diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 487fc11b3b..199804729a 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-f72108d4cfe5673036fd32c5b3ebe33c0121932d
\ No newline at end of file
+925c350cff55d3ea738d9e2e4098d9ce4bdda418
\ No newline at end of file
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index 9e12faaef5..046a46b857 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -1241,6 +1241,16 @@ async fn create_script_internal<'c>(
     // membership; parsed writes tell us what is produced (we don't record
     // them in auto_kind itself).
     let pipeline_annotations = parse_pipeline_annotations(&ns.content);
+    // `// freshness` is parsed but enforcement is a not-yet-implemented
+    // enterprise feature (skeleton in windmill_common::pipeline_advanced).
+    // Surface a clear TODO at deploy rather than silently accepting an
+    // annotation that does nothing.
+    if pipeline_annotations.freshness.is_some() {
+        tracing::warn!(
+            "{}",
+            windmill_common::pipeline_advanced::freshness_enforcement_todo()
+        );
+    }
     let in_pipeline = pipeline_annotations.in_pipeline;
     // `// trigger all` → AND join barrier (else OR, the default).
     let pipeline_join_all = !pipeline_annotations.join_mode.is_any();
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index 9ef2dc7ae1..c501bbed6e 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -88,6 +88,13 @@ pub mod partition_oss;
 pub use partition_ee as partition;
 #[cfg(not(feature = "private"))]
 pub use partition_oss as partition;
+#[cfg(feature = "private")]
+pub mod pipeline_advanced_ee;
+pub mod pipeline_advanced_oss;
+#[cfg(feature = "private")]
+pub use pipeline_advanced_ee as pipeline_advanced;
+#[cfg(not(feature = "private"))]
+pub use pipeline_advanced_oss as pipeline_advanced;
 pub mod query_builders;
 pub mod queue;
 pub mod result_stream;
diff --git a/backend/windmill-common/src/pipeline_advanced_oss.rs b/backend/windmill-common/src/pipeline_advanced_oss.rs
new file mode 100644
index 0000000000..009e783bd5
--- /dev/null
+++ b/backend/windmill-common/src/pipeline_advanced_oss.rs
@@ -0,0 +1,16 @@
+//! OSS fallback: pipeline freshness/SLA enforcement and partition backfills
+//! are enterprise features; their implementations live in windmill-ee-private
+//! (see `pipeline_advanced_ee`). In the public build the entry points report
+//! that the enterprise edition is required.
+
+use crate::error::Error;
+
+pub fn freshness_enforcement_todo() -> Error {
+    Error::internal_err(
+        "Pipeline freshness/SLA enforcement requires the enterprise edition".to_string(),
+    )
+}
+
+pub fn backfill_todo() -> Error {
+    Error::internal_err("Pipeline partition backfill requires the enterprise edition".to_string())
+}