diff --git a/config/extensions/README.md b/config/extensions/README.md
new file mode 100644
index 000000000..4f63ff756
--- /dev/null
+++ b/config/extensions/README.md
@@ -0,0 +1,88 @@
+# PHP Extension Configuration
+
+This directory contains the YAML files that define which PHP extensions and
+native modules are compiled into each PHP binary. These files are passed to
+[binary-builder](https://github.com/cloudfoundry/binary-builder) via the
+`--extensions-dir` flag during CI builds.
+
+## File Structure
+
+### Base file
+
+`php{major}-base-extensions.yml` defines the full list of extensions for all
+minor versions of a PHP major release. Currently:
+
+- `php8-base-extensions.yml` — all extensions for PHP 8.x
+
+### Patch files
+
+`php{major}{minor}-extensions-patch.yml` defines per-minor-version overrides:
+
+- **Exclusions** — extensions in the base file that are incompatible with this
+  minor version (removed before compilation).
+- **Additions** — replacement versions or new extensions added for this minor
+  version.
+
+When an exclusion has a matching addition (same `name`), the addition replaces
+the excluded entry in-place, preserving build order.
+
+Currently:
+- `php81-extensions-patch.yml`
+- `php82-extensions-patch.yml`
+- `php83-extensions-patch.yml`
+- `php84-extensions-patch.yml`
+- `php85-extensions-patch.yml`
+
+## Adding a new PHP minor version
+
+1. Create `php{major}{minor}-extensions-patch.yml` (e.g. `php86-extensions-patch.yml`).
+2. Add `exclusions` for any base extensions that are incompatible.
+3. Add `additions` with compatible replacement versions.
+4. An empty patch is valid (no overrides needed for this minor version):
+   ```yaml
+   ---
+   extensions:
+   ```
+
+## Adding a new PHP major version
+
+1. Create `php{major}-base-extensions.yml` (e.g. `php9-base-extensions.yml`).
+2. Create patch files for each minor version as needed.
+
+## Entry format
+
+Each extension entry has four fields:
+
+```yaml
+- name: redis          # Extension name (matches PECL package name)
+  version: 6.0.2       # Version to compile
+  md5: def456abc...     # MD5 checksum of the source tarball
+  klass: PeclRecipe     # Build recipe class in binary-builder
+```
+
+Common `klass` values:
+- `PeclRecipe` — standard PECL extension (most common)
+- `FakePeclRecipe` — built-in PHP extension compiled from PHP source
+- `LuaRecipe`, `HiredisRecipe`, `LibRdKafkaRecipe`, etc. — native module recipes
+- `IonCubeRecipe` — IonCube loader (binary download, not compiled)
+
+## Updating extension versions
+
+Use the helper scripts in
+[buildpacks-ci/scripts/php-modules/](https://github.com/cloudfoundry/buildpacks-ci/tree/master/scripts/php-modules):
+
+```bash
+# Check which extensions are outdated (dry-run, no file changes):
+BINARY_BUILDER_DIR=/path/to/binary-builder \
+  bundle exec ruby bump-versions.rb --dry-run
+
+# Bump all extensions to latest versions:
+./scripts/php-modules/bump-versions.sh
+
+# Recompute MD5 hashes for bumped extensions:
+./scripts/php-modules/update-hashes.sh
+```
+
+> **Note:** Not all PECL version bumps are compatible with all PHP versions.
+> Review the diff carefully after running `bump-versions.sh` — some bumps may
+> need to be reverted or moved to per-version patch files.
diff --git a/config/extensions/php8-base-extensions.yml b/config/extensions/php8-base-extensions.yml
new file mode 100644
index 000000000..7e97ae126
--- /dev/null
+++ b/config/extensions/php8-base-extensions.yml
@@ -0,0 +1,179 @@
+---
+native_modules:
+- name: rabbitmq
+  version: 0.11.0
+  md5: e7d9896577aea6351811d7c1d7f0a68a
+  klass: RabbitMQRecipe
+- name: lua
+  version: 5.4.6
+  md5: 25a429319dff20dfbfb9956c2b5be911
+  klass: LuaRecipe
+- name: hiredis
+  version: 1.2.0
+  md5: 119767d178cfa79718a80c83e0d0e849
+  klass: HiredisRecipe
+- name: snmp
+  version: nil
+  md5: nil
+  klass: SnmpRecipe
+- name: librdkafka
+  version: 2.3.0
+  md5: afb9d41c50535ba0aa5025ea81d39617
+  klass: LibRdKafkaRecipe
+- name: libsodium
+  version: 1.0.19
+  md5: faaff6e58b34c47794a2f659d6dfd7aa
+  klass: LibSodiumRecipe
+extensions:
+- name: apcu
+  version: 5.1.28
+  md5: 69e2063b28725aca0ce6cac087a5d2bc
+  klass: PeclRecipe
+- name: igbinary
+  version: 3.2.15
+  md5: de81e2f54bfbe741a7f2453bccf970e9
+  klass: PeclRecipe
+- name: gnupg
+  version: 1.5.1
+  md5: c48f5de2f96ffebe2e18eaefff4917f9
+  klass: PeclRecipe
+- name: imagick
+  version: 3.7.0
+  md5: '0687774a6126467d4e5ede02171e981d'
+  klass: PeclRecipe
+- name: LZF
+  version: 1.7.0
+  md5: e242c66e53c0d155982713cd78b3d480
+  klass: PeclRecipe
+- name: mailparse
+  version: 3.1.6
+  md5: e3a71b27439ee08dd63272d7d290d136
+  klass: PeclRecipe
+- name: mongodb
+  version: 1.21.12
+  md5: 0cd4c765161794c749521adcb81dc269
+  klass: PeclRecipe
+- name: msgpack
+  version: 2.2.0
+  md5: 703fb4e08deac7ba68e53ee1e52bbc64
+  klass: PeclRecipe
+- name: oauth
+  version: 2.0.7
+  md5: 8ea6eb5ac6de8a4ed399980848c04c0c
+  klass: PeclRecipe
+- name: odbc
+  version: nil
+  md5: nil
+  klass: OdbcRecipe
+- name: pdo_odbc
+  version: nil
+  md5: nil
+  klass: PdoOdbcRecipe
+- name: pdo_sqlsrv
+  version: 5.12.0
+  md5: 0c06402f30a7f6f0b758ad55277ad950
+  klass: PeclRecipe
+- name: rdkafka
+  version: 6.0.3
+  md5: fd10faec0c599e34837a9482d3c6c801
+  klass: PeclRecipe
+- name: redis
+  version: 6.0.2
+  md5: 29f1f0ba367aef7e0313cd75aa1ea83f
+  klass: RedisPeclRecipe
+- name: ssh2
+  version: 1.4.1
+  md5: 9d655fb9e83aec24fcd6f943ddf94000
+  klass: PeclRecipe
+- name: sqlsrv
+  version: 5.12.0
+  md5: e62485cbbcb564f4a55ab8eae40df6a6
+  klass: PeclRecipe
+- name: stomp
+  version: 2.0.3
+  md5: 30de4089ae5c17f32617cef35dbe53e5
+  klass: PeclRecipe
+- name: xdebug
+  version: 3.3.2
+  md5: 3c5bca14b7c638893383646565d78e9b
+  klass: PeclRecipe
+- name: yaf
+  version: 3.3.7
+  md5: 8c97aa7e81c5592c7bddae1b8a0cff50
+  klass: PeclRecipe
+- name: yaml
+  version: 2.2.3
+  md5: 8d8d18bc1d033966083ec4d6e993d61a
+  klass: PeclRecipe
+- name: memcached
+  version: 3.2.0
+  md5: acc58fea7b7f456408a25ac927846ad0
+  klass: MemcachedPeclRecipe
+- name: sodium
+  version: nil
+  md5: nil
+  klass: SodiumRecipe
+- name: tidy
+  version: nil
+  md5: nil
+  klass: FakePeclRecipe
+- name: enchant
+  version: nil
+  md5: nil
+  klass: EnchantFakePeclRecipe
+- name: pdo_firebird
+  version: nil
+  md5: nil
+  klass: FakePeclRecipe
+- name: readline
+  version: nil
+  md5: nil
+  klass: FakePeclRecipe
+- name: zip
+  version: nil
+  md5: nil
+  klass: FakePeclRecipe
+- name: amqp
+  version: 2.1.2
+  md5: addd05de32a74af7d3d332b5f58b8414
+  klass: AmqpPeclRecipe
+- name: maxminddb
+  version: 1.11.1
+  md5: 1e020b49b8c320b43ebfee1f31d0017b
+  klass: MaxMindRecipe
+- name: psr
+  version: 1.2.0
+  md5: '07695da8376002babbce528205decf07'
+  klass: PeclRecipe
+- name: phalcon
+  version: 5.6.2
+  md5: 806c25f017c0842798d937caaecbc994
+  klass: PeclRecipe
+- name: phpiredis
+  version: 1.0.1
+  md5: '09a9bdb347c70832d3e034655b604064'
+  klass: PHPIRedisRecipe
+- name: tideways_xhprof
+  version: 5.0.4
+  md5: 68b68cd9410e62b8481445e0d89220c0
+  klass: TidewaysXhprofRecipe
+- name: solr
+  version: 2.7.0
+  md5: 3e9df94b06f8a026e33b3a8a3f02921b
+  klass: PeclRecipe
+- name: oci8
+  version: 3.3.0
+  md5: bbbbb26f1791d1f27ffc05289abee2f3
+  klass: OraclePeclRecipe
+- name: pdo_oci
+  version: nil
+  md5: nil
+  klass: OraclePdoRecipe
+- name: gd
+  version: nil
+  md5: nil
+  klass: Gd74FakePeclRecipe
+- name: ioncube
+  version: 13.0.2
+  md5: 0526cd3702ef25de119e4724d603d773
+  klass: IonCubeRecipe
diff --git a/config/extensions/php81-extensions-patch.yml b/config/extensions/php81-extensions-patch.yml
new file mode 100644
index 000000000..18ce48628
--- /dev/null
+++ b/config/extensions/php81-extensions-patch.yml
@@ -0,0 +1,7 @@
+---
+extensions:
+  additions:
+  - name: oci8
+    version: 3.2.1
+    md5: 309190ef3ede2779a617c9375d32ea7a
+    klass: OraclePeclRecipe
diff --git a/config/extensions/php82-extensions-patch.yml b/config/extensions/php82-extensions-patch.yml
new file mode 100644
index 000000000..ca8541ddf
--- /dev/null
+++ b/config/extensions/php82-extensions-patch.yml
@@ -0,0 +1,7 @@
+---
+extensions:
+  additions:
+    - name: oci8
+      version: 3.3.0
+      md5: bbbbb26f1791d1f27ffc05289abee2f3
+      klass: OraclePeclRecipe
diff --git a/config/extensions/php83-extensions-patch.yml b/config/extensions/php83-extensions-patch.yml
new file mode 100644
index 000000000..3efa52ff5
--- /dev/null
+++ b/config/extensions/php83-extensions-patch.yml
@@ -0,0 +1,7 @@
+---
+extensions:
+  additions:
+    - name: ioncube
+      version: 14.0.0
+      md5: 4e35b4f31e0238f8efdfe7a0f9e1fade
+      klass: IonCubeRecipe
diff --git a/config/extensions/php84-extensions-patch.yml b/config/extensions/php84-extensions-patch.yml
new file mode 100644
index 000000000..5ce62c256
--- /dev/null
+++ b/config/extensions/php84-extensions-patch.yml
@@ -0,0 +1,69 @@
+---
+extensions:
+  exclusions:
+    - name: mongodb
+      version: 1.21.12
+      md5: 0cd4c765161794c749521adcb81dc269
+      klass: PeclRecipe
+    # oauth 2.0.7 uses php_rand.h which was removed in PHP 8.4; replaced by 2.0.10
+    - name: oauth
+      version: 2.0.7
+      md5: 8ea6eb5ac6de8a4ed399980848c04c0c
+      klass: PeclRecipe
+    # redis 6.0.2 uses standard/php_random.h which was removed in PHP 8.4; replaced by 6.1.0
+    - name: redis
+      version: 6.0.2
+      md5: 29f1f0ba367aef7e0313cd75aa1ea83f
+      klass: PeclRecipe
+    # xdebug 3.3.2 does not support PHP >= 8.4; replaced by 3.4.0
+    - name: xdebug
+      version: 3.3.2
+      md5: 3c5bca14b7c638893383646565d78e9b
+      klass: PeclRecipe
+    # phalcon 5.6.2 uses php_rand.h which was removed in PHP 8.4; no compatible PECL release exists
+    - name: phalcon
+      version: 5.6.2
+      md5: 806c25f017c0842798d937caaecbc994
+      klass: PeclRecipe
+    # tideways_xhprof 5.0.4 has configure syntax error on PHP 8.4; no newer release available
+    - name: tideways_xhprof
+      version: 5.0.4
+      md5: 68b68cd9410e62b8481445e0d89220c0
+      klass: TidewaysXhprofRecipe
+    # solr 2.7.0 has configure syntax error on PHP 8.4; replaced by 2.9.3
+    - name: solr
+      version: 2.7.0
+      md5: 3e9df94b06f8a026e33b3a8a3f02921b
+      klass: PeclRecipe
+  additions:
+    # ioncube 15.5.0 is a binary download (not compiled from source); MD5 not available from vendor
+    - name: ioncube
+      version: 15.5.0
+      md5: nil
+      klass: IonCubeRecipe
+    - name: mongodb
+      version: 2.5.5
+      md5: 7fd1c98fb542dd99806da858467ed001
+      klass: PeclRecipe
+    # oauth 2.0.10 adds PHP 8.4 support (php_rand.h conditional)
+    - name: oauth
+      version: 2.0.10
+      md5: 47eeb6adc46a72844f48ce7d2ad3f0da
+      klass: PeclRecipe
+    # redis 6.1.0 adds PHP 8.4 support (fixes php_random.h includes)
+    - name: redis
+      version: 6.1.0
+      md5: ca6277b27ee35e1f55f9ad7f0b4df29b
+      klass: PeclRecipe
+    # xdebug 3.4.0 adds PHP 8.4 support
+    - name: xdebug
+      version: 3.4.0
+      md5: 799983a15e5f5ec7fb19d70304415128
+      klass: PeclRecipe
+    # phalcon has no PHP 8.4 compatible PECL release (all versions use removed php_rand.h)
+    # tideways_xhprof has no PHP 8.4 compatible release (configure syntax error, no newer version)
+    # solr 2.9.3 adds PHP 8.4 support (configure.ac rewritten)
+    - name: solr
+      version: 2.9.3
+      md5: ec442fc69a885220345d13d0889b10e5
+      klass: PeclRecipe
diff --git a/config/extensions/php85-extensions-patch.yml b/config/extensions/php85-extensions-patch.yml
new file mode 100644
index 000000000..ecc1c9e6c
--- /dev/null
+++ b/config/extensions/php85-extensions-patch.yml
@@ -0,0 +1,165 @@
+---
+extensions:
+  exclusions:
+    - name: mongodb
+      version: 1.21.12
+      md5: 0cd4c765161794c749521adcb81dc269
+      klass: PeclRecipe
+    # oauth 2.0.7 uses php_rand.h which was removed in PHP 8.4+; replaced by 2.0.10
+    - name: oauth
+      version: 2.0.7
+      md5: 8ea6eb5ac6de8a4ed399980848c04c0c
+      klass: PeclRecipe
+    # redis 6.0.2 uses standard/php_random.h which was removed in PHP 8.4+; replaced by 6.1.0
+    - name: redis
+      version: 6.0.2
+      md5: 29f1f0ba367aef7e0313cd75aa1ea83f
+      klass: PeclRecipe
+    # xdebug 3.3.2 does not support PHP >= 8.5; replaced by 3.5.1
+    - name: xdebug
+      version: 3.3.2
+      md5: 3c5bca14b7c638893383646565d78e9b
+      klass: PeclRecipe
+    # phalcon 5.6.2 uses php_rand.h which was removed in PHP 8.4+; no compatible PECL release exists
+    - name: phalcon
+      version: 5.6.2
+      md5: 806c25f017c0842798d937caaecbc994
+      klass: PeclRecipe
+    # tideways_xhprof 5.0.4 has configure syntax error on PHP 8.4+; no newer release available
+    - name: tideways_xhprof
+      version: 5.0.4
+      md5: 68b68cd9410e62b8481445e0d89220c0
+      klass: TidewaysXhprofRecipe
+    # memcached 3.2.0 has unguarded php_smart_string.h removed in PHP 8.5; replaced by 3.4.0
+    - name: memcached
+      version: 3.2.0
+      md5: acc58fea7b7f456408a25ac927846ad0
+      klass: MemcachedPeclRecipe
+    # amqp 2.1.2 uses unguarded zend_exception_get_default() removed in PHP 8.5; replaced by 2.2.0
+    - name: amqp
+      version: 2.1.2
+      md5: addd05de32a74af7d3d332b5f58b8414
+      klass: AmqpPeclRecipe
+    # stomp 2.0.3 uses unguarded zend_exception_get_default() removed in PHP 8.5; no fix available
+    - name: stomp
+      version: 2.0.3
+      md5: 30de4089ae5c17f32617cef35dbe53e5
+      klass: PeclRecipe
+    # solr 2.7.0 has configure syntax error on PHP 8.4+; replaced by 2.9.3
+    - name: solr
+      version: 2.7.0
+      md5: 3e9df94b06f8a026e33b3a8a3f02921b
+      klass: PeclRecipe
+    # igbinary 3.2.15 uses php_smart_string.h which was removed in PHP 8.5; replaced by 3.2.17RC1
+    - name: igbinary
+      version: 3.2.15
+      md5: de81e2f54bfbe741a7f2453bccf970e9
+      klass: PeclRecipe
+    # imagick 3.7.0 uses php_smart_string.h which was removed in PHP 8.5; replaced by 3.8.1
+    - name: imagick
+      version: 3.7.0
+      md5: 0687774a6126467d4e5ede02171e981d
+      klass: PeclRecipe
+    # mailparse 3.1.6 uses php_smart_string.h which was removed in PHP 8.5; replaced by 3.2.0
+    - name: mailparse
+      version: 3.1.6
+      md5: e3a71b27439ee08dd63272d7d290d136
+      klass: PeclRecipe
+    # pdo_sqlsrv 5.12.0 has PHP 8.5 struct incompatibilities; replaced by 5.13.0
+    - name: pdo_sqlsrv
+      version: 5.12.0
+      md5: 0c06402f30a7f6f0b758ad55277ad950
+      klass: PeclRecipe
+    # sqlsrv 5.12.0 has PHP 8.5 struct incompatibilities; replaced by 5.13.0
+    - name: sqlsrv
+      version: 5.12.0
+      md5: e62485cbbcb564f4a55ab8eae40df6a6
+      klass: PeclRecipe
+    # yaml 2.2.3 unconditionally includes php_smart_string.h removed in PHP 8.5; replaced by 2.3.0
+    - name: yaml
+      version: 2.2.3
+      md5: 8d8d18bc1d033966083ec4d6e993d61a
+      klass: PeclRecipe
+    # gnupg 1.5.1 uses removed zend_exception_get_default(); replaced by 1.5.4
+    - name: gnupg
+      version: 1.5.1
+      md5: c48f5de2f96ffebe2e18eaefff4917f9
+      klass: PeclRecipe
+  additions:
+    # ioncube 15.5.0 is a binary download (not compiled from source); MD5 not available from vendor
+    - name: ioncube
+      version: 15.5.0
+      md5: nil
+      klass: IonCubeRecipe
+    - name: mongodb
+      version: 2.5.5
+      md5: 7fd1c98fb542dd99806da858467ed001
+      klass: PeclRecipe
+    # oauth 2.0.10 adds PHP 8.4+ support (php_rand.h conditional)
+    - name: oauth
+      version: 2.0.10
+      md5: 47eeb6adc46a72844f48ce7d2ad3f0da
+      klass: PeclRecipe
+    # redis 6.3.0 adds PHP 8.5 support (removes php_smart_string.h dependency)
+    - name: redis
+      version: 6.3.0
+      md5: ac080d0329813bb1291d0697c6f539c4
+      klass: PeclRecipe
+    # xdebug 3.5.1 adds PHP 8.5 support (< 8.6)
+    - name: xdebug
+      version: 3.5.1
+      md5: d404e827a10ab301d602533d6eb8bceb
+      klass: PeclRecipe
+    # phalcon has no PHP 8.4+ compatible PECL release (all versions use removed php_rand.h)
+    # tideways_xhprof has no PHP 8.4+ compatible release (configure syntax error, no newer version)
+    # stomp has no PHP 8.5 compatible release (unguarded zend_exception_get_default, no newer version)
+    # solr 2.9.3 adds PHP 8.4+ support (configure.ac rewritten)
+    - name: solr
+      version: 2.9.3
+      md5: ec442fc69a885220345d13d0889b10e5
+      klass: PeclRecipe
+    # igbinary 3.2.17RC1 adds PHP 8.5 support (removes php_smart_string.h dependency)
+    - name: igbinary
+      version: 3.2.17RC1
+      md5: 84d49a68917b5ad5cf087ee7286e91ba
+      klass: PeclRecipe
+    # imagick 3.8.1 adds PHP 8.5 support
+    - name: imagick
+      version: 3.8.1
+      md5: aadbb5ad3db484e19bb6ba39aa2cd4a0
+      klass: PeclRecipe
+    # mailparse 3.2.0 adds PHP 8.5 support (removes php_smart_string.h dependency)
+    - name: mailparse
+      version: 3.2.0
+      md5: 26459ec76b2e8d103faad6ed11d1995e
+      klass: PeclRecipe
+    # pdo_sqlsrv 5.13.0 adds PHP 8.5 support
+    - name: pdo_sqlsrv
+      version: 5.13.0
+      md5: 915a36cb0b294e831d5f66786bc01d4b
+      klass: PeclRecipe
+    # sqlsrv 5.13.0 adds PHP 8.5 support
+    - name: sqlsrv
+      version: 5.13.0
+      md5: 6a3957633e53c260ae3a2740adbaa991
+      klass: PeclRecipe
+    # yaml 2.3.0 adds PHP 8.5 support (guards php_smart_string.h for PHP < 7.2 only)
+    - name: yaml
+      version: 2.3.0
+      md5: 1cd70efbdc86c12c30aee95eeb75cc7f
+      klass: PeclRecipe
+    # gnupg 1.5.4 adds PHP 8.5 support (uses zend_ce_exception instead of removed zend_exception_get_default)
+    - name: gnupg
+      version: 1.5.4
+      md5: 23ae146131b9f4238bdd98a53c087fc5
+      klass: PeclRecipe
+    # memcached 3.4.0 adds PHP 8.5 support (php_smart_string.h guarded by PHP_VERSION_ID < 70200)
+    - name: memcached
+      version: 3.4.0
+      md5: 43c53e36ac2ecc2c3c403e5bf225ee1a
+      klass: MemcachedPeclRecipe
+    # amqp 2.2.0 adds PHP 8.5 support (removes unguarded zend_exception_get_default usage)
+    - name: amqp
+      version: 2.2.0
+      md5: 6888bbca9ee741fa6096efa454d5b9b0
+      klass: AmqpPeclRecipe