface IVariablePayload {
   name: string;
   value: string;
 }
diff --git a/frontend/pages/ManageControlsPage/Scripts/ScriptBatchDetailsPage/ScriptBatchDetailsPage.tsx b/frontend/pages/ManageControlsPage/Scripts/ScriptBatchDetailsPage/ScriptBatchDetailsPage.tsx
index 873b0d90036..93fac9d810e 100644
--- a/frontend/pages/ManageControlsPage/Scripts/ScriptBatchDetailsPage/ScriptBatchDetailsPage.tsx
+++ b/frontend/pages/ManageControlsPage/Scripts/ScriptBatchDetailsPage/ScriptBatchDetailsPage.tsx
@@ -43,7 +43,7 @@ import TabNav from "components/TabNav";
 import TabText from "components/TabText";
 import ViewAllHostsLink from "components/ViewAllHostsLink";
 
-import getWhen from "../helpers";
+import { getWhen } from "../helpers";
 import CancelScriptBatchModal from "../components/CancelScriptBatchModal";
 import ScriptBatchHostsTable from "./components/ScriptBatchHostsTable";
 
diff --git a/frontend/pages/ManageControlsPage/Scripts/cards/ScriptBatchProgress/ScriptBatchProgress.tests.tsx b/frontend/pages/ManageControlsPage/Scripts/cards/ScriptBatchProgress/ScriptBatchProgress.tests.tsx
index 4c9af299274..4e8ba86a4a8 100644
--- a/frontend/pages/ManageControlsPage/Scripts/cards/ScriptBatchProgress/ScriptBatchProgress.tests.tsx
+++ b/frontend/pages/ManageControlsPage/Scripts/cards/ScriptBatchProgress/ScriptBatchProgress.tests.tsx
@@ -12,9 +12,7 @@ import { ScriptBatchStatus } from "interfaces/script";
 
 import { createMockBatchScriptSummary } from "__mocks__/scriptMock";
 
-import ScriptBatchProgress, {
-  EMPTY_STATE_DETAILS,
-} from "./ScriptBatchProgress";
+import ScriptBatchProgress from "./ScriptBatchProgress";
 import { ScriptsLocation } from "../../Scripts";
 
 const waitForLoadingToFinish = async (container: HTMLElement) => {
@@ -114,6 +112,12 @@ const getTestLocation = (status: ScriptBatchStatus): ScriptsLocation => ({
   search: `?status=${status}`,
 });
 
+const EMPTY_STATE_TEXT: Record<ScriptBatchStatus, string> = {
+  started: "Scripts running on multiple hosts will appear here.",
+  scheduled: "Scheduled scripts will appear here.",
+  finished: "Completed or canceled batch scripts will appear here.",
+};
+
 const testTabURLNavAndEmpty = async (status: ScriptBatchStatus) => {
   const render = createCustomRenderer({
     withBackendMock: true,
@@ -144,7 +148,7 @@ const testTabURLNavAndEmpty = async (status: ScriptBatchStatus) => {
 
   await waitForLoadingToFinish(container);
 
-  expect(screen.getByText(EMPTY_STATE_DETAILS[status])).toBeInTheDocument();
+  expect(screen.getByText(EMPTY_STATE_TEXT[status])).toBeInTheDocument();
   cleanup();
 };
 
diff --git a/frontend/pages/ManageControlsPage/Scripts/cards/ScriptBatchProgress/ScriptBatchProgress.tsx b/frontend/pages/ManageControlsPage/Scripts/cards/ScriptBatchProgress/ScriptBatchProgress.tsx
index b4431877403..121bc24f850 100644
--- a/frontend/pages/ManageControlsPage/Scripts/cards/ScriptBatchProgress/ScriptBatchProgress.tsx
+++ b/frontend/pages/ManageControlsPage/Scripts/cards/ScriptBatchProgress/ScriptBatchProgress.tsx
@@ -12,6 +12,7 @@ import scriptsAPI, {
 import { isValidScriptBatchStatus, ScriptBatchStatus } from "interfaces/script";
 
 import { COLORS } from "styles/var/colors";
+import { LEARN_MORE_ABOUT_BASE_LINK } from "utilities/constants";
 
 import Spinner from "components/Spinner";
 import ProgressBar from "components/ProgressBar";
@@ -22,9 +23,10 @@ import PaginatedList, { IPaginatedListHandle } from "components/PaginatedList";
 import ListItem from "components/ListItem";
 import Icon from "components/Icon/Icon";
 import EmptyState from "components/EmptyState";
+import CustomLink from "components/CustomLink";
 
 import { IScriptsCommonProps } from "../../ScriptsNavItems";
-import getWhen from "../../helpers";
+import { getWhen } from "../../helpers";
 
 const baseClass = "script-batch-progress";
 
@@ -34,19 +36,36 @@ const STATUS_BY_INDEX: ScriptBatchStatus[] = [
   "finished",
 ];
 
-export const EMPTY_STATE_DETAILS: Record<ScriptBatchStatus, string> = {
-  started: "When a script is run on multiple hosts, progress will appear here.",
-  scheduled:
-    "When a script is scheduled to run in the future, it will appear here.",
-  finished:
-    "When a batch script is completed or canceled, historical results will appear here.",
+const EMPTY_STATE_DETAILS: Record<ScriptBatchStatus, JSX.Element> = {
+  started: (
+    <>
+      Scripts running on multiple hosts will appear here. <br />
+      <CustomLink
+        url={`${LEARN_MORE_ABOUT_BASE_LINK}/batch-scripts`}
+        newTab
+        text="Learn more about batch scripts"
+      />
+    </>
+  ),
+  scheduled: (
+    <>
+      Scheduled scripts will appear here.
+      <br />
+      <CustomLink
+        url={`${LEARN_MORE_ABOUT_BASE_LINK}/batch-scripts`}
+        newTab
+        text="Learn more about batch scripts"
+      />
+    </>
+  ),
+  finished: <>Completed or canceled batch scripts will appear here.</>,
 };
 
 const getEmptyState = (status: ScriptBatchStatus) => {
   return (
     <EmptyState
       variant="list"
-      header={`No batch scripts ${status} for this fleet`}
+      header={`No batch scripts ${status}`}
       info={EMPTY_STATE_DETAILS[status]}
     />
   );
diff --git a/frontend/pages/ManageControlsPage/Scripts/cards/ScriptLibrary/ScriptLibrary.tests.tsx b/frontend/pages/ManageControlsPage/Scripts/cards/ScriptLibrary/ScriptLibrary.tests.tsx
new file mode 100644
index 00000000000..93b38d8032b
--- /dev/null
+++ b/frontend/pages/ManageControlsPage/Scripts/cards/ScriptLibrary/ScriptLibrary.tests.tsx
@@ -0,0 +1,140 @@
+import React from "react";
+import { screen, waitFor } from "@testing-library/react";
+import {
+  baseUrl,
+  createCustomRenderer,
+  createMockRouter,
+} from "test/test-utils";
+import mockServer from "test/mock-server";
+import { http, HttpResponse } from "msw";
+
+import ScriptLibrary from "./ScriptLibrary";
+import { ScriptsLocation } from "../../Scripts";
+
+const mockRouter = createMockRouter();
+
+const mockLocation: ScriptsLocation = {
+  pathname: "/controls/scripts/library",
+  query: {},
+  search: "",
+};
+
+const emptyScriptsHandler = http.get(baseUrl("/scripts"), () =>
+  HttpResponse.json({
+    scripts: [],
+    meta: { has_next_results: false, has_previous_results: false },
+  })
+);
+
+const baseProps = {
+  router: mockRouter,
+  teamId: 1,
+  location: mockLocation,
+};
+
+describe("ScriptLibrary empty state", () => {
+  it("renders Upload CTA and info text for global admin", async () => {
+    mockServer.use(emptyScriptsHandler);
+
+    const render = createCustomRenderer({
+      withBackendMock: true,
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          config: {
+            server_settings: { scripts_disabled: false },
+          },
+        },
+      },
+    });
+
+    render(<ScriptLibrary {...baseProps} />);
+
+    await waitFor(() => {
+      expect(screen.getByText("No scripts")).toBeInTheDocument();
+    });
+    expect(screen.getByRole("button", { name: /upload/i })).toBeInTheDocument();
+    expect(
+      screen.getByText(/Upload shell \(.sh\) or Python \(.py\)/i)
+    ).toBeInTheDocument();
+  });
+
+  it("renders Upload CTA even when scripts are disabled (managing library is still allowed)", async () => {
+    mockServer.use(emptyScriptsHandler);
+
+    const render = createCustomRenderer({
+      withBackendMock: true,
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          config: {
+            server_settings: { scripts_disabled: true },
+          },
+        },
+      },
+    });
+
+    render(<ScriptLibrary {...baseProps} />);
+
+    await waitFor(() => {
+      expect(screen.getByText("No scripts")).toBeInTheDocument();
+    });
+    expect(screen.getByRole("button", { name: /upload/i })).toBeInTheDocument();
+  });
+
+  it("hides Upload CTA and info text for global technician", async () => {
+    mockServer.use(emptyScriptsHandler);
+
+    const render = createCustomRenderer({
+      withBackendMock: true,
+      context: {
+        app: {
+          isGlobalTechnician: true,
+          config: {
+            server_settings: { scripts_disabled: false },
+          },
+        },
+      },
+    });
+
+    render(<ScriptLibrary {...baseProps} />);
+
+    await waitFor(() => {
+      expect(screen.getByText("No scripts")).toBeInTheDocument();
+    });
+    expect(
+      screen.queryByRole("button", { name: /upload/i })
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(/Upload shell \(.sh\) or Python \(.py\)/i)
+    ).not.toBeInTheDocument();
+  });
+
+  it("hides Upload CTA and info text for team technician", async () => {
+    mockServer.use(emptyScriptsHandler);
+
+    const render = createCustomRenderer({
+      withBackendMock: true,
+      context: {
+        app: {
+          isTeamTechnician: true,
+          config: {
+            server_settings: { scripts_disabled: false },
+          },
+        },
+      },
+    });
+
+    render(<ScriptLibrary {...baseProps} />);
+
+    await waitFor(() => {
+      expect(screen.getByText("No scripts")).toBeInTheDocument();
+    });
+    expect(
+      screen.queryByRole("button", { name: /upload/i })
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(/Upload shell \(.sh\) or Python \(.py\)/i)
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/ManageControlsPage/Scripts/cards/ScriptLibrary/ScriptLibrary.tsx b/frontend/pages/ManageControlsPage/Scripts/cards/ScriptLibrary/ScriptLibrary.tsx
index 8e5d318df1b..28c1c348542 100644
--- a/frontend/pages/ManageControlsPage/Scripts/cards/ScriptLibrary/ScriptLibrary.tsx
+++ b/frontend/pages/ManageControlsPage/Scripts/cards/ScriptLibrary/ScriptLibrary.tsx
@@ -19,6 +19,8 @@ import Spinner from "components/Spinner";
 import Pagination from "components/Pagination";
 import SectionHeader from "components/SectionHeader";
 import EmptyState from "components/EmptyState";
+import Button from "components/buttons/Button";
+import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
 
 import UploadList from "../../../../../components/UploadList";
 import DeleteScriptModal from "../../components/DeleteScriptModal";
@@ -26,8 +28,8 @@ import EditScriptModal from "../../components/EditScriptModal";
 import ScriptUploadModal from "../../components/ScriptUploadModal";
 import ScriptListHeading from "../../components/ScriptListHeading";
 import ScriptListItem from "../../components/ScriptListItem";
-import ScriptUploader from "../../components/ScriptUploader";
 import { IScriptsCommonProps } from "../../ScriptsNavItems";
+import { SCRIPT_UPLOADER_EMPTY_STATE_TEXT } from "../../helpers";
 
 const baseClass = "script-library";
 
@@ -183,19 +185,34 @@ const ScriptLibrary = ({ router, teamId, location }: IScriptLibraryProps) => {
     </InfoBanner>
   );
 
+  const canUploadScripts = !isTechnician;
+
   return (
     <div className={baseClass}>
       <SectionHeader title="Library" alignLeftHeaderVertically />
       {config.server_settings.scripts_disabled && renderScriptsDisabledBanner()}
       {renderScriptsList()}
-      {!isLoading &&
-        currentPage === 0 &&
-        !scripts?.length &&
-        (isTechnician ? (
-          <EmptyState variant="header-list" header="No scripts uploaded" />
-        ) : (
-          <ScriptUploader onButtonClick={() => setShowAddScriptModal(true)} />
-        ))}
+      {!isLoading && !isError && currentPage === 0 && !scripts?.length && (
+        <EmptyState
+          variant="header-list"
+          header="No scripts"
+          info={canUploadScripts ? SCRIPT_UPLOADER_EMPTY_STATE_TEXT : undefined}
+          primaryButton={
+            canUploadScripts ? (
+              <GitOpsModeTooltipWrapper
+                renderChildren={(disableChildren) => (
+                  <Button
+                    onClick={() => setShowAddScriptModal(true)}
+                    disabled={disableChildren}
+                  >
+                    Upload
+                  </Button>
+                )}
+              />
+            ) : undefined
+          }
+        />
+      )}
       {showDeleteScriptModal && selectedScript.current && (
         <DeleteScriptModal
           scriptName={selectedScript.current?.name}
diff --git a/frontend/pages/ManageControlsPage/Scripts/components/ScriptUploader/ScriptUploader.tsx b/frontend/pages/ManageControlsPage/Scripts/components/ScriptUploader/ScriptUploader.tsx
index 557af5ce986..25bc8c2f8fa 100644
--- a/frontend/pages/ManageControlsPage/Scripts/components/ScriptUploader/ScriptUploader.tsx
+++ b/frontend/pages/ManageControlsPage/Scripts/components/ScriptUploader/ScriptUploader.tsx
@@ -2,6 +2,7 @@ import React from "react";
 
 import FileUploader, { ISupportedGraphicNames } from "components/FileUploader";
 import { getFileDetails } from "utilities/file/fileUtils";
+import { SCRIPT_UPLOADER_TEXT } from "../../helpers";
 
 const baseClass = "script-uploader";
 
@@ -46,7 +47,7 @@ const ScriptPackageUploader = ({
     <FileUploader
       className={baseClass}
       graphicName={graphicName}
-      message="Shell (.sh) or Python (.py) for macOS and Linux, or PowerShell (.ps1) for Windows"
+      message={SCRIPT_UPLOADER_TEXT}
       title="Upload script"
       accept=".sh,.py,.ps1"
       onFileUpload={onFileSelect}
diff --git a/frontend/pages/ManageControlsPage/Scripts/helpers.tsx b/frontend/pages/ManageControlsPage/Scripts/helpers.tsx
index d305fb7e247..6c41be68bed 100644
--- a/frontend/pages/ManageControlsPage/Scripts/helpers.tsx
+++ b/frontend/pages/ManageControlsPage/Scripts/helpers.tsx
@@ -5,7 +5,18 @@ import { IScriptBatchSummaryV2 } from "services/entities/scripts";
 
 import { isDateTimePast } from "utilities/helpers";
 
-const getWhen = (summary: IScriptBatchSummaryV2) => {
+export const SCRIPT_UPLOADER_EMPTY_STATE_TEXT = (
+  <>
+    Upload shell (.sh) or Python (.py) for macOS and Linux,
+    <br />
+    or PowerShell (.ps1) for Windows.
+  </>
+);
+
+export const SCRIPT_UPLOADER_TEXT =
+  "Shell (.sh) or Python (.py) for macOS and Linux, or PowerShell (.ps1) for Windows";
+
+export const getWhen = (summary: IScriptBatchSummaryV2) => {
   const {
     batch_execution_id: id,
     not_before,
@@ -73,5 +84,3 @@ const getWhen = (summary: IScriptBatchSummaryV2) => {
       return null;
   }
 };
-
-export default getWhen;
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/BootstrapPackage.tests.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/BootstrapPackage.tests.tsx
index 1adbdc2a90d..29463450730 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/BootstrapPackage.tests.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/BootstrapPackage.tests.tsx
@@ -60,7 +60,7 @@ describe("BootstrapPackage", () => {
 
     await waitFor(() => {
       expect(
-        screen.getByText(/turn on automatic enrollment/)
+        screen.getByText(/Turn on MDM and automatic enrollment/)
       ).toBeInTheDocument();
     });
     expect(
@@ -83,7 +83,7 @@ describe("BootstrapPackage", () => {
 
     await waitFor(() => {
       expect(
-        screen.getByText(/turn on automatic enrollment/)
+        screen.getByText(/Turn on MDM and automatic enrollment/)
       ).toBeInTheDocument();
     });
   });
@@ -105,7 +105,7 @@ describe("BootstrapPackage", () => {
 
     await waitFor(() => {
       expect(
-        screen.getByText(/turn on automatic enrollment/)
+        screen.getByText(/Turn on MDM and automatic enrollment/)
       ).toBeInTheDocument();
     });
   });
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/BootstrapPackage.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/BootstrapPackage.tsx
index ba60550dc50..e28108d1185 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/BootstrapPackage.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/BootstrapPackage.tsx
@@ -220,7 +220,14 @@ const BootstrapPackage = ({
         <EmptyState
           variant="form"
           header="Additional configuration required"
-          info="Supported on macOS. To customize, first turn on automatic enrollment."
+          info={
+            <>
+              Turn on MDM and automatic enrollment to deploy a custom bootstrap
+              package.
+              <br />
+              Supported on macOS.
+            </>
+          }
           primaryButton={
             <Button onClick={() => router.push(PATHS.ADMIN_INTEGRATIONS_MDM)}>
               Turn on
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/RunScript/RunScript.tests.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/RunScript/RunScript.tests.tsx
index 4fce5d6e83e..ac8b1c55b9a 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/RunScript/RunScript.tests.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/RunScript/RunScript.tests.tsx
@@ -30,14 +30,14 @@ describe("RunScript", () => {
     render(<RunScript router={createMockRouter()} currentTeamId={1} />);
 
     expect(
-      await screen.findByText(/turn on automatic enrollment/)
+      await screen.findByText(/Turn on MDM and automatic enrollment/i)
     ).toBeInTheDocument();
     expect(
       screen.getByText(/Upload a script to run on macOS hosts/)
     ).toBeVisible();
   });
 
-  it("should render the 'turn on automatic enrollment' message when MDM isn't configured", async () => {
+  it("should render the 'Turn on MDM and automatic enrollment' message when MDM isn't configured", async () => {
     mockServer.use(errorNoSetupExperienceScriptHandler);
     mockServer.use(
       createGetConfigHandler({
@@ -53,14 +53,14 @@ describe("RunScript", () => {
     // Spinner has a 250ms anti-flash delay; the mocked request resolves
     // before that, so the spinner intentionally never renders here.
     expect(
-      screen.queryByText(/turn on automatic enrollment/)
+      screen.queryByText(/Turn on MDM and automatic enrollment/i)
     ).not.toBeInTheDocument();
     expect(
-      await screen.findByText(/turn on automatic enrollment/)
+      await screen.findByText(/Turn on MDM and automatic enrollment/i)
     ).toBeInTheDocument();
   });
 
-  it("should render the 'turn on automatic enrollment' message when MDM is configured but not ABM", async () => {
+  it("should render the 'Turn on MDM and automatic enrollment' message when MDM is configured but not ABM", async () => {
     mockServer.use(errorNoSetupExperienceScriptHandler);
     mockServer.use(
       createGetConfigHandler({
@@ -80,10 +80,10 @@ describe("RunScript", () => {
     // Spinner has a 250ms anti-flash delay; the mocked request resolves
     // before that, so the spinner intentionally never renders here.
     expect(
-      screen.queryByText(/turn on automatic enrollment/)
+      screen.queryByText(/Turn on MDM and automatic enrollment/i)
     ).not.toBeInTheDocument();
     expect(
-      await screen.findByText(/turn on automatic enrollment/)
+      await screen.findByText(/Turn on MDM and automatic enrollment/i)
     ).toBeInTheDocument();
   });
 
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/RunScript/RunScript.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/RunScript/RunScript.tsx
index 12b3536f50a..6a2424266fd 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/RunScript/RunScript.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/RunScript/RunScript.tsx
@@ -101,7 +101,7 @@ const RunScript = ({ currentTeamId, router }: ISetupExperienceCardProps) => {
         <EmptyState
           variant="list"
           header="Additional configuration required"
-          info="Supported on macOS. To customize, first turn on automatic enrollment."
+          info="Supported on macOS. Turn on MDM and automatic enrollment to customize."
           primaryButton={
             <Button onClick={() => router.push(PATHS.ADMIN_INTEGRATIONS_MDM)}>
               Turn on
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/SetupAssistant.tests.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/SetupAssistant.tests.tsx
index 95954780e74..ac228e20a9d 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/SetupAssistant.tests.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/SetupAssistant.tests.tsx
@@ -49,11 +49,11 @@ describe("SetupAssistant", () => {
 
     await waitFor(() => {
       expect(
-        screen.getByText(/first turn on automatic enrollment/)
+        screen.getByText(/Additional configuration required/)
       ).toBeInTheDocument();
     });
     expect(
-      screen.getByText(/Add an automatic enrollment profile/)
+      screen.getByText(/Turn on MDM and automatic enrollment to customize/)
     ).toBeVisible();
   });
 
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/SetupAssistant.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/SetupAssistant.tsx
index 2014d7bc381..631c3557d6c 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/SetupAssistant.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/SetupAssistant.tsx
@@ -128,7 +128,7 @@ const SetupAssistant = ({
         <EmptyState
           variant="form"
           header="Additional configuration required"
-          info="To customize, first turn on automatic enrollment."
+          info="Supported on macOS. Turn on MDM and automatic enrollment to customize."
           primaryButton={
             <Button onClick={() => router.push(PATHS.ADMIN_INTEGRATIONS_MDM)}>
               Turn on
diff --git a/frontend/pages/ManageControlsPage/Variables/Variables.tests.tsx b/frontend/pages/ManageControlsPage/Variables/Variables.tests.tsx
index 710b8a8685f..9be8d1ffb7d 100644
--- a/frontend/pages/ManageControlsPage/Variables/Variables.tests.tsx
+++ b/frontend/pages/ManageControlsPage/Variables/Variables.tests.tsx
@@ -1,7 +1,7 @@
 import React from "react";
 import { screen, waitFor } from "@testing-library/react";
 
-import { ISecret } from "interfaces/secrets";
+import { IVariable } from "interfaces/variables";
 import { UserEvent } from "@testing-library/user-event";
 import { createCustomRenderer } from "test/test-utils";
 import { http, HttpResponse } from "msw";
@@ -39,32 +39,67 @@ describe("Custom variables", () => {
     },
   });
   describe("empty state", () => {
+    const emptyVariablesHandler = http.get(baseUrl("/custom_variables"), () => {
+      return HttpResponse.json({
+        custom_variables: [],
+        count: 0,
+        meta: {
+          has_previous_results: false,
+          has_next_results: false,
+        },
+      });
+    });
+
     afterAll(() => {
       mockServer.resetHandlers();
     });
-    it("renders when no secrets are saved", async () => {
-      const secretsHandler = http.get(baseUrl("/custom_variables"), () => {
-        return HttpResponse.json({
-          custom_variables: [],
-          count: 0,
-          has_prev_results: false,
-          has_next_results: false,
-        });
-      });
-      mockServer.use(secretsHandler);
+    it("renders with Add CTA and edit info when user can edit", async () => {
+      mockServer.use(emptyVariablesHandler);
 
       render(<Variables />);
       await waitFor(() => {
         expect(screen.getByText(/No custom variables/i)).toBeInTheDocument();
+        expect(
+          screen.getByText(
+            "Add a custom variable to make it available in scripts and profiles."
+          )
+        ).toBeInTheDocument();
         expect(
           screen.getByRole("button", { name: "Add custom variable" })
         ).toBeInTheDocument();
       });
     });
+
+    it("renders without Add CTA and with read-only info when user cannot edit", async () => {
+      mockServer.use(emptyVariablesHandler);
+
+      const renderReadOnly = createCustomRenderer({
+        withBackendMock: true,
+        context: {
+          app: {
+            isGlobalAdmin: false,
+            isGlobalMaintainer: false,
+          },
+        },
+      });
+
+      renderReadOnly(<Variables />);
+      await waitFor(() => {
+        expect(screen.getByText("No custom variables")).toBeInTheDocument();
+        expect(
+          screen.getByText(
+            "No custom variables are available for scripts and profiles."
+          )
+        ).toBeInTheDocument();
+        expect(
+          screen.queryByRole("button", { name: "Add custom variable" })
+        ).not.toBeInTheDocument();
+      });
+    });
   });
 
   describe("non-empty state", () => {
-    const mockSecrets: ISecret[] = [
+    const mockVariables: IVariable[] = [
       {
         name: "SECRET_UNO",
         id: 1,
@@ -78,17 +113,19 @@ describe("Custom variables", () => {
         updated_at: new Date().toISOString(),
       },
     ];
-    const secretsResponse: { secrets: ISecret[] } = { secrets: [] };
-    // Mock the scripts endpoint to return our two test scripts.
-    const secretsHandler = http.get(baseUrl("/custom_variables"), () => {
+    const variablesResponse: { variables: IVariable[] } = { variables: [] };
+    // Mock the variables endpoint to return our two test variables.
+    const variablesHandler = http.get(baseUrl("/custom_variables"), () => {
       return HttpResponse.json({
-        custom_variables: secretsResponse.secrets,
-        count: mockSecrets.length,
-        has_prev_results: false,
-        has_next_results: false,
+        custom_variables: variablesResponse.variables,
+        count: variablesResponse.variables.length,
+        meta: {
+          has_previous_results: false,
+          has_next_results: false,
+        },
       });
     });
-    const addSecretHandler = http.post(
+    const addVariableHandler = http.post(
       baseUrl("/custom_variables"),
       async ({ request }) => {
         const { name, value } = (await request.json()) as {
@@ -97,26 +134,26 @@ describe("Custom variables", () => {
         };
         // const name = formData.get("name");
         // const value = formData.get("value");
-        const newSecret = {
-          id: mockSecrets.length + 1,
+        const newVariable = {
+          id: mockVariables.length + 1,
           name,
           value,
           created_at: new Date().toISOString(),
           updated_at: new Date().toISOString(),
-        } as ISecret;
-        secretsResponse.secrets.push(newSecret);
-        return HttpResponse.json(newSecret);
+        } as IVariable;
+        variablesResponse.variables.push(newVariable);
+        return HttpResponse.json(newVariable);
       }
     );
-    const deleteSecretHandler = http.delete(
+    const deleteVariableHandler = http.delete(
       baseUrl("/custom_variables/:id"),
       async ({ request }) => {
         const id = request.url.split("/").pop();
         if (!id) {
-          throw new Error("Secret ID not found in request URL");
+          throw new Error("Variable ID not found in request URL");
         }
-        secretsResponse.secrets = secretsResponse.secrets.filter(
-          (secret) => secret.id !== parseInt(id, 10)
+        variablesResponse.variables = variablesResponse.variables.filter(
+          (variable) => variable.id !== parseInt(id, 10)
         );
         return HttpResponse.json({ success: true });
       }
@@ -124,13 +161,13 @@ describe("Custom variables", () => {
     beforeEach(async () => {
       // Wait for the query stale timer to expire.
       await new Promise((resolve) => setTimeout(resolve, 250));
-      mockServer.use(secretsHandler);
-      mockServer.use(addSecretHandler);
-      mockServer.use(deleteSecretHandler);
-      secretsResponse.secrets = [...mockSecrets];
+      mockServer.use(variablesHandler);
+      mockServer.use(addVariableHandler);
+      mockServer.use(deleteVariableHandler);
+      variablesResponse.variables = [...mockVariables];
     });
 
-    it("renders when secrets are saved", async () => {
+    it("renders when variables are saved", async () => {
       render(<Variables />);
       await waitFor(
         () => {
@@ -147,48 +184,48 @@ describe("Custom variables", () => {
       it("renders the add button disabled in GitOps mode", async () => {
         renderInGOM(<Variables />);
 
-        let addSecretButton;
+        let addVariableButton;
         await waitFor(() => {
-          addSecretButton = screen.getByRole("button", {
+          addVariableButton = screen.getByRole("button", {
             name: /Add custom variable/,
           });
 
-          expect(addSecretButton).toBeInTheDocument();
+          expect(addVariableButton).toBeInTheDocument();
         });
-        if (!addSecretButton) {
+        if (!addVariableButton) {
           throw new Error("Add custom variable button not found");
         }
 
-        expect(addSecretButton).toHaveAttribute("disabled");
-        expect(addSecretButton).toHaveClass("button--disabled");
+        expect(addVariableButton).toHaveAttribute("disabled");
+        expect(addVariableButton).toHaveClass("button--disabled");
 
         // Tooltip behavior covered in GitOpsModeWrapper.tests.tsx; omitted here due to flakiness
       });
 
-      it("deleting a secret is successful in GitOps mode", async () => {
+      it("deleting a variable is successful in GitOps mode", async () => {
         const { user } = renderInGOM(<Variables />);
         await waitFor(() => {
           expect(screen.getByText("Add custom variable")).toBeInTheDocument();
         });
         // Get the element with SECRET_UNO in it.
-        let secretUno: HTMLElement | null = null;
+        let variableUno: HTMLElement | null = null;
         await waitFor(() => {
-          secretUno = screen.getByText("SECRET_UNO");
-          expect(secretUno).toBeInTheDocument();
+          variableUno = screen.getByText("SECRET_UNO");
+          expect(variableUno).toBeInTheDocument();
         });
-        if (secretUno === null) {
-          throw new Error("Secret not found");
+        if (variableUno === null) {
+          throw new Error("Variable not found");
         }
         // Find the element with .paginated-list__row class that is ancestor to that element.
-        const secretUnoRow = (secretUno as HTMLElement).closest(
+        const variableUnoRow = (variableUno as HTMLElement).closest(
           ".paginated-list__row"
         );
-        expect(secretUnoRow).toBeInTheDocument();
-        if (!secretUnoRow) {
-          throw new Error("Secret row not found");
+        expect(variableUnoRow).toBeInTheDocument();
+        if (!variableUnoRow) {
+          throw new Error("Variable row not found");
         }
         // Find the element with data-id="trash-icon"
-        const trashIcon = secretUnoRow.querySelector(
+        const trashIcon = variableUnoRow.querySelector(
           "[data-testid='trash-icon']"
         );
         expect(trashIcon).toBeInTheDocument();
@@ -216,8 +253,8 @@ describe("Custom variables", () => {
       });
     });
 
-    describe("adding a new secret", () => {
-      const getAddSecretUI = async () => {
+    describe("adding a new variable", () => {
+      const getAddVariableUI = async () => {
         let nameInput;
         let valueInput;
         let saveButton;
@@ -238,20 +275,20 @@ describe("Custom variables", () => {
       let user: UserEvent;
       beforeEach(async () => {
         ({ user } = render(<Variables />));
-        let addSecretButton;
+        let addVariableButton;
         await waitFor(() => {
-          addSecretButton = screen.getByRole("button", {
+          addVariableButton = screen.getByRole("button", {
             name: /Add custom variable/,
           });
-          expect(addSecretButton).toBeInTheDocument();
+          expect(addVariableButton).toBeInTheDocument();
         });
-        if (!addSecretButton) {
+        if (!addVariableButton) {
           throw new Error("Add custom variable button not found");
         }
-        await user.click(addSecretButton);
+        await user.click(addVariableButton);
       });
       it("is successful with valid name and value", async () => {
-        const { nameInput, valueInput, saveButton } = await getAddSecretUI();
+        const { nameInput, valueInput, saveButton } = await getAddVariableUI();
         await user.type(nameInput, "New_Secret");
         await user.type(valueInput, "Secret Value");
         await user.click(saveButton);
@@ -262,7 +299,7 @@ describe("Custom variables", () => {
         });
       });
       it("does not allow saving without name", async () => {
-        const { valueInput, saveButton } = await getAddSecretUI();
+        const { valueInput, saveButton } = await getAddVariableUI();
         await user.type(valueInput, "Secret Value");
         await user.click(saveButton);
         await waitFor(() => {
@@ -271,7 +308,7 @@ describe("Custom variables", () => {
         });
       });
       it("does not allow saving without value", async () => {
-        const { nameInput, saveButton } = await getAddSecretUI();
+        const { nameInput, saveButton } = await getAddVariableUI();
         await user.type(nameInput, "Secret Name");
         await user.click(saveButton);
         await waitFor(() => {
@@ -280,7 +317,7 @@ describe("Custom variables", () => {
         });
       });
       it("does not allow saving with invalid name", async () => {
-        const { nameInput, valueInput, saveButton } = await getAddSecretUI();
+        const { nameInput, valueInput, saveButton } = await getAddVariableUI();
         await user.type(nameInput, "COOL!"); // Invalid name
         await user.type(valueInput, "Secret Value");
         await user.click(saveButton);
@@ -294,7 +331,7 @@ describe("Custom variables", () => {
         });
       });
       it("does not allow saving very long name", async () => {
-        const { nameInput, valueInput, saveButton } = await getAddSecretUI();
+        const { nameInput, valueInput, saveButton } = await getAddVariableUI();
         await user.type(nameInput, new Array(256).fill("A").join("")); // Invalid name
         await user.type(valueInput, "a value");
         await user.click(saveButton);
@@ -307,30 +344,30 @@ describe("Custom variables", () => {
       });
     });
 
-    it("deleting a secret is successful", async () => {
+    it("deleting a variable is successful", async () => {
       const { user } = render(<Variables />);
       await waitFor(() => {
         expect(screen.getByText("Add custom variable")).toBeInTheDocument();
       });
       // Get the element with SECRET_UNO in it.
-      let secretUno: HTMLElement | null = null;
+      let variableUno: HTMLElement | null = null;
       await waitFor(() => {
-        secretUno = screen.getByText("SECRET_UNO");
-        expect(secretUno).toBeInTheDocument();
+        variableUno = screen.getByText("SECRET_UNO");
+        expect(variableUno).toBeInTheDocument();
       });
-      if (secretUno === null) {
-        throw new Error("Secret not found");
+      if (variableUno === null) {
+        throw new Error("Variable not found");
       }
       // Find the element with .paginated-list__row class that is ancestor to that element.
-      const secretUnoRow = (secretUno as HTMLElement).closest(
+      const variableUnoRow = (variableUno as HTMLElement).closest(
         ".paginated-list__row"
       );
-      expect(secretUnoRow).toBeInTheDocument();
-      if (!secretUnoRow) {
-        throw new Error("Secret row not found");
+      expect(variableUnoRow).toBeInTheDocument();
+      if (!variableUnoRow) {
+        throw new Error("Variable row not found");
       }
       // Find the element with data-id="trash-icon"
-      const trashIcon = secretUnoRow.querySelector(
+      const trashIcon = variableUnoRow.querySelector(
         "[data-testid='trash-icon']"
       );
       expect(trashIcon).toBeInTheDocument();
diff --git a/frontend/pages/ManageControlsPage/Variables/Variables.tsx b/frontend/pages/ManageControlsPage/Variables/Variables.tsx
index 57329973c32..f68a3bb8a99 100644
--- a/frontend/pages/ManageControlsPage/Variables/Variables.tsx
+++ b/frontend/pages/ManageControlsPage/Variables/Variables.tsx
@@ -2,8 +2,10 @@ import React, { useContext, useEffect, useRef, useState } from "react";
 
 import { useQuery } from "react-query";
 
-import secretsAPI, { IListSecretsResponse } from "services/entities/secrets";
-import { ISecret } from "interfaces/secrets";
+import variablesAPI, {
+  IListVariablesResponse,
+} from "services/entities/variables";
+import { IVariable } from "interfaces/variables";
 
 import { AppContext } from "context/app";
 
@@ -24,17 +26,19 @@ import DeleteCustomVariableModal from "./components/DeleteCustomVariableModal";
 
 const baseClass = "variables";
 
-export const SECRETS_PAGE_SIZE = 20;
+export const VARIABLES_PAGE_SIZE = 20;
 
 const Variables = () => {
-  const paginatedListRef = useRef<IPaginatedListHandle<ISecret>>(null);
+  const paginatedListRef = useRef<IPaginatedListHandle<IVariable>>(null);
 
   const [copyMessage, setCopyMessage] = useState("");
-  const [copiedSecretName, setCopiedSecretName] = useState("");
+  const [copiedVariableName, setCopiedVariableName] = useState("");
   const copyMessageTimeoutIdRef = useRef<NodeJS.Timeout | null>(null);
 
   const [showDeleteModal, setShowDeleteModal] = useState(false);
-  const [secretToDelete, setSecretToDelete] = useState<ISecret | undefined>();
+  const [variableToDelete, setVariableToDelete] = useState<
+    IVariable | undefined
+  >();
   const [showAddModal, setShowAddModal] = useState(false);
   const [pageNumber, setPageNumber] = useState(0);
 
@@ -44,12 +48,12 @@ const Variables = () => {
 
   const canEdit = isGlobalAdmin || isGlobalMaintainer;
 
-  const apiParams = { page: pageNumber, per_page: SECRETS_PAGE_SIZE };
+  const apiParams = { page: pageNumber, per_page: VARIABLES_PAGE_SIZE };
   const { data, isFetching: isLoading, refetch } = useQuery<
-    IListSecretsResponse,
+    IListVariablesResponse,
     Error,
-    IListSecretsResponse
-  >(["secrets", apiParams], () => secretsAPI.getSecrets(apiParams));
+    IListVariablesResponse
+  >(["variables", apiParams], () => variablesAPI.getVariables(apiParams));
 
   // Open add modal via query param (e.g. from command palette)
   useEffect(() => {
@@ -66,45 +70,45 @@ const Variables = () => {
     }
   }, []);
 
-  const onClickAddSecret = () => {
+  const onClickAddVariable = () => {
     setShowAddModal(true);
   };
 
-  const onSaveSecret = () => {
+  const onSaveVariable = () => {
     setShowAddModal(false);
     refetch();
   };
 
-  const onDeleteSecret = () => {
+  const onDeleteVariable = () => {
     setShowDeleteModal(false);
     refetch();
   };
 
-  const onClickDeleteSecret = (secret: ISecret) => {
-    setSecretToDelete(secret);
+  const onClickDeleteVariable = (variable: IVariable) => {
+    setVariableToDelete(variable);
     setShowDeleteModal(true);
   };
 
-  const getTokenFromSecretName = (secretName: string): string => {
-    return `$FLEET_SECRET_${secretName.toUpperCase()}`;
+  const getTokenFromVariableName = (variableName: string): string => {
+    return `$FLEET_SECRET_${variableName.toUpperCase()}`;
   };
 
-  const onCopySecretName = (evt: React.MouseEvent, secretName: string) => {
+  const onCopyVariableName = (evt: React.MouseEvent, variableName: string) => {
     evt.preventDefault();
 
     if (copyMessageTimeoutIdRef.current) {
       clearTimeout(copyMessageTimeoutIdRef.current);
     }
 
-    setCopiedSecretName(secretName);
-    stringToClipboard(getTokenFromSecretName(secretName))
+    setCopiedVariableName(variableName);
+    stringToClipboard(getTokenFromVariableName(variableName))
       .then(() => setCopyMessage("Copied!"))
       .catch(() => setCopyMessage("Copy failed"));
 
     // Clear message after 1 second
     copyMessageTimeoutIdRef.current = setTimeout(() => {
       setCopyMessage("");
-      setCopiedSecretName("");
+      setCopiedVariableName("");
     }, 1000);
 
     return false;
@@ -119,27 +123,27 @@ const Variables = () => {
     };
   }, []);
 
-  const renderSecretRow = (secret: ISecret) => (
+  const renderVariableRow = (variable: IVariable) => (
     <>
       <ListItem
-        title={secret.name.toUpperCase()}
+        title={variable.name.toUpperCase()}
         details={
           <span>
-            <span className="secret-details__text">
+            <span className="variable-details__text">
               Updated{" "}
-              <HumanTimeDiffWithDateTip timeString={secret.updated_at} /> &bull;{" "}
-              {getTokenFromSecretName(secret.name)}
+              <HumanTimeDiffWithDateTip timeString={variable.updated_at} />{" "}
+              &bull; {getTokenFromVariableName(variable.name)}
             </span>
             <Button
               variant="unstyled"
-              className={`${baseClass}__copy-secret-icon`}
+              className={`${baseClass}__copy-variable-icon`}
               onClick={(e: React.MouseEvent<HTMLButtonElement>) =>
-                onCopySecretName(e, secret.name)
+                onCopyVariableName(e, variable.name)
               }
             >
               <Icon name="copy" />
             </Button>
-            {copyMessage && copiedSecretName === secret.name && (
+            {copyMessage && copiedVariableName === variable.name && (
               <span
                 className={`${baseClass}__copy-message`}
               >{`${copyMessage} `}</span>
@@ -152,7 +156,7 @@ const Variables = () => {
           variant="icon"
           onClick={(e: React.MouseEvent<HTMLButtonElement>) => {
             e.stopPropagation();
-            onClickDeleteSecret(secret);
+            onClickDeleteVariable(variable);
           }}
         >
           <>
@@ -202,13 +206,20 @@ const Variables = () => {
         </div>
         <EmptyState
           variant="header-list"
-          header="No custom variables created yet"
-          info="Add a custom variable to make it available in scripts and profiles."
+          header="No custom variables"
+          info={
+            canEdit
+              ? "Add a custom variable to make it available in scripts and profiles."
+              : "No custom variables are available for scripts and profiles."
+          }
           primaryButton={
             canEdit ? (
               <GitOpsModeTooltipWrapper
                 renderChildren={(disableChildren) => (
-                  <Button onClick={onClickAddSecret} disabled={disableChildren}>
+                  <Button
+                    onClick={onClickAddVariable}
+                    disabled={disableChildren}
+                  >
                     Add custom variable
                   </Button>
                 )}
@@ -219,7 +230,7 @@ const Variables = () => {
         {showAddModal && (
           <AddCustomVariableModal
             onCancel={() => setShowAddModal(false)}
-            onSave={onSaveSecret}
+            onSave={onSaveVariable}
           />
         )}
       </div>
@@ -236,7 +247,7 @@ const Variables = () => {
               <Button
                 variant="inverse"
                 size="small"
-                onClick={onClickAddSecret}
+                onClick={onClickAddVariable}
                 disabled={disableChildren}
               >
                 <Icon name="plus" />
@@ -246,15 +257,14 @@ const Variables = () => {
           />
         )}
       </div>
-      <PaginatedList<ISecret>
+      <PaginatedList<IVariable>
         ref={paginatedListRef}
-        pageSize={SECRETS_PAGE_SIZE}
-        renderItemRow={renderSecretRow}
+        pageSize={VARIABLES_PAGE_SIZE}
+        renderItemRow={renderVariableRow}
         count={data?.count || 0}
         data={data?.custom_variables || []}
         currentPage={pageNumber}
         onChangePage={setPageNumber}
-        onClickRow={(secret) => secret}
         heading={
           <div className={`${baseClass}__header`}>
             <span>Custom variables</span>
@@ -274,14 +284,14 @@ const Variables = () => {
       {showAddModal && (
         <AddCustomVariableModal
           onCancel={() => setShowAddModal(false)}
-          onSave={onSaveSecret}
+          onSave={onSaveVariable}
         />
       )}
       {showDeleteModal && (
         <DeleteCustomVariableModal
-          secret={secretToDelete}
+          variable={variableToDelete}
           onExit={() => setShowDeleteModal(false)}
-          onDeleteSecret={onDeleteSecret}
+          onDeleteVariable={onDeleteVariable}
         />
       )}
     </div>
diff --git a/frontend/pages/ManageControlsPage/Variables/_styles.scss b/frontend/pages/ManageControlsPage/Variables/_styles.scss
index f06c0a210e8..99630d69bfe 100644
--- a/frontend/pages/ManageControlsPage/Variables/_styles.scss
+++ b/frontend/pages/ManageControlsPage/Variables/_styles.scss
@@ -32,7 +32,7 @@
       }
     }
 
-    .variables__copy-secret-icon {
+    .variables__copy-variable-icon {
       margin: -12px 0 -12px 4px;
       vertical-align: bottom;
       .children-wrapper {
@@ -79,7 +79,7 @@
       min-width: 0;
     }
 
-    .secret-details__text {
+    .variable-details__text {
       flex: 1 1 auto;
       min-width: 0;
       white-space: nowrap;
diff --git a/frontend/pages/ManageControlsPage/Variables/components/AddCustomVariableModal/AddCustomVariableModal.tsx b/frontend/pages/ManageControlsPage/Variables/components/AddCustomVariableModal/AddCustomVariableModal.tsx
index 791c7f153d8..eb67100ba39 100644
--- a/frontend/pages/ManageControlsPage/Variables/components/AddCustomVariableModal/AddCustomVariableModal.tsx
+++ b/frontend/pages/ManageControlsPage/Variables/components/AddCustomVariableModal/AddCustomVariableModal.tsx
@@ -1,9 +1,9 @@
 import React, { useContext, useState } from "react";
 import Modal from "components/Modal";
 import Button from "components/buttons/Button";
-import { ISecretPayload } from "interfaces/secrets";
+import { IVariablePayload } from "interfaces/variables";
 import { hasStatusKey } from "interfaces/errors";
-import secretsAPI from "services/entities/secrets";
+import variablesAPI from "services/entities/variables";
 import { NotificationContext } from "context/notification";
 import InputField from "components/forms/fields/InputField";
 import { validateFormData, IAddCustomVariableFormValidation } from "./helpers";
@@ -24,8 +24,8 @@ const AddCustomVariableModal = ({
   onCancel,
   onSave,
 }: AddCustomVariableModalProps) => {
-  const [secretName, setSecretName] = useState("");
-  const [secretValue, setSecretValue] = useState("");
+  const [variableName, setVariableName] = useState("");
+  const [variableValue, setVariableValue] = useState("");
   const [isSaving, setIsSaving] = useState(false);
 
   const { renderFlash } = useContext(NotificationContext);
@@ -34,22 +34,22 @@ const AddCustomVariableModal = ({
     formValidation,
     setFormValidation,
   ] = useState<IAddCustomVariableFormValidation>(() =>
-    validateFormData({ name: secretName, value: secretValue })
+    validateFormData({ name: variableName, value: variableValue })
   );
 
   const onInputChange = (update: { name: string; value: string }) => {
     const name = update.name;
     let value = update.value;
     if (name === "name") {
-      value = value.trimRight().toUpperCase();
-      setSecretName(value);
+      value = value.trimEnd().toUpperCase();
+      setVariableName(value);
     } else if (name === "value") {
-      setSecretValue(value);
+      setVariableValue(value);
     }
     setFormValidation(
       validateFormData({
-        name: secretName,
-        value: secretValue,
+        name: variableName,
+        value: variableValue,
         [update.name]: value,
       })
     );
@@ -59,21 +59,21 @@ const AddCustomVariableModal = ({
     const validation = validateFormData({ name, value }, true);
     if (validation.isValid) {
       setIsSaving(true);
-      const newSecret: ISecretPayload = {
-        name: secretName,
-        value: secretValue,
+      const newVariable: IVariablePayload = {
+        name: variableName,
+        value: variableValue,
       };
       try {
-        await secretsAPI.addSecret(newSecret);
+        await variablesAPI.addVariable(newVariable);
         renderFlash("success", "Variable created.");
         onSave();
       } catch (error) {
         if (hasStatusKey(error) && error.status === 409) {
-          renderFlash("error", "A secret with this name already exists.");
+          renderFlash("error", "A variable with this name already exists.");
         } else {
           renderFlash(
             "error",
-            "An error occurred while saving the secret. Please try again."
+            "An error occurred while saving the variable. Please try again."
           );
         }
       } finally {
@@ -89,21 +89,21 @@ const AddCustomVariableModal = ({
       <form className={`${baseClass}__add-variable-form`}>
         <InputField
           onChange={onInputChange}
-          value={secretName}
+          value={variableName}
           label="Name"
           name="name"
           parseTarget
           helpText={
             <span>
               You can use this in your script or configuration profile as
-              &ldquo;$FLEET_SECRET_{secretName}&rdquo;.
+              &ldquo;$FLEET_SECRET_{variableName}&rdquo;.
             </span>
           }
           error={formValidation.name?.message}
         />
         <InputField
           onChange={onInputChange}
-          value={secretValue}
+          value={variableValue}
           label="Value"
           name="value"
           parseTarget
@@ -112,7 +112,7 @@ const AddCustomVariableModal = ({
         <div className="modal-cta-wrap">
           <Button
             onClick={() => {
-              onClickSave(secretName, secretValue);
+              onClickSave(variableName, variableValue);
             }}
             disabled={!formValidation.isValid || isSaving}
             isLoading={isSaving}
diff --git a/frontend/pages/ManageControlsPage/Variables/components/DeleteCustomVariableModal/DeleteCustomVariableModal.tsx b/frontend/pages/ManageControlsPage/Variables/components/DeleteCustomVariableModal/DeleteCustomVariableModal.tsx
index d50395b2b3f..254d7ebf787 100644
--- a/frontend/pages/ManageControlsPage/Variables/components/DeleteCustomVariableModal/DeleteCustomVariableModal.tsx
+++ b/frontend/pages/ManageControlsPage/Variables/components/DeleteCustomVariableModal/DeleteCustomVariableModal.tsx
@@ -2,38 +2,38 @@ import React, { useContext, useState } from "react";
 import Modal from "components/Modal";
 import Button from "components/buttons/Button";
 import TooltipTruncatedText from "components/TooltipTruncatedText";
-import { ISecret } from "interfaces/secrets";
+import { IVariable } from "interfaces/variables";
 import { NotificationContext } from "context/notification";
 
 import formatErrorResponse from "utilities/format_error_response";
-import secretsAPI from "services/entities/secrets";
+import variablesAPI from "services/entities/variables";
 
 interface DeleteCustomVariableModalProps {
-  secret: ISecret | undefined;
+  variable: IVariable | undefined;
   onExit: () => void;
-  onDeleteSecret: () => void;
+  onDeleteVariable: () => void;
 }
 
 const baseClass = "delete-custom-variable-modal";
 
 const DeleteCustomVariableModal = ({
-  secret,
+  variable,
   onExit,
-  onDeleteSecret,
+  onDeleteVariable,
 }: DeleteCustomVariableModalProps) => {
   const [isDeleting, setIsDeleting] = useState(false);
 
   const { renderFlash } = useContext(NotificationContext);
 
   const onClickDelete = async () => {
-    if (!secret) {
+    if (!variable) {
       return;
     }
     setIsDeleting(true);
     try {
-      await secretsAPI.deleteSecret(secret.id);
+      await variablesAPI.deleteVariable(variable.id);
       renderFlash("success", "Variable successfully deleted.");
-      onDeleteSecret();
+      onDeleteVariable();
     } catch (error) {
       const errorObject = formatErrorResponse(error);
       const isInUseError =
@@ -60,7 +60,7 @@ const DeleteCustomVariableModal = ({
         <span>
           This will delete the
           <b>
-            <TooltipTruncatedText value={secret?.name} />
+            <TooltipTruncatedText value={variable?.name} />
           </b>
           custom variable.
         </span>
diff --git a/frontend/services/entities/secrets.tsx b/frontend/services/entities/secrets.tsx
deleted file mode 100644
index 71eac37a26e..00000000000
--- a/frontend/services/entities/secrets.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import { ISecret, ISecretPayload } from "interfaces/secrets";
-import sendRequest from "services";
-import { buildQueryStringFromParams } from "utilities/url";
-import endpoints from "utilities/endpoints";
-
-export interface IListSecretsRequestApiParams {
-  page?: number;
-  per_page?: number;
-}
-
-export interface IListSecretsResponse {
-  custom_variables: ISecret[] | null;
-  meta: {
-    has_next_results: boolean;
-    has_previous_results: boolean;
-  };
-  count: number;
-}
-
-export default {
-  getSecrets(
-    params: IListSecretsRequestApiParams
-  ): Promise<IListSecretsResponse> {
-    const { SECRETS } = endpoints;
-    const path = `${SECRETS}?${buildQueryStringFromParams({
-      page: params.page,
-      per_page: params.per_page,
-    })}`;
-
-    return sendRequest("GET", path);
-  },
-
-  addSecret(secret: ISecretPayload) {
-    const { SECRETS } = endpoints;
-    return sendRequest("POST", SECRETS, secret);
-  },
-
-  deleteSecret(secretId: number) {
-    const { SECRETS } = endpoints;
-    return sendRequest("DELETE", `${SECRETS}/${secretId}`);
-  },
-};
diff --git a/frontend/services/entities/variables.ts b/frontend/services/entities/variables.ts
new file mode 100644
index 00000000000..86657d0eb92
--- /dev/null
+++ b/frontend/services/entities/variables.ts
@@ -0,0 +1,42 @@
+import { IVariable, IVariablePayload } from "interfaces/variables";
+import sendRequest from "services";
+import { buildQueryStringFromParams } from "utilities/url";
+import endpoints from "utilities/endpoints";
+
+export interface IListVariablesRequestApiParams {
+  page?: number;
+  per_page?: number;
+}
+
+export interface IListVariablesResponse {
+  custom_variables: IVariable[] | null;
+  meta: {
+    has_next_results: boolean;
+    has_previous_results: boolean;
+  };
+  count: number;
+}
+
+export default {
+  getVariables(
+    params: IListVariablesRequestApiParams
+  ): Promise<IListVariablesResponse> {
+    const { VARIABLES } = endpoints;
+    const path = `${VARIABLES}?${buildQueryStringFromParams({
+      page: params.page,
+      per_page: params.per_page,
+    })}`;
+
+    return sendRequest("GET", path);
+  },
+
+  addVariable(variable: IVariablePayload) {
+    const { VARIABLES } = endpoints;
+    return sendRequest("POST", VARIABLES, variable);
+  },
+
+  deleteVariable(variableId: number) {
+    const { VARIABLES } = endpoints;
+    return sendRequest("DELETE", `${VARIABLES}/${variableId}`);
+  },
+};
diff --git a/frontend/services/mock_service/mocks/config.ts b/frontend/services/mock_service/mocks/config.ts
index 08f93b68529..3ef13298bad 100644
--- a/frontend/services/mock_service/mocks/config.ts
+++ b/frontend/services/mock_service/mocks/config.ts
@@ -41,7 +41,7 @@ const REQUEST_RESPONSE_MAPPINGS: IResponses = {
     "queries?team_id=13": RESPONSES.teamQueries,
     "queries/113/report?order_key=host_name&order_direction=asc":
       RESPONSES.queryReport,
-    "custom_variables?page=*&per_page=*": RESPONSES.secrets,
+    "custom_variables?page=*&per_page=*": RESPONSES.variables,
   },
   POST: {
     // request body is ISelectedTargets
@@ -62,10 +62,10 @@ const REQUEST_RESPONSE_MAPPINGS: IResponses = {
       platform: "linux",
     },
     "autofill/policies": RESPONSES.aiAutofillPolicy,
-    custom_variables: RESPONSES.addSecret,
+    custom_variables: RESPONSES.addVariable,
   },
   DELETE: {
-    "custom_variables/*": RESPONSES.deleteSecret,
+    "custom_variables/*": RESPONSES.deleteVariable,
   },
 } as IResponses;
 
diff --git a/frontend/services/mock_service/mocks/responses.ts b/frontend/services/mock_service/mocks/responses.ts
index 4610eef05a3..178111d45b3 100644
--- a/frontend/services/mock_service/mocks/responses.ts
+++ b/frontend/services/mock_service/mocks/responses.ts
@@ -10602,51 +10602,51 @@ const aiAutofillPolicy = {
     "The maintenance will probably involve investigation of the firewall status, troubleshooting any issues found, and enabling the firewall to ensure the laptop's security.",
 };
 
-let mockSecrets = new Array(39).fill(null).map((_, index) => ({
+let mockVariables = new Array(39).fill(null).map((_, index) => ({
   id: index + 1,
   name: `SECRET_${index + 1}`,
   created_at: new Date(Date.now() - index * 1000 * 60 * 60 * 24).toISOString(), // Created 1 day apart
   updated_at: new Date(Date.now() - index * 1000 * 60 * 60 * 24).toISOString(), // Updated 1 day apart
 }));
-let nextSecretId = mockSecrets.length + 1;
+let nextVariableId = mockVariables.length + 1;
 
-const SECRETS_PAGE_SIZE = 20;
-const secrets = (url: string) => {
+const VARIABLES_PAGE_SIZE = 20;
+const variables = (url: string) => {
   const parsedUrl = new URL(`http://example.com/${url}`);
   const params = new URLSearchParams(parsedUrl.search);
   const page = parseInt(params.get("page") || "0", 10);
   const perPage = parseInt(
-    params.get("per_page") || `${SECRETS_PAGE_SIZE}`,
+    params.get("per_page") || `${VARIABLES_PAGE_SIZE}`,
     10
   );
-  const startIndex = (page || 0) * (perPage || SECRETS_PAGE_SIZE);
-  const endIndex = startIndex + (perPage || SECRETS_PAGE_SIZE);
-  const hasNextResults = endIndex < mockSecrets.length;
+  const startIndex = (page || 0) * (perPage || VARIABLES_PAGE_SIZE);
+  const endIndex = startIndex + (perPage || VARIABLES_PAGE_SIZE);
+  const hasNextResults = endIndex < mockVariables.length;
   const hasPreviousResults = startIndex > 0;
   return {
-    custom_variables: [...mockSecrets].slice(startIndex, endIndex),
+    custom_variables: [...mockVariables].slice(startIndex, endIndex),
     meta: {
       has_next_results: hasNextResults,
       has_previous_results: hasPreviousResults,
     },
-    count: mockSecrets.length,
+    count: mockVariables.length,
   };
 };
 
-const addSecret = (url: string, secret: any) => {
-  // Stubbed out for now, as the secrets endpoint is not yet implemented.
-  if (secret.name === "DUPE") {
+const addVariable = (url: string, variable: any) => {
+  if (variable.name === "DUPE") {
     return Promise.reject({ status: 409, message: "Conflict" });
   }
-  if (secret.name === "ERR") {
+  if (variable.name === "ERR") {
     return Promise.reject({ status: 500, message: "Internal Server Error" });
   }
 
-  mockSecrets = [
-    ...mockSecrets,
+  nextVariableId += 1;
+  mockVariables = [
+    ...mockVariables,
     {
-      name: secret.name,
-      id: (nextSecretId += 1),
+      name: variable.name,
+      id: nextVariableId,
       created_at: new Date().toISOString(),
       updated_at: new Date().toISOString(),
     },
@@ -10654,9 +10654,9 @@ const addSecret = (url: string, secret: any) => {
   return Promise.resolve({});
 };
 
-const deleteSecret = (url: string) => {
-  const secretId = parseInt(url.split("/").pop() || "0", 10);
-  mockSecrets = mockSecrets.filter((s) => s.id !== secretId);
+const deleteVariable = (url: string) => {
+  const variableId = parseInt(url.split("/").pop() || "0", 10);
+  mockVariables = mockVariables.filter((v) => v.id !== variableId);
   return Promise.resolve({});
 };
 
@@ -10678,7 +10678,7 @@ export default {
   aiAutofillPolicy,
   teamPolicy1,
   hostDetailsiOS,
-  secrets,
-  addSecret,
-  deleteSecret,
+  variables,
+  addVariable,
+  deleteVariable,
 };
diff --git a/frontend/utilities/endpoints.ts b/frontend/utilities/endpoints.ts
index 1f2ef39ff43..90e5e68088b 100644
--- a/frontend/utilities/endpoints.ts
+++ b/frontend/utilities/endpoints.ts
@@ -345,6 +345,6 @@ export default {
   CERTIFICATE_AUTHORITY_REQUEST_CERT: (id: number) => {
     return `/${API_VERSION}/fleet/certificate_authorities/${id}/request_certificate`;
   },
-  // custom variables (secrets) endpoints
-  SECRETS: `/${API_VERSION}/fleet/custom_variables`,
+  // custom variables endpoints
+  VARIABLES: `/${API_VERSION}/fleet/custom_variables`,
 };
diff --git a/website/config/routes.js b/website/config/routes.js
index a3063b80217..ec45202468d 100644
--- a/website/config/routes.js
+++ b/website/config/routes.js
@@ -1201,6 +1201,7 @@ module.exports.routes = {
   'GET /learn-more-about/exe-install-scripts': '/guides/exe-install-scripts',
   'GET /learn-more-about/install-scripts': '/guides/deploy-software-packages#install-script',
   'GET /learn-more-about/uninstall-scripts': '/guides/deploy-software-packages#uninstall-script',
+  'GET /learn-more-about/batch-scripts': '/guides/scripts#batch-execute-scripts',
   'GET /learn-more-about/package-metadata-extraction': '/guides/deploy-software-packages#package-metadata-extraction',
   'GET /learn-more-about/read-package-version': '/guides/deploy-software-packages#package-metadata-extraction',
   'GET /learn-more-about/fleetctl': '/guides/fleetctl',