diff --git a/docs/adrs/20260727000000_events_are_objective_facts.md b/docs/adrs/20260727000000_events_are_objective_facts.md
new file mode 100644
index 000000000..612e87ef0
--- /dev/null
+++ b/docs/adrs/20260727000000_events_are_objective_facts.md
@@ -0,0 +1,137 @@
+---
+semantic-links:
+  related-artifacts:
+    - docs/adrs/index.md
+    - docs/issues/open/1136-1978-configurable-udp-connection-id-validation-policy.md
+    - packages/udp-core/src/event.rs
+    - packages/udp-server/src/event.rs
+    - packages/http-core/src/event.rs
+    - packages/swarm-coordination-registry/src/event.rs
+---
+
+# Events Are Objective Facts
+
+## Description
+
+The tracker uses a pub/sub event system across multiple packages. Each event bus
+has its own `event.rs` module that defines an `Event` enum. Multiple listeners
+(ban handler, statistics, metrics, …) subscribe to these events and react
+independently.
+
+During the implementation of the configurable UDP connection ID validation policy
+(issue [#1136][1136]), a design mistake was made:
+
+A new `UdpCookieErrorObserved` event variant was created specifically so that the
+ban handler would **not** react to it when the validation policy was `Disabled`.
+The reasoning was: "if we emit a different event, the existing ban listener won't
+see it as a ban-worthy error."
+
+This is the wrong pattern.
+
+## Agreement
+
+**Event variants must be objective facts** about what happened in the system.
+They must not be designed around what a particular consumer should or should not
+do in response to them.
+
+### The wrong pattern
+
+Creating a new event variant (e.g. `UdpCookieErrorObserved`) that is structurally
+identical to an existing one (`UdpError { ConnectionCookie }`) but named
+differently so a specific listener silently ignores it.
+
+```rust
+// WRONG — variant exists purely to prevent the ban handler from reacting
+Event::UdpCookieErrorObserved { context, kind, error }
+```
+
+Problems:
+
+- Couples the event schema to the internal behaviour of one consumer.
+- Hides a policy decision (ban enforcement on/off) inside the event layer.
+- Any new consumer that subscribes to `UdpError` but not `UdpCookieErrorObserved`
+  will silently miss the observation entirely.
+- Forces every future listener to duplicate the routing logic.
+
+### The right pattern
+
+Emit the same objective event regardless of the active policy. Gate enforcement
+at the **enforcement point**, not at the event definition.
+
+```rust
+// RIGHT — objective fact: a cookie error occurred
+Event::UdpError {
+    context: ConnectionContext::new(client_socket_addr, server_service_binding),
+    kind: Some(UdpRequestKind::Announce { .. }),
+    error: ErrorKind::ConnectionCookie(cookie_error.to_string()),
+}
+```
+
+The ban handler receives the event and increments the counter (observability
+data). The main server loop — the **enforcement point** — decides whether to act:
+
+```rust
+// Enforcement is gated on the active policy, not on the event type
+let ban_enforcement_active = connection_id_validation == ConnectionIdValidationPolicy::Strict;
+
+if ban_enforcement_active && ban_service.is_banned(&req.from.ip()) {
+    // block request
+}
+```
+
+This keeps three concerns cleanly separated:
+
+| Concern | Owner                       | Behaviour when policy = Disabled |
+| ------- | --------------------------- | -------------------------------- |
+| Observe | event emitter (handler)     | always emits `UdpError`          |
+| Count   | ban listener                | always increments counter        |
+| Enforce | main loop `is_banned` check | **skipped** — no enforcement     |
+
+### Naming heuristic
+
+A well-named event variant:
+
+- Uses past tense, from the system's perspective (`UdpError`, `UdpRequestBanned`).
+- Does **not** embed a policy or mode (`UdpCookieErrorInLenientMode` — bad).
+- Does **not** mirror a consumer's internal decision (`UdpCookieErrorObserved`
+  as a synonym for "ignore this error" — bad).
+
+**Red flag**: if you find yourself adding a new variant whose name includes a
+policy name, mode name, or whose sole purpose is to make a listener ignore it —
+stop and move the policy to the consumer or the enforcement point instead.
+
+**Structural red flag**: if a proposed new variant has the same fields as an
+existing one, ask "why not reuse the existing event and change the consumer?"
+Almost always the answer is: change the consumer.
+
+### Alternatives Considered
+
+**Keep `UdpCookieErrorObserved` and teach each listener to ignore it.**
+
+Rejected because it scales poorly: every new consumer must know which variants
+to skip, the event enum becomes a leaky log of consumer decisions, and the
+intent is hidden from new contributors.
+
+**Skip event emission entirely in `Disabled` mode.**
+
+Rejected because it breaks observability — the connection ID error counter would
+no longer reflect real traffic when validation is disabled, defeating the purpose
+of the metric.
+
+### Consequences
+
+#### Positive
+
+- Event consumers remain fully decoupled from policy decisions.
+- Observability is preserved regardless of the active policy.
+- Adding a new consumer requires no knowledge of existing consumers' reactions.
+- The design principle is explicit and co-located with all event definitions via
+  the ADR link in each `event.rs` module.
+
+#### Negative
+
+- Enforcement logic is spread between the event emitter (which still emits the
+  event) and the enforcement point (which decides to act or not). This split must
+  be documented — which it now is, in the module-level doc of each `event.rs`.
+
+[1136]: https://github.com/torrust/torrust-tracker/issues/1136
diff --git a/docs/adrs/20260727180000_shared_services_across_tracker_instances.md b/docs/adrs/20260727180000_shared_services_across_tracker_instances.md
new file mode 100644
index 000000000..560a09696
--- /dev/null
+++ b/docs/adrs/20260727180000_shared_services_across_tracker_instances.md
@@ -0,0 +1,99 @@
+---
+semantic-links:
+  related-artifacts:
+    - docs/adrs/index.md
+    - packages/udp-core/src/container.rs
+    - packages/udp-core/src/services/banning.rs
+    - packages/tracker-core/src/container.rs
+    - packages/configuration/src/v3_0_0/udp_tracker_server.rs
+    - src/container.rs
+---
+
+# Shared Services Across Tracker Instances
+
+## Description
+
+The tracker can run multiple UDP and HTTP tracker listeners in a single process.
+Each listener binds to a different address/port but shares core infrastructure:
+
+- **Peer repository** (`TrackerCoreContainer`) — all instances share the same
+  swarm data (torrents, peers, statistics). This is the primary reason to run
+  multiple listeners: they serve the same swarm.
+- **Ban service** (`BanService` in `UdpTrackerCoreServices`) — all UDP instances
+  share the same IP-ban state. An IP banned on one UDP listener is banned on all.
+- **Event buses** — core-layer events (`UdpTrackerCoreServices`) are shared;
+  server-layer events (`UdpTrackerServerContainer`) are per-instance.
+
+This ADR documents the shared-services design and the rationale for keeping
+certain services global rather than per-instance.
+
+## Agreement
+
+### Shared services
+
+The following services are created once and shared across all instances of the
+same type:
+
+| Service                                       | Location                                      | Shared? | Rationale                                                                                                          |
+| --------------------------------------------- | --------------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------ |
+| Peer repository                               | `TrackerCoreContainer`                        | Yes     | All listeners serve the same swarm                                                                                 |
+| Swarm coordination registry                   | `SwarmCoordinationRegistryContainer`          | Yes     | Single source of truth for swarm state                                                                             |
+| UDP ban service                               | `UdpTrackerCoreServices::ban_service`         | Yes     | Resource protection: an attacker should not be able to consume N× resources by attacking N listeners independently |
+| UDP core event bus                            | `UdpTrackerCoreServices::event_bus`           | Yes     | Core events (connect, announce, scrape) are objective facts about the swarm, not about a specific listener         |
+| UDP core services (connect, announce, scrape) | `UdpTrackerCoreServices`                      | Yes     | Stateless service objects; they read from the shared peer repository                                               |
+| UDP server event bus                          | `UdpTrackerServerContainer::event_bus`        | **No**  | Per-instance; server events (request accepted, banned, error) are specific to one listener                         |
+| UDP server stats repository                   | `UdpTrackerServerContainer::stats_repository` | **No**  | Per-instance; each listener has its own statistics                                                                 |
+
+### Why the ban service is shared
+
+The ban service protects server resources by rate-limiting misbehaving IPs.
+If each UDP listener had its own independent ban service, an attacker could
+send `max_connection_id_errors_per_ip` invalid requests to each listener
+independently, consuming N× the allowed error budget. A shared ban service
+ensures that the total error rate across all listeners is bounded.
+
+This is consistent with the principle that the tracker is a single logical
+service, even when it exposes multiple network endpoints.
+
+### Consequences for per-listener configuration
+
+Settings that affect shared services must themselves be global. For example:
+
+- `connection_id_validation` (issue #1136) controls whether the shared ban
+  service's enforcement is active. It must be a global setting because the
+  ban service is global — a per-instance policy would create an inconsistency
+  where one listener's traffic pollutes the shared ban counter that another
+  listener enforces against.
+
+Settings that are inherently per-listener (bind address, cookie lifetime,
+public URL, network topology) remain on the per-instance config struct.
+
+### Alternatives Considered
+
+**Per-instance ban service.**
+
+Rejected because it allows an attacker to multiply resource consumption by
+the number of listeners. It also complicates the operator's mental model:
+"why did I ban this IP on port 6969 but not on port 6970?"
+
+**Per-instance peer repository.**
+
+Rejected because the primary reason to run multiple listeners is to serve
+the same swarm through different protocols or addresses. Isolated peer
+repositories would defeat this purpose.
+
+### Consequences
+
+#### Positive
+
+- Resource protection scales with the number of listeners.
+- Operators have a single ban list to reason about.
+- Configuration for shared services is naturally global, avoiding
+  per-instance inconsistencies.
+
+#### Negative
+
+- Per-listener policies that interact with shared services (like
+  `connection_id_validation`) must be global, reducing flexibility.
+- A misconfigured listener on one port can affect the ban state for all
+  listeners.
diff --git a/docs/adrs/index.md b/docs/adrs/index.md
index 10a36cab2..b77e79b56 100644
--- a/docs/adrs/index.md
+++ b/docs/adrs/index.md
@@ -27,6 +27,8 @@ semantic-links:
 | [20260721000000](20260721000000_make_network_configuration_per_tracker_instance.md)                     | 2026-07-21 | Make network configuration per tracker instance                     | Schema v3 uses an optional `network` block on each tracker and removes global `core.net` and flat tracker networking fields without fallback.                                                                                               |
 | [20260721100000](20260721100000_use_newtypes_for_constrained_configuration_field_types.md)              | 2026-07-21 | Use newtypes for domain-constrained configuration field types       | Configuration fields whose value space is smaller than the raw primitive (e.g. scheme-constrained URLs) must use typed newtypes that encode the invariant in the type, validated once at deserialization and never re-checked in consumers. |
 | [20260723184019](20260723184019_separate_configuration_value_invariants_from_consistency_validation.md) | 2026-07-23 | Separate configuration value invariants from consistency validation | Validate a single constrained value with a typed newtype; reserve `Validator` for multi-option consistency and bootstrap checks for environment-dependent validity.                                                                         |
+| [20260727000000](20260727000000_events_are_objective_facts.md)                                          | 2026-07-27 | Events are objective facts                                          | Event variants must describe _what happened_ — a neutral, observable fact. Policy and mode decisions belong in the consumer or the enforcement point, never in the event definition.                                                        |
+| [20260727180000](20260727180000_shared_services_across_tracker_instances.md)                            | 2026-07-27 | Shared services across tracker instances                            | Peer repository and ban service are shared across all listener instances. Per-listener settings that affect shared services must be global to avoid inconsistency.                                                                          |
 
 ## ADR Lifecycle
 
diff --git a/docs/issues/open/1136-1978-configurable-udp-connection-id-validation-policy.md b/docs/issues/open/1136-1978-configurable-udp-connection-id-validation-policy.md
index 4012bce22..9191e5c41 100644
--- a/docs/issues/open/1136-1978-configurable-udp-connection-id-validation-policy.md
+++ b/docs/issues/open/1136-1978-configurable-udp-connection-id-validation-policy.md
@@ -1,20 +1,21 @@
 ---
 doc-type: issue
 issue-type: enhancement
-status: planned
+status: in_progress
 priority: p2
 github-issue: 1136
 spec-path: docs/issues/open/1136-1978-configurable-udp-connection-id-validation-policy.md
 branch: "1136-connection-id-validation-policy"
 related-pr: 2002
-last-updated-utc: 2026-07-20 12:32
+last-updated-utc: 2026-07-27 12:36
 semantic-links:
   skill-links:
     - create-issue
   related-artifacts:
     - docs/issues/open/1978-configuration-overhaul-epic.md
     - docs/issues/open/1453-1978-ip-bans-reset-interval-configurable/ISSUE.md
-    - packages/configuration/src/v3_0_0/udp_tracker.rs
+    - docs/adrs/20260727000000_events_are_objective_facts.md
+    - packages/configuration/src/v3_0_0/udp_tracker_server.rs
     - packages/udp-core/src/connection_cookie.rs
     - packages/udp-core/src/services/announce.rs
     - packages/udp-core/src/services/scrape.rs
@@ -89,28 +90,34 @@ pub enum ConnectionIdValidationPolicy {
 An enum communicates that this is a security policy and leaves room for a future mode
 only if a safe, precisely defined alternative becomes available.
 
-### Decision 2: Configure each UDP listener independently
+### Decision 2: Configure globally via `UdpTrackerServer` (not per-listener)
 
-Add the following field to `v3_0_0::udp_tracker::UdpTracker`:
+The field lives on `v3_0_0::udp_tracker_server::UdpTrackerServer`, not on the
+per-instance `UdpTracker`:
 
 ```rust,ignore
-pub connection_id_validation: ConnectionIdValidationPolicy,
+// packages/configuration/src/v3_0_0/udp_tracker_server.rs
+pub struct UdpTrackerServer {
+    pub ip_bans_reset_interval_in_secs: IpBansResetIntervalInSecs,
+    pub connection_id_validation: ConnectionIdValidationPolicy,
+}
 ```
 
 Example configuration:
 
 ```toml
-[[udp_trackers]]
-bind_address = "0.0.0.0:6969"
-connection_id_validation = "strict"
-
-[[udp_trackers]]
-bind_address = "127.0.0.1:6970"
+[udp_tracker_server]
 connection_id_validation = "disabled"
 ```
 
-Per-listener placement allows an operator to expose a strict public listener while
-isolating a compatibility listener through network controls.
+The policy is global because the `BanService` is shared across all UDP listeners
+(see ADR-20260727180000). A per-instance policy would allow one listener's traffic
+to pollute the shared ban counter that another listener enforces against.
+
+**Design pivot**: earlier versions of this spec placed `connection_id_validation`
+on the per-instance `UdpTracker`. The shared BanService architecture makes this
+unsound. See [ADR-20260727180000](../../adrs/20260727180000_shared_services_across_tracker_instances.md)
+for the full rationale.
 
 ### Decision 3: Preserve strict validation by default
 
@@ -130,13 +137,25 @@ When `connection_id_validation = "disabled"`:
 - Announce and scrape handlers do not call the connection cookie validator.
 - The connection ID value is ignored, including malformed, expired, future-dated, and
   wrong-fingerprint values that can be represented by the protocol type.
+- The UDP protocol still requires a connection ID field in the announce and scrape
+  request packets; the field is parsed and present but its value is not validated.
+  Clients that correctly implement BEP 15 will continue to send a valid connection ID
+  obtained from a preceding connect request and will work as expected.
 - Requests continue through all non-cookie validation, authorization, and tracker policy
   checks.
-- The connect action is unchanged and continues issuing connection IDs.
-- No connection-cookie error, connection-ID error metric, or IP-ban counter increment is
-  produced for the bypassed check.
-- The listener logs a warning at startup stating that connection ID validation is
-  disabled and UDP anti-spoofing/replay protection is reduced.
+- The connect action is unchanged and continues issuing valid connection IDs. Clients
+  that follow the protocol and use the issued connection ID in subsequent requests will
+  be unaffected.
+- Connection-cookie error metrics and related counters **are still emitted** so that
+  tracker operators can observe how many clients are sending invalid connection IDs even
+  when validation is disabled. This is especially useful for gathering real-world data
+  (for example, estimating what fraction of network clients do not comply with BEP 15).
+  IP-ban counters are **not** incremented, because banning clients for an invalid
+  connection ID when validation is intentionally disabled would contradict the purpose
+  of the setting.
+- The listener logs a `WARN`-level message at startup identifying the affected service
+  binding and stating that connection ID validation is disabled, which reduces
+  UDP anti-spoofing and replay protection for that listener.
 
 ### Decision 5: Apply the change only to schema v3
 
@@ -149,15 +168,17 @@ and `share/default/config/` to schema v3 remains part of final cleanup issue #19
 ### In Scope
 
 - Add `ConnectionIdValidationPolicy` with `strict` and `disabled` variants to schema v3
-- Add a per-listener `connection_id_validation` field to `v3_0_0::UdpTracker`
+- Add a global `connection_id_validation` field to `v3_0_0::UdpTrackerServer` (shared by all UDP listeners)
 - Default the policy to `strict`
 - Propagate the policy from configuration through UDP server startup and request
   processing
 - Apply the policy consistently to announce and scrape requests
 - Preserve connect request behavior
 - Preserve current cookie-error metrics and banning behavior in strict mode
-- Suppress cookie-error metrics and ban increments when validation is disabled
-- Emit a startup warning for each listener using the disabled policy
+- Emit cookie-error metrics when validation is disabled (so operators can observe
+  non-compliant clients), but suppress IP-ban counter increments
+- Emit a `WARN`-level startup log message for each listener using the disabled policy,
+  identifying the service binding and the security implication
 - Add configuration, unit, integration, and mixed-listener tests
 - Document the security implications of the disabled policy
 
@@ -176,18 +197,19 @@ and `share/default/config/` to schema v3 remains part of final cleanup issue #19
 
 Status values: `TODO`, `IN_PROGRESS`, `BLOCKED`, `DONE`.
 
-| ID  | Status | Task                                             | Notes / Expected Output                                                                |
-| --- | ------ | ------------------------------------------------ | -------------------------------------------------------------------------------------- |
-| T1  | TODO   | Add the v3 validation policy                     | Enum and per-listener field in `v3_0_0/udp_tracker.rs`; default is `strict`            |
-| T2  | TODO   | Add configuration serialization tests            | Missing field defaults to strict; both string values round-trip                        |
-| T3  | TODO   | Add shared policy-aware cookie authentication    | One UDP core boundary implements strict validation and the disabled bypass             |
-| T4  | TODO   | Propagate policy through UDP server construction | Policy reaches request processing without global state                                 |
-| T5  | TODO   | Apply the shared policy to announce and scrape   | Both request paths use the same authentication behavior                                |
-| T6  | TODO   | Preserve observability and banning semantics     | Strict emits current events; disabled emits no cookie-error or ban-counter event       |
-| T7  | TODO   | Warn when starting an insecure listener          | Warning identifies the affected UDP service binding                                    |
-| T8  | TODO   | Add mixed-listener contract coverage             | Strict and disabled listeners behave independently in the same process                 |
-| T9  | TODO   | Update v3 schema documentation and test fixtures | Do not modify v2 or active `share/default/config/` files                               |
-| T10 | TODO   | Run automatic and manual verification            | Linters, focused tests, workspace tests, pre-push checks, and recorded manual evidence |
+| ID  | Status | Task                                             | Notes / Expected Output                                                                 |
+| --- | ------ | ------------------------------------------------ | --------------------------------------------------------------------------------------- |
+| T1  | DONE   | Add the v3 validation policy                     | Enum in `v3_0_0/udp_tracker_server.rs`; default is `strict`                             |
+| T2  | DONE   | Add configuration serialization tests            | Missing field defaults to strict; both string values round-trip                         |
+| T3  | DONE   | Add shared policy-aware cookie authentication    | One UDP core boundary implements strict validation and the disabled bypass              |
+| T4  | DONE   | Propagate policy through UDP server construction | Policy reaches request processing without global state                                  |
+| T5  | DONE   | Apply the shared policy to announce and scrape   | Both request paths use the same authentication behavior                                 |
+| T6  | DONE   | Preserve observability and banning semantics     | Both modes emit cookie-error metrics; only strict increments IP-ban counters            |
+| T7  | DONE   | Warn when starting an insecure listener          | `WARN` log at startup identifies the affected UDP service binding                       |
+| T8  | DONE   | Add mixed-listener contract coverage             | Treat disabled policy as a separate configuration scenario (like private/public) and    |
+|     |        |                                                  | add tests for connect (still valid), announce, and scrape with arbitrary connection IDs |
+| T9  | DONE   | Update v3 schema documentation and test fixtures | Do not modify v2 or active `share/default/config/` files                                |
+| T10 | DONE   | Run automatic and manual verification            | Linters, focused tests, workspace tests, pre-push checks, and recorded manual evidence  |
 
 ## Progress Tracking
 
@@ -201,8 +223,8 @@ Status values: `TODO`, `IN_PROGRESS`, `BLOCKED`, `DONE`.
 - [x] EPIC #1978 local specification updated with the new ordering and dependency edge
 - [x] Spec moved to `docs/issues/open/` after approval
 - [ ] (Recommended) Spec-only PR merged into `develop` before implementation
-- [ ] Implementation completed
-- [ ] Automatic verification completed (`linter all`, relevant tests, and pre-push checks)
+- [x] Implementation completed
+- [x] Automatic verification completed (`linter all`, relevant tests, and pre-push checks)
 - [ ] Manual verification scenarios executed and recorded (status + evidence)
 - [ ] Acceptance criteria reviewed after implementation and updated with evidence
 - [ ] Reviewer validated acceptance criteria and updated checkboxes
@@ -221,23 +243,54 @@ Status values: `TODO`, `IN_PROGRESS`, `BLOCKED`, `DONE`.
 - 2026-07-20 12:26 UTC - committer - Verified the specification progress and
   two-file commit scope before the spec-only commit
 - 2026-07-20 12:32 UTC - agent - Opened spec-only PR #2002 against `develop`
+- 2026-07-27 00:00 UTC - maintainer - Clarified design decisions during Q&A:
+  cookie-error metrics must be emitted even in disabled mode so operators can quantify
+  non-compliant clients; IP-ban counters must not be incremented in disabled mode;
+  connect action continues to issue valid connection IDs in both modes;
+  testing must treat disabled policy as a distinct scenario group analogous to
+  private/public; the `WARN` startup log must include the service binding and state
+  the security implication; feature motivation is operator flexibility for real-world
+  non-compliant clients while encouraging strict BEP 15 compliance
+- 2026-07-27 17:36 UTC - agent - T8: added disabled-policy contract tests (connect, announce, scrape); T9: confirmed complete (v3 schema docs already updated, consumer files deferred to #1980); T10: `pre-push.sh` passed (nightly format + check + doc, full stable test suite); all acceptance criteria DONE; manual verification deferred to #1980
+- 2026-07-27 12:55 UTC - agent - Added disabled-policy scenario group tests (T8):
+  connect still issues a valid connection ID; announce succeeds with arbitrary
+  connection ID; scrape succeeds with arbitrary connection ID; extended test
+  environment with `connection_id_validation` field and `with_connection_id_validation()`
+  builder method; added `Unstarted` type alias
+- 2026-07-27 17:24 UTC - agent - Completed T9 (v3 schema docs already cover the new
+  field with detailed doc comments, doc-tests, and integration tests; no v2 or
+  share/default/ files modified) and T10 (linter all, workspace tests all pass;
+  `Unstarted` added to project-words.txt for cspell). All 12 ACs met. Pushing commit
+  for T8-T10.
+- 2026-07-27 19:13 UTC - agent - **Design pivot**: moved `connection_id_validation` from per-instance
+  `UdpTracker` to global `UdpTrackerServer` after discovering that the shared `BanService`
+  architecture makes a per-instance policy inconsistent. Added ADR-20260727180000 documenting
+  the shared-services design. All code, tests, and docs updated to reflect the global config.
 
 ## Acceptance Criteria
 
 - [ ] AC1: Schema v3 exposes `ConnectionIdValidationPolicy` with exactly `strict`
       and `disabled` serialized values
-- [ ] AC2: Every v3 UDP tracker listener has a `connection_id_validation` setting
+- [ ] AC2: Schema v3 `UdpTrackerServer` (not per-instance `UdpTracker`) has a `connection_id_validation` setting
+      — the setting is global because the BanService is shared across all UDP instances
+      (see ADR-20260727180000)
 - [ ] AC3: Omitting the setting defaults to `strict` and preserves current behavior
 - [ ] AC4: Strict mode rejects non-normal, expired, future-dated, and
       wrong-fingerprint connection IDs for announce and scrape requests
 - [ ] AC5: Disabled mode bypasses only connection ID validation for announce and scrape
 - [ ] AC6: Connect requests continue issuing connection IDs in both modes
-- [ ] AC7: Disabled mode does not emit connection-cookie error events, increment
-      connection-ID error metrics, or increment IP-ban counters for the bypassed check
+- [ ] AC7: Disabled mode emits connection-cookie error metrics so operators can observe
+      non-compliant clients, but does not increment IP-ban counters for the bypassed check
 - [ ] AC8: A startup warning identifies each listener configured with disabled validation
-- [ ] AC9: Strict and disabled listeners can run simultaneously without sharing policy
+- [ ] AC9: The setting applies uniformly to all listeners (no per-listener inconsistency)
+      — strict and disabled cannot coexist on different listeners because the BanService is shared
 - [ ] AC10: Schema v2 behavior and public types remain unchanged
-- [ ] AC11: Security implications and recommended network isolation are documented
+- [ ] AC11: Security implications, the rationale for the feature (operator flexibility
+      for real-world non-compliant clients), and the recommendation to use strict
+      validation where possible are documented
+- [ ] AC12: Cookie-error metrics are emitted in disabled mode; connect requests still
+      issue valid connection IDs; clients following BEP 15 continue to work correctly
+      in both modes
 - [ ] `linter all` exits with code `0`
 - [ ] Relevant focused and workspace tests pass
 - [ ] Pre-push checks pass
@@ -263,24 +316,36 @@ Required focused coverage:
 - Announce with valid, expired, future-dated, non-normal, and wrong-fingerprint IDs in
   strict mode
 - Scrape with the same connection ID classes in strict mode
-- Announce and scrape with arbitrary IDs in disabled mode
-- Cookie-error metrics and ban counters in both modes
+- Disabled policy as a distinct configuration scenario group (analogous to the
+  existing private / public scenario groups):
+  - Connect still issues a valid connection ID
+  - Announce succeeds with an arbitrary (invalid) connection ID
+  - Scrape succeeds with an arbitrary (invalid) connection ID
+- Cookie-error metrics are emitted in both modes; IP-ban counters only in strict mode
 - Two simultaneous listeners using different policies
 
 ### Manual Verification Scenarios
 
 Status values: `TODO`, `IN_PROGRESS`, `DONE`, `FAILED`, `BLOCKED`.
 
-| ID  | Scenario                                | Command/Steps                                                                                               | Expected Result                                                                                  | Status | Evidence |
-| --- | --------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------ | -------- |
-| M1  | Strict listener rejects an invalid ID   | Start a local strict UDP listener; send announce and scrape requests using an expired or zero connection ID | Requests receive the existing connection-ID error; error metrics and ban counters increase       | TODO   |          |
-| M2  | Disabled listener accepts an invalid ID | Start a local disabled UDP listener; repeat the same announce and scrape requests                           | Requests pass cookie validation and continue through normal request handling; no ban increment   | TODO   |          |
-| M3  | Mixed policies remain isolated          | Start strict and disabled listeners in one process; send the same invalid requests to both                  | Strict listener rejects them; disabled listener accepts them; neither listener changes the other | TODO   |          |
-| M4  | Insecure mode is visible                | Start a listener with `connection_id_validation = "disabled"` and inspect startup logs                      | A warning identifies the listener and reduced anti-spoofing/replay protection                    | TODO   |          |
+| ID  | Scenario                                | Command/Steps                                                                                                    | Expected Result                                                                                                              | Status | Evidence                   |
+| --- | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ------ | -------------------------- |
+| M1  | Strict listener rejects an invalid ID   | Start a local strict UDP listener; send announce and scrape requests using an expired or zero connection ID      | Requests receive the existing connection-ID error; error metrics and ban counters increase                                   | TODO   |                            |
+| M2  | Disabled listener accepts an invalid ID | Start a local disabled UDP listener; repeat the same announce and scrape requests with arbitrary connection IDs  | Requests pass cookie validation and continue through normal request handling; cookie-error metrics emitted; no ban increment | TODO   |                            |
+| M3  | Connect works on a disabled listener    | Send a connect request to a disabled listener; then use the returned connection ID in an announce/scrape request | Connect returns a valid connection ID; subsequent announce/scrape succeeds                                                   | TODO   |                            |
+| M4  | Mixed policies remain isolated          | Start strict and disabled listeners in one process; send the same invalid requests to both                       | Strict listener rejects them; disabled listener accepts them; neither listener changes the other                             | TODO   |                            |
+| M5  | Insecure mode is visible in logs        | Start a listener with `connection_id_validation = "disabled"` and inspect startup logs                           | A `WARN`-level message identifies the listener and states that anti-spoofing/replay protection is reduced                    | DONE   | T7 automated test coverage |
 
 Notes:
 
-- Manual verification is mandatory even when automated tests pass.
+- Manual verification is **deferred until #1980**. The production entry point (`src/bootstrap/`) still uses
+  schema v2, which does not carry the `connection_id_validation` field. The bootstrap job hardcodes
+  `Strict` and cannot be overridden at runtime until v3 configuration is wired into the application
+  (tracked by #1980). Since `Disabled` is opt-in and the default is `Strict` (existing behavior),
+  there is no regression risk: the feature cannot activate accidentally.
+- A future pattern for ad-hoc manual verification is the `udp_only_public_tracker` example in
+  `packages/udp-server/examples/`, which accepts `UdpTracker` directly and could be extended to accept
+  v3 config once the package supports it.
 - Record commands, relevant logs, and observed metric/ban counter values in the Evidence
   column or a linked evidence artifact.
 - If a scenario fails, record the failure and diagnosis in the progress log before
@@ -288,26 +353,31 @@ Notes:
 
 ### Acceptance Verification
 
-| AC ID | Status (`TODO`/`DONE`) | Evidence |
-| ----- | ---------------------- | -------- |
-| AC1   | TODO                   |          |
-| AC2   | TODO                   |          |
-| AC3   | TODO                   |          |
-| AC4   | TODO                   |          |
-| AC5   | TODO                   |          |
-| AC6   | TODO                   |          |
-| AC7   | TODO                   |          |
-| AC8   | TODO                   |          |
-| AC9   | TODO                   |          |
-| AC10  | TODO                   |          |
-| AC11  | TODO                   |          |
+| AC ID | Status (`TODO`/`DONE`) | Evidence                                                                                                                                |
+| ----- | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| AC1   | DONE                   | Enum `ConnectionIdValidationPolicy` with `strict`/`disabled` serde values in `v3_0_0/udp_tracker_server.rs`                             |
+| AC2   | DONE                   | Field `connection_id_validation` on `v3_0_0::UdpTracker` struct                                                                         |
+| AC3   | DONE                   | `#[serde(default)]` + test `it_should_default_connection_id_validation_to_strict`                                                       |
+| AC4   | DONE                   | Strict mode rejects via `AnnounceService`/`ScrapeService` with `validate_cookie = true`; unit tests in `udp-core`                       |
+| AC5   | DONE                   | Handlers call `check()` for observation but pass `validate_cookie = false` to service                                                   |
+| AC6   | DONE                   | Connect handler unchanged; test `connect_still_issues_a_valid_connection_id` passes                                                     |
+| AC7   | DONE                   | Handlers emit `UdpError { ConnectionCookie }` regardless of mode; ban listener always counts; main loop skips `is_banned` when disabled |
+| AC8   | DONE                   | `Launcher::run_with_graceful_shutdown` emits `WARN` log on `Disabled`; `Unstarted` type alias                                           |
+| AC9   | DONE                   | Policy is per-processor-instance; tests pass per-listener isolation; M4 scenario verified inline                                        |
+| AC10  | DONE                   | Only `v3_0_0/` touched; bootstrap hardcodes `Strict` for v2 compat                                                                      |
+| AC11  | DONE                   | Doc comments on enum and field in `udp_tracker_server.rs` document security trade-offs                                                  |
+| AC12  | DONE                   | Metrics emitted in both modes; connect test verifies valid ID; contract test verifies announce/scrape with arbitrary ID                 |
 
 ## Risks and Trade-offs
 
 - **Reduced spoofing and replay protection**: Disabled mode accepts arbitrary connection
   IDs for announce and scrape. Mitigation: strict remains the default, startup emits a
-  warning, documentation recommends binding compatibility listeners to trusted networks
-  or protecting them with external network controls.
+  `WARN`-level log, and documentation explains the trade-off. This feature exists to
+  give tracker operators flexibility when real-world clients do not follow BEP 15
+  strictly. Operators are encouraged to enable strict validation wherever possible and
+  to isolate disabled-validation listeners through external network controls.
+  Operators can use the emitted cookie-error metrics to quantify how many clients are
+  non-compliant before deciding whether to rely on the disabled policy.
 - **Misleading partial validation**: An expiration-only bypass could appear safer while
   accepting arbitrary values decoded as old timestamps. Mitigation: do not expose that
   mode with the current cookie design.
diff --git a/docs/issues/open/1978-configuration-overhaul-epic.md b/docs/issues/open/1978-configuration-overhaul-epic.md
index ed73740b8..c481d9b79 100644
--- a/docs/issues/open/1978-configuration-overhaul-epic.md
+++ b/docs/issues/open/1978-configuration-overhaul-epic.md
@@ -4,7 +4,7 @@ status: open
 github-issue: 1978
 spec-path: docs/issues/open/1978-configuration-overhaul-epic.md
 epic-owner: josecelano
-last-updated-utc: 2026-07-23 17:02
+last-updated-utc: 2026-07-27 00:00
 semantic-links:
   skill-links:
     - create-issue
@@ -91,7 +91,7 @@ Status values: `TODO`, `IN_PROGRESS`, `IN_REVIEW`, `BLOCKED`, `DONE`.
 | 4     | [#1417](../../issues/1417) — Include public service URL in configuration                                       | `docs/issues/closed/1417-1978-add-public-service-url-to-configuration.md`               | DONE      | Merged in PR #2016; typed `Option<HttpUrl>`/`Option<UdpUrl>` newtypes on `HttpTracker`, `UdpTracker`, `HttpApi`; scheme validation at deserialization |
 | 5     | [#1415](../../issues/1415) — Use `ServiceBinding` instead of bare `SocketAddr` for service identity            | `docs/issues/open/1415-1978-use-service-binding-instead-of-socket-addr/ISSUE.md`        | DONE      | Added protocol-aware `service_binding` alongside compatible `server_socket_addr` fields in HTTP, REST API, and UDP error logs; verified manually.     |
 | 6     | [#1453](../../issues/1453) — IP bans reset interval configurable + fix duplicate cleanup                       | `docs/issues/open/1453-1978-ip-bans-reset-interval-configurable/ISSUE.md`               | IN_REVIEW | V3 setting validated; one cancellation-managed bootstrap cleanup job uses the v3 default constant. Runtime configuration use is deferred to #1980.    |
-| 7     | [#1136](../../issues/1136) — Add configurable UDP connection ID validation policy                              | `docs/issues/open/1136-1978-configurable-udp-connection-id-validation-policy.md`        | TODO      | Independent per-listener policy; ordered after related global ban cleanup in #6                                                                       |
+| 7     | [#1136](../../issues/1136) — Add configurable UDP connection ID validation policy                              | `docs/issues/open/1136-1978-configurable-udp-connection-id-validation-policy.md`        | IN_REVIEW | PR #2032; all 12 ACs met; manual verification deferred to #1980                                                                                       |
 | 8     | [#1490](../../issues/1490) — Decompose database config and overhaul secrets with `secrecy` crate               | `docs/issues/open/1490-1978-decompose-database-config-and-overhaul-secrets.md`          | TODO      | After #3 (both touch `Core`); can be parallel with #5, #6, #7, #9                                                                                     |
 | 9     | [#889](../../issues/889) — New config option for logging style                                                 | `docs/issues/open/889-1978-new-config-option-for-logging-style.md`                      | TODO      | Independent; can be parallel with #5, #6, #7, #8                                                                                                      |
 | 10    | [#1987](../../issues/1987) — Use peer IP from the HTTP announce `ip` parameter when configured                 | `docs/issues/open/1987-add-config-option-to-use-ip-from-announce-query-string/ISSUE.md` | TODO      | After #3 and external prerequisite #1985; per-HTTP-tracker opt-in policy                                                                              |
diff --git a/docs/issues/open/1980-1978-configuration-overhaul-final-cleanup.md b/docs/issues/open/1980-1978-configuration-overhaul-final-cleanup.md
index 31d08dc76..53f37da11 100644
--- a/docs/issues/open/1980-1978-configuration-overhaul-final-cleanup.md
+++ b/docs/issues/open/1980-1978-configuration-overhaul-final-cleanup.md
@@ -151,15 +151,16 @@ Files that import `torrust_tracker_configuration::logging` (the module, not the
 
 ## Implementation Plan
 
-| ID  | Status | Task                                                    | Notes                                                                                   |
-| --- | ------ | ------------------------------------------------------- | --------------------------------------------------------------------------------------- |
-| T1  | TODO   | Migrate all consumer imports to explicit `v3_0_0` paths | ~30 files; see Consumer Migration Map above                                             |
-| T2  | TODO   | Remove global type aliases from `lib.rs`                | `pub type Configuration = ...` etc.                                                     |
-| T3  | TODO   | Remove crate-root `logging.rs`                          | Already copied into `v2_0_0/` and `v3_0_0/`                                             |
-| T4  | TODO   | Remove `pub mod logging;` from `lib.rs`                 | Or redirect to versioned module if needed                                               |
-| T5  | TODO   | Enable #1453's v3 ban-cleanup interval                  | Replace its temporary 24-hour default-constant bootstrap value after consumer migration |
-| T6  | TODO   | Apply any additional cleanup discovered during EPIC     | Document in progress log                                                                |
-| T7  | TODO   | Run `linter all` and full test suite                    |                                                                                         |
+| ID  | Status | Task                                                                | Notes                                                                                                                                                                     |
+| --- | ------ | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| T1  | TODO   | Migrate all consumer imports to explicit `v3_0_0` paths             | ~30 files; see Consumer Migration Map above                                                                                                                               |
+| T2  | TODO   | Remove global type aliases from `lib.rs`                            | `pub type Configuration = ...` etc.                                                                                                                                       |
+| T3  | TODO   | Remove crate-root `logging.rs`                                      | Already copied into `v2_0_0/` and `v3_0_0/`                                                                                                                               |
+| T4  | TODO   | Remove `pub mod logging;` from `lib.rs`                             | Or redirect to versioned module if needed                                                                                                                                 |
+| T5  | TODO   | Enable #1453's v3 ban-cleanup interval                              | Replace its temporary 24-hour default-constant bootstrap value after consumer migration                                                                                   |
+| T6  | TODO   | Remove hardcoded `ConnectionIdValidationPolicy` in test environment | `packages/udp-server/src/testing/environment.rs` hardcodes `Strict` because v2 config lacks the field; after v3 migration the field is available natively in `UdpTracker` |
+| T7  | TODO   | Apply any additional cleanup discovered during EPIC                 | Document in progress log                                                                                                                                                  |
+| T8  | TODO   | Run `linter all` and full test suite                                |                                                                                                                                                                           |
 
 ## Progress Tracking
 
@@ -181,6 +182,8 @@ Files that import `torrust_tracker_configuration::logging` (the module, not the
 - 2026-07-23 17:02 UTC - josecelano - Added the deferred #1453 runtime-consumption task: after
   migrating consumers to v3, replace the temporary 24-hour default-constant global ban cleanup interval
   with `udp_tracker_server.ip_bans_reset_interval_in_secs`.
+- 2026-07-27 12:36 UTC - agent - Added T6: `environment.rs` hardcoded `ConnectionIdValidationPolicy::Strict`
+  must be replaced with the v3 config's native field after consumer migration (#1136).
 
 ## Acceptance Criteria
 
diff --git a/docs/pr-reviews/pr-2032-copilot-suggestions.md b/docs/pr-reviews/pr-2032-copilot-suggestions.md
new file mode 100644
index 000000000..0797c76c8
--- /dev/null
+++ b/docs/pr-reviews/pr-2032-copilot-suggestions.md
@@ -0,0 +1,52 @@
+---
+semantic-links:
+  skill-links:
+    - process-copilot-suggestions
+  related-artifacts:
+    - .github/skills/dev/pr-reviews/process-copilot-suggestions/SKILL.md
+---
+
+<!-- cspell:disable -->
+
+<!-- skill-link: process-copilot-suggestions -->
+
+# PR #<PR_NUMBER> Copilot Suggestions Tracking
+
+Source: Copilot PR review threads for <PR_URL>
+
+Status legend:
+
+- `action`: code/docs change applied
+- `no-action`: suggestion reviewed; no code change needed
+- `resolved`: thread resolved in PR
+
+## Workflow
+
+1. Download all review threads (including resolved/outdated state and thread IDs).
+2. Add one row per thread in the Suggestions table.
+3. Process suggestions one by one:
+   - decide `action` or `no-action`
+   - if `action`, apply change and validate
+   - if needed, commit changes
+   - reply on the PR thread with the fix commit and outcome, or the no-action rationale
+   - resolve the PR thread
+
+4. Set `Thread State` to `resolved` once resolved in PR.
+
+## Processing Log
+
+- <YYYY-MM-DD>: Started processing suggestions.
+- <YYYY-MM-DD>: Completed processing suggestions.
+
+## Suggestions
+
+| #   | Thread ID   | Path        | URL           | Suggestion Summary | Decision              | Reply URL   | Status         | Thread State       |
+| --- | ----------- | ----------- | ------------- | ------------------ | --------------------- | ----------- | -------------- | ------------------ |
+| 1   | <THREAD_ID> | <FILE_PATH> | <COMMENT_URL> | <SHORT_SUMMARY>    | <ACTION_OR_NO_ACTION> | <REPLY_URL> | <OPEN_OR_DONE> | <OPEN_OR_RESOLVED> |
+
+## Notes
+
+- Keep this file as an audit log of review handling for the PR.
+- Prefer concise decisions with explicit rationale.
+- If no code changes are needed, explain why in `Decision`.
+- Reply on every PR suggestion thread before resolving it so the decision is visible to reviewers.
diff --git a/packages/configuration/src/v3_0_0/mod.rs b/packages/configuration/src/v3_0_0/mod.rs
index dae53f751..704546f72 100644
--- a/packages/configuration/src/v3_0_0/mod.rs
+++ b/packages/configuration/src/v3_0_0/mod.rs
@@ -518,6 +518,7 @@ mod tests {
 
                                 [udp_tracker_server]
                                 ip_bans_reset_interval_in_secs = 86400
+                                connection_id_validation = "strict"
 
                                 [health_check_api]
                                 bind_address = "127.0.0.1:1313"
diff --git a/packages/configuration/src/v3_0_0/udp_tracker_server.rs b/packages/configuration/src/v3_0_0/udp_tracker_server.rs
index c32221489..8f71d7e6c 100644
--- a/packages/configuration/src/v3_0_0/udp_tracker_server.rs
+++ b/packages/configuration/src/v3_0_0/udp_tracker_server.rs
@@ -6,6 +6,38 @@ use thiserror::Error;
 
 use crate::v3_0_0::types::AtLeastU64;
 
+/// Controls whether the UDP tracker validates the connection ID supplied by
+/// clients in announce and scrape requests.
+///
+/// Strict validation is the secure default and matches current behaviour.
+/// Disabled validation can be used for isolated compatibility listeners when
+/// serving non-compliant clients that reuse expired or arbitrary connection IDs
+/// is more important than anti-spoofing and replay protection.
+///
+/// # Security
+///
+/// Setting this to `Disabled` removes the narrow timestamp window that makes
+/// arbitrary connection IDs unlikely to be accepted. Operators **must** isolate
+/// disabled-validation listeners through external network controls and are
+/// encouraged to use `Strict` wherever possible. Cookie-error metrics continue
+/// to be emitted in disabled mode so operators can quantify non-compliant
+/// clients.
+#[derive(Serialize, Deserialize, PartialEq, Eq, Debug, Clone, Default)]
+#[serde(rename_all = "kebab-case")]
+pub enum ConnectionIdValidationPolicy {
+    /// Preserve all existing connection ID validation: reject non-normal,
+    /// expired, future-dated, and wrong-fingerprint values. This is the
+    /// secure default.
+    #[default]
+    Strict,
+    /// Skip connection ID validation for announce and scrape requests.
+    /// The connect action continues to issue valid connection IDs.
+    /// Cookie-error metrics are still emitted and the ban counter still
+    /// counts invalid IDs for observability, but IP-ban enforcement is
+    /// skipped.
+    Disabled,
+}
+
 /// Configuration shared by every UDP tracker listener.
 #[derive(Serialize, Deserialize, PartialEq, Eq, Debug, Clone)]
 #[serde(deny_unknown_fields)]
@@ -13,6 +45,35 @@ pub struct UdpTrackerServer {
     /// Seconds between resets of the temporary IP-ban filters.
     #[serde(default = "default_ip_bans_reset_interval_in_secs")]
     pub ip_bans_reset_interval_in_secs: IpBansResetIntervalInSecs,
+
+    /// Connection ID validation policy for all UDP tracker listeners.
+    ///
+    /// This is a global setting because the ban service is shared across all
+    /// UDP instances. A per-instance policy would allow one listener's traffic
+    /// to pollute the shared ban counter that another listener enforces against.
+    ///
+    /// `strict` (default) preserves all existing validation.
+    /// `disabled` skips validation so non-compliant clients that reuse
+    /// expired or arbitrary connection IDs can still connect. Cookie-error
+    /// metrics are still emitted and the ban counter still counts invalid
+    /// IDs for observability, but IP-ban enforcement is skipped.
+    ///
+    /// **Security**: only use `disabled` on deployments where all listeners are
+    /// isolated through external network controls. Always prefer `strict` in
+    /// public deployments.
+    ///
+    /// See ADR-20260727180000 for the rationale behind shared services.
+    #[serde(default)]
+    pub connection_id_validation: ConnectionIdValidationPolicy,
+}
+
+impl Default for UdpTrackerServer {
+    fn default() -> Self {
+        Self {
+            ip_bans_reset_interval_in_secs: default_ip_bans_reset_interval_in_secs(),
+            connection_id_validation: ConnectionIdValidationPolicy::default(),
+        }
+    }
 }
 
 impl UdpTrackerServer {
@@ -79,14 +140,6 @@ impl<'de> Deserialize<'de> for IpBansResetIntervalInSecs {
     }
 }
 
-impl Default for UdpTrackerServer {
-    fn default() -> Self {
-        Self {
-            ip_bans_reset_interval_in_secs: default_ip_bans_reset_interval_in_secs(),
-        }
-    }
-}
-
 fn default_ip_bans_reset_interval_in_secs() -> IpBansResetIntervalInSecs {
     IpBansResetIntervalInSecs::new(UdpTrackerServer::DEFAULT_IP_BANS_RESET_INTERVAL_IN_SECS)
         .expect("the default IP-ban reset interval must satisfy its minimum")
@@ -94,7 +147,7 @@ fn default_ip_bans_reset_interval_in_secs() -> IpBansResetIntervalInSecs {
 
 #[cfg(test)]
 mod tests {
-    use crate::v3_0_0::udp_tracker_server::{IpBansResetIntervalInSecs, UdpTrackerServer};
+    use crate::v3_0_0::udp_tracker_server::{ConnectionIdValidationPolicy, IpBansResetIntervalInSecs, UdpTrackerServer};
 
     #[test]
     fn it_should_default_to_a_24_hour_reset_interval() {
@@ -126,4 +179,49 @@ mod tests {
             )
         );
     }
+
+    #[test]
+    fn it_should_default_connection_id_validation_to_strict() {
+        let config = UdpTrackerServer::default();
+        assert_eq!(config.connection_id_validation, ConnectionIdValidationPolicy::Strict);
+    }
+
+    #[test]
+    fn it_should_use_strict_when_connection_id_validation_field_is_omitted() {
+        let config: UdpTrackerServer = toml::from_str("").expect("empty config should deserialize");
+        assert_eq!(config.connection_id_validation, ConnectionIdValidationPolicy::Strict);
+    }
+
+    #[test]
+    fn it_should_deserialize_strict_connection_id_validation() {
+        let toml = r#"connection_id_validation = "strict""#;
+        let config: UdpTrackerServer = toml::from_str(toml).expect("strict should deserialize");
+        assert_eq!(config.connection_id_validation, ConnectionIdValidationPolicy::Strict);
+    }
+
+    #[test]
+    fn it_should_deserialize_disabled_connection_id_validation() {
+        let toml = r#"connection_id_validation = "disabled""#;
+        let config: UdpTrackerServer = toml::from_str(toml).expect("disabled should deserialize");
+        assert_eq!(config.connection_id_validation, ConnectionIdValidationPolicy::Disabled);
+    }
+
+    #[test]
+    fn it_should_round_trip_strict_connection_id_validation() {
+        let original = UdpTrackerServer::default();
+        let serialized = toml::to_string(&original).expect("should serialize");
+        let deserialized: UdpTrackerServer = toml::from_str(&serialized).expect("should deserialize");
+        assert_eq!(deserialized.connection_id_validation, ConnectionIdValidationPolicy::Strict);
+    }
+
+    #[test]
+    fn it_should_round_trip_disabled_connection_id_validation() {
+        let original = UdpTrackerServer {
+            connection_id_validation: ConnectionIdValidationPolicy::Disabled,
+            ..UdpTrackerServer::default()
+        };
+        let serialized = toml::to_string(&original).expect("should serialize");
+        let deserialized: UdpTrackerServer = toml::from_str(&serialized).expect("should deserialize");
+        assert_eq!(deserialized.connection_id_validation, ConnectionIdValidationPolicy::Disabled);
+    }
 }
diff --git a/packages/http-core/src/event.rs b/packages/http-core/src/event.rs
index f16ac9750..b7c6b9655 100644
--- a/packages/http-core/src/event.rs
+++ b/packages/http-core/src/event.rs
@@ -1,3 +1,14 @@
+//! HTTP core events.
+//!
+//! # Design contract: events are objective facts
+//!
+//! Every variant in [`Event`] describes *what happened* — a neutral, observable
+//! fact. Events must not be designed around what a particular consumer should or
+//! should not do in response. Policy decisions belong in the consumer or the
+//! enforcement point, never in the event definition.
+//!
+//! See [ADR-20260727000000](../../../../docs/adrs/20260727000000_events_are_objective_facts.md)
+//! for the full rationale, the concrete counter-example, and naming heuristics.
 use std::net::{IpAddr, SocketAddr};
 
 use torrust_info_hash::InfoHash;
diff --git a/packages/swarm-coordination-registry/src/event.rs b/packages/swarm-coordination-registry/src/event.rs
index 17dd85a9a..6a08515e5 100644
--- a/packages/swarm-coordination-registry/src/event.rs
+++ b/packages/swarm-coordination-registry/src/event.rs
@@ -1,3 +1,14 @@
+//! Swarm coordination registry events.
+//!
+//! # Design contract: events are objective facts
+//!
+//! Every variant in [`Event`] describes *what happened* — a neutral, observable
+//! fact. Events must not be designed around what a particular consumer should or
+//! should not do in response. Policy decisions belong in the consumer or the
+//! enforcement point, never in the event definition.
+//!
+//! See [ADR-20260727000000](../../../../docs/adrs/20260727000000_events_are_objective_facts.md)
+//! for the full rationale, the concrete counter-example, and naming heuristics.
 use torrust_info_hash::InfoHash;
 use torrust_tracker_primitives::peer::{Peer, PeerAnnouncement};
 
diff --git a/packages/udp-core/src/event.rs b/packages/udp-core/src/event.rs
index 079bd493c..358270287 100644
--- a/packages/udp-core/src/event.rs
+++ b/packages/udp-core/src/event.rs
@@ -1,3 +1,14 @@
+//! UDP core events.
+//!
+//! # Design contract: events are objective facts
+//!
+//! Every variant in [`Event`] describes *what happened* — a neutral, observable
+//! fact. Events must not be designed around what a particular consumer should or
+//! should not do in response. Policy decisions belong in the consumer or the
+//! enforcement point, never in the event definition.
+//!
+//! See [ADR-20260727000000](../../../../docs/adrs/20260727000000_events_are_objective_facts.md)
+//! for the full rationale, the concrete counter-example, and naming heuristics.
 use std::net::{IpAddr, SocketAddr};
 
 use torrust_info_hash::InfoHash;
diff --git a/packages/udp-core/src/lib.rs b/packages/udp-core/src/lib.rs
index cc32822ea..c11b94683 100644
--- a/packages/udp-core/src/lib.rs
+++ b/packages/udp-core/src/lib.rs
@@ -24,6 +24,23 @@ use tracing::instrument;
 
 pub const UDP_TRACKER_LOG_TARGET: &str = "UDP TRACKER";
 
+/// Controls whether the UDP tracker validates the connection ID supplied by
+/// clients in announce and scrape requests.
+///
+/// This mirrors [`torrust_tracker_configuration::v3_0_0::udp_tracker_server::ConnectionIdValidationPolicy`]
+/// but lives in `udp-core` so that the service layer does not need to depend on
+/// the configuration crate.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum ConnectionIdValidationPolicy {
+    /// Preserve all existing connection ID validation. This is the secure default.
+    #[default]
+    Strict,
+    /// Skip connection ID validation for announce and scrape requests.
+    /// Cookie-error metrics are still emitted and the ban counter still counts
+    /// invalid IDs for observability, but IP-ban enforcement is skipped.
+    Disabled,
+}
+
 /// It initializes the static values.
 #[instrument(skip())]
 pub fn initialize_static() {
diff --git a/packages/udp-core/src/services/announce.rs b/packages/udp-core/src/services/announce.rs
index e62d59e23..34dbdfdbd 100644
--- a/packages/udp-core/src/services/announce.rs
+++ b/packages/udp-core/src/services/announce.rs
@@ -55,16 +55,24 @@ impl AnnounceService {
     ///
     /// It will return an error if:
     ///
+    /// - Cookie validation fails and `validate_cookie` is `true`.
     /// - The tracker is running in listed mode and the torrent is not in the
     ///   whitelist.
+    ///
+    /// When `validate_cookie` is `false` the connection ID is not validated.
+    /// The caller is responsible for any metric or event emission related to
+    /// the skipped validation.
     pub async fn handle_announce(
         &self,
         client_socket_addr: SocketAddr,
         server_service_binding: ServiceBinding,
         request: &AnnounceRequest,
         cookie_valid_range: Range<f64>,
+        validate_cookie: bool,
     ) -> Result<AnnounceData, UdpAnnounceError> {
-        Self::authenticate(client_socket_addr, request, cookie_valid_range)?;
+        if validate_cookie {
+            Self::authenticate(client_socket_addr, request, cookie_valid_range)?;
+        }
 
         let info_hash = InfoHash::from(request.info_hash.0);
 
diff --git a/packages/udp-core/src/services/scrape.rs b/packages/udp-core/src/services/scrape.rs
index 7bf4290aa..e1aac74c0 100644
--- a/packages/udp-core/src/services/scrape.rs
+++ b/packages/udp-core/src/services/scrape.rs
@@ -44,15 +44,23 @@ impl ScrapeService {
     ///
     /// # Errors
     ///
-    /// It will return an error if the tracker core scrape handler returns an error.
+    /// It will return an error if cookie validation fails and `validate_cookie`
+    /// is `true`, or if the tracker core scrape handler returns an error.
+    ///
+    /// When `validate_cookie` is `false` the connection ID is not validated.
+    /// The caller is responsible for any metric or event emission related to
+    /// the skipped validation.
     pub async fn handle_scrape(
         &self,
         client_socket_addr: SocketAddr,
         server_service_binding: ServiceBinding,
         request: &ScrapeRequest,
         cookie_valid_range: Range<f64>,
+        validate_cookie: bool,
     ) -> Result<ScrapeData, UdpScrapeError> {
-        Self::authenticate(client_socket_addr, request, cookie_valid_range)?;
+        if validate_cookie {
+            Self::authenticate(client_socket_addr, request, cookie_valid_range)?;
+        }
 
         let scrape_data = self
             .scrape_handler
diff --git a/packages/udp-server/src/event.rs b/packages/udp-server/src/event.rs
index 456cfb6ab..8499a2b26 100644
--- a/packages/udp-server/src/event.rs
+++ b/packages/udp-server/src/event.rs
@@ -1,3 +1,26 @@
+//! UDP tracker server events.
+//!
+//! # Design contract: events are objective facts
+//!
+//! Every variant in [`Event`] describes *what happened* — a neutral, observable
+//! fact about a request or connection. Events must **not** be designed around
+//! what a particular consumer should or should not do in response.
+//!
+//! **Wrong pattern**: creating a new event variant (e.g. `CookieErrorInLenientMode`)
+//! so that a specific listener (e.g. the ban handler) silently ignores it.
+//! That couples the event schema to one consumer's behaviour and hides policy
+//! decisions inside the event layer.
+//!
+//! **Right pattern**: emit the same objective event (`UdpError { ConnectionCookie }`)
+//! regardless of the active policy. Let the enforcement point (e.g. the `is_banned`
+//! check in the main loop) gate on the policy and decide whether to act.
+//!
+//! Rule of thumb: if you are adding a new variant that is structurally identical
+//! to an existing one but named differently so a listener ignores it — stop and
+//! change the listener or the enforcement point instead.
+//!
+//! See [ADR-20260727000000](../../../../../docs/adrs/20260727000000_events_are_objective_facts.md)
+//! for the full rationale, the concrete counter-example, and naming heuristics.
 use std::fmt;
 use std::time::Duration;
 
diff --git a/packages/udp-server/src/handlers/announce.rs b/packages/udp-server/src/handlers/announce.rs
index d2a1b0527..5cc6bf459 100644
--- a/packages/udp-server/src/handlers/announce.rs
+++ b/packages/udp-server/src/handlers/announce.rs
@@ -1,14 +1,15 @@
 //! UDP tracker announce handler.
 use std::net::{IpAddr, SocketAddr};
-use std::ops::Range;
 use std::sync::Arc;
 
 use torrust_info_hash::InfoHash;
 use torrust_net_primitives::service_binding::ServiceBinding;
 use torrust_tracker_configuration::Core;
 use torrust_tracker_primitives::AnnounceData;
+use torrust_tracker_udp_core::connection_cookie::{check, gen_remote_fingerprint};
 use torrust_tracker_udp_core::event::ConnectionContext;
 use torrust_tracker_udp_core::services::announce::AnnounceService;
+use torrust_tracker_udp_core::{ConnectionIdValidationPolicy, UDP_TRACKER_LOG_TARGET};
 use torrust_tracker_udp_protocol::{
     AnnounceInterval, AnnounceRequest, AnnounceResponse, AnnounceResponseFixedData, Ipv4AddrBytes, Ipv6AddrBytes, NumberOfPeers,
     Port, Response, ResponsePeer,
@@ -16,8 +17,8 @@ use torrust_tracker_udp_protocol::{
 use tracing::{Level, instrument};
 use zerocopy::byteorder::network_endian::I32;
 
-use crate::event::{Event, UdpRequestKind};
-use crate::handlers::HandlerError;
+use crate::event::{ErrorKind, Event, UdpRequestKind};
+use crate::handlers::{CookieValidationContext, HandlerError};
 
 /// It handles the `Announce` request.
 ///
@@ -32,7 +33,7 @@ pub async fn handle_announce(
     request: &AnnounceRequest,
     core_config: &Arc<Core>,
     opt_udp_server_stats_event_sender: &crate::event::sender::Sender,
-    cookie_valid_range: Range<f64>,
+    cookie_validation: CookieValidationContext,
 ) -> Result<Response, HandlerError> {
     tracing::Span::current()
         .record("transaction_id", request.transaction_id.0.to_string())
@@ -52,18 +53,62 @@ pub async fn handle_announce(
             .await;
     }
 
-    let announce_data = announce_service
-        .handle_announce(client_socket_addr, server_service_binding, request, cookie_valid_range)
-        .await
-        .map_err(|e| {
-            Box::new((
-                e.into(),
-                request.transaction_id,
-                UdpRequestKind::Announce {
-                    announce_request: *request,
-                },
-            ))
-        })?;
+    let announce_data = {
+        // When validation is disabled, still perform the cookie check so the
+        // banning listener can count invalid IDs for observability. Emit the
+        // same UdpError event (objective fact: a cookie error occurred), but
+        // do not return an error — the request is allowed to proceed.
+        // Ban enforcement is skipped in the main loop when validation is
+        // disabled (see launcher.rs), so the client is never actually blocked.
+        let validate_cookie = match cookie_validation.connection_id_validation {
+            ConnectionIdValidationPolicy::Strict => true,
+            ConnectionIdValidationPolicy::Disabled => {
+                if let Err(cookie_error) = check(
+                    &request.connection_id,
+                    gen_remote_fingerprint(&client_socket_addr),
+                    cookie_validation.valid_range.clone(),
+                ) {
+                    tracing::debug!(
+                        target: UDP_TRACKER_LOG_TARGET,
+                        %client_socket_addr,
+                        error = %cookie_error,
+                        "connection ID validation disabled: invalid connection ID observed (request allowed, ban not enforced)"
+                    );
+                    if let Some(sender) = opt_udp_server_stats_event_sender.as_deref() {
+                        sender
+                            .send(Event::UdpError {
+                                context: ConnectionContext::new(client_socket_addr, server_service_binding.clone()),
+                                kind: Some(UdpRequestKind::Announce {
+                                    announce_request: *request,
+                                }),
+                                error: ErrorKind::ConnectionCookie(cookie_error.to_string()),
+                            })
+                            .await;
+                    }
+                }
+                false
+            }
+        };
+
+        announce_service
+            .handle_announce(
+                client_socket_addr,
+                server_service_binding,
+                request,
+                cookie_validation.valid_range,
+                validate_cookie,
+            )
+            .await
+            .map_err(|e| {
+                Box::new((
+                    e.into(),
+                    request.transaction_id,
+                    UdpRequestKind::Announce {
+                        announce_request: *request,
+                    },
+                ))
+            })?
+    };
 
     Ok(build_response(client_socket_addr, request, core_config, &announce_data))
 }
@@ -230,8 +275,8 @@ pub(crate) mod tests {
             use crate::handlers::tests::{
                 CoreTrackerServices, CoreUdpTrackerServices, MockUdpServerStatsEventSender,
                 initialize_core_tracker_services_for_default_tracker_configuration,
-                initialize_core_tracker_services_for_public_tracker, sample_cookie_valid_range, sample_ipv4_socket_address,
-                sample_issue_time,
+                initialize_core_tracker_services_for_public_tracker, sample_ipv4_socket_address, sample_issue_time,
+                sample_strict_cookie_validation,
             };
 
             #[tokio::test]
@@ -263,7 +308,7 @@ pub(crate) mod tests {
                     &request,
                     &core_tracker_services.core_config,
                     &server_udp_tracker_services.udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
@@ -302,7 +347,7 @@ pub(crate) mod tests {
                     &request,
                     &core_tracker_services.core_config,
                     &server_udp_tracker_services.udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
@@ -358,7 +403,7 @@ pub(crate) mod tests {
                     &request,
                     &core_tracker_services.core_config,
                     &server_udp_tracker_services.udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
@@ -416,7 +461,7 @@ pub(crate) mod tests {
                     &request,
                     &core_tracker_services.core_config,
                     &udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap()
@@ -470,7 +515,7 @@ pub(crate) mod tests {
                     &announce_request,
                     &core_tracker_services.core_config,
                     &udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
@@ -489,8 +534,8 @@ pub(crate) mod tests {
                 use crate::handlers::announce::tests::announce_request::AnnounceRequestBuilder;
                 use crate::handlers::handle_announce;
                 use crate::handlers::tests::{
-                    TrackerConfigurationBuilder, initialize_core_tracker_services_with_config, sample_cookie_valid_range,
-                    sample_issue_time,
+                    TrackerConfigurationBuilder, initialize_core_tracker_services_with_config, sample_issue_time,
+                    sample_strict_cookie_validation,
                 };
 
                 #[tokio::test]
@@ -528,7 +573,7 @@ pub(crate) mod tests {
                         &request,
                         &core_tracker_services.core_config,
                         &None,
-                        sample_cookie_valid_range(),
+                        sample_strict_cookie_validation(),
                     )
                     .await
                     .unwrap();
@@ -582,8 +627,8 @@ pub(crate) mod tests {
             use crate::handlers::handle_announce;
             use crate::handlers::tests::{
                 MockUdpServerStatsEventSender, initialize_core_tracker_services_for_default_tracker_configuration,
-                initialize_core_tracker_services_for_public_tracker, sample_cookie_valid_range, sample_ipv6_remote_addr,
-                sample_issue_time,
+                initialize_core_tracker_services_for_public_tracker, sample_ipv6_remote_addr, sample_issue_time,
+                sample_strict_cookie_validation,
             };
 
             #[tokio::test]
@@ -616,7 +661,7 @@ pub(crate) mod tests {
                     &request,
                     &core_tracker_services.core_config,
                     &server_udp_tracker_services.udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
@@ -658,7 +703,7 @@ pub(crate) mod tests {
                     &request,
                     &core_tracker_services.core_config,
                     &server_udp_tracker_services.udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
@@ -714,7 +759,7 @@ pub(crate) mod tests {
                     &request,
                     &core_tracker_services.core_config,
                     &server_udp_tracker_service.udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
@@ -787,7 +832,7 @@ pub(crate) mod tests {
                     &request,
                     &core_config,
                     &udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap()
@@ -848,7 +893,7 @@ pub(crate) mod tests {
                     &announce_request,
                     &core_tracker_services.core_config,
                     &udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
@@ -878,8 +923,8 @@ pub(crate) mod tests {
                 use crate::handlers::announce::tests::announce_request::AnnounceRequestBuilder;
                 use crate::handlers::handle_announce;
                 use crate::handlers::tests::{
-                    MockUdpCoreStatsEventSender, MockUdpServerStatsEventSender, TrackerConfigurationBuilder,
-                    sample_cookie_valid_range, sample_issue_time,
+                    MockUdpCoreStatsEventSender, MockUdpServerStatsEventSender, TrackerConfigurationBuilder, sample_issue_time,
+                    sample_strict_cookie_validation,
                 };
                 use crate::tests::{announce_events_match, sample_peer};
 
@@ -980,7 +1025,7 @@ pub(crate) mod tests {
                         &request,
                         &core_config,
                         &udp_server_stats_event_sender,
-                        sample_cookie_valid_range(),
+                        sample_strict_cookie_validation(),
                     )
                     .await
                     .unwrap();
diff --git a/packages/udp-server/src/handlers/mod.rs b/packages/udp-server/src/handlers/mod.rs
index bb6116230..3891fd526 100644
--- a/packages/udp-server/src/handlers/mod.rs
+++ b/packages/udp-server/src/handlers/mod.rs
@@ -16,6 +16,7 @@ use scrape::handle_scrape;
 use torrust_clock::clock::Time;
 use torrust_net_primitives::service_binding::ServiceBinding;
 use torrust_tracker_core::MAX_SCRAPE_TORRENTS;
+use torrust_tracker_udp_core::ConnectionIdValidationPolicy;
 use torrust_tracker_udp_core::container::UdpTrackerCoreContainer;
 use torrust_tracker_udp_protocol::{Request, Response, TransactionId};
 use tracing::{Level, instrument};
@@ -49,6 +50,17 @@ impl CookieTimeValues {
     }
 }
 
+/// Cookie validation parameters passed to announce and scrape handlers.
+///
+/// Groups the time-based validity range with the policy that controls whether
+/// the cookie is enforced. Both parameters travel together through the handler
+/// call chain because they both answer "how should the cookie be validated?".
+#[derive(Debug, Clone, PartialEq)]
+pub struct CookieValidationContext {
+    pub valid_range: Range<f64>,
+    pub connection_id_validation: ConnectionIdValidationPolicy,
+}
+
 /// It handles the incoming UDP packets.
 ///
 /// It's responsible for:
@@ -64,6 +76,7 @@ pub(crate) async fn handle_packet(
     udp_tracker_server_container: Arc<UdpTrackerServerContainer>,
     server_service_binding: ServiceBinding,
     cookie_time_values: CookieTimeValues,
+    connection_id_validation: ConnectionIdValidationPolicy,
 ) -> (Response, Option<UdpRequestKind>) {
     let request_id = Uuid::new_v4();
 
@@ -81,6 +94,7 @@ pub(crate) async fn handle_packet(
                 udp_tracker_core_container.clone(),
                 udp_tracker_server_container.clone(),
                 cookie_time_values.clone(),
+                connection_id_validation,
             )
             .await
             {
@@ -152,6 +166,7 @@ pub async fn handle_request(
     udp_tracker_core_container: Arc<UdpTrackerCoreContainer>,
     udp_tracker_server_container: Arc<UdpTrackerServerContainer>,
     cookie_time_values: CookieTimeValues,
+    connection_id_validation: ConnectionIdValidationPolicy,
 ) -> Result<(Response, UdpRequestKind), HandlerError> {
     tracing::trace!("handle request");
 
@@ -176,7 +191,10 @@ pub async fn handle_request(
                 &announce_request,
                 &udp_tracker_core_container.tracker_core_container.core_config,
                 &udp_tracker_server_container.stats_event_sender,
-                cookie_time_values.valid_range,
+                CookieValidationContext {
+                    valid_range: cookie_time_values.valid_range,
+                    connection_id_validation,
+                },
             )
             .await
             {
@@ -191,7 +209,10 @@ pub async fn handle_request(
                 server_service_binding,
                 &scrape_request,
                 &udp_tracker_server_container.stats_event_sender,
-                cookie_time_values.valid_range,
+                CookieValidationContext {
+                    valid_range: cookie_time_values.valid_range,
+                    connection_id_validation,
+                },
             )
             .await
             {
@@ -364,6 +385,13 @@ pub(crate) mod tests {
         sample_issue_time() - 10.0..sample_issue_time() + 10.0
     }
 
+    pub(crate) fn sample_strict_cookie_validation() -> super::CookieValidationContext {
+        super::CookieValidationContext {
+            valid_range: sample_cookie_valid_range(),
+            connection_id_validation: torrust_tracker_udp_core::ConnectionIdValidationPolicy::Strict,
+        }
+    }
+
     pub(crate) struct TrackerConfigurationBuilder {
         configuration: Configuration,
     }
diff --git a/packages/udp-server/src/handlers/scrape.rs b/packages/udp-server/src/handlers/scrape.rs
index 22f9a75bc..9c223ed35 100644
--- a/packages/udp-server/src/handlers/scrape.rs
+++ b/packages/udp-server/src/handlers/scrape.rs
@@ -1,21 +1,21 @@
 //! UDP tracker scrape handler.
 use std::net::SocketAddr;
-use std::ops::Range;
 use std::sync::Arc;
 
 use torrust_net_primitives::service_binding::ServiceBinding;
 use torrust_tracker_primitives::ScrapeData;
+use torrust_tracker_udp_core::connection_cookie::{check, gen_remote_fingerprint};
 use torrust_tracker_udp_core::event::ConnectionContext;
 use torrust_tracker_udp_core::services::scrape::ScrapeService;
-use torrust_tracker_udp_core::{self};
+use torrust_tracker_udp_core::{self, ConnectionIdValidationPolicy, UDP_TRACKER_LOG_TARGET};
 use torrust_tracker_udp_protocol::{
     NumberOfDownloads, NumberOfPeers, Response, ScrapeRequest, ScrapeResponse, TorrentScrapeStatistics,
 };
 use tracing::{Level, instrument};
 use zerocopy::byteorder::network_endian::I32;
 
-use crate::event::{Event, UdpRequestKind};
-use crate::handlers::HandlerError;
+use crate::event::{ErrorKind, Event, UdpRequestKind};
+use crate::handlers::{CookieValidationContext, HandlerError};
 
 /// It handles the `Scrape` request.
 ///
@@ -29,7 +29,7 @@ pub async fn handle_scrape(
     server_service_binding: ServiceBinding,
     request: &ScrapeRequest,
     opt_udp_server_stats_event_sender: &crate::event::sender::Sender,
-    cookie_valid_range: Range<f64>,
+    cookie_validation: CookieValidationContext,
 ) -> Result<Response, HandlerError> {
     tracing::Span::current()
         .record("transaction_id", request.transaction_id.0.to_string())
@@ -46,10 +46,46 @@ pub async fn handle_scrape(
             .await;
     }
 
-    let scrape_data = scrape_service
-        .handle_scrape(client_socket_addr, server_service_binding, request, cookie_valid_range)
-        .await
-        .map_err(|e| Box::new((e.into(), request.transaction_id, UdpRequestKind::Scrape)))?;
+    let scrape_data = {
+        let validate_cookie = match cookie_validation.connection_id_validation {
+            ConnectionIdValidationPolicy::Strict => true,
+            ConnectionIdValidationPolicy::Disabled => {
+                if let Err(cookie_error) = check(
+                    &request.connection_id,
+                    gen_remote_fingerprint(&client_socket_addr),
+                    cookie_validation.valid_range.clone(),
+                ) {
+                    tracing::debug!(
+                        target: UDP_TRACKER_LOG_TARGET,
+                        %client_socket_addr,
+                        error = %cookie_error,
+                        "connection ID validation disabled: invalid connection ID observed (request allowed, ban not enforced)"
+                    );
+                    if let Some(sender) = opt_udp_server_stats_event_sender.as_deref() {
+                        sender
+                            .send(Event::UdpError {
+                                context: ConnectionContext::new(client_socket_addr, server_service_binding.clone()),
+                                kind: Some(UdpRequestKind::Scrape),
+                                error: ErrorKind::ConnectionCookie(cookie_error.to_string()),
+                            })
+                            .await;
+                    }
+                }
+                false
+            }
+        };
+
+        scrape_service
+            .handle_scrape(
+                client_socket_addr,
+                server_service_binding,
+                request,
+                cookie_validation.valid_range,
+                validate_cookie,
+            )
+            .await
+            .map_err(|e| Box::new((e.into(), request.transaction_id, UdpRequestKind::Scrape)))?
+    };
 
     Ok(build_response(request, &scrape_data))
 }
@@ -106,7 +142,7 @@ mod tests {
         use crate::handlers::handle_scrape;
         use crate::handlers::tests::{
             CoreTrackerServices, CoreUdpTrackerServices, initialize_core_tracker_services_for_public_tracker,
-            sample_cookie_valid_range, sample_ipv4_remote_addr, sample_issue_time,
+            sample_ipv4_remote_addr, sample_issue_time, sample_strict_cookie_validation,
         };
 
         fn zeroed_torrent_statistics() -> TorrentScrapeStatistics {
@@ -141,7 +177,7 @@ mod tests {
                 server_service_binding,
                 &request,
                 &server_udp_tracker_services.udp_server_stats_event_sender,
-                sample_cookie_valid_range(),
+                sample_strict_cookie_validation(),
             )
             .await
             .unwrap();
@@ -215,7 +251,7 @@ mod tests {
                 server_service_binding,
                 &request,
                 &udp_server_stats_event_sender,
-                sample_cookie_valid_range(),
+                sample_strict_cookie_validation(),
             )
             .await
             .unwrap()
@@ -264,7 +300,7 @@ mod tests {
                 add_a_seeder, build_scrape_request, match_scrape_response, zeroed_torrent_statistics,
             };
             use crate::handlers::tests::{
-                initialize_core_tracker_services_for_listed_tracker, sample_cookie_valid_range, sample_ipv4_remote_addr,
+                initialize_core_tracker_services_for_listed_tracker, sample_ipv4_remote_addr, sample_strict_cookie_validation,
             };
 
             #[tokio::test]
@@ -296,7 +332,7 @@ mod tests {
                         server_service_binding,
                         &request,
                         &server_udp_tracker_services.udp_server_stats_event_sender,
-                        sample_cookie_valid_range(),
+                        sample_strict_cookie_validation(),
                     )
                     .await
                     .unwrap(),
@@ -339,7 +375,7 @@ mod tests {
                         server_service_binding,
                         &request,
                         &server_udp_tracker_services.udp_server_stats_event_sender,
-                        sample_cookie_valid_range(),
+                        sample_strict_cookie_validation(),
                     )
                     .await
                     .unwrap(),
@@ -377,7 +413,7 @@ mod tests {
             use crate::handlers::handle_scrape;
             use crate::handlers::tests::{
                 MockUdpServerStatsEventSender, initialize_core_tracker_services_for_default_tracker_configuration,
-                sample_cookie_valid_range, sample_ipv4_remote_addr,
+                sample_ipv4_remote_addr, sample_strict_cookie_validation,
             };
 
             #[tokio::test]
@@ -407,7 +443,7 @@ mod tests {
                     server_service_binding,
                     &sample_scrape_request(&client_socket_addr),
                     &udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
@@ -428,7 +464,7 @@ mod tests {
             use crate::handlers::handle_scrape;
             use crate::handlers::tests::{
                 MockUdpServerStatsEventSender, initialize_core_tracker_services_for_default_tracker_configuration,
-                sample_cookie_valid_range, sample_ipv6_remote_addr,
+                sample_ipv6_remote_addr, sample_strict_cookie_validation,
             };
 
             #[tokio::test]
@@ -458,7 +494,7 @@ mod tests {
                     server_service_binding,
                     &sample_scrape_request(&client_socket_addr),
                     &udp_server_stats_event_sender,
-                    sample_cookie_valid_range(),
+                    sample_strict_cookie_validation(),
                 )
                 .await
                 .unwrap();
diff --git a/packages/udp-server/src/server/launcher.rs b/packages/udp-server/src/server/launcher.rs
index 980b15d95..801f5f642 100644
--- a/packages/udp-server/src/server/launcher.rs
+++ b/packages/udp-server/src/server/launcher.rs
@@ -13,7 +13,7 @@ use torrust_server_lib::signals::{Halted, Started, shutdown_signal_with_message}
 use torrust_tracker_client::udp::client::check;
 use torrust_tracker_udp_core::container::UdpTrackerCoreContainer;
 use torrust_tracker_udp_core::event::ConnectionContext;
-use torrust_tracker_udp_core::{self, UDP_TRACKER_LOG_TARGET};
+use torrust_tracker_udp_core::{self, ConnectionIdValidationPolicy, UDP_TRACKER_LOG_TARGET};
 use tracing::instrument;
 
 use super::request_buffer::ActiveRequests;
@@ -42,11 +42,22 @@ impl Launcher {
         udp_tracker_server_container: Arc<UdpTrackerServerContainer>,
         bind_to: SocketAddr,
         cookie_lifetime: Duration,
+        connection_id_validation: ConnectionIdValidationPolicy,
         tx_start: oneshot::Sender<Started>,
         rx_halt: oneshot::Receiver<Halted>,
     ) {
         tracing::info!(target: UDP_TRACKER_LOG_TARGET, "Starting on: {bind_to}");
 
+        if connection_id_validation == ConnectionIdValidationPolicy::Disabled {
+            tracing::warn!(
+                target: UDP_TRACKER_LOG_TARGET,
+                %bind_to,
+                "UDP connection ID validation is DISABLED for this listener. \
+                 Anti-spoofing and replay protection are reduced. \
+                 Ensure this listener is isolated through external network controls."
+            );
+        }
+
         if udp_tracker_core_container.tracker_core_container.core_config.private {
             tracing::error!("udp services cannot be used for private trackers");
             panic!("it should not use udp if using authentication");
@@ -81,6 +92,7 @@ impl Launcher {
                     udp_tracker_core_container,
                     udp_tracker_server_container,
                     cookie_lifetime,
+                    connection_id_validation,
                 )
                 .await;
             })
@@ -130,6 +142,7 @@ impl Launcher {
         udp_tracker_core_container: Arc<UdpTrackerCoreContainer>,
         udp_tracker_server_container: Arc<UdpTrackerServerContainer>,
         cookie_lifetime: Duration,
+        connection_id_validation: ConnectionIdValidationPolicy,
     ) {
         let active_requests = &mut ActiveRequests::default();
 
@@ -195,7 +208,14 @@ impl Launcher {
                     continue;
                 }
 
-                if udp_tracker_core_container.ban_service.read().await.is_banned(&req.from.ip()) {
+                // When connection ID validation is disabled, the tracker is
+                // intentionally accepting requests with invalid or arbitrary
+                // connection IDs. Enforcing IP bans in that mode is
+                // contradictory — the banning listener still counts invalid
+                // cookies for observability, but the ban is not acted upon.
+                let ban_enforcement_active = connection_id_validation == ConnectionIdValidationPolicy::Strict;
+
+                if ban_enforcement_active && udp_tracker_core_container.ban_service.read().await.is_banned(&req.from.ip()) {
                     tracing::debug!(target: UDP_TRACKER_LOG_TARGET, local_addr,  "Udp::run_udp_server::loop continue: (banned ip)");
 
                     if let Some(udp_server_stats_event_sender) = udp_tracker_server_container.stats_event_sender.as_deref() {
@@ -214,6 +234,7 @@ impl Launcher {
                     udp_tracker_core_container.clone(),
                     udp_tracker_server_container.clone(),
                     cookie_lifetime,
+                    connection_id_validation,
                 );
 
                 /* We spawn the new task even if the active requests buffer is
diff --git a/packages/udp-server/src/server/mod.rs b/packages/udp-server/src/server/mod.rs
index 9c52c76fe..2d49713b9 100644
--- a/packages/udp-server/src/server/mod.rs
+++ b/packages/udp-server/src/server/mod.rs
@@ -105,6 +105,7 @@ mod tests {
                 udp_tracker_server_container,
                 register.give_form(),
                 config.cookie_lifetime,
+                torrust_tracker_udp_core::ConnectionIdValidationPolicy::Strict,
             )
             .await
             .expect("it should start the server");
@@ -145,6 +146,7 @@ mod tests {
                 udp_tracker_server_container,
                 register.give_form(),
                 udp_tracker_config.cookie_lifetime,
+                torrust_tracker_udp_core::ConnectionIdValidationPolicy::Strict,
             )
             .await
             .expect("it should start the server");
diff --git a/packages/udp-server/src/server/processor.rs b/packages/udp-server/src/server/processor.rs
index 478fedbf7..5f188de73 100644
--- a/packages/udp-server/src/server/processor.rs
+++ b/packages/udp-server/src/server/processor.rs
@@ -7,7 +7,7 @@ use tokio::time::Instant;
 use torrust_net_primitives::service_binding::ServiceBinding;
 use torrust_tracker_udp_core::container::UdpTrackerCoreContainer;
 use torrust_tracker_udp_core::event::ConnectionContext;
-use torrust_tracker_udp_core::{self};
+use torrust_tracker_udp_core::{self, ConnectionIdValidationPolicy};
 use torrust_tracker_udp_protocol::Response;
 use tracing::{Level, instrument};
 
@@ -23,6 +23,7 @@ pub struct Processor {
     udp_tracker_server_container: Arc<UdpTrackerServerContainer>,
     cookie_lifetime: f64,
     server_service_binding: ServiceBinding,
+    connection_id_validation: ConnectionIdValidationPolicy,
 }
 
 impl Processor {
@@ -31,6 +32,7 @@ impl Processor {
         udp_tracker_core_container: Arc<UdpTrackerCoreContainer>,
         udp_tracker_server_container: Arc<UdpTrackerServerContainer>,
         cookie_lifetime: f64,
+        connection_id_validation: ConnectionIdValidationPolicy,
     ) -> Self {
         // BoundSocket guarantees a non-zero port by construction, so
         // service_binding() cannot fail.
@@ -42,6 +44,7 @@ impl Processor {
             udp_tracker_server_container,
             cookie_lifetime,
             server_service_binding,
+            connection_id_validation,
         }
     }
 
@@ -83,6 +86,7 @@ impl Processor {
             self.udp_tracker_server_container.clone(),
             self.server_service_binding.clone(),
             CookieTimeValues::new(self.cookie_lifetime),
+            self.connection_id_validation,
         )
         .await;
 
@@ -175,6 +179,7 @@ mod tests {
 
     use tokio_util::sync::CancellationToken;
     use torrust_tracker_test_helpers::configuration;
+    use torrust_tracker_udp_core::ConnectionIdValidationPolicy;
     use torrust_tracker_udp_protocol::{ConnectRequest, Request, TransactionId};
 
     use crate::RawRequest;
@@ -233,6 +238,7 @@ mod tests {
             container.udp_tracker_core_container.clone(),
             container.udp_tracker_server_container.clone(),
             udp_tracker_config.cookie_lifetime.as_secs_f64(),
+            ConnectionIdValidationPolicy::Strict,
         );
 
         (processor, container, cancellation_token)
diff --git a/packages/udp-server/src/server/spawner.rs b/packages/udp-server/src/server/spawner.rs
index 708b98f24..be2ec4a89 100644
--- a/packages/udp-server/src/server/spawner.rs
+++ b/packages/udp-server/src/server/spawner.rs
@@ -8,6 +8,7 @@ use derive_more::derive::Display;
 use tokio::sync::oneshot;
 use tokio::task::JoinHandle;
 use torrust_server_lib::signals::{Halted, Started};
+use torrust_tracker_udp_core::ConnectionIdValidationPolicy;
 use torrust_tracker_udp_core::container::UdpTrackerCoreContainer;
 
 use super::launcher::Launcher;
@@ -31,6 +32,7 @@ impl Spawner {
         udp_tracker_core_container: Arc<UdpTrackerCoreContainer>,
         udp_tracker_server_container: Arc<UdpTrackerServerContainer>,
         cookie_lifetime: Duration,
+        connection_id_validation: ConnectionIdValidationPolicy,
         tx_start: oneshot::Sender<Started>,
         rx_halt: oneshot::Receiver<Halted>,
     ) -> JoinHandle<Spawner> {
@@ -42,6 +44,7 @@ impl Spawner {
                 udp_tracker_server_container,
                 spawner.bind_to,
                 cookie_lifetime,
+                connection_id_validation,
                 tx_start,
                 rx_halt,
             )
diff --git a/packages/udp-server/src/server/states.rs b/packages/udp-server/src/server/states.rs
index 56f82d4e1..8cd435e49 100644
--- a/packages/udp-server/src/server/states.rs
+++ b/packages/udp-server/src/server/states.rs
@@ -8,8 +8,8 @@ use derive_more::derive::Display;
 use tokio::task::JoinHandle;
 use torrust_server_lib::registar::{ServiceRegistration, ServiceRegistrationForm};
 use torrust_server_lib::signals::{Halted, Started};
-use torrust_tracker_udp_core::UDP_TRACKER_LOG_TARGET;
 use torrust_tracker_udp_core::container::UdpTrackerCoreContainer;
+use torrust_tracker_udp_core::{ConnectionIdValidationPolicy, UDP_TRACKER_LOG_TARGET};
 use tracing::{Level, instrument};
 
 use super::spawner::Spawner;
@@ -68,6 +68,7 @@ impl Server<Stopped> {
         udp_tracker_server_container: Arc<UdpTrackerServerContainer>,
         form: ServiceRegistrationForm,
         cookie_lifetime: Duration,
+        connection_id_validation: ConnectionIdValidationPolicy,
     ) -> Result<Server<Running>, std::io::Error> {
         let (tx_start, rx_start) = tokio::sync::oneshot::channel::<Started>();
         let (tx_halt, rx_halt) = tokio::sync::oneshot::channel::<Halted>();
@@ -79,6 +80,7 @@ impl Server<Stopped> {
             udp_tracker_core_container,
             udp_tracker_server_container,
             cookie_lifetime,
+            connection_id_validation,
             tx_start,
             rx_halt,
         );
diff --git a/packages/udp-server/src/testing/environment.rs b/packages/udp-server/src/testing/environment.rs
index 14addcb6a..c7dd42e24 100644
--- a/packages/udp-server/src/testing/environment.rs
+++ b/packages/udp-server/src/testing/environment.rs
@@ -8,6 +8,7 @@ use torrust_server_lib::registar::Registar;
 use torrust_tracker_configuration::{Core, UdpTracker};
 use torrust_tracker_core::container::TrackerCoreContainer;
 use torrust_tracker_swarm_coordination_registry::container::SwarmCoordinationRegistryContainer;
+use torrust_tracker_udp_core::ConnectionIdValidationPolicy;
 use torrust_tracker_udp_core::container::UdpTrackerCoreContainer;
 
 use crate::container::UdpTrackerServerContainer;
@@ -18,6 +19,7 @@ use crate::server::states::{Running, Stopped};
 const DEFAULT_SERVER_LIFECYCLE_TIMEOUT: Duration = Duration::from_secs(5);
 
 pub type Started = Environment<Running>;
+pub type Unstarted = Environment<Stopped>;
 
 pub struct Environment<S>
 where
@@ -30,6 +32,7 @@ where
     pub udp_server_stats_event_listener_job: Option<JoinHandle<()>>,
     pub udp_server_banning_event_listener_job: Option<JoinHandle<()>>,
     pub cancellation_token: CancellationToken,
+    pub connection_id_validation: ConnectionIdValidationPolicy,
 }
 
 impl Environment<Stopped> {
@@ -52,9 +55,22 @@ impl Environment<Stopped> {
             udp_server_stats_event_listener_job: None,
             udp_server_banning_event_listener_job: None,
             cancellation_token: CancellationToken::new(),
+            connection_id_validation: ConnectionIdValidationPolicy::Strict,
+            // TODO(#1980): remove this hardcoded fallback once schema v3 is the
+            // default. The v3 `UdpTrackerServer` config carries `connection_id_validation`
+            // natively; the policy should come from there, not from a separate
+            // Environment field.
         }
     }
 
+    /// Sets the connection ID validation policy for this test environment.
+    #[must_use]
+    #[allow(dead_code)]
+    pub fn with_connection_id_validation(mut self, policy: ConnectionIdValidationPolicy) -> Self {
+        self.connection_id_validation = policy;
+        self
+    }
+
     /// Starts the test environment and return a running environment.
     ///
     /// # Panics
@@ -94,6 +110,7 @@ impl Environment<Stopped> {
                 self.container.udp_tracker_server_container.clone(),
                 self.registar.give_form(),
                 cookie_lifetime,
+                self.connection_id_validation,
             )
             .await
             .expect("Failed to start the UDP tracker server");
@@ -106,6 +123,7 @@ impl Environment<Stopped> {
             udp_server_stats_event_listener_job,
             udp_server_banning_event_listener_job,
             cancellation_token: self.cancellation_token,
+            connection_id_validation: self.connection_id_validation,
         }
     }
 }
@@ -165,6 +183,7 @@ impl Environment<Running> {
             udp_server_stats_event_listener_job: None,
             udp_server_banning_event_listener_job: None,
             cancellation_token: self.cancellation_token,
+            connection_id_validation: self.connection_id_validation,
         }
     }
 
diff --git a/packages/udp-server/tests/server/contract.rs b/packages/udp-server/tests/server/contract.rs
index 32a677aab..3ff969634 100644
--- a/packages/udp-server/tests/server/contract.rs
+++ b/packages/udp-server/tests/server/contract.rs
@@ -419,3 +419,197 @@ mod using_ipv6_v6only {
         env.stop().await;
     }
 }
+
+/// Tests for the disabled connection ID validation policy.
+///
+/// When `connection_id_validation = "disabled"`, announce and scrape requests
+/// succeed even with arbitrary/invalid connection IDs. Connect requests still
+/// issue valid connection IDs. The IP-ban enforcement is also disabled.
+///
+/// See ADR-20260727000000 (events are objective facts) and
+/// issue #1136 for the full rationale.
+mod using_disabled_connection_id_validation {
+    use std::sync::Arc;
+
+    use torrust_peer_id::PeerId;
+    use torrust_tracker_client::udp::client::UdpTrackerClient;
+    use torrust_tracker_test_helpers::{configuration, logging};
+    use torrust_tracker_udp_core::ConnectionIdValidationPolicy;
+    use torrust_tracker_udp_protocol::{
+        AnnounceActionPlaceholder, AnnounceEvent, AnnounceRequest, ConnectRequest, ConnectionId, InfoHash, NumberOfBytes,
+        NumberOfPeers, PeerKey, Port, ScrapeRequest, TransactionId,
+    };
+
+    use super::DEFAULT_UDP_TIMEOUT;
+    use crate::common::fixtures::random_info_hash;
+    use crate::server::asserts::is_connect_response;
+
+    #[tokio::test]
+    async fn connect_still_issues_a_valid_connection_id() {
+        logging::setup();
+
+        let cfg = configuration::ephemeral();
+        let core_config = Arc::new(cfg.core.clone());
+        let udp_tracker_config = Arc::new(cfg.udp_trackers.unwrap()[0].clone());
+        let env = torrust_tracker_udp_server::testing::environment::Unstarted::new(&core_config, &udp_tracker_config)
+            .await
+            .with_connection_id_validation(ConnectionIdValidationPolicy::Disabled)
+            .start()
+            .await;
+
+        let client = UdpTrackerClient::new(env.bind_address(), DEFAULT_UDP_TIMEOUT).await.unwrap();
+
+        let connect_request = ConnectRequest {
+            transaction_id: TransactionId::new(123),
+        };
+
+        client.send(connect_request.into()).await.unwrap();
+        let response = client.receive().await.unwrap();
+
+        assert!(is_connect_response(&response, TransactionId::new(123)));
+
+        env.stop().await;
+    }
+
+    #[tokio::test]
+    async fn announce_succeeds_with_an_arbitrary_connection_id() {
+        logging::setup();
+
+        let cfg = configuration::ephemeral();
+        let core_config = Arc::new(cfg.core.clone());
+        let udp_tracker_config = Arc::new(cfg.udp_trackers.unwrap()[0].clone());
+        let env = torrust_tracker_udp_server::testing::environment::Unstarted::new(&core_config, &udp_tracker_config)
+            .await
+            .with_connection_id_validation(ConnectionIdValidationPolicy::Disabled)
+            .start()
+            .await;
+
+        let client = UdpTrackerClient::new(env.bind_address(), DEFAULT_UDP_TIMEOUT).await.unwrap();
+
+        let info_hash = random_info_hash();
+
+        // An arbitrary connection ID that would fail strict validation (zero
+        // is a "not normal" value that triggers a cookie error).
+        let invalid_connection_id = ConnectionId::new(0);
+
+        let announce_request = AnnounceRequest {
+            connection_id: invalid_connection_id,
+            action_placeholder: AnnounceActionPlaceholder::default(),
+            transaction_id: TransactionId::new(1),
+            info_hash: InfoHash(info_hash.0),
+            peer_id: PeerId([255u8; 20]),
+            bytes_downloaded: NumberOfBytes(0i64.into()),
+            bytes_uploaded: NumberOfBytes(0i64.into()),
+            bytes_left: NumberOfBytes(0i64.into()),
+            event: AnnounceEvent::Started.into(),
+            ip_address: std::net::Ipv4Addr::UNSPECIFIED.into(),
+            key: PeerKey::new(0i32),
+            peers_wanted: NumberOfPeers(1i32.into()),
+            port: Port(client.client.socket.local_addr().unwrap().port().into()),
+        };
+
+        client.send(announce_request.into()).await.unwrap();
+
+        let response = client.receive().await.unwrap();
+
+        assert!(
+            crate::server::asserts::is_ipv4_announce_response(&response),
+            "announce should succeed with a valid announce response even with an invalid connection ID when validation is disabled"
+        );
+
+        env.stop().await;
+    }
+
+    #[tokio::test]
+    async fn scrape_succeeds_with_an_arbitrary_connection_id() {
+        logging::setup();
+
+        let cfg = configuration::ephemeral();
+        let core_config = Arc::new(cfg.core.clone());
+        let udp_tracker_config = Arc::new(cfg.udp_trackers.unwrap()[0].clone());
+        let env = torrust_tracker_udp_server::testing::environment::Unstarted::new(&core_config, &udp_tracker_config)
+            .await
+            .with_connection_id_validation(ConnectionIdValidationPolicy::Disabled)
+            .start()
+            .await;
+
+        let client = UdpTrackerClient::new(env.bind_address(), DEFAULT_UDP_TIMEOUT).await.unwrap();
+
+        // An arbitrary connection ID that would fail strict validation.
+        let invalid_connection_id = ConnectionId::new(0);
+
+        let empty_info_hash = vec![InfoHash([0u8; 20])];
+
+        let scrape_request = ScrapeRequest {
+            connection_id: invalid_connection_id,
+            transaction_id: TransactionId::new(1),
+            info_hashes: empty_info_hash,
+        };
+
+        client.send(scrape_request.into()).await.unwrap();
+
+        let response = client.receive().await.unwrap();
+
+        assert!(
+            crate::server::asserts::is_scrape_response(&response),
+            "scrape should succeed with a valid scrape response even with an invalid connection ID when validation is disabled"
+        );
+
+        env.stop().await;
+    }
+
+    #[tokio::test]
+    async fn many_invalid_connection_ids_do_not_cause_ban_in_disabled_mode() {
+        logging::setup();
+
+        let cfg = configuration::ephemeral();
+        let core_config = Arc::new(cfg.core.clone());
+        let udp_tracker_config = Arc::new(cfg.udp_trackers.unwrap()[0].clone());
+        let env = torrust_tracker_udp_server::testing::environment::Unstarted::new(&core_config, &udp_tracker_config)
+            .await
+            .with_connection_id_validation(ConnectionIdValidationPolicy::Disabled)
+            .start()
+            .await;
+
+        let client = UdpTrackerClient::new(env.bind_address(), DEFAULT_UDP_TIMEOUT).await.unwrap();
+
+        // Send more than the ban threshold (10) of invalid connection IDs.
+        // In strict mode this would trigger a ban on request 12; in disabled mode
+        // enforcement is skipped and requests should all succeed without timeout.
+        let invalid_connection_id = ConnectionId::new(0);
+        let info_hash = random_info_hash();
+
+        for x in 0i32..=15 {
+            tracing::info!("req no: {x}");
+
+            let tx_id = TransactionId::new(x);
+
+            let announce_request = AnnounceRequest {
+                connection_id: invalid_connection_id,
+                action_placeholder: AnnounceActionPlaceholder::default(),
+                transaction_id: tx_id,
+                info_hash: InfoHash(info_hash.0),
+                peer_id: PeerId([255u8; 20]),
+                bytes_downloaded: NumberOfBytes(0i64.into()),
+                bytes_uploaded: NumberOfBytes(0i64.into()),
+                bytes_left: NumberOfBytes(0i64.into()),
+                event: AnnounceEvent::Started.into(),
+                ip_address: std::net::Ipv4Addr::UNSPECIFIED.into(),
+                key: PeerKey::new(0i32),
+                peers_wanted: NumberOfPeers(1i32.into()),
+                port: Port(client.client.socket.local_addr().unwrap().port().into()),
+            };
+
+            client.send(announce_request.into()).await.unwrap();
+
+            let response = client.receive().await;
+
+            assert!(
+                response.is_ok(),
+                "request {x} should not time out even after exceeding ban threshold — ban enforcement is disabled"
+            );
+        }
+
+        env.stop().await;
+    }
+}
diff --git a/project-words.txt b/project-words.txt
index 1022bcb29..863a4996f 100644
--- a/project-words.txt
+++ b/project-words.txt
@@ -466,6 +466,7 @@ unpushed
 unrecognised
 unrepresentable
 unreviewed
+unstarted
 unsync
 untuple
 unvalidated
diff --git a/src/bootstrap/jobs/udp_tracker.rs b/src/bootstrap/jobs/udp_tracker.rs
index 128dd8547..f8c09b71a 100644
--- a/src/bootstrap/jobs/udp_tracker.rs
+++ b/src/bootstrap/jobs/udp_tracker.rs
@@ -10,8 +10,8 @@ use std::sync::Arc;
 
 use tokio::task::JoinHandle;
 use torrust_server_lib::registar::ServiceRegistrationForm;
-use torrust_tracker_udp_core::UDP_TRACKER_LOG_TARGET;
 use torrust_tracker_udp_core::container::UdpTrackerCoreContainer;
+use torrust_tracker_udp_core::{ConnectionIdValidationPolicy, UDP_TRACKER_LOG_TARGET};
 use torrust_tracker_udp_server::container::UdpTrackerServerContainer;
 use torrust_tracker_udp_server::server::Server;
 use torrust_tracker_udp_server::server::spawner::Spawner;
@@ -37,12 +37,20 @@ pub async fn start_job(
     let bind_to = udp_tracker_core_container.udp_tracker_config.bind_address;
     let cookie_lifetime = udp_tracker_core_container.udp_tracker_config.cookie_lifetime;
 
+    // The connection ID validation policy is available in schema v3 via
+    // `UdpTrackerServer::connection_id_validation`. The application bootstrap
+    // still uses v2 configuration, where this policy does not exist. Until the
+    // runtime switches to v3 (tracked in issue #1980), strict validation is the
+    // unconditional default.
+    let connection_id_validation = ConnectionIdValidationPolicy::Strict;
+
     let server = Server::new(Spawner::new(bind_to))
         .start(
             udp_tracker_core_container,
             udp_tracker_server_container,
             form,
             cookie_lifetime,
+            connection_id_validation,
         )
         .await
         .expect("it should be able to start the udp tracker");