diff --git a/.buildkite/default-pipeline.yml b/.buildkite/default-pipeline.yml
new file mode 100644
index 00000000..05048f31
--- /dev/null
+++ b/.buildkite/default-pipeline.yml
@@ -0,0 +1,21 @@
+---
+# $yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
+steps:
+  - label: ":docker: Build and Push Dockerfile"
+    commands:
+      - "vault kv get -field=password kv/ci-shared/opex/oci-registry-creds-prod | docker login -u $(vault kv get -field=username kv/ci-shared/opex/oci-registry-creds-prod) --password-stdin docker.elastic.co"
+      - "docker buildx create --use"
+      - "docker buildx build --platform linux/amd64,linux/arm64 --push -t docker.elastic.co/opex/diagnostics:latest ."
+    agents:
+      provider: "gcp"
+      imagePrefix: "core-ubuntu-2204"
+      machineType: "n2-standard-2"
+
+  - label: "Test"
+    command: "true"
+
+  - label: "Deploy"
+    command: "true"
+
+  - label: "Publish"
+    command: "true"
diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
new file mode 100644
index 00000000..53325d71
--- /dev/null
+++ b/.buildkite/pipeline.yml
@@ -0,0 +1,29 @@
+---
+# $yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
+steps:
+
+  # if our Renovate configuration is amended, then make sure we have well-formed config
+  # for more info, see https://docs.elastic.dev/plat-prod-team/service-catalogue/renovate/testing-renovate-changes
+  - label: "Verify Renovate configuration"
+    command: "renovate-config-validator"
+    agents:
+      image: "docker.elastic.co/ci-agent-images/pipelib:0.25.0@sha256:1e7cbd9859c9d4d16471b99c4d734709340d7c584401a62b762ca1592c2e5df0"
+    if_changed:
+      - "renovate.json"
+
+  # if our catalog-info.yaml is changed, make sure it's well-formed according to our internal standards as well as Backstage's validation
+  - label: Validate TokenPolicy RREs
+    command: "/agent/check-catalog-info.sh"
+    agents:
+      image: "docker.elastic.co/ci-agent-images/pipelib:0.25.0@sha256:1e7cbd9859c9d4d16471b99c4d734709340d7c584401a62b762ca1592c2e5df0"
+    if_changed:
+      - "catalog-info.yaml"
+
+  - label: ":pipeline: Upload default Pipeline"
+    command: "buildkite-agent pipeline upload .buildkite/default-pipeline.yml"
+    if_changed:
+      include:
+        - "**/*"
+      exclude:
+        - "catalog-info.yaml"
+        - "renovate.json"
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 66048aba..22cb5a83 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,2 +1,3 @@
-# used for branch protection
-*       @pickypg
+# These owners will be the default owners for everything in
+# the repo.
+*       @elastic/opex @pickypg
diff --git a/catalog-info.yaml b/catalog-info.yaml
index 058422c7..78d01ba9 100644
--- a/catalog-info.yaml
+++ b/catalog-info.yaml
@@ -1,15 +1,4 @@
-# Declare a Backstage Component that represents your application.
----
-# yaml-language-server: $schema=https://json.schemastore.org/catalog-info.json
-apiVersion: backstage.io/v1alpha1
-kind: Component
-metadata:
-  name: support-diagnostics
-spec:
-  type: tool # or service, library, etc.
-  owner: group:opex
-  system: autoops
-  lifecycle: production
+# Declare your Buildkite pipelines below
 ---
 # yaml-language-server: $schema=https://gist.githubusercontent.com/elasticmachine/988b80dae436cafea07d9a4a460a011d/raw/rre.schema.json
 apiVersion: backstage.io/v1alpha1
@@ -17,6 +6,10 @@ kind: Resource
 metadata:
   name: buildkite-pipeline-support-diagnostics
   description: Buildkite Pipeline for support-diagnostics
+  links:
+    - title: Buildkite Pipeline
+      url: https://buildkite.com/elastic/support-diagnostics
+
 spec:
   type: buildkite-pipeline
   owner: group:opex
@@ -25,9 +18,13 @@ spec:
     apiVersion: buildkite.elastic.dev/v1
     kind: Pipeline
     metadata:
-      name: Support Diagnostics Buildkite Pipeline
+      name: support-diagnostics
+      description: 
     spec:
       repository: elastic/support-diagnostics
+      pipeline_file: ".buildkite/pipeline.yml"
+      provider_settings:
+        build_pull_request_forks: true
       teams:
         opex:
           access_level: MANAGE_BUILD_AND_READ