diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index b2e24e4508..bc6b8dded1 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -79,7 +79,7 @@ Added
   to pants' use of PEX lockfiles. This is not a user-facing addition.
   #6118 #6141 #6133 #6120 #6181 #6183 #6200 #6237 #6229 #6240 #6241 #6244 #6251 #6253
   #6254 #6258 #6259 #6260 #6269 #6275 #6279 #6278 #6282 #6283 #6273 #6287 #6306 #6307
-  #6311 #6314 #6315 #6317 #6319 #6312 #6320
+  #6311 #6314 #6315 #6317 #6319 #6312 #6320 #6321
   Contributed by @cognifloyd
 * Build of ST2 EL9 packages #6153
   Contributed by @amanda11
diff --git a/contrib/runners/orquesta_runner/in-requirements.txt b/contrib/runners/orquesta_runner/in-requirements.txt
index 3197648c25..637e8a8ba6 100644
--- a/contrib/runners/orquesta_runner/in-requirements.txt
+++ b/contrib/runners/orquesta_runner/in-requirements.txt
@@ -1 +1,2 @@
 orquesta@ git+https://github.com/StackStorm/orquesta.git@5ba1467614b2ef8b4709b2ca89e68baa671e8975
+setuptools
diff --git a/contrib/runners/orquesta_runner/requirements.txt b/contrib/runners/orquesta_runner/requirements.txt
index bc32b16e29..a93eba892d 100644
--- a/contrib/runners/orquesta_runner/requirements.txt
+++ b/contrib/runners/orquesta_runner/requirements.txt
@@ -6,3 +6,4 @@
 # in-requirements.txt for that component and then run 'make requirements' to
 # update the component requirements.txt
 orquesta@ git+https://github.com/StackStorm/orquesta.git@5ba1467614b2ef8b4709b2ca89e68baa671e8975
+setuptools<78
diff --git a/fixed-requirements.txt b/fixed-requirements.txt
index 185b0d3fcb..2c601455b1 100644
--- a/fixed-requirements.txt
+++ b/fixed-requirements.txt
@@ -72,6 +72,9 @@ tooz==6.3.0
 # virtualenv==20.29.2 (<21) has pip==25.0.1 wheel==0.45.1 setuptools==75.3.0
 # lockfiles/st2.lock has pip==25.0.1 wheel==0.45.1 setuptools==75.3.0
 virtualenv==20.29.2
+# This setuptools version number is in the Makefile, but CircleCI builds are pulling a version
+# that is incompatible with our logshipper fork.
+setuptools<78
 webob==1.8.9
 webtest==3.0.1
 zake==0.2.2
diff --git a/pants-plugins/release/rules.py b/pants-plugins/release/rules.py
index 86df6c0461..8ee338b57a 100644
--- a/pants-plugins/release/rules.py
+++ b/pants-plugins/release/rules.py
@@ -21,12 +21,19 @@
 from __future__ import annotations
 
 import re
+from dataclasses import dataclass
 
+from pants.backend.nfpm.fields.version import NfpmVersionField, NfpmVersionSchemaField
+from pants.backend.nfpm.util_rules.inject_config import (
+    InjectedNfpmPackageFields,
+    InjectNfpmPackageFieldsRequest,
+)
 from pants.backend.python.util_rules.package_dists import (
     SetupKwargs,
     SetupKwargsRequest,
 )
 from pants.engine.fs import DigestContents, GlobMatchErrorBehavior, PathGlobs
+from pants.engine.internals.native_engine import Field
 from pants.engine.target import Target
 from pants.engine.rules import collect_rules, Get, MultiGet, rule, UnionRule
 from pants.util.frozendict import FrozenDict
@@ -88,6 +95,40 @@ def is_applicable(cls, _: Target) -> bool:
         # return target.address.spec.startswith("st2")
 
 
+@dataclass(frozen=True)
+class StackStormVersionRequest:
+    version_file: str
+    description_of_origin: str
+
+
+@dataclass(frozen=True)
+class StackStormVersion:
+    value: str
+
+
+@rule
+async def extract_version(request: StackStormVersionRequest) -> StackStormVersion:
+    version_digest_contents = await Get(
+        DigestContents,
+        PathGlobs(
+            [request.version_file],
+            description_of_origin=request.description_of_origin,
+            glob_match_error_behavior=GlobMatchErrorBehavior.error,
+        ),
+    )
+
+    version_file_contents = version_digest_contents[0].content.decode()
+    version_match = re.search(
+        r"^__version__ = ['\"]([^'\"]*)['\"]", version_file_contents, re.M
+    )
+    if not version_match:
+        raise ValueError(
+            f"Could not find the __version__ in {request.version_file}\n{version_file_contents}"
+        )
+
+    return StackStormVersion(version_match.group(1))
+
+
 @rule
 async def setup_kwargs_plugin(request: StackStormSetupKwargsRequest) -> SetupKwargs:
     kwargs = request.explicit_kwargs.copy()
@@ -100,13 +141,12 @@ async def setup_kwargs_plugin(request: StackStormSetupKwargsRequest) -> SetupKwa
 
     version_file = kwargs.pop("version_file")
 
-    version_digest_contents, readme_digest_contents = await MultiGet(
+    version, readme_digest_contents = await MultiGet(
         Get(
-            DigestContents,
-            PathGlobs(
-                [f"{request.target.address.spec_path}/{version_file}"],
+            StackStormVersion,
+            StackStormVersionRequest(
+                version_file=f"{request.target.address.spec_path}/{version_file}",
                 description_of_origin=f"StackStorm version file: {version_file}",
-                glob_match_error_behavior=GlobMatchErrorBehavior.error,
             ),
         ),
         Get(
@@ -118,19 +158,10 @@ async def setup_kwargs_plugin(request: StackStormSetupKwargsRequest) -> SetupKwa
         ),
     )
 
-    version_file_contents = version_digest_contents[0].content.decode()
-    version_match = re.search(
-        r"^__version__ = ['\"]([^'\"]*)['\"]", version_file_contents, re.M
-    )
-    if not version_match:
-        raise ValueError(
-            f"Could not find the __version__ in {request.target.address.spec_path}/{version_file}\n{version_file_contents}"
-        )
-
     # Hardcode certain kwargs and validate that they weren't already set.
     hardcoded_kwargs = PROJECT_METADATA.copy()
     hardcoded_kwargs["project_urls"] = FrozenDict(PROJECT_URLS)
-    hardcoded_kwargs["version"] = version_match.group(1)
+    hardcoded_kwargs["version"] = version.value
 
     long_description = (
         readme_digest_contents[0].content.decode() if readme_digest_contents else ""
@@ -162,8 +193,43 @@ async def setup_kwargs_plugin(request: StackStormSetupKwargsRequest) -> SetupKwa
     return SetupKwargs(kwargs, address=request.target.address)
 
 
+class StackStormNfpmPackageFieldsRequest(InjectNfpmPackageFieldsRequest):
+    @classmethod
+    def is_applicable(cls, _: Target) -> bool:
+        return True
+
+
+@rule
+async def inject_package_fields(
+    request: StackStormNfpmPackageFieldsRequest,
+) -> InjectedNfpmPackageFields:
+    address = request.target.address
+
+    version_file = "st2common/st2common/__init__.py"
+    extracted_version = await Get(
+        StackStormVersion,
+        StackStormVersionRequest(
+            version_file=version_file,
+            description_of_origin=f"StackStorm version file: {version_file}",
+        ),
+    )
+
+    version: str = extracted_version.value
+    if version.endswith("dev") and version[-4] != "-":
+        # nfpm parses this into version[-version_prerelease][+version_metadata]
+        # that dash is required to be a valid semver version.
+        version = version.replace("dev", "-dev")
+
+    fields: list[Field] = [
+        NfpmVersionSchemaField("semver", address=address),
+        NfpmVersionField(version, address=address),
+    ]
+    return InjectedNfpmPackageFields(fields, address=address)
+
+
 def rules():
     return [
         *collect_rules(),
         UnionRule(SetupKwargsRequest, StackStormSetupKwargsRequest),
+        UnionRule(InjectNfpmPackageFieldsRequest, StackStormNfpmPackageFieldsRequest),
     ]
diff --git a/pants.toml b/pants.toml
index ade479e33f..1a6ff6b16d 100644
--- a/pants.toml
+++ b/pants.toml
@@ -31,6 +31,9 @@ backend_packages = [
   # packaging
   "pants.backend.experimental.makeself",
 
+  # packaging
+  "pants.backend.experimental.nfpm",
+
   # internal plugins in pants-plugins/
   "pants.backend.plugin_development",
   "api_spec",
diff --git a/requirements.txt b/requirements.txt
index 976c39a2ea..425dd728d5 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -62,6 +62,7 @@ requests==2.32.3
 retrying==1.3.4
 routes==2.5.1
 semver==3.0.4
+setuptools<78
 simplejson
 six==1.17.0
 sseclient-py==1.8.0
diff --git a/st2actions/in-requirements.txt b/st2actions/in-requirements.txt
index 601589e424..0d5630871e 100644
--- a/st2actions/in-requirements.txt
+++ b/st2actions/in-requirements.txt
@@ -19,6 +19,9 @@ lockfile
 # needed by core "linux" pack - TODO: create virtualenv for linux pack on postinst
 pyinotify
 logshipper@ git+https://github.com/StackStorm/logshipper.git@stackstorm_patched ; platform_system=="Linux"
+# logshipper has metadata in setup.cfg that is not supported by setuptools 78, so we need
+# an explicit dep (from fixed-requirements.txt) to prevent CircleCI from pulling that in.
+setuptools
 # required by pack_mgmt/setup_virtualenv.py#L135
 virtualenv
 # needed by requests
diff --git a/st2actions/requirements.txt b/st2actions/requirements.txt
index d19d898601..556124bcfc 100644
--- a/st2actions/requirements.txt
+++ b/st2actions/requirements.txt
@@ -22,5 +22,6 @@ python-dateutil==2.9.0.post0
 python-json-logger
 pyyaml==6.0.2
 requests==2.32.3
+setuptools<78
 six==1.17.0
 urllib3==2.2.3