diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 888c457358..7a571e03a4 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -56,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b89b6c64a3..38f5420055 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -61,7 +61,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -84,7 +84,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -108,7 +108,7 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -127,7 +127,7 @@ jobs:
       BUILD_TYPE: 'Release'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -158,7 +158,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -197,7 +197,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -236,7 +236,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -275,7 +275,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -307,7 +307,7 @@ jobs:
       CXX_STANDARD: '14'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -339,7 +339,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -376,7 +376,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -408,7 +408,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -436,7 +436,7 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -455,7 +455,7 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -476,7 +476,7 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -497,7 +497,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -524,7 +524,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -543,7 +543,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -571,7 +571,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -596,7 +596,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -621,7 +621,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -656,7 +656,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -681,7 +681,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -716,7 +716,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -747,7 +747,7 @@ jobs:
       CXX_STANDARD: '14'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -769,7 +769,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -792,7 +792,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -817,7 +817,7 @@ jobs:
     if: false
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -842,7 +842,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -869,7 +869,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -896,7 +896,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -923,7 +923,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -950,7 +950,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -977,7 +977,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1004,7 +1004,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1031,7 +1031,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1058,7 +1058,7 @@ jobs:
     runs-on: macos-15
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1086,7 +1086,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1120,7 +1120,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1137,7 +1137,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1154,7 +1154,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1169,7 +1169,7 @@ jobs:
     runs-on: windows-2022
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1190,7 +1190,7 @@ jobs:
     runs-on: windows-2022
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1213,7 +1213,7 @@ jobs:
     runs-on: windows-2022
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1234,7 +1234,7 @@ jobs:
     runs-on: windows-2022
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1255,7 +1255,7 @@ jobs:
     if: false
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1274,7 +1274,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1304,7 +1304,7 @@ jobs:
 
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1323,7 +1323,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1340,7 +1340,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1360,7 +1360,7 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -1378,7 +1378,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -1424,7 +1424,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/clang-tidy.yaml b/.github/workflows/clang-tidy.yaml
index 604c6fce97..d0f3955af4 100644
--- a/.github/workflows/clang-tidy.yaml
+++ b/.github/workflows/clang-tidy.yaml
@@ -17,15 +17,15 @@ jobs:
       matrix:
         include:
           - cmake_options: all-options-abiv1-preview
-            warning_limit: 73
+            warning_limit: 113
           - cmake_options: all-options-abiv2-preview
-            warning_limit: 76
+            warning_limit: 124
     env:
       CC: /usr/bin/clang-22
       CXX: /usr/bin/clang++-22
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/cmake_install.yml b/.github/workflows/cmake_install.yml
index d2b799c3be..b0ab565c8d 100644
--- a/.github/workflows/cmake_install.yml
+++ b/.github/workflows/cmake_install.yml
@@ -19,7 +19,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -44,7 +44,7 @@ jobs:
       CXX_STANDARD: '20'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -70,7 +70,7 @@ jobs:
       BUILD_TYPE: 'Debug'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -105,7 +105,7 @@ jobs:
       BUILD_TYPE: 'Debug'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -138,7 +138,7 @@ jobs:
       BUILD_TYPE: 'Debug'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -174,7 +174,7 @@ jobs:
       BUILD_TYPE: 'Debug'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -209,7 +209,7 @@ jobs:
       BUILD_TYPE: 'Debug'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -251,7 +251,7 @@ jobs:
       BUILD_TYPE: 'Debug'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
@@ -294,7 +294,7 @@ jobs:
       BUILD_TYPE: 'Debug'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -329,7 +329,7 @@ jobs:
       BUILD_TYPE: 'Debug'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 61986d49b4..8e2d8fd255 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -23,7 +23,7 @@ jobs:
       CXX_STANDARD: '17'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -57,7 +57,7 @@ jobs:
       run: |
         sudo -E ./ci/install_thirdparty.sh --install-dir /usr/local --tags-file third_party_release --packages "ryml"
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
       with:
         languages: cpp
         config: |
@@ -72,4 +72,4 @@ jobs:
               "${GITHUB_WORKSPACE}"
         cmake --build . --parallel
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index 4b74a8b1f1..bda237b3a8 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/dependencies_image.yml b/.github/workflows/dependencies_image.yml
index 608b3c9fe0..ebff0da65a 100644
--- a/.github/workflows/dependencies_image.yml
+++ b/.github/workflows/dependencies_image.yml
@@ -13,7 +13,7 @@ jobs:
     timeout-minutes: 300
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -24,7 +24,7 @@ jobs:
         persist-credentials: false
     -
       name: Set up QEMU
-      uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
     -
       name: Set up Docker Buildx
       id: buildx
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 83daa4b544..4693bee020 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/iwyu.yml b/.github/workflows/iwyu.yml
index c1b44d0f0b..90d1c90a95 100644
--- a/.github/workflows/iwyu.yml
+++ b/.github/workflows/iwyu.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 68aee69dc6..372ddc6a23 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -8,14 +8,45 @@ on:
     - cron: "56 23 * * 6" # once a week
   workflow_dispatch:
 
-permissions: {}
+permissions: read-all
 
 jobs:
   analysis:
+    runs-on: ubuntu-latest
     permissions:
-      contents: read # for actions/checkout
-      id-token: write # for Scorecard to publish results
-      security-events: write # for the SARIF upload to code scanning
-    uses: open-telemetry/shared-workflows/.github/workflows/scorecard.yml@03559ef555db0eae5d85c3c6347d1530243e7aa7 # v0.13.0
-    with:
-      use-harden-runner: true
+      # Needed for Code scanning upload
+      security-events: write
+      # Needed for GitHub OIDC token if publish_results is true
+      id-token: write
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable
+      # uploads of run results in SARIF format to the repository Actions tab.
+      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        with:
+          sarif_file: results.sarif
diff --git a/.github/workflows/project_management_comment.yml b/.github/workflows/project_management_comment.yml
index 28f412da66..9422b8f153 100644
--- a/.github/workflows/project_management_comment.yml
+++ b/.github/workflows/project_management_comment.yml
@@ -15,7 +15,7 @@ jobs:
       issues: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/project_management_issue_open.yml b/.github/workflows/project_management_issue_open.yml
index 2bc328aad2..8d2a63c820 100644
--- a/.github/workflows/project_management_issue_open.yml
+++ b/.github/workflows/project_management_issue_open.yml
@@ -14,7 +14,7 @@ jobs:
       issues: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 52cda6b363..5da178d494 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -15,4 +15,4 @@ jobs:
     permissions:
       contents: read # for actions/checkout
       security-events: write # for zizmor to upload SARIF results
-    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@03559ef555db0eae5d85c3c6347d1530243e7aa7 # v0.13.0
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@d9b812f9924a121c6a8276ea2f9e6f5b622cdd4d # v0.10.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58b6b66a2b..5d13e91d1b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,14 @@ Increment the:
 
 ## [Unreleased]
 
+* [SDK] Allow SDK provider and instrumentation constructors to throw during
+  initialization. `GetTracer`, `GetLogger`, and `GetMeter` stay `noexcept` and
+  return a pre-allocated noop object if constructing a new instrumentation
+  object fails. After the first failure, later uncached `Get*` calls return
+  the same noop immediately without retrying construction. Existing cached
+  objects continue to be returned.
+  [#4361](https://github.com/open-telemetry/opentelemetry-cpp/issues/4361)
+
 * [DOC] Fix and clarify the `StartSpanOptions` documentation
   [#4526](https://github.com/open-telemetry/opentelemetry-cpp/pull/4526)
 
diff --git a/sdk/include/opentelemetry/sdk/logs/logger.h b/sdk/include/opentelemetry/sdk/logs/logger.h
index 44ed4ec1ee..7ad7a7cd62 100644
--- a/sdk/include/opentelemetry/sdk/logs/logger.h
+++ b/sdk/include/opentelemetry/sdk/logs/logger.h
@@ -42,7 +42,7 @@ class Logger final : public opentelemetry::logs::Logger
       opentelemetry::nostd::string_view name,
       std::shared_ptr<LoggerContext> context,
       std::unique_ptr<instrumentationscope::InstrumentationScope> instrumentation_scope =
-          instrumentationscope::InstrumentationScope::Create("")) noexcept;
+          instrumentationscope::InstrumentationScope::Create(""));
 
   /**
    * Returns the name of this logger.
diff --git a/sdk/include/opentelemetry/sdk/logs/logger_provider.h b/sdk/include/opentelemetry/sdk/logs/logger_provider.h
index 06ef66cc6a..f9206d8bf9 100644
--- a/sdk/include/opentelemetry/sdk/logs/logger_provider.h
+++ b/sdk/include/opentelemetry/sdk/logs/logger_provider.h
@@ -45,7 +45,7 @@ class OPENTELEMETRY_EXPORT LoggerProvider final : public opentelemetry::logs::Lo
           std::make_unique<instrumentationscope::ScopeConfigurator<LoggerConfig>>(
               instrumentationscope::ScopeConfigurator<LoggerConfig>::Builder(
                   LoggerConfig::Default())
-                  .Build())) noexcept;
+                  .Build()));
 
   /**
    * Initialize a new logger provider.
@@ -62,19 +62,19 @@ class OPENTELEMETRY_EXPORT LoggerProvider final : public opentelemetry::logs::Lo
           std::make_unique<instrumentationscope::ScopeConfigurator<LoggerConfig>>(
               instrumentationscope::ScopeConfigurator<LoggerConfig>::Builder(
                   LoggerConfig::Default())
-                  .Build())) noexcept;
+                  .Build()));
 
   /**
    * Initialize a new logger provider. A processor must later be assigned
    * to this logger provider via the AddProcessor() method.
    */
-  explicit LoggerProvider() noexcept;
+  explicit LoggerProvider();
 
   /**
    * Initialize a new logger provider with a specified context
    * @param context The owned logger configuration/pipeline for this provider.
    */
-  explicit LoggerProvider(std::unique_ptr<LoggerContext> context) noexcept;
+  explicit LoggerProvider(std::unique_ptr<LoggerContext> context);
 
   LoggerProvider(const LoggerProvider &)            = delete;
   LoggerProvider(LoggerProvider &&)                 = delete;
@@ -144,6 +144,11 @@ class OPENTELEMETRY_EXPORT LoggerProvider final : public opentelemetry::logs::Lo
   std::vector<std::shared_ptr<opentelemetry::sdk::logs::Logger>> loggers_;
   std::shared_ptr<LoggerContext> context_;
   std::mutex lock_;
+  // Allocated during provider construction so GetLogger can return it without allocating.
+  nostd::shared_ptr<opentelemetry::logs::Logger> noop_logger_;
+  // Set on the first GetLogger construction failure. Later uncached GetLogger
+  // calls return the preallocated noop without retrying construction.
+  bool construction_failed_{false};
 };
 }  // namespace logs
 }  // namespace sdk
diff --git a/sdk/include/opentelemetry/sdk/metrics/meter.h b/sdk/include/opentelemetry/sdk/metrics/meter.h
index e0ed7acdbb..92d61471fa 100644
--- a/sdk/include/opentelemetry/sdk/metrics/meter.h
+++ b/sdk/include/opentelemetry/sdk/metrics/meter.h
@@ -45,7 +45,7 @@ class Meter final : public opentelemetry::metrics::Meter
   explicit Meter(
       std::weak_ptr<sdk::metrics::MeterContext> meter_context,
       std::unique_ptr<opentelemetry::sdk::instrumentationscope::InstrumentationScope> scope =
-          opentelemetry::sdk::instrumentationscope::InstrumentationScope::Create("")) noexcept;
+          opentelemetry::sdk::instrumentationscope::InstrumentationScope::Create(""));
 
   nostd::unique_ptr<opentelemetry::metrics::Counter<uint64_t>> CreateUInt64Counter(
       nostd::string_view name,
diff --git a/sdk/include/opentelemetry/sdk/metrics/meter_provider.h b/sdk/include/opentelemetry/sdk/metrics/meter_provider.h
index c6871a434e..5fb3550301 100644
--- a/sdk/include/opentelemetry/sdk/metrics/meter_provider.h
+++ b/sdk/include/opentelemetry/sdk/metrics/meter_provider.h
@@ -59,13 +59,13 @@ class OPENTELEMETRY_EXPORT MeterProvider final : public opentelemetry::metrics::
       std::unique_ptr<instrumentationscope::ScopeConfigurator<MeterConfig>> meter_configurator =
           std::make_unique<instrumentationscope::ScopeConfigurator<MeterConfig>>(
               instrumentationscope::ScopeConfigurator<MeterConfig>::Builder(MeterConfig::Default())
-                  .Build())) noexcept;
+                  .Build()));
 
   /**
    * Initialize a new meter provider with a specified context
    * @param context The owned meter configuration/pipeline for this provider.
    */
-  explicit MeterProvider(std::unique_ptr<MeterContext> context) noexcept;
+  explicit MeterProvider(std::unique_ptr<MeterContext> context);
 
   MeterProvider(const MeterProvider &)            = delete;
   MeterProvider(MeterProvider &&)                 = delete;
@@ -152,6 +152,11 @@ class OPENTELEMETRY_EXPORT MeterProvider final : public opentelemetry::metrics::
 private:
   std::shared_ptr<MeterContext> context_;
   std::mutex lock_;
+  // Allocated during provider construction so GetMeter can return it without allocating.
+  nostd::shared_ptr<opentelemetry::metrics::Meter> noop_meter_;
+  // Set on the first GetMeter construction failure. Later uncached GetMeter
+  // calls return the preallocated noop without retrying construction.
+  bool construction_failed_{false};
 
 #if defined(__cpp_lib_atomic_value_initialization) && \
     __cpp_lib_atomic_value_initialization >= 201911L
diff --git a/sdk/include/opentelemetry/sdk/trace/tracer.h b/sdk/include/opentelemetry/sdk/trace/tracer.h
index 88e12ab16d..edd7eb73ec 100644
--- a/sdk/include/opentelemetry/sdk/trace/tracer.h
+++ b/sdk/include/opentelemetry/sdk/trace/tracer.h
@@ -40,7 +40,7 @@ class Tracer final : public opentelemetry::trace::Tracer,
   /** Construct a new Tracer with the given context pipeline. */
   explicit Tracer(std::shared_ptr<TracerContext> context,
                   std::unique_ptr<InstrumentationScope> instrumentation_scope =
-                      InstrumentationScope::Create("")) noexcept;
+                      InstrumentationScope::Create(""));
 
   nostd::shared_ptr<opentelemetry::trace::Span> StartSpan(
       nostd::string_view name,
diff --git a/sdk/include/opentelemetry/sdk/trace/tracer_provider.h b/sdk/include/opentelemetry/sdk/trace/tracer_provider.h
index 5b9986a4c3..e0bfb2edf0 100644
--- a/sdk/include/opentelemetry/sdk/trace/tracer_provider.h
+++ b/sdk/include/opentelemetry/sdk/trace/tracer_provider.h
@@ -56,7 +56,7 @@ class OPENTELEMETRY_EXPORT TracerProvider final : public opentelemetry::trace::T
               instrumentationscope::ScopeConfigurator<TracerConfig>::Builder(
                   TracerConfig::Default())
                   .Build()),
-      SpanLimits span_limits = SpanLimits::NoLimits()) noexcept;
+      SpanLimits span_limits = SpanLimits::NoLimits());
 
   explicit TracerProvider(
       std::vector<std::unique_ptr<SpanProcessor>> &&processors,
@@ -70,13 +70,13 @@ class OPENTELEMETRY_EXPORT TracerProvider final : public opentelemetry::trace::T
               instrumentationscope::ScopeConfigurator<TracerConfig>::Builder(
                   TracerConfig::Default())
                   .Build()),
-      SpanLimits span_limits = SpanLimits::NoLimits()) noexcept;
+      SpanLimits span_limits = SpanLimits::NoLimits());
 
   /**
    * Initialize a new tracer provider with a specified context
    * @param context The owned tracer configuration/pipeline for this provider.
    */
-  explicit TracerProvider(std::unique_ptr<TracerContext> context) noexcept;
+  explicit TracerProvider(std::unique_ptr<TracerContext> context);
 
   TracerProvider(const TracerProvider &)            = delete;
   TracerProvider(TracerProvider &&)                 = delete;
@@ -155,6 +155,11 @@ class OPENTELEMETRY_EXPORT TracerProvider final : public opentelemetry::trace::T
   std::vector<std::shared_ptr<Tracer>> tracers_;
   std::shared_ptr<TracerContext> context_;
   std::mutex lock_;
+  // Allocated during provider construction so GetTracer can return it without allocating.
+  nostd::shared_ptr<opentelemetry::trace::Tracer> noop_tracer_;
+  // Set on the first GetTracer construction failure. Later uncached GetTracer
+  // calls return the preallocated noop without retrying construction.
+  bool construction_failed_{false};
 };
 }  // namespace trace
 }  // namespace sdk
diff --git a/sdk/src/logs/logger.cc b/sdk/src/logs/logger.cc
index c04b1dfe68..c60057e6a8 100644
--- a/sdk/src/logs/logger.cc
+++ b/sdk/src/logs/logger.cc
@@ -96,10 +96,9 @@ void StampSpanContextFromVariant(
 
 opentelemetry::logs::NoopLogger Logger::kNoopLogger = opentelemetry::logs::NoopLogger();
 
-Logger::Logger(
-    opentelemetry::nostd::string_view name,
-    std::shared_ptr<LoggerContext> context,
-    std::unique_ptr<instrumentationscope::InstrumentationScope> instrumentation_scope) noexcept
+Logger::Logger(opentelemetry::nostd::string_view name,
+               std::shared_ptr<LoggerContext> context,
+               std::unique_ptr<instrumentationscope::InstrumentationScope> instrumentation_scope)
     : logger_name_(std::string(name)),
       instrumentation_scope_(std::move(instrumentation_scope)),
       context_(std::move(context))
diff --git a/sdk/src/logs/logger_provider.cc b/sdk/src/logs/logger_provider.cc
index 235c3bb4f8..65546cfde0 100644
--- a/sdk/src/logs/logger_provider.cc
+++ b/sdk/src/logs/logger_provider.cc
@@ -2,10 +2,14 @@
 // SPDX-License-Identifier: Apache-2.0
 
 #include <chrono>
+#include <exception>
 #include <mutex>
+#include <ostream>
 #include <utility>
 #include <vector>
 
+#include "opentelemetry/logs/logger.h"
+#include "opentelemetry/logs/noop.h"
 #include "opentelemetry/nostd/shared_ptr.h"
 #include "opentelemetry/nostd/string_view.h"
 #include "opentelemetry/sdk/common/global_log_handler.h"
@@ -25,11 +29,39 @@ namespace sdk
 namespace logs
 {
 
+namespace
+{
+
+nostd::shared_ptr<opentelemetry::logs::Logger> CreateNoopLoggerFallback()
+{
+  return nostd::shared_ptr<opentelemetry::logs::Logger>(new opentelemetry::logs::NoopLogger());
+}
+
+void LogGetLoggerConstructionFailure(const char *detail) noexcept
+{
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  try
+  {
+#endif
+    OTEL_INTERNAL_LOG_ERROR("[LoggerProvider::GetLogger] Failed to construct logger: "
+                            << detail << "; returning noop logger.");
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  }
+  catch (const std::exception &)  // NOLINT(bugprone-empty-catch)
+  {
+    // Logging can throw (typically std::bad_alloc from the string stream).
+    // Swallow it so the noexcept GetLogger path cannot throw.
+  }
+#endif
+}
+
+}  // namespace
+
 LoggerProvider::LoggerProvider(
     std::unique_ptr<LogRecordProcessor> &&processor,
     const opentelemetry::sdk::resource::Resource &resource,
-    std::unique_ptr<instrumentationscope::ScopeConfigurator<LoggerConfig>>
-        logger_configurator) noexcept
+    std::unique_ptr<instrumentationscope::ScopeConfigurator<LoggerConfig>> logger_configurator)
+    : noop_logger_(CreateNoopLoggerFallback())
 {
   std::vector<std::unique_ptr<LogRecordProcessor>> processors;
   processors.emplace_back(std::move(processor));
@@ -41,19 +73,20 @@ LoggerProvider::LoggerProvider(
 LoggerProvider::LoggerProvider(
     std::vector<std::unique_ptr<LogRecordProcessor>> &&processors,
     const opentelemetry::sdk::resource::Resource &resource,
-    std::unique_ptr<instrumentationscope::ScopeConfigurator<LoggerConfig>>
-        logger_configurator) noexcept
+    std::unique_ptr<instrumentationscope::ScopeConfigurator<LoggerConfig>> logger_configurator)
     : context_{std::make_shared<LoggerContext>(std::move(processors),
                                                resource,
-                                               std::move(logger_configurator))}
+                                               std::move(logger_configurator))},
+      noop_logger_(CreateNoopLoggerFallback())
 {}
 
-LoggerProvider::LoggerProvider() noexcept
-    : context_{std::make_shared<LoggerContext>(std::vector<std::unique_ptr<LogRecordProcessor>>{})}
+LoggerProvider::LoggerProvider()
+    : context_{std::make_shared<LoggerContext>(std::vector<std::unique_ptr<LogRecordProcessor>>{})},
+      noop_logger_(CreateNoopLoggerFallback())
 {}
 
-LoggerProvider::LoggerProvider(std::unique_ptr<LoggerContext> context) noexcept
-    : context_(std::move(context))
+LoggerProvider::LoggerProvider(std::unique_ptr<LoggerContext> context)
+    : context_(std::move(context)), noop_logger_(CreateNoopLoggerFallback())
 {}
 
 LoggerProvider::~LoggerProvider()
@@ -94,12 +127,42 @@ opentelemetry::nostd::shared_ptr<opentelemetry::logs::Logger> LoggerProvider::Ge
     }
   }
 
-  std::unique_ptr<instrumentationscope::InstrumentationScope> lib =
-      instrumentationscope::InstrumentationScope::Create(name, version, schema_url, attributes);
+  // GetLogger is noexcept and does not surface an error, so callers cannot
+  // recover after a construction failure. Retrying would re-throw, catch, and
+  // log on later GetLogger calls. After the first failure, treat the provider
+  // as non-functional for new loggers.
+  if (construction_failed_)
+  {
+    return noop_logger_;
+  }
 
-  loggers_.push_back(std::shared_ptr<opentelemetry::sdk::logs::Logger>(
-      new Logger(logger_name, context_, std::move(lib))));
-  return opentelemetry::nostd::shared_ptr<opentelemetry::logs::Logger>{loggers_.back()};
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  try
+  {
+#endif
+    std::unique_ptr<instrumentationscope::InstrumentationScope> lib =
+        instrumentationscope::InstrumentationScope::Create(name, version, schema_url, attributes);
+
+    auto logger = std::make_shared<Logger>(logger_name, context_, std::move(lib));
+    loggers_.push_back(logger);
+    return opentelemetry::nostd::shared_ptr<opentelemetry::logs::Logger>{logger};
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  }
+  catch (const std::exception &ex)
+  {
+    construction_failed_ = true;
+    LogGetLoggerConstructionFailure(ex.what());
+    return noop_logger_;
+  }
+  // User-provided scope configurators can throw any exception type, not just
+  // std::exception. Catch everything so GetLogger stays noexcept.
+  catch (...)
+  {
+    construction_failed_ = true;
+    LogGetLoggerConstructionFailure("unknown exception");
+    return noop_logger_;
+  }
+#endif
 }
 
 void LoggerProvider::AddProcessor(std::unique_ptr<LogRecordProcessor> processor) noexcept
diff --git a/sdk/src/metrics/meter.cc b/sdk/src/metrics/meter.cc
index 0abd75265e..0f7ee6992b 100644
--- a/sdk/src/metrics/meter.cc
+++ b/sdk/src/metrics/meter.cc
@@ -95,9 +95,8 @@ namespace metrics = opentelemetry::metrics;
 
 metrics::NoopMeter Meter::kNoopMeter = metrics::NoopMeter();
 
-Meter::Meter(
-    std::weak_ptr<MeterContext> meter_context,
-    std::unique_ptr<sdk::instrumentationscope::InstrumentationScope> instrumentation_scope) noexcept
+Meter::Meter(std::weak_ptr<MeterContext> meter_context,
+             std::unique_ptr<sdk::instrumentationscope::InstrumentationScope> instrumentation_scope)
     : scope_{std::move(instrumentation_scope)},
       meter_context_{std::move(meter_context)},
       observable_registry_(new ObservableRegistry()),
diff --git a/sdk/src/metrics/meter_provider.cc b/sdk/src/metrics/meter_provider.cc
index 98d510906c..97ca148669 100644
--- a/sdk/src/metrics/meter_provider.cc
+++ b/sdk/src/metrics/meter_provider.cc
@@ -3,11 +3,15 @@
 
 #include <atomic>
 #include <chrono>
+#include <exception>
 #include <mutex>
+#include <ostream>
 #include <utility>
 #include <vector>
 
 #include "opentelemetry/common/key_value_iterable.h"  // IWYU pragma: keep
+#include "opentelemetry/metrics/meter.h"
+#include "opentelemetry/metrics/noop.h"
 #include "opentelemetry/nostd/shared_ptr.h"
 #include "opentelemetry/nostd/span.h"
 #include "opentelemetry/nostd/string_view.h"
@@ -39,25 +43,56 @@ namespace metrics
 namespace resource    = opentelemetry::sdk::resource;
 namespace metrics_api = opentelemetry::metrics;
 
+namespace
+{
+
+nostd::shared_ptr<metrics_api::Meter> CreateNoopMeterFallback()
+{
+  return nostd::shared_ptr<metrics_api::Meter>(new metrics_api::NoopMeter());
+}
+
+void LogGetMeterConstructionFailure(const char *detail) noexcept
+{
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  try
+  {
+#endif
+    OTEL_INTERNAL_LOG_ERROR("[MeterProvider::GetMeter] Failed to construct meter: "
+                            << detail << "; returning noop meter.");
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  }
+  catch (const std::exception &)  // NOLINT(bugprone-empty-catch)
+  {
+    // Logging can throw (typically std::bad_alloc from the string stream).
+    // Swallow it so the noexcept GetMeter path cannot throw.
+  }
+#endif
+}
+
+}  // namespace
+
 MeterProvider::MeterProvider()
     : context_(std::make_shared<MeterContext>(
           std::make_unique<ViewRegistry>(),
           resource::Resource::Create({}),
           std::make_unique<instrumentationscope::ScopeConfigurator<MeterConfig>>(
               instrumentationscope::ScopeConfigurator<MeterConfig>::Builder(MeterConfig::Default())
-                  .Build())))
+                  .Build()))),
+      noop_meter_(CreateNoopMeterFallback())
 {}
 
-MeterProvider::MeterProvider(std::unique_ptr<MeterContext> context) noexcept
-    : context_(std::move(context))
+MeterProvider::MeterProvider(std::unique_ptr<MeterContext> context)
+    : context_(std::move(context)), noop_meter_(CreateNoopMeterFallback())
 {}
 
-MeterProvider::MeterProvider(std::unique_ptr<ViewRegistry> views,
-                             const sdk::resource::Resource &resource,
-                             std::unique_ptr<instrumentationscope::ScopeConfigurator<MeterConfig>>
-                                 meter_configurator) noexcept
-    : context_(
-          std::make_shared<MeterContext>(std::move(views), resource, std::move(meter_configurator)))
+MeterProvider::MeterProvider(
+    std::unique_ptr<ViewRegistry> views,
+    const sdk::resource::Resource &resource,
+    std::unique_ptr<instrumentationscope::ScopeConfigurator<MeterConfig>> meter_configurator)
+    : context_(std::make_shared<MeterContext>(std::move(views),
+                                              resource,
+                                              std::move(meter_configurator))),
+      noop_meter_(CreateNoopMeterFallback())
 {
   OTEL_INTERNAL_LOG_DEBUG("[MeterProvider] MeterProvider created.");
 }
@@ -96,13 +131,43 @@ nostd::shared_ptr<metrics_api::Meter> MeterProvider::GetMeter(
     }
   }
 
-  instrumentationscope::InstrumentationScopeAttributes attrs_map(attributes);
-  auto scope =
-      instrumentationscope::InstrumentationScope::Create(name, version, schema_url, attrs_map);
+  // GetMeter is noexcept and does not surface an error, so callers cannot
+  // recover after a construction failure. Retrying would re-throw, catch, and
+  // log on later GetMeter calls. After the first failure, treat the provider
+  // as non-functional for new meters.
+  if (construction_failed_)
+  {
+    return noop_meter_;
+  }
 
-  auto meter = std::shared_ptr<Meter>(new Meter(context_, std::move(scope)));
-  context_->AddMeter(meter);
-  return nostd::shared_ptr<metrics_api::Meter>{meter};
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  try
+  {
+#endif
+    instrumentationscope::InstrumentationScopeAttributes attrs_map(attributes);
+    auto scope =
+        instrumentationscope::InstrumentationScope::Create(name, version, schema_url, attrs_map);
+
+    auto meter = std::make_shared<Meter>(context_, std::move(scope));
+    context_->AddMeter(meter);
+    return nostd::shared_ptr<metrics_api::Meter>{meter};
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  }
+  catch (const std::exception &ex)
+  {
+    construction_failed_ = true;
+    LogGetMeterConstructionFailure(ex.what());
+    return noop_meter_;
+  }
+  // User-provided scope configurators can throw any exception type, not just
+  // std::exception. Catch everything so GetMeter stays noexcept.
+  catch (...)
+  {
+    construction_failed_ = true;
+    LogGetMeterConstructionFailure("unknown exception");
+    return noop_meter_;
+  }
+#endif
 }
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
diff --git a/sdk/src/trace/tracer.cc b/sdk/src/trace/tracer.cc
index 88e84b953d..8509dd6c5b 100644
--- a/sdk/src/trace/tracer.cc
+++ b/sdk/src/trace/tracer.cc
@@ -94,7 +94,7 @@ OPENTELEMETRY_BEGIN_NAMESPACE namespace sdk
   }  // namespace
 
   Tracer::Tracer(std::shared_ptr<TracerContext> context,
-                 std::unique_ptr<InstrumentationScope> instrumentation_scope) noexcept
+                 std::unique_ptr<InstrumentationScope> instrumentation_scope)
       : instrumentation_scope_{std::move(instrumentation_scope)},
         context_{std::move(context)},
         tracer_config_(context_->GetTracerConfigurator().ComputeConfig(*instrumentation_scope_)),
diff --git a/sdk/src/trace/tracer_provider.cc b/sdk/src/trace/tracer_provider.cc
index 47d3bb98b9..2659959ff5 100644
--- a/sdk/src/trace/tracer_provider.cc
+++ b/sdk/src/trace/tracer_provider.cc
@@ -2,7 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 #include <chrono>
+#include <exception>
 #include <mutex>
+#include <ostream>
 #include <utility>
 #include <vector>
 
@@ -21,6 +23,8 @@
 #include "opentelemetry/sdk/trace/tracer_config.h"
 #include "opentelemetry/sdk/trace/tracer_context.h"
 #include "opentelemetry/sdk/trace/tracer_provider.h"
+#include "opentelemetry/trace/noop.h"
+#include "opentelemetry/trace/tracer.h"
 #include "opentelemetry/version.h"
 
 OPENTELEMETRY_BEGIN_NAMESPACE
@@ -31,8 +35,39 @@ namespace trace
 namespace resource  = opentelemetry::sdk::resource;
 namespace trace_api = opentelemetry::trace;
 
-TracerProvider::TracerProvider(std::unique_ptr<TracerContext> context) noexcept
-    : context_(std::move(context))
+namespace
+{
+
+nostd::shared_ptr<trace_api::Tracer> CreateNoopTracerFallback()
+{
+  // Construct as NoopTracer so enable_shared_from_this is initialized; StartSpan
+  // relies on shared_from_this() for the static noop span.
+  nostd::shared_ptr<trace_api::NoopTracer> tracer(new trace_api::NoopTracer());
+  return nostd::shared_ptr<trace_api::Tracer>(std::move(tracer));
+}
+
+void LogGetTracerConstructionFailure(const char *detail) noexcept
+{
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  try
+  {
+#endif
+    OTEL_INTERNAL_LOG_ERROR("[TracerProvider::GetTracer] Failed to construct tracer: "
+                            << detail << "; returning noop tracer.");
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  }
+  catch (const std::exception &)  // NOLINT(bugprone-empty-catch)
+  {
+    // Logging can throw (typically std::bad_alloc from the string stream).
+    // Swallow it so the noexcept GetTracer path cannot throw.
+  }
+#endif
+}
+
+}  // namespace
+
+TracerProvider::TracerProvider(std::unique_ptr<TracerContext> context)
+    : context_(std::move(context)), noop_tracer_(CreateNoopTracerFallback())
 {
   OTEL_INTERNAL_LOG_DEBUG("[TracerProvider] TracerProvider created.");
 }
@@ -43,7 +78,8 @@ TracerProvider::TracerProvider(
     std::unique_ptr<Sampler> sampler,
     std::unique_ptr<IdGenerator> id_generator,
     std::unique_ptr<instrumentationscope::ScopeConfigurator<TracerConfig>> tracer_configurator,
-    SpanLimits span_limits) noexcept
+    SpanLimits span_limits)
+    : noop_tracer_(CreateNoopTracerFallback())
 {
   std::vector<std::unique_ptr<SpanProcessor>> processors;
   processors.push_back(std::move(processor));
@@ -58,13 +94,14 @@ TracerProvider::TracerProvider(
     std::unique_ptr<Sampler> sampler,
     std::unique_ptr<IdGenerator> id_generator,
     std::unique_ptr<instrumentationscope::ScopeConfigurator<TracerConfig>> tracer_configurator,
-    SpanLimits span_limits) noexcept
+    SpanLimits span_limits)
     : context_(std::make_shared<TracerContext>(std::move(processors),
                                                resource,
                                                std::move(sampler),
                                                std::move(id_generator),
                                                std::move(tracer_configurator),
-                                               span_limits))
+                                               span_limits)),
+      noop_tracer_(CreateNoopTracerFallback())
 {}
 
 TracerProvider::~TracerProvider()
@@ -116,13 +153,43 @@ nostd::shared_ptr<trace_api::Tracer> TracerProvider::GetTracer(
     }
   }
 
-  instrumentationscope::InstrumentationScopeAttributes attrs_map(attributes);
-  auto scope =
-      instrumentationscope::InstrumentationScope::Create(name, version, schema_url, attrs_map);
+  // GetTracer is noexcept and does not surface an error, so callers cannot
+  // recover after a construction failure. Retrying would re-throw, catch, and
+  // log on hot paths such as GetTracer(...)->StartSpan(...). After the first
+  // failure, treat the provider as non-functional for new tracers.
+  if (construction_failed_)
+  {
+    return noop_tracer_;
+  }
 
-  auto tracer = std::shared_ptr<Tracer>(new Tracer(context_, std::move(scope)));
-  tracers_.push_back(tracer);
-  return nostd::shared_ptr<trace_api::Tracer>{tracer};
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  try
+  {
+#endif
+    instrumentationscope::InstrumentationScopeAttributes attrs_map(attributes);
+    auto scope =
+        instrumentationscope::InstrumentationScope::Create(name, version, schema_url, attrs_map);
+
+    auto tracer = std::make_shared<Tracer>(context_, std::move(scope));
+    tracers_.push_back(tracer);
+    return nostd::shared_ptr<trace_api::Tracer>{tracer};
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+  }
+  catch (const std::exception &ex)
+  {
+    construction_failed_ = true;
+    LogGetTracerConstructionFailure(ex.what());
+    return noop_tracer_;
+  }
+  // User-provided scope configurators can throw any exception type, not just
+  // std::exception. Catch everything so GetTracer stays noexcept.
+  catch (...)
+  {
+    construction_failed_ = true;
+    LogGetTracerConstructionFailure("unknown exception");
+    return noop_tracer_;
+  }
+#endif
 }
 
 void TracerProvider::AddProcessor(std::unique_ptr<SpanProcessor> processor) noexcept
diff --git a/sdk/test/logs/logger_provider_sdk_test.cc b/sdk/test/logs/logger_provider_sdk_test.cc
index 3db9dcefc2..0fbc3d922a 100644
--- a/sdk/test/logs/logger_provider_sdk_test.cc
+++ b/sdk/test/logs/logger_provider_sdk_test.cc
@@ -6,8 +6,10 @@
 #include <chrono>
 #include <cstddef>
 #include <cstdint>
+#include <functional>
 #include <future>
 #include <mutex>
+#include <stdexcept>
 #include <string>
 #include <thread>
 #include <unordered_map>
@@ -15,6 +17,7 @@
 #include <vector>
 
 #include "opentelemetry/common/attribute_value.h"
+#include "opentelemetry/common/macros.h"
 #include "opentelemetry/common/timestamp.h"
 #include "opentelemetry/logs/logger.h"
 #include "opentelemetry/logs/logger_provider.h"
@@ -270,6 +273,29 @@ class DummyProcessor : public LogRecordProcessor
   bool ForceFlush(std::chrono::microseconds /* timeout */) noexcept override { return true; }
   bool Shutdown(std::chrono::microseconds /* timeout */) noexcept override { return true; }
 };
+
+class CountingProcessor : public LogRecordProcessor
+{
+public:
+  std::unique_ptr<Recordable> MakeRecordable() noexcept override
+  {
+    return std::unique_ptr<Recordable>(new DummyLogRecordable());
+  }
+
+  void OnEmit(std::unique_ptr<Recordable> &&record) noexcept override
+  {
+    auto record_ptr = std::move(record);
+    ++emit_count_;
+  }
+
+  bool ForceFlush(std::chrono::microseconds /* timeout */) noexcept override { return true; }
+  bool Shutdown(std::chrono::microseconds /* timeout */) noexcept override { return true; }
+
+  std::size_t emit_count() const { return emit_count_; }
+
+private:
+  std::size_t emit_count_{0};
+};
 }  // namespace
 
 TEST(LoggerProviderSDK, GetResource)
@@ -641,3 +667,118 @@ TEST(LoggerProviderSDK, UpdateLoggerConfiguratorConcurrentEmit)
   stop.store(true, std::memory_order_relaxed);
   worker.join();
 }
+
+TEST(LoggerProviderSDK, ConstructorsAreNotNoexcept)
+{
+  static_assert(!noexcept(LoggerProvider()),
+                "LoggerProvider construction must be allowed to throw");
+  static_assert(!noexcept(LoggerProvider(std::unique_ptr<LoggerContext>{})),
+                "LoggerProvider construction must be allowed to throw");
+  static_assert(!noexcept(Logger("", std::shared_ptr<LoggerContext>{})),
+                "Logger construction must be allowed to throw");
+}
+
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+TEST(LoggerProviderSDK, GetLoggerReturnsNoopOnConstructionFailure)
+{
+  auto should_throw          = std::make_shared<bool>(true);
+  auto construct_attempts    = std::make_shared<int>(0);
+  auto throwing_configurator = std::make_unique<scope_sdk::ScopeConfigurator<LoggerConfig>>(
+      scope_sdk::ScopeConfigurator<LoggerConfig>::Builder(LoggerConfig::Default())
+          .AddCondition(
+              [should_throw, construct_attempts](const scope_sdk::InstrumentationScope &scope) {
+                ++*construct_attempts;
+                if (scope.GetName() == "throwing-scope" && *should_throw)
+                {
+                  throw std::runtime_error("injected logger construction failure");
+                }
+                return false;
+              },
+              LoggerConfig::Default())
+          .Build());
+
+  auto *counting_processor = new CountingProcessor();
+  std::unique_ptr<LogRecordProcessor> processor(counting_processor);
+  LoggerProvider provider(std::move(processor), opentelemetry::sdk::resource::Resource::Create({}),
+                          std::move(throwing_configurator));
+
+  auto cached = provider.GetLogger("cached-logger", "cached-scope");
+  ASSERT_NE(cached, nullptr);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  ASSERT_NE(dynamic_cast<Logger *>(cached.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 1);
+  EXPECT_EQ(provider.GetLogger("cached-logger", "cached-scope"), cached);
+  EXPECT_EQ(*construct_attempts, 1);
+
+  auto failed = provider.GetLogger("throwing-logger", "throwing-scope");
+  ASSERT_NE(failed, nullptr);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  EXPECT_EQ(dynamic_cast<Logger *>(failed.get()), nullptr);
+#  endif
+  EXPECT_EQ(failed->GetName(), "noop logger");
+  EXPECT_EQ(*construct_attempts, 2);
+  failed->Info("should-not-emit");
+  provider.ForceFlush();
+  EXPECT_EQ(counting_processor->emit_count(), 0u);
+
+  auto failed_again = provider.GetLogger("throwing-logger", "throwing-scope");
+  EXPECT_EQ(failed, failed_again);
+  EXPECT_EQ(*construct_attempts, 2);
+
+  auto other = provider.GetLogger("other-logger", "other-scope");
+  EXPECT_EQ(other, failed);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  EXPECT_EQ(dynamic_cast<Logger *>(other.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 2);
+
+  *should_throw     = false;
+  auto still_failed = provider.GetLogger("throwing-logger", "throwing-scope");
+  EXPECT_EQ(still_failed, failed);
+  EXPECT_EQ(*construct_attempts, 2);
+
+  EXPECT_EQ(provider.GetLogger("cached-logger", "cached-scope"), cached);
+}
+
+TEST(LoggerProviderSDK, GetLoggerReturnsNoopOnNonStdConstructionFailure)
+{
+  auto construct_attempts    = std::make_shared<int>(0);
+  auto throwing_configurator = std::make_unique<scope_sdk::ScopeConfigurator<LoggerConfig>>(
+      scope_sdk::ScopeConfigurator<LoggerConfig>::Builder(LoggerConfig::Default())
+          .AddCondition(
+              [construct_attempts](const scope_sdk::InstrumentationScope &scope) {
+                ++*construct_attempts;
+                if (scope.GetName() == "throwing-scope")
+                {
+                  throw 1;
+                }
+                return false;
+              },
+              LoggerConfig::Default())
+          .Build());
+
+  auto *counting_processor = new CountingProcessor();
+  std::unique_ptr<LogRecordProcessor> processor(counting_processor);
+  LoggerProvider provider(std::move(processor), opentelemetry::sdk::resource::Resource::Create({}),
+                          std::move(throwing_configurator));
+
+  auto failed = provider.GetLogger("throwing-logger", "throwing-scope");
+  ASSERT_NE(failed, nullptr);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  EXPECT_EQ(dynamic_cast<Logger *>(failed.get()), nullptr);
+#  endif
+  EXPECT_EQ(failed->GetName(), "noop logger");
+  EXPECT_EQ(*construct_attempts, 1);
+  failed->Info("should-not-emit");
+  provider.ForceFlush();
+  EXPECT_EQ(counting_processor->emit_count(), 0u);
+
+  auto failed_again = provider.GetLogger("throwing-logger", "throwing-scope");
+  EXPECT_EQ(failed, failed_again);
+  EXPECT_EQ(*construct_attempts, 1);
+  auto other = provider.GetLogger("other-logger", "other-scope");
+  EXPECT_EQ(other, failed);
+  EXPECT_EQ(*construct_attempts, 1);
+}
+#endif  // OPENTELEMETRY_HAVE_EXCEPTIONS
diff --git a/sdk/test/metrics/meter_provider_sdk_test.cc b/sdk/test/metrics/meter_provider_sdk_test.cc
index 7634d8f0b3..e13b79ed8a 100644
--- a/sdk/test/metrics/meter_provider_sdk_test.cc
+++ b/sdk/test/metrics/meter_provider_sdk_test.cc
@@ -2,7 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 #include <gtest/gtest.h>
+#include <functional>
 #include <memory>
+#include <stdexcept>
 #include <string>
 #include <utility>
 #include <vector>
@@ -14,10 +16,15 @@
 
 #include "opentelemetry/common/macros.h"
 #include "opentelemetry/metrics/meter.h"
+#include "opentelemetry/metrics/sync_instruments.h"
 #include "opentelemetry/nostd/string_view.h"
 #include "opentelemetry/sdk/common/global_log_handler.h"
+#include "opentelemetry/sdk/instrumentationscope/instrumentation_scope.h"
+#include "opentelemetry/sdk/instrumentationscope/scope_configurator.h"
 #include "opentelemetry/sdk/metrics/instruments.h"
 #include "opentelemetry/sdk/metrics/meter.h"
+#include "opentelemetry/sdk/metrics/meter_config.h"
+#include "opentelemetry/sdk/metrics/meter_context.h"
 #include "opentelemetry/sdk/metrics/meter_provider.h"
 #include "opentelemetry/sdk/metrics/meter_provider_factory.h"
 #include "opentelemetry/sdk/metrics/metric_reader.h"
@@ -25,20 +32,14 @@
 #include "opentelemetry/sdk/metrics/view/instrument_selector.h"
 #include "opentelemetry/sdk/metrics/view/meter_selector.h"
 #include "opentelemetry/sdk/metrics/view/view.h"
+#include "opentelemetry/sdk/metrics/view/view_registry.h"
+#include "opentelemetry/sdk/resource/resource.h"
 #include "opentelemetry/test_common/sdk/common/scoped_test_log_handler.h"
 
 #ifdef ENABLE_METRICS_EXEMPLAR_PREVIEW
 #  include "opentelemetry/sdk/metrics/exemplar/filter_type.h"
 #  include "opentelemetry/sdk/metrics/meter_context_factory.h"
 
-#  ifndef NO_GETENV
-#    include "opentelemetry/sdk/instrumentationscope/scope_configurator.h"
-#    include "opentelemetry/sdk/metrics/meter_config.h"
-#    include "opentelemetry/sdk/metrics/meter_context.h"
-#    include "opentelemetry/sdk/metrics/view/view_registry.h"
-#    include "opentelemetry/sdk/resource/resource.h"
-#  endif
-
 #  if defined(_MSC_VER) && !defined(NO_GETENV)
 #    include "opentelemetry/sdk/common/env_variables.h"
 using opentelemetry::sdk::common::setenv;
@@ -55,7 +56,6 @@ using opentelemetry::sdk::common::unsetenv;
 #  include "opentelemetry/common/attribute_value.h"
 #  include "opentelemetry/nostd/utility.h"
 #  include "opentelemetry/nostd/variant.h"
-#  include "opentelemetry/sdk/instrumentationscope/instrumentation_scope.h"
 #endif /* OPENTELEMETRY_ABI_VERSION_NO >= 2 */
 
 using namespace opentelemetry::sdk::metrics;
@@ -520,3 +520,119 @@ TEST(MeterProvider, ExplicitShutdownNotWarnOnDestructionCheck)
   logs     = log_handler.Drain();
   EXPECT_TRUE(logs.empty());
 }
+
+TEST(MeterProvider, ConstructorsAreNotNoexcept)
+{
+  static_assert(!noexcept(MeterProvider()), "MeterProvider construction must be allowed to throw");
+  static_assert(!noexcept(MeterProvider(std::unique_ptr<MeterContext>{})),
+                "MeterProvider construction must be allowed to throw");
+  static_assert(!noexcept(Meter(std::weak_ptr<MeterContext>{})),
+                "Meter construction must be allowed to throw");
+}
+
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+TEST(MeterProvider, GetMeterReturnsNoopOnConstructionFailure)
+{
+  auto should_throw       = std::make_shared<bool>(true);
+  auto construct_attempts = std::make_shared<int>(0);
+  auto throwing_configurator =
+      std::make_unique<opentelemetry::sdk::instrumentationscope::ScopeConfigurator<MeterConfig>>(
+          opentelemetry::sdk::instrumentationscope::ScopeConfigurator<MeterConfig>::Builder(
+              MeterConfig::Default())
+              .AddCondition(
+                  [should_throw, construct_attempts](
+                      const opentelemetry::sdk::instrumentationscope::InstrumentationScope &scope) {
+                    ++*construct_attempts;
+                    if (scope.GetName() == "throwing-scope" && *should_throw)
+                    {
+                      throw std::runtime_error("injected meter construction failure");
+                    }
+                    return false;
+                  },
+                  MeterConfig::Default())
+              .Build());
+
+  MeterProvider provider(std::unique_ptr<ViewRegistry>(new ViewRegistry()),
+                         opentelemetry::sdk::resource::Resource::Create({}),
+                         std::move(throwing_configurator));
+
+  auto cached = provider.GetMeter("cached-scope");
+  ASSERT_NE(cached, nullptr);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  ASSERT_NE(dynamic_cast<Meter *>(cached.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 1);
+  EXPECT_EQ(provider.GetMeter("cached-scope"), cached);
+  EXPECT_EQ(*construct_attempts, 1);
+
+  auto failed = provider.GetMeter("throwing-scope");
+  ASSERT_NE(failed, nullptr);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  EXPECT_EQ(dynamic_cast<Meter *>(failed.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 2);
+  auto failed_counter = failed->CreateUInt64Counter("requests");
+  ASSERT_NE(failed_counter, nullptr);
+  failed_counter->Add(1);
+
+  auto failed_again = provider.GetMeter("throwing-scope");
+  EXPECT_EQ(failed, failed_again);
+  EXPECT_EQ(*construct_attempts, 2);
+
+  auto other = provider.GetMeter("other-scope");
+  EXPECT_EQ(other, failed);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  EXPECT_EQ(dynamic_cast<Meter *>(other.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 2);
+
+  *should_throw     = false;
+  auto still_failed = provider.GetMeter("throwing-scope");
+  EXPECT_EQ(still_failed, failed);
+  EXPECT_EQ(*construct_attempts, 2);
+
+  EXPECT_EQ(provider.GetMeter("cached-scope"), cached);
+}
+
+TEST(MeterProvider, GetMeterReturnsNoopOnNonStdConstructionFailure)
+{
+  auto construct_attempts = std::make_shared<int>(0);
+  auto throwing_configurator =
+      std::make_unique<opentelemetry::sdk::instrumentationscope::ScopeConfigurator<MeterConfig>>(
+          opentelemetry::sdk::instrumentationscope::ScopeConfigurator<MeterConfig>::Builder(
+              MeterConfig::Default())
+              .AddCondition(
+                  [construct_attempts](
+                      const opentelemetry::sdk::instrumentationscope::InstrumentationScope &scope) {
+                    ++*construct_attempts;
+                    if (scope.GetName() == "throwing-scope")
+                    {
+                      throw 1;
+                    }
+                    return false;
+                  },
+                  MeterConfig::Default())
+              .Build());
+
+  MeterProvider provider(std::unique_ptr<ViewRegistry>(new ViewRegistry()),
+                         opentelemetry::sdk::resource::Resource::Create({}),
+                         std::move(throwing_configurator));
+
+  auto failed = provider.GetMeter("throwing-scope");
+  ASSERT_NE(failed, nullptr);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  EXPECT_EQ(dynamic_cast<Meter *>(failed.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 1);
+  auto failed_counter = failed->CreateUInt64Counter("requests");
+  ASSERT_NE(failed_counter, nullptr);
+  failed_counter->Add(1);
+
+  auto failed_again = provider.GetMeter("throwing-scope");
+  EXPECT_EQ(failed, failed_again);
+  EXPECT_EQ(*construct_attempts, 1);
+  auto other = provider.GetMeter("other-scope");
+  EXPECT_EQ(other, failed);
+  EXPECT_EQ(*construct_attempts, 1);
+}
+#endif  // OPENTELEMETRY_HAVE_EXCEPTIONS
diff --git a/sdk/test/trace/tracer_provider_test.cc b/sdk/test/trace/tracer_provider_test.cc
index d8c6822388..fd5e72cdde 100644
--- a/sdk/test/trace/tracer_provider_test.cc
+++ b/sdk/test/trace/tracer_provider_test.cc
@@ -6,16 +6,19 @@
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
+#include <functional>
 #include <future>
 #include <limits>
+#include <memory>
+#include <stdexcept>
 #include <string>
 #include <thread>
 #include <utility>
 #include <vector>
 
 #include "opentelemetry/common/macros.h"
+#include "opentelemetry/exporters/memory/in_memory_span_data.h"
 #include "opentelemetry/exporters/memory/in_memory_span_exporter.h"
-#include "opentelemetry/nostd/shared_ptr.h"
 #include "opentelemetry/nostd/string_view.h"
 #include "opentelemetry/sdk/instrumentationscope/instrumentation_scope.h"
 #include "opentelemetry/sdk/instrumentationscope/scope_configurator.h"
@@ -29,6 +32,7 @@
 #include "opentelemetry/sdk/trace/samplers/always_on.h"
 #include "opentelemetry/sdk/trace/simple_processor.h"
 #include "opentelemetry/sdk/trace/simple_processor_factory.h"
+#include "opentelemetry/sdk/trace/span_data.h"
 #include "opentelemetry/sdk/trace/span_limits.h"
 #include "opentelemetry/sdk/trace/tracer.h"
 #include "opentelemetry/sdk/trace/tracer_config.h"
@@ -56,6 +60,7 @@ using opentelemetry::sdk::common::unsetenv;
 
 using namespace opentelemetry::sdk::trace;
 using namespace opentelemetry::sdk::resource;
+using opentelemetry::sdk::instrumentationscope::InstrumentationScope;
 using opentelemetry::sdk::instrumentationscope::ScopeConfigurator;
 
 TEST(TracerProvider, GetTracer)
@@ -699,3 +704,123 @@ TEST(TracerProvider, SpanLimitsTracerProviderFactoryCreateDefault)
   EXPECT_EQ(limits.link_attribute_count_limit, no_limits.link_attribute_count_limit);
   EXPECT_EQ(limits.attribute_value_length_limit, no_limits.attribute_value_length_limit);
 }
+
+TEST(TracerProvider, ConstructorsAreNotNoexcept)
+{
+  static_assert(!noexcept(TracerProvider(std::unique_ptr<TracerContext>{})),
+                "TracerProvider construction must be allowed to throw");
+  static_assert(!noexcept(Tracer(std::shared_ptr<TracerContext>{})),
+                "Tracer construction must be allowed to throw");
+}
+
+#if OPENTELEMETRY_HAVE_EXCEPTIONS
+TEST(TracerProvider, GetTracerReturnsNoopOnConstructionFailure)
+{
+  auto should_throw          = std::make_shared<bool>(true);
+  auto construct_attempts    = std::make_shared<int>(0);
+  auto throwing_configurator = std::make_unique<ScopeConfigurator<TracerConfig>>(
+      ScopeConfigurator<TracerConfig>::Builder(TracerConfig::Default())
+          .AddCondition(
+              [should_throw, construct_attempts](const InstrumentationScope &scope) {
+                ++*construct_attempts;
+                if (scope.GetName() == "throwing-scope" && *should_throw)
+                {
+                  throw std::runtime_error("injected tracer construction failure");
+                }
+                return false;
+              },
+              TracerConfig::Default())
+          .Build());
+
+  std::unique_ptr<opentelemetry::exporter::memory::InMemorySpanExporter> exporter(
+      new opentelemetry::exporter::memory::InMemorySpanExporter());
+  auto span_data = exporter->GetData();
+  auto processor = SimpleSpanProcessorFactory::Create(std::move(exporter));
+  TracerProvider provider(
+      std::move(processor), Resource::Create({}), std::unique_ptr<Sampler>(new AlwaysOnSampler()),
+      std::unique_ptr<IdGenerator>(new RandomIdGenerator()), std::move(throwing_configurator));
+
+  auto cached = provider.GetTracer("cached-scope");
+  ASSERT_NE(cached, nullptr);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  ASSERT_NE(dynamic_cast<Tracer *>(cached.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 1);
+  auto cached_again = provider.GetTracer("cached-scope");
+  EXPECT_EQ(cached, cached_again);
+  EXPECT_EQ(*construct_attempts, 1);
+
+  auto failed = provider.GetTracer("throwing-scope");
+  ASSERT_NE(failed, nullptr);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  EXPECT_EQ(dynamic_cast<Tracer *>(failed.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 2);
+  auto failed_span = failed->StartSpan("should-not-record");
+  ASSERT_NE(failed_span, nullptr);
+  EXPECT_FALSE(failed_span->IsRecording());
+  failed_span->End();
+  provider.ForceFlush();
+  EXPECT_EQ(span_data->GetSpans().size(), 0u);
+
+  auto failed_again = provider.GetTracer("throwing-scope");
+  EXPECT_EQ(failed, failed_again);
+  EXPECT_EQ(*construct_attempts, 2);
+
+  auto other = provider.GetTracer("other-scope");
+  EXPECT_EQ(other, failed);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  EXPECT_EQ(dynamic_cast<Tracer *>(other.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 2);
+
+  *should_throw     = false;
+  auto still_failed = provider.GetTracer("throwing-scope");
+  EXPECT_EQ(still_failed, failed);
+  EXPECT_EQ(*construct_attempts, 2);
+
+  EXPECT_EQ(provider.GetTracer("cached-scope"), cached);
+}
+
+TEST(TracerProvider, GetTracerReturnsNoopOnNonStdConstructionFailure)
+{
+  auto construct_attempts    = std::make_shared<int>(0);
+  auto throwing_configurator = std::make_unique<ScopeConfigurator<TracerConfig>>(
+      ScopeConfigurator<TracerConfig>::Builder(TracerConfig::Default())
+          .AddCondition(
+              [construct_attempts](const InstrumentationScope &scope) {
+                ++*construct_attempts;
+                if (scope.GetName() == "throwing-scope")
+                {
+                  throw 1;
+                }
+                return false;
+              },
+              TracerConfig::Default())
+          .Build());
+
+  std::unique_ptr<opentelemetry::exporter::memory::InMemorySpanExporter> exporter(
+      new opentelemetry::exporter::memory::InMemorySpanExporter());
+  auto processor = SimpleSpanProcessorFactory::Create(std::move(exporter));
+  TracerProvider provider(
+      std::move(processor), Resource::Create({}), std::unique_ptr<Sampler>(new AlwaysOnSampler()),
+      std::unique_ptr<IdGenerator>(new RandomIdGenerator()), std::move(throwing_configurator));
+
+  auto failed = provider.GetTracer("throwing-scope");
+  ASSERT_NE(failed, nullptr);
+#  ifdef OPENTELEMETRY_RTTI_ENABLED
+  EXPECT_EQ(dynamic_cast<Tracer *>(failed.get()), nullptr);
+#  endif
+  EXPECT_EQ(*construct_attempts, 1);
+  auto failed_span = failed->StartSpan("should-not-record");
+  ASSERT_NE(failed_span, nullptr);
+  EXPECT_FALSE(failed_span->IsRecording());
+
+  auto failed_again = provider.GetTracer("throwing-scope");
+  EXPECT_EQ(failed, failed_again);
+  EXPECT_EQ(*construct_attempts, 1);
+  auto other = provider.GetTracer("other-scope");
+  EXPECT_EQ(other, failed);
+  EXPECT_EQ(*construct_attempts, 1);
+}
+#endif  // OPENTELEMETRY_HAVE_EXCEPTIONS