diff --git a/ci-operator/config/openshift/monitoring-plugin/openshift-monitoring-plugin-main.yaml b/ci-operator/config/openshift/monitoring-plugin/openshift-monitoring-plugin-main.yaml
index 2866e806ce723..85a2c7f42adbb 100644
--- a/ci-operator/config/openshift/monitoring-plugin/openshift-monitoring-plugin-main.yaml
+++ b/ci-operator/config/openshift/monitoring-plugin/openshift-monitoring-plugin-main.yaml
@@ -146,6 +146,14 @@ tests:
     test:
     - ref: monitoring-plugin-tests-alerts-ui
     workflow: ipi-aws
+- always_run: false
+  as: e2e-management-api
+  optional: true
+  steps:
+    cluster_profile: openshift-org-aws
+    test:
+    - ref: monitoring-plugin-tests-management-api
+    workflow: ipi-aws
 - always_run: false
   as: e2e-dashboards
   optional: true
diff --git a/ci-operator/jobs/openshift/monitoring-plugin/openshift-monitoring-plugin-main-presubmits.yaml b/ci-operator/jobs/openshift/monitoring-plugin/openshift-monitoring-plugin-main-presubmits.yaml
index 54ad79e3ff137..f9ac7acf98ea6 100644
--- a/ci-operator/jobs/openshift/monitoring-plugin/openshift-monitoring-plugin-main-presubmits.yaml
+++ b/ci-operator/jobs/openshift/monitoring-plugin/openshift-monitoring-plugin-main-presubmits.yaml
@@ -637,6 +637,94 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )e2e-incidents,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build01
+    context: ci/prow/e2e-management-api
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - Dockerfile
+      - Dockerfile.mcp
+      - Dockerfile.test
+      - web/cypress/Dockerfile
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-monitoring-plugin-main-e2e-management-api
+    optional: true
+    rerun_command: /test e2e-management-api
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-management-api
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-management-api,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:
diff --git a/ci-operator/step-registry/monitoring-plugin/tests/management-api/OWNERS b/ci-operator/step-registry/monitoring-plugin/tests/management-api/OWNERS
new file mode 100644
index 0000000000000..9dfa5975fe337
--- /dev/null
+++ b/ci-operator/step-registry/monitoring-plugin/tests/management-api/OWNERS
@@ -0,0 +1,14 @@
+approvers:
+- etmurasaki
+- jan--f
+- jgbernalp
+- kyoto
+- peteryurkovich
+- zhuje
+options: {}
+reviewers:
+- etmurasaki
+- jgbernalp
+- kyoto
+- peteryurkovich
+- zhuje
diff --git a/ci-operator/step-registry/monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-commands.sh b/ci-operator/step-registry/monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-commands.sh
new file mode 100644
index 0000000000000..5cef7a03f6a62
--- /dev/null
+++ b/ci-operator/step-registry/monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-commands.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+set -o nounset
+set -o errexit
+set -o pipefail
+
+if [ -f "${SHARED_DIR}/proxy-conf.sh" ] ; then
+  source "${SHARED_DIR}/proxy-conf.sh"
+fi
+
+# Run the plugin backend directly in this step container (which has the Go
+# source and toolchain via from: src). The backend only needs kube API access
+# to manage PrometheusRule CRDs — it does not need the full console plugin
+# stack. KUBECONFIG is injected by ci-operator from the provisioned cluster.
+
+PORT=9001
+
+unset GOFLAGS
+export GOCACHE=/tmp/go-build
+export GOMODCACHE=/tmp/go-mod
+
+echo "Starting monitoring-plugin backend on port ${PORT}..."
+go run ./cmd/plugin-backend.go \
+  -port="${PORT}" \
+  -config-path="./config" \
+  -static-path="./web/dist" &
+BACKEND_PID=$!
+# Single quotes: $BACKEND_PID must expand at signal time, not at registration
+trap 'kill ${BACKEND_PID} 2>/dev/null || true' EXIT
+
+# Wait for the backend to be ready
+echo "Waiting for backend to be ready..."
+ready=false
+for i in $(seq 1 15); do
+  if curl -sf "http://localhost:${PORT}/health" > /dev/null 2>&1; then
+    echo "Backend is ready"
+    ready=true
+    break
+  fi
+  echo "  attempt ${i}/15..."
+  sleep 2
+done
+
+if [ "${ready}" != "true" ]; then
+  echo "ERROR: Backend did not become ready after 15 attempts"
+  exit 1
+fi
+
+echo "Running management API e2e tests..."
+export PLUGIN_URL="http://localhost:${PORT}"
+
+make test-e2e
diff --git a/ci-operator/step-registry/monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-ref.metadata.json b/ci-operator/step-registry/monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-ref.metadata.json
new file mode 100644
index 0000000000000..dcc92e895488f
--- /dev/null
+++ b/ci-operator/step-registry/monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-ref.metadata.json
@@ -0,0 +1,20 @@
+{
+	"path": "monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-ref.yaml",
+	"owners": {
+		"approvers": [
+			"etmurasaki",
+			"jan--f",
+			"jgbernalp",
+			"kyoto",
+			"peteryurkovich",
+			"zhuje"
+		],
+		"reviewers": [
+			"etmurasaki",
+			"jgbernalp",
+			"kyoto",
+			"peteryurkovich",
+			"zhuje"
+		]
+	}
+}
\ No newline at end of file
diff --git a/ci-operator/step-registry/monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-ref.yaml b/ci-operator/step-registry/monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-ref.yaml
new file mode 100644
index 0000000000000..8175859912f21
--- /dev/null
+++ b/ci-operator/step-registry/monitoring-plugin/tests/management-api/monitoring-plugin-tests-management-api-ref.yaml
@@ -0,0 +1,19 @@
+ref:
+  as: monitoring-plugin-tests-management-api
+  from: src
+  commands: monitoring-plugin-tests-management-api-commands.sh
+  timeout: 30m0s
+  grace_period: 60s
+  resources:
+    requests:
+      cpu: "2"
+      memory: 4Gi
+    limits:
+      memory: 8Gi
+  documentation: |-
+    The monitoring-plugin-tests-management-api step starts the
+    monitoring-plugin backend directly from source (go run) inside the
+    step container, then runs the Go e2e tests in test/e2e/ against the
+    live Alerting Management API (make test-e2e). KUBECONFIG is injected
+    by ci-operator from the provisioned cluster so the tests can create
+    namespaces and verify PrometheusRule CRDs.