diff --git a/.github/scripts/create-platform-release-pr.sh b/.github/scripts/create-platform-release-pr.sh
index a646999b..426ff59e 100755
--- a/.github/scripts/create-platform-release-pr.sh
+++ b/.github/scripts/create-platform-release-pr.sh
@@ -22,15 +22,27 @@ set -e
 set -u
 set -o pipefail
 
-# Input validation
+# Input assignments (quoted args prevent shifting). Use defaults only for optional args.
 PLATFORM="${1}"
-PREVIOUS_VERSION_REF="${2}"
+PREVIOUS_VERSION_REF="${2:-}"
+# Normalize whitespace-only values; hotfixes are indicated by the literal string 'null'
+PREVIOUS_VERSION_REF="${PREVIOUS_VERSION_REF//[[:space:]]/}"
 NEW_VERSION="${3}"
+NEW_VERSION="${NEW_VERSION//[[:space:]]/}"
 NEW_VERSION_NUMBER="${4:-}"
 GIT_USER_NAME="${5:-metamaskbot}"
 GIT_USER_EMAIL="${6:-metamaskbot@users.noreply.github.com}"
 
-# Validate required parameters
+# Log assigned variables for debugging (after defaults and trimming)
+echo "Assigned variables:"
+echo "PLATFORM: $PLATFORM"
+echo "PREVIOUS_VERSION_REF: $PREVIOUS_VERSION_REF"
+echo "NEW_VERSION: $NEW_VERSION"
+echo "NEW_VERSION_NUMBER: $NEW_VERSION_NUMBER"
+echo "GIT_USER_NAME: $GIT_USER_NAME"
+echo "GIT_USER_EMAIL: $GIT_USER_EMAIL"
+
+# Validate required parameters (allow empty PREVIOUS_VERSION_REF for hotfixes)
 if [[ -z $PLATFORM ]]; then
   echo "Error: No platform specified."
   exit 1
@@ -46,9 +58,6 @@ if [[ -z $NEW_VERSION_NUMBER && $PLATFORM == "mobile" ]]; then
   exit 1
 fi
 
-
-
-
 # Helper Functions
 # ---------------
 
@@ -312,43 +321,52 @@ create_changelog_pr() {
     echo "Generating changelog via auto-changelog.."
     npx @metamask/auto-changelog@4.1.0 update --rc --repo "${GITHUB_REPOSITORY_URL}" --currentVersion "${new_version}" --autoCategorize
 
-    # Need to run from .github-tools context to inherit it's dependencies/environment
-    echo "Current Directory: $(pwd)"
-    PROJECT_GIT_DIR=$(pwd)
-
-    # By default, DIFF_BASE is set to the provided `previous_version_ref` (which can be a branch name, tag, or commit hash).
-    # If `previous_version_ref` matches a remote branch on origin, we fetch it and update DIFF_BASE to the fully qualified remote ref (`origin/<branch>`).
-    # This is required for the `generate-rc-commits.mjs` script to resolve the branch and successfully run the `git log` command.
-    # Otherwise, DIFF_BASE remains unchanged.
-    DIFF_BASE="${previous_version_ref}"
-
-    # Only consider known release branch patterns to avoid regex pitfalls:
-    # - Extension: Version-vx.y.z
-    # - Mobile:    release/x.y.z
-    if [[ "${previous_version_ref}" =~ ^Version-v[0-9]+\.[0-9]+\.[0-9]+$ || "${previous_version_ref}" =~ ^release/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-      echo "Previous version looks like a release branch: ${previous_version_ref}"
-      # Check if the exact branch exists on origin without interpolating into a regex
-      if git ls-remote --heads origin "${previous_version_ref}" | grep -q "."; then
-        echo "Detected remote branch for previous version: ${previous_version_ref}"
-        git fetch origin "${previous_version_ref}"
-        DIFF_BASE="origin/${previous_version_ref}"
+    # Skip commits.csv for hotfix releases (previous_version_ref is literal "null")
+    # - When we create a new major/minor release, we fetch all commits included in the release, by fetching the diff between HEAD and previous version reference.
+    # - When we create a new hotfix release, there are no commits included in the release by default (they will be cherry-picked one by one). So we don't have previous version reference, which is why the value is set to 'null'.
+    if [[ "${previous_version_ref,,}" == "null" ]]; then
+      echo "Hotfix release detected (previous-version-ref is 'null'); skipping commits.csv generation."
+    else
+      # Need to run from .github-tools context to inherit it's dependencies/environment
+      echo "Current Directory: $(pwd)"
+      PROJECT_GIT_DIR=$(pwd)
+
+      # By default, DIFF_BASE is set to the provided `previous_version_ref` (which can be a branch name, tag, or commit hash).
+      # If `previous_version_ref` matches a remote branch on origin, we fetch it and update DIFF_BASE to the fully qualified remote ref (`origin/<branch>`).
+      # This is required for the `generate-rc-commits.mjs` script to resolve the branch and successfully run the `git log` command.
+      # Otherwise, DIFF_BASE remains unchanged.
+      DIFF_BASE="${previous_version_ref}"
+
+      # Only consider known release branch patterns to avoid regex pitfalls:
+      # - Extension: Version-vx.y.z
+      # - Mobile:    release/x.y.z
+      if [[ "${previous_version_ref}" =~ ^Version-v[0-9]+\.[0-9]+\.[0-9]+$ || "${previous_version_ref}" =~ ^release/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+        echo "Previous version looks like a release branch: ${previous_version_ref}"
+        # Check if the exact branch exists on origin without interpolating into a regex
+        if git ls-remote --heads origin "${previous_version_ref}" | grep -q "."; then
+          echo "Detected remote branch for previous version: ${previous_version_ref}"
+          git fetch origin "${previous_version_ref}"
+          DIFF_BASE="origin/${previous_version_ref}"
+        else
+          echo "Remote branch not found on origin: ${previous_version_ref}. Will use as-is."
+        fi
       else
-        echo "Remote branch not found on origin: ${previous_version_ref}. Will use as-is."
+        echo "Previous version is not a recognized release branch pattern. Treating as tag or SHA: ${previous_version_ref}"
       fi
-    else
-      echo "Previous version is not a recognized release branch pattern. Treating as tag or SHA: ${previous_version_ref}"
-    fi
 
-    # Switch to github-tools directory
-    cd ./github-tools/
-    ls -ltra
-    corepack prepare yarn@4.5.1 --activate
-    # This can't be done from the actions context layer due to the upstream repository having it's own context set with yarn
-    yarn --cwd install
+      # Switch to github-tools directory
+      cd ./github-tools/
+      ls -ltra
+      corepack prepare yarn@4.5.1 --activate
+      # This can't be done from the actions context layer due to the upstream repository having it's own context set with yarn
+      yarn --cwd install
+
+      echo "Generating test plan csv.."
+      yarn run gen:commits "${platform}" "${DIFF_BASE}" "${release_branch_name}" "${PROJECT_GIT_DIR}"
+      # Return to project root after generating commits.csv
+      cd ../
+    fi
 
-    echo "Generating test plan csv.."
-    yarn run gen:commits "${platform}" "${DIFF_BASE}" "${release_branch_name}" "${PROJECT_GIT_DIR}"
-    
     # Skipping Google Sheets update since there is no need for it anymore
     # TODO: Remove this once the current post-main validation approach is stable
     # if [[ "${TEST_ONLY:-false}" == 'false' ]]; then
@@ -356,16 +374,22 @@ create_changelog_pr() {
     #   # Create a new Release Sheet Page for the new version with our commits.csv content
     #   yarn run update-release-sheet "${platform}" "${new_version}" "${GOOGLE_DOCUMENT_ID}" "./commits.csv" "${PROJECT_GIT_DIR}" "${MOBILE_TEMPLATE_SHEET_ID}" "${EXTENSION_TEMPLATE_SHEET_ID}"
     # fi
-    cd ../
+    # Note: Only change directories when we actually entered ./github-tools/
 
     # Commit and Push Changelog Changes (exclude commits.csv)
     echo "Adding and committing changes.."
-    if ! (git commit -am "update changelog for ${new_version}"); then
-        echo "Error: No changes detected."
-        exit 1
+    local commit_msg="update changelog for ${new_version}"
+    if [[ "${previous_version_ref,,}" == "null" ]]; then
+      commit_msg="${commit_msg} (hotfix - no test plan)"
+    fi
+    if ! (git commit -am "${commit_msg}"); then
+      echo "No changes detected; skipping commit."
     fi
 
     local pr_body="This PR updates the change log for ${new_version}."
+    if [[ "${previous_version_ref,,}" == "null" ]]; then
+      pr_body="${pr_body} (Hotfix - no test plan generated.)"
+    fi
 
     # Use helper functions for push and PR creation
     push_branch_with_handling "${changelog_branch_name}"
@@ -413,6 +437,18 @@ Platform: ${platform}"
         echo "Version bump committed"
     fi
 
+    # Ensure base branch exists locally; fetch from origin if missing
+    if ! git rev-parse --verify --quiet "refs/heads/${main_branch}" >/dev/null; then
+        echo "Base branch ${main_branch} not found locally. Attempting to fetch from origin..."
+        if git ls-remote --heads origin "${main_branch}" | grep -q "."; then
+            git fetch origin "${main_branch}:${main_branch}" || git fetch origin "${main_branch}"
+            echo "Fetched base branch ${main_branch} from origin."
+        else
+            echo "Error: Base branch not found on origin: ${main_branch}"
+            exit 1
+        fi
+    fi
+
     # If the version bump branch has no commits ahead of main, skip pushing/PR creation
     # Validate refs before computing ahead count to avoid masking errors
     # Fail fast with a error message if the base branch doesn’t exist locally (or isn’t fetched)
diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml
index a4240416..2abb99b2 100644
--- a/.github/workflows/create-release-pr.yml
+++ b/.github/workflows/create-release-pr.yml
@@ -22,7 +22,7 @@ on:
       previous-version-ref:
         required: true
         type: string
-        description: 'Previous release version branch name, tag or commit hash (e.g., release/7.7.0, v7.7.0, or 76fbc500034db9779e9ff7ce637ac5be1da0493d)'
+        description: 'Previous release version branch name, tag or commit hash (e.g., release/7.7.0, v7.7.0, or 76fbc500034db9779e9ff7ce637ac5be1da0493d). For hotfix releases, pass the literal string "null".'
       # Flag to indicate if the release is a test release for development purposes only
       mobile-template-sheet-id:
         required: false
@@ -139,12 +139,12 @@ jobs:
         run: |
           # Execute the script from github-tools
           ./github-tools/.github/scripts/create-platform-release-pr.sh \
-            ${{ inputs.platform }} \
-            ${{ inputs.previous-version-ref }} \
-            ${{ inputs.semver-version }} \
-            ${{ inputs.mobile-build-version }} \
-            ${{ inputs.git-user-name }} \
-            ${{ inputs.git-user-email }}
+            "${{ inputs.platform }}" \
+            "${{ inputs.previous-version-ref }}" \
+            "${{ inputs.semver-version }}" \
+            "${{ inputs.mobile-build-version }}" \
+            "${{ inputs.git-user-name }}" \
+            "${{ inputs.git-user-email }}"
 
       # Step 6: Upload commits.csv as artifact (if generated)
       - name: Upload commits.csv artifact