diff --git a/pkg/api/handlers/ops/registrar.go b/pkg/api/handlers/ops/registrar.go
new file mode 100644
index 0000000000..d8875611a2
--- /dev/null
+++ b/pkg/api/handlers/ops/registrar.go
@@ -0,0 +1,34 @@
+package ops
+
+import (
+	"github.com/gofiber/fiber/v2"
+
+	"github.com/kubestellar/console/pkg/api/transport"
+	k8sclient "github.com/kubestellar/console/pkg/k8s"
+	"github.com/kubestellar/console/pkg/store"
+)
+
+// RegisterSelfUpgrade wires the /self-upgrade/status and
+// /self-upgrade/trigger routes onto router, using the shared multi-cluster
+// client, transport hub, and persistence store. It preserves the exact
+// route order previously registered by hand in setupGitOpsRoutes so
+// fiber's first-match semantics are unchanged (epic #23685 phase 2,
+// #23725 slice 2b.7).
+//
+// A file-scoped registrar is used rather than a monolithic ops.Register
+// because each ops handler (air-gap, manifest, notifications, onboarding,
+// ping, self-upgrade, timeline, token-usage) is wired from a different
+// route file in pkg/api. Individual RegisterXxx functions let each caller
+// wire only what it needs without importing sibling subdomains.
+//
+// The signature is domain-local (not handlers.Registrar) because the
+// parent pkg/api/handlers package still imports pkg/api/handlers/ops
+// through ops_aliases.go, so this subpackage cannot import the parent's
+// Deps/Registrar types without an import cycle. Slice 2c collapses all
+// domain registrars onto a shared signature once the final _aliases.go
+// files are retired.
+func RegisterSelfUpgrade(router fiber.Router, k8sClient *k8sclient.MultiClusterClient, hub *transport.Hub, store store.Store) {
+	h := NewSelfUpgradeHandler(k8sClient, hub, store)
+	router.Get("/self-upgrade/status", h.GetStatus)
+	router.Post("/self-upgrade/trigger", h.TriggerUpgrade)
+}
diff --git a/pkg/api/routes_gitops.go b/pkg/api/routes_gitops.go
index 54ba00e3db..97d1a138b5 100644
--- a/pkg/api/routes_gitops.go
+++ b/pkg/api/routes_gitops.go
@@ -3,8 +3,8 @@ package api
 import (
 	"github.com/gofiber/fiber/v2"
 
-	"github.com/kubestellar/console/pkg/api/handlers"
 	"github.com/kubestellar/console/pkg/api/handlers/gitops"
+	"github.com/kubestellar/console/pkg/api/handlers/ops"
 )
 
 // setupGitOpsRoutes registers GitOps, ArgoCD, and self-upgrade routes.
@@ -29,9 +29,10 @@ func (s *Server) setupGitOpsRoutes(api fiber.Router) {
 	// kubeconfig instead of the backend pod ServiceAccount.
 
 	// Helm self-upgrade (in-cluster Deployment patch)
-	selfUpgradeHandler := handlers.NewSelfUpgradeHandler(s.k8sClient, s.hub, s.store)
-	api.Get("/self-upgrade/status", selfUpgradeHandler.GetStatus)
-	api.Post("/self-upgrade/trigger", selfUpgradeHandler.TriggerUpgrade)
+	// Wired through the ops domain registrar (#23725 slice 2b.7). Route
+	// order is preserved by RegisterSelfUpgrade so fiber's first-match
+	// semantics are unchanged.
+	ops.RegisterSelfUpgrade(api, s.k8sClient, s.hub, s.store)
 
 	// ArgoCD routes (Application CRD discovery and sync)
 	api.Get("/gitops/argocd/applications", gitopsHandlers.ListArgoApplications)