diff --git a/GithubIssueTagger/GitHubClientBinder.cs b/GithubIssueTagger/GitHubClientBinder.cs
index 84b02447..4083260c 100644
--- a/GithubIssueTagger/GitHubClientBinder.cs
+++ b/GithubIssueTagger/GitHubClientBinder.cs
@@ -41,6 +41,12 @@ protected override GitHubPat GetBoundValue(BindingContext bindingContext)
                 return pat;
             }
 
+            pat = GetGitHubCliToken();
+            if (!string.IsNullOrEmpty(pat))
+            {
+                return pat;
+            }
+
             Dictionary<string, string>? credentials = GetGitCredentials(new Uri("https://github.com/NuGet/Home"));
             if (credentials?.TryGetValue("password", out pat) == true && !string.IsNullOrEmpty(pat))
             {
@@ -50,6 +56,42 @@ protected override GitHubPat GetBoundValue(BindingContext bindingContext)
             return null;
         }
 
+        // Attempt to get a token from the GitHub CLI
+        private static string? GetGitHubCliToken()
+        {
+            try
+            {
+                ProcessStartInfo processStartInfo = new()
+                {
+                    FileName = "gh",
+                    Arguments = "auth token",
+                    CreateNoWindow = true,
+                    RedirectStandardOutput = true,
+                    RedirectStandardError = true,
+                };
+
+                Process? process = Process.Start(processStartInfo);
+                if (process == null)
+                {
+                    return null;
+                }
+
+                string output = process.StandardOutput.ReadToEnd().Trim();
+                process.WaitForExit();
+
+                if (process.ExitCode == 0 && !string.IsNullOrEmpty(output))
+                {
+                    return output;
+                }
+            }
+            catch
+            {
+                // gh CLI not available
+            }
+
+            return null;
+        }
+
         // Implement https://git-scm.com/docs/git-credential#_typical_use_of_git_credential
         private static Dictionary<string, string>? GetGitCredentials(Uri uri)
         {
diff --git a/GithubIssueTagger/GithubIssueTagger.csproj b/GithubIssueTagger/GithubIssueTagger.csproj
index 6a314eb9..e3f36184 100644
--- a/GithubIssueTagger/GithubIssueTagger.csproj
+++ b/GithubIssueTagger/GithubIssueTagger.csproj
@@ -41,4 +41,15 @@
     </EmbeddedResource>
   </ItemGroup>
 
+  <ItemGroup>
+    <UpToDateCheckInput Include="Reports\IceBox\*.graphql" />
+  </ItemGroup>
+
+  <Target Name="TouchResxWhenGraphqlChanges"
+          BeforeTargets="PrepareForBuild"
+          Inputs="Reports\IceBox\*.graphql"
+          Outputs="Reports\IceBox\IceBoxResource.resx">
+    <Touch Files="Reports\IceBox\IceBoxResource.resx" />
+  </Target>
+
 </Project>
diff --git a/GithubIssueTagger/IEnumerableExtensions.cs b/GithubIssueTagger/IEnumerableExtensions.cs
index abb123b3..5587195e 100644
--- a/GithubIssueTagger/IEnumerableExtensions.cs
+++ b/GithubIssueTagger/IEnumerableExtensions.cs
@@ -17,5 +17,17 @@ internal static class IEnumerableExtensions
                 return default;
             }
         }
+
+        internal static T? MaxOrDefault<T>(this IEnumerable<T> enumerable) where T : IComparable
+        {
+            try
+            {
+                return enumerable.Max();
+            }
+            catch (InvalidOperationException)
+            {
+                return default;
+            }
+        }
     }
 }
diff --git a/GithubIssueTagger/Reports/IceBox/GetIssues.graphql b/GithubIssueTagger/Reports/IceBox/GetIssues.graphql
index 2806d058..1fe5fe8a 100644
--- a/GithubIssueTagger/Reports/IceBox/GetIssues.graphql
+++ b/GithubIssueTagger/Reports/IceBox/GetIssues.graphql
@@ -15,7 +15,8 @@
         id,
         number,
         title,
-        timelineItems(itemTypes: [LABELED_EVENT], last: $timelineCount) {
+        url,
+        timelineItems(itemTypes: [LABELED_EVENT, UNLABELED_EVENT], last: $timelineCount) {
           totalCount,
           pageInfo {
             hasNextPage,
@@ -29,6 +30,13 @@
                 id
               },
               createdAt
+            },
+            ... on UnlabeledEvent {
+              label {
+                name,
+                id
+              },
+              createdAt
             }
           }
         },
diff --git a/GithubIssueTagger/Reports/IceBox/GetIssuesResult.cs b/GithubIssueTagger/Reports/IceBox/GetIssuesResult.cs
index d8a87784..0954443b 100644
--- a/GithubIssueTagger/Reports/IceBox/GetIssuesResult.cs
+++ b/GithubIssueTagger/Reports/IceBox/GetIssuesResult.cs
@@ -28,11 +28,12 @@ public RepositoryModel(Connection<IssuesModel> issues)
 
         internal class IssuesModel
         {
-            public IssuesModel(string id, int? number, string title, Connection<LabeledEvent> timelineItems, Connection<Reaction> reactions, Connection<Label> labels)
+            public IssuesModel(string id, int? number, string title, string url, Connection<TimelineEvent> timelineItems, Connection<Reaction> reactions, Connection<Label> labels)
             {
                 Id = id ?? throw new ArgumentNullException(nameof(id));
                 Number = number ?? throw new ArgumentNullException(nameof(number));
                 Title = title ?? throw new ArgumentNullException(nameof(title));
+                Url = url ?? throw new ArgumentNullException(nameof(url));
                 TimelineItems = timelineItems ?? throw new ArgumentNullException(nameof(timelineItems));
                 Reactions = reactions ?? throw new ArgumentNullException(nameof(reactions));
                 Labels = labels ?? throw new ArgumentNullException(nameof(labels));
@@ -47,8 +48,11 @@ public IssuesModel(string id, int? number, string title, Connection<LabeledEvent
             [JsonPropertyName("title")]
             public string Title { get; init; }
 
+            [JsonPropertyName("url")]
+            public string Url { get; init; }
+
             [JsonPropertyName("timelineItems")]
-            public Connection<LabeledEvent> TimelineItems { get; init; }
+            public Connection<TimelineEvent> TimelineItems { get; init; }
 
             [JsonPropertyName("reactions")]
             public Connection<Reaction> Reactions { get; init; }
diff --git a/GithubIssueTagger/Reports/IceBox/GetLabeledEvents.graphql b/GithubIssueTagger/Reports/IceBox/GetLabeledEvents.graphql
index b40b44dd..fa30ff66 100644
--- a/GithubIssueTagger/Reports/IceBox/GetLabeledEvents.graphql
+++ b/GithubIssueTagger/Reports/IceBox/GetLabeledEvents.graphql
@@ -1,19 +1,27 @@
 query($issue: ID!) {
     node (id: $issue) {
         ... on Issue {
-            timelineItems(last: 100, itemTypes: [ LABELED_EVENT ]) {
+            timelineItems(last: 100, itemTypes: [ LABELED_EVENT, UNLABELED_EVENT ]) {
                 totalCount,
                 pageInfo {
                     hasNextPage,
                     endCursor
                 }
                 nodes {
+                    __typename,
                     ... on LabeledEvent {
                         createdAt,
                         label {
                             name,
                             id
                         }
+                    },
+                    ... on UnlabeledEvent {
+                        createdAt,
+                        label {
+                            name,
+                            id
+                        }
                     }
                 }
             }
diff --git a/GithubIssueTagger/Reports/IceBox/GetLabeledEventsResult.cs b/GithubIssueTagger/Reports/IceBox/GetLabeledEventsResult.cs
index 93acad54..16582e40 100644
--- a/GithubIssueTagger/Reports/IceBox/GetLabeledEventsResult.cs
+++ b/GithubIssueTagger/Reports/IceBox/GetLabeledEventsResult.cs
@@ -17,13 +17,13 @@ public GetLabeledEventsResult(Issue node)
 
         internal class Issue
         {
-            public Issue(Connection<LabeledEvent> timelineItems)
+            public Issue(Connection<TimelineEvent> timelineItems)
             {
                 TimelineItems = timelineItems ?? throw new ArgumentNullException(nameof(timelineItems));
             }
 
             [JsonPropertyName("timelineItems")]
-            public Connection<LabeledEvent> TimelineItems { get; init; }
+            public Connection<TimelineEvent> TimelineItems { get; init; }
         }
     }
 }
diff --git a/GithubIssueTagger/Reports/IceBox/IceBoxConfig.cs b/GithubIssueTagger/Reports/IceBox/IceBoxConfig.cs
new file mode 100644
index 00000000..bd52d8b5
--- /dev/null
+++ b/GithubIssueTagger/Reports/IceBox/IceBoxConfig.cs
@@ -0,0 +1,37 @@
+using System.IO;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace GithubIssueTagger.Reports.IceBox
+{
+    internal class IceBoxConfig
+    {
+        [JsonPropertyName("owner")]
+        public required string Owner { get; init; }
+
+        [JsonPropertyName("repo")]
+        public required string Repo { get; init; }
+
+        [JsonPropertyName("searchLabel")]
+        public required string SearchLabel { get; init; }
+
+        [JsonPropertyName("triage")]
+        public required TriageConfig Triage { get; init; }
+
+        internal class TriageConfig
+        {
+            [JsonPropertyName("upvotes")]
+            public required int Upvotes { get; init; }
+
+            [JsonPropertyName("label")]
+            public required string Label { get; init; }
+        }
+
+        public static IceBoxConfig Load(string path)
+        {
+            string json = File.ReadAllText(path);
+            return JsonSerializer.Deserialize<IceBoxConfig>(json)
+                ?? throw new JsonException("Failed to deserialize config file: " + path);
+        }
+    }
+}
diff --git a/GithubIssueTagger/Reports/IceBox/IceBoxReport.cs b/GithubIssueTagger/Reports/IceBox/IceBoxReport.cs
index ff02385a..f92de427 100644
--- a/GithubIssueTagger/Reports/IceBox/IceBoxReport.cs
+++ b/GithubIssueTagger/Reports/IceBox/IceBoxReport.cs
@@ -5,7 +5,9 @@
 using System.Collections.Generic;
 using System.CommandLine;
 using System.Diagnostics.CodeAnalysis;
+using System.IO;
 using System.Linq;
+using System.Text.Json;
 using System.Threading.Tasks;
 
 namespace GithubIssueTagger.Reports.IceBox
@@ -14,7 +16,7 @@ namespace GithubIssueTagger.Reports.IceBox
     internal class IceBoxReport : IReport
     {
         private readonly GitHubGraphQLClient _client;
-        private string? _addLabelId;
+        private string? _triageLabelId;
 
         public IceBoxReport(GitHubGraphQLClient client)
         {
@@ -27,52 +29,71 @@ public Task RunAsync()
             return Task.CompletedTask;
         }
 
-        public async Task RunAsync(string owner, string repo, string label, int upvoteCount, string? add)
+        public async Task RunAsync(IceBoxConfig config, bool apply, bool verbose)
         {
-            await foreach (GetIssuesResult.IssuesModel issue in GetIssuesAsync(owner, repo, label, upvoteCount))
+            string searchLabel = config.SearchLabel;
+            string triageLabel = config.Triage.Label;
+            int upvoteCount = config.Triage.Upvotes;
+
+            await foreach (GetIssuesResult.IssuesModel issue in GetIssuesAsync(config.Owner, config.Repo, searchLabel, upvoteCount))
             {
-                if (add != null)
+                if (issue.Labels.Nodes.Any(l => l.Name == triageLabel))
                 {
-                    if (issue.Labels.Nodes.Any(l => l.Name == add))
-                    {
-                        if (_addLabelId == null)
-                        {
-                            Label addLabel = issue.Labels.Nodes.First(l => l.Name == add);
-                            _addLabelId = addLabel.Id;
-                        }
-
-                        // action label already applied, skip
-                        continue;
-                    }
-                    else if (issue.Labels.PageInfo.HasNextPage)
+                    if (_triageLabelId == null)
                     {
-                        // TODO: Handle when issue has more than 100 labels
-                        WriteGitHubActionsWarning("Unsupported scenario: issue " + issue.Number + " has more than 100 labels");
+                        Label label = issue.Labels.Nodes.First(l => l.Name == triageLabel);
+                        _triageLabelId = label.Id;
                     }
+
+                    // triage label already applied, skip
+                    continue;
+                }
+                else if (issue.Labels.PageInfo.HasNextPage)
+                {
+                    // TODO: Handle when issue has more than 100 labels
+                    WriteGitHubActionsWarning("Unsupported scenario: issue " + issue.Number + " has more than 100 labels");
                 }
 
-                if (!TryGetLastLabelTime(issue.TimelineItems.Nodes, label, out DateTime? labelAdded))
+                string? cutoffReason;
+                if (!TryGetCutoffDate(issue.TimelineItems.Nodes, searchLabel, triageLabel, out DateTime? cutoffDate, out cutoffReason))
                 {
-                    labelAdded = await GetLastLabelTimeAsync(issue.Id, label);
-                    if (labelAdded == null)
+                    (cutoffDate, cutoffReason) = await GetCutoffDateAsync(issue.Id, searchLabel, triageLabel);
+                    if (cutoffDate == null)
                     {
-                        // TODO: If we reach here, we need to do a different GraphQL query to get more events for this issue to find the last time the label was added.
                         WriteGitHubActionsWarning("Unsupported scenario: issue " + issue.Number + " did not find label in latest events");
                         continue;
                     }
                 }
 
-                if (HasEnoughPositiveReactions(issue, labelAdded.Value, upvoteCount))
+                int upvotes = GetPositiveReactionCount(issue, cutoffDate.Value);
+                bool qualifies = upvotes >= upvoteCount;
+
+                if (upvotes == -1)
+                {
+                    // Unsupported scenario already warned inside GetPositiveReactionCount
+                    if (verbose)
+                    {
+                        Console.WriteLine($"Issue {issue.Url} - cutoff: {cutoffDate.Value:yyyy-MM-dd} ({cutoffReason}), upvotes: unknown (needs more data)");
+                    }
+                    continue;
+                }
+
+                if (verbose)
                 {
-                    Console.WriteLine($"Issue {issue.Number} has enough upvotes");
-                    if (add != null)
+                    Console.WriteLine($"Issue {issue.Url} - cutoff: {cutoffDate.Value:yyyy-MM-dd} ({cutoffReason}), upvotes: {upvotes}");
+                }
+
+                if (qualifies)
+                {
+                    Console.WriteLine($"Issue {issue.Url} has enough upvotes");
+                    if (apply)
                     {
-                        if (_addLabelId == null)
+                        if (_triageLabelId == null)
                         {
-                            _addLabelId = await GetLabelIdAsync(owner, repo, add);
+                            _triageLabelId = await GetLabelIdAsync(config.Owner, config.Repo, triageLabel);
                         }
 
-                        await AddLabelToIssueAsync(issue.Id, _addLabelId);
+                        await AddLabelToIssueAsync(issue.Id, _triageLabelId);
                     }
                 }
             }
@@ -125,24 +146,47 @@ public async Task RunAsync(string owner, string repo, string label, int upvoteCo
             }
         }
 
-        private static bool TryGetLastLabelTime(IReadOnlyList<LabeledEvent>? labeledEvents, string label, [NotNullWhen(true)] out DateTime? labelAdded)
+        private static bool TryGetCutoffDate(IReadOnlyList<TimelineEvent>? events, string searchLabel, string triageLabel, [NotNullWhen(true)] out DateTime? cutoffDate, out string? cutoffReason)
         {
-            IEnumerable<DateTime>? enumerable = labeledEvents
-                ?.Where(e => string.Equals(label, e?.Label?.Name, StringComparison.OrdinalIgnoreCase))
-                ?.Select(e => e.CreatedAt);
-            if (enumerable == null || !enumerable.Any())
+            if (events == null || events.Count == 0)
             {
-                labelAdded = null;
+                cutoffDate = null;
+                cutoffReason = null;
                 return false;
             }
+
+            DateTime searchLabelAdded = events
+                .Where(e => e.IsLabeledEvent && string.Equals(searchLabel, e.Label?.Name, StringComparison.OrdinalIgnoreCase))
+                .Select(e => e.CreatedAt)
+                .MaxOrDefault();
+
+            if (searchLabelAdded == default)
+            {
+                cutoffDate = null;
+                cutoffReason = null;
+                return false;
+            }
+
+            DateTime triageLabelRemoved = events
+                .Where(e => e.IsUnlabeledEvent && string.Equals(triageLabel, e.Label?.Name, StringComparison.OrdinalIgnoreCase))
+                .Select(e => e.CreatedAt)
+                .MaxOrDefault();
+
+            if (triageLabelRemoved != default && triageLabelRemoved > searchLabelAdded)
+            {
+                cutoffDate = triageLabelRemoved;
+                cutoffReason = "triage label removed";
+            }
             else
             {
-                labelAdded = enumerable.Max();
-                return true;
+                cutoffDate = searchLabelAdded;
+                cutoffReason = "search label added";
             }
+
+            return true;
         }
 
-        private async Task<DateTime?> GetLastLabelTimeAsync(string issueId, string label)
+        private async Task<(DateTime? cutoffDate, string? cutoffReason)> GetCutoffDateAsync(string issueId, string searchLabel, string triageLabel)
         {
             Dictionary<string, object?> variables = new Dictionary<string, object?>()
             {
@@ -158,7 +202,7 @@ private static bool TryGetLastLabelTime(IReadOnlyList<LabeledEvent>? labeledEven
 
             if (response == null)
             {
-                return null;
+                return (null, null);
             }
 
             if (response?.Errors?.Count > 0)
@@ -176,47 +220,39 @@ private static bool TryGetLastLabelTime(IReadOnlyList<LabeledEvent>? labeledEven
                         Console.WriteLine(error.Message);
                     }
                 }
-                return null;
+                return (null, null);
             }
 
-            IReadOnlyList<LabeledEvent>? labeledEvents = response.Data?.Node.TimelineItems.Nodes;
-            if (!TryGetLastLabelTime(labeledEvents, label, out DateTime? labeledAdded))
+            IReadOnlyList<TimelineEvent>? events = response.Data?.Node.TimelineItems.Nodes;
+            if (!TryGetCutoffDate(events, searchLabel, triageLabel, out DateTime? cutoffDate, out string? cutoffReason))
             {
-                return null;
+                return (null, null);
             }
 
-            return labeledAdded;
+            return (cutoffDate, cutoffReason);
         }
 
-        private static bool HasEnoughPositiveReactions(GetIssuesResult.IssuesModel issue, DateTime after, int upvotes)
+        private static int GetPositiveReactionCount(GetIssuesResult.IssuesModel issue, DateTime after)
         {
             if (!issue.Reactions.PageInfo.HasNextPage)
             {
                 // No need to fetch more reactions, since we already have the complete list.
-                int count = GetCustomerUpvoteCount(issue.Reactions.Nodes.Where(r => r.CreatedAt > after));
-                return count >= upvotes;
+                return GetCustomerUpvoteCount(issue.Reactions.Nodes.Where(r => r.CreatedAt > after));
             }
             else
             {
-                // If few customers added multiple reactions, we should have enough information already
                 int count = GetCustomerUpvoteCount(issue.Reactions.Nodes.Where(r => r.CreatedAt > after));
-                if (count > upvotes)
+
+                // If the oldest date we already have is more recent than the cutoff, then getting more reactions will not help
+                DateTime? min = issue.Reactions.Nodes.Select(r => r.CreatedAt).MinOrDefault();
+                if (min != null && min < after)
                 {
-                    return true;
+                    return count;
                 }
-                else
-                {
-                    // If the oldest date we already have is more recent than the cutoff, then getting more reactions will not help
-                    DateTime? min = issue.Reactions.Nodes.Select(r => r.CreatedAt).MinOrDefault();
-                    if (min != null && min < after)
-                    {
-                        return false;
-                    }
 
-                    // TODO: Need to get more reactions from GraphQL to check if upvote threshold met
-                    WriteGitHubActionsWarning("Unsupported scenario: issue " + issue?.Number + " needs to check more reactions for threshold check.");
-                    return false;
-                }
+                // TODO: Need to get more reactions from GraphQL to check if upvote threshold met
+                WriteGitHubActionsWarning("Unsupported scenario: issue " + issue?.Number + " needs to check more reactions for threshold check.");
+                return -1;
             }
 
             static int GetCustomerUpvoteCount(IEnumerable<Reaction> reactions)
@@ -328,43 +364,49 @@ public Command CreateCommand(Type type, GitHubPatBinder patBinder)
                 var command = new Command("IceBox");
                 command.Description = "Check for issues with a label that exceed a count of upvotes since the label was added.";
 
-                var ownerOption = new Option<string>("--owner");
-                ownerOption.AddAlias("-o");
-                ownerOption.Description = "GitHub owner (org or user) of the repo.";
-                ownerOption.SetDefaultValue("NuGet");
-                command.Add(ownerOption);
-
-                var repoOption = new Option<string>("--repo");
-                repoOption.AddAlias("-r");
-                repoOption.Description = "Repo to search issues in.";
-                repoOption.SetDefaultValue("Home");
-                command.Add(repoOption);
-
-                var labelOption = new Option<string>("--label");
-                labelOption.AddAlias("-l");
-                labelOption.Description = "Which label to filter issues by.";
-                labelOption.SetDefaultValue("pipeline:IceBox");
-                command.Add(labelOption);
-
-                var upvotesOption = new Option<int>("--upvotes");
-                upvotesOption.AddAlias("-u");
-                upvotesOption.Description = "Number of upvotes required to meet threshold.";
-                upvotesOption.SetDefaultValue(5);
-                command.Add(upvotesOption);
-
-                var addOption = new Option<string>("--add");
-                addOption.AddAlias("-a");
-                addOption.Description = "Label to add on issues which meet or exceed the upvote threshold. When not specified, no action is taken.";
-                command.Add(addOption);
+                var configArgument = new Argument<string>("config");
+                configArgument.Description = "Path to the JSON configuration file.";
+                command.Add(configArgument);
+
+                var applyOption = new Option<bool>("--apply");
+                applyOption.Description = "Apply label changes to qualifying issues. Without this flag, the report runs in dry-run mode.";
+                applyOption.SetDefaultValue(false);
+                command.Add(applyOption);
+
+                var verboseOption = new Option<bool>("--verbose");
+                verboseOption.Description = "Output details for every issue, including cutoff date and upvote count.";
+                verboseOption.SetDefaultValue(false);
+                command.Add(verboseOption);
 
                 command.SetHandler(async
                     (GitHubPat pat,
-                    string owner,
-                    string repo, 
-                    string label, 
-                    int upvotes,
-                    string add) =>
+                    string configPath,
+                    bool apply,
+                    bool verbose) =>
                 {
+                    if (!File.Exists(configPath))
+                    {
+                        Console.Error.WriteLine("::error ::Config file not found: " + configPath);
+                        return;
+                    }
+
+                    IceBoxConfig config;
+                    try
+                    {
+                        config = IceBoxConfig.Load(configPath);
+                    }
+                    catch (JsonException ex)
+                    {
+                        Console.Error.WriteLine("::error ::Invalid config file: " + ex.Message);
+                        return;
+                    }
+
+                    if (pat?.Value == null)
+                    {
+                        Console.Error.WriteLine("::error ::No GitHub access token available. Provide --pat, configure the GitHub CLI, or set up Git Credential Manager.");
+                        return;
+                    }
+
                     var serviceProvider = new ServiceCollection()
                         .AddGithubIssueTagger(pat)
                         .BuildServiceProvider();
@@ -373,9 +415,9 @@ public Command CreateCommand(Type type, GitHubPatBinder patBinder)
                     using (scopeFactory.CreateScope())
                     {
                         var report = serviceProvider.GetRequiredService<IceBoxReport>();
-                        await report.RunAsync(owner, repo, label, upvotes, add);
+                        await report.RunAsync(config, apply, verbose);
                     }
-                }, patBinder, ownerOption, repoOption, labelOption, upvotesOption, addOption);
+                }, patBinder, configArgument, applyOption, verboseOption);
 
                 return command;
             }
diff --git a/GithubIssueTagger/Reports/IceBox/Models/TimelineEvent.cs b/GithubIssueTagger/Reports/IceBox/Models/TimelineEvent.cs
new file mode 100644
index 00000000..41370174
--- /dev/null
+++ b/GithubIssueTagger/Reports/IceBox/Models/TimelineEvent.cs
@@ -0,0 +1,27 @@
+using System;
+using System.Text.Json.Serialization;
+
+namespace GithubIssueTagger.Reports.IceBox.Models
+{
+    internal class TimelineEvent
+    {
+        public TimelineEvent(string typeName, Label label, DateTime createdAt)
+        {
+            TypeName = typeName ?? throw new ArgumentNullException(nameof(typeName));
+            Label = label ?? throw new ArgumentNullException(nameof(label));
+            CreatedAt = createdAt;
+        }
+
+        [JsonPropertyName("__typename")]
+        public string TypeName { get; init; }
+
+        [JsonPropertyName("label")]
+        public Label Label { get; init; }
+
+        [JsonPropertyName("createdAt")]
+        public DateTime CreatedAt { get; init; }
+
+        public bool IsLabeledEvent => string.Equals(TypeName, "LabeledEvent", StringComparison.OrdinalIgnoreCase);
+        public bool IsUnlabeledEvent => string.Equals(TypeName, "UnlabeledEvent", StringComparison.OrdinalIgnoreCase);
+    }
+}
diff --git a/GithubIssueTagger/Reports/IceBox/Models/UnlabeledEvent.cs b/GithubIssueTagger/Reports/IceBox/Models/UnlabeledEvent.cs
new file mode 100644
index 00000000..57bf9ba0
--- /dev/null
+++ b/GithubIssueTagger/Reports/IceBox/Models/UnlabeledEvent.cs
@@ -0,0 +1,20 @@
+using System;
+using System.Text.Json.Serialization;
+
+namespace GithubIssueTagger.Reports.IceBox.Models
+{
+    internal class UnlabeledEvent
+    {
+        public UnlabeledEvent(Label label, DateTime createdAt)
+        {
+            Label = label ?? throw new ArgumentNullException(nameof(label));
+            CreatedAt = createdAt;
+        }
+
+        [JsonPropertyName("label")]
+        public Label Label { get; init; }
+
+        [JsonPropertyName("createdAt")]
+        public DateTime CreatedAt { get; init; }
+    }
+}
diff --git a/GithubIssueTagger/Reports/IceBox/Requirements.md b/GithubIssueTagger/Reports/IceBox/Requirements.md
new file mode 100644
index 00000000..2e717ec9
--- /dev/null
+++ b/GithubIssueTagger/Reports/IceBox/Requirements.md
@@ -0,0 +1,134 @@
+# IceBox Report — Requirements
+
+## Purpose
+
+The IceBox report identifies GitHub issues that have been placed in an "ice box" (deprioritized) but have since received significant community interest in the form of positive reactions (upvotes).
+
+## Inputs
+
+The report accepts the following command line arguments:
+- The path to a JSON configuration file (required).
+- `--pat` (optional): a GitHub personal access token for authentication (see section on Authentication).
+- `--apply` (optional): when specified, the report modifies issues that meet the upvote threshold (see section 5).
+  Without it, the report runs in dry-run mode — it outputs which issues qualify but does not modify them.
+- `--verbose` (optional): when specified, the report additionally outputs the date the `searchLabel` was applied and the number of upvotes the issue has received since that date.
+
+### Configuration File Schema
+
+The JSON file contains the following properties:
+
+| Property | Description |
+|----------|-------------|
+| `owner` | GitHub owner (org or user) of the repository. |
+| `repo` | Repository to search for issues in. |
+| `searchLabel` | The label used to filter issues (i.e., the ice box label). |
+| `triage` | Object containing triage settings. |
+| `triage.upvotes` | Number of unique positive reactions required to meet the threshold. |
+| `triage.label` | Label to add to issues that meet the upvote threshold. |
+
+All properties are required.
+If any property is missing or undefined, the report must print an error message identifying the missing property and exit without processing any issues.
+
+### Example Configuration File
+
+```json
+{
+  "owner": "NuGet",
+  "repo": "Home",
+  "searchLabel": "Priority:3",
+  "triage": {
+    "upvotes": 5,
+    "label": "Triage:NeedsTriageDiscussion"
+  }
+}
+```
+
+## Authentication
+
+The report requires a GitHub access token to authenticate with the GraphQL API.
+The token is resolved using the following strategy, in order:
+
+1. If `--pat` is provided on the command line, that value is used.
+2. Otherwise, the report attempts to obtain a token from the **GitHub CLI** (`gh auth token`).
+3. If the GitHub CLI is not available or does not return a token, the report attempts to obtain a token from **Git Credential Manager**.
+4. If no token can be obtained, the report prints an error message and exits without processing any issues.
+
+## Behaviour
+
+### 1. Issue Retrieval and Data Fetching
+
+The report queries GitHub's GraphQL API to retrieve all **open issues** in the specified repository that have the `searchLabel`.
+Issues are fetched in pages of 100 using cursor-based pagination.
+
+GitHub's GraphQL API enforces a data size limit per query, so the amount of nested data fetched per issue must be kept small.
+For each issue, the initial query fetches only:
+- The **last 5 timeline events** of type `LabeledEvent` and `UnlabeledEvent` (used to determine the cutoff date — see section 3).
+- The most recent **reactions** (fetched at a count of `triage.upvotes × 2`).
+- The first **100 labels** on the issue (used to check whether the `triage.label` has already been applied).
+
+If the pre-fetched timeline events are insufficient to determine the cutoff date, a separate GraphQL query retrieves the **last 100 labeled/unlabeled event entries** for that specific issue.
+If the required events still cannot be found, a **GitHub Actions warning** is emitted and the issue is skipped.
+
+GitHub's GraphQL API also enforces rate limits.
+When a response includes a `Retry-After` header, the report must wait for the specified duration before making the next request.
+
+### 2. Skip If Triage Label Already Applied
+
+Each issue is first checked to see whether it already has the `triage.label`.
+If it does, the issue is **skipped** — no further processing or output is produced for it.
+
+### 3. Determine the Cutoff Date
+
+The report determines a **cutoff date** for each issue.
+Only reactions after this date are counted toward the upvote threshold.
+The cutoff date is the **most recent** of the following two events:
+
+- The most recent date the `searchLabel` was **added** to the issue.
+- The most recent date the `triage.label` was **removed** from the issue (if it was ever removed).
+
+If the `triage.label` was never removed, the cutoff date is simply when the `searchLabel` was last added.
+
+### 4. Count Positive Reactions Since the Cutoff Date
+
+Only reactions that occurred **after** the cutoff date are considered.
+A reaction is considered "positive" if its content type is one of:
+
+- `THUMBS_UP` (👍)
+- `HEART` (❤️)
+- `ROCKET` (🚀)
+
+Reactions are **deduplicated by user** — multiple positive reactions from the same user count as a single upvote.
+The total number of distinct users who added positive reactions after the cutoff date is compared against the configured upvote threshold.
+
+If the issue has more reactions than were fetched (pagination applies), the report attempts a best-effort determination:
+- If the already-fetched reactions exceed the threshold, the issue qualifies.
+- If the oldest fetched reaction is older than the cutoff date, the issue does not qualify (fetching more would not change the result).
+- Otherwise, a GitHub Actions warning is emitted indicating more reactions need to be fetched, and the issue is treated as **not qualifying**.
+
+### 5. Output and Label Application
+
+For each issue that meets the upvote threshold, a message is printed: `Issue {url} has enough upvotes`.
+If `--verbose` is specified, a message is printed for **every** issue, including the cutoff date, the reason for the cutoff (whether the search label was added or the triage label was removed), and the number of upvotes the issue received since that date.
+If `--apply` is specified, the `triage.label` is **added to the issue** via a GraphQL mutation.
+The label's node ID is resolved once (by name) and cached for subsequent issues.
+
+### 6. Error and Warning Reporting
+
+The report uses GitHub Actions annotation syntax for warnings and errors:
+- `::warning ::` for non-fatal conditions (e.g., unsupported pagination scenarios).
+- `::error ::` for GraphQL response errors.
+
+This makes the report suitable for running as a **GitHub Actions workflow step**, where these annotations surface in the Actions UI.
+
+## Known Limitations
+
+The following scenarios are not fully handled and produce warnings:
+
+1. **Issue has more than 100 labels** — The report cannot confirm whether the action label is already applied.
+2. **Ice box label not found in the last 100 timeline events** — The report cannot determine when the label was applied and skips the issue.
+3. **Reactions require additional pagination** — When the fetched reactions are insufficient to determine the threshold and a definitive answer cannot be derived from the available data, the issue is treated as not qualifying.
+
+## Interactive Mode
+
+The IceBox report is **not available in interactive mode**.
+Running it without CLI arguments prints an informational message and exits.
diff --git a/GithubIssueTagger/Reports/IceBox/sample-config.json b/GithubIssueTagger/Reports/IceBox/sample-config.json
new file mode 100644
index 00000000..f0bf2b29
--- /dev/null
+++ b/GithubIssueTagger/Reports/IceBox/sample-config.json
@@ -0,0 +1,9 @@
+{
+  "owner": "NuGet",
+  "repo": "Home",
+  "searchLabel": "Priority:3",
+  "triage": {
+    "upvotes": 5,
+    "label": "Triage:NeedsTriageDiscussion"
+  }
+}