diff --git a/backend/go.mod b/backend/go.mod
index f4c0db230..1058d1480 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -29,7 +29,7 @@ require (
 	github.com/tidwall/gjson v1.19.0
 	github.com/utmstack/license-manager-sdk v0.1.0
 	golang.org/x/crypto v0.54.0
-	google.golang.org/api v0.289.0
+	google.golang.org/api v0.290.0
 	google.golang.org/grpc v1.82.1
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
diff --git a/backend/go.sum b/backend/go.sum
index 59461374d..a05315023 100644
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -488,8 +488,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.289.0 h1:DmH0c6NigNFmsvsohM9bxv+MzVhag3aGHnojA5fFQjc=
-google.golang.org/api v0.289.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8=
+google.golang.org/api v0.290.0 h1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A=
+google.golang.org/api v0.290.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
diff --git a/backend/modules/eventprocessing/handler/correlation_rule.go b/backend/modules/eventprocessing/handler/correlation_rule.go
index c26a3780b..dbf68cbea 100644
--- a/backend/modules/eventprocessing/handler/correlation_rule.go
+++ b/backend/modules/eventprocessing/handler/correlation_rule.go
@@ -141,7 +141,11 @@ func (h *CorrelationRuleHandler) ActivateDeactivate(c *gin.Context) {
 	}
 
 	changed, err := h.usecase.SetActive(c.Request.Context(), relPath, active)
-	audit.Record(c, audit_connectors.Event{Action: "correlation_rule.activate"}, audit_domain.CORRELATION_RULE_UPDATE_ATTEMPT, audit_domain.CORRELATION_RULE_UPDATE_SUCCESS, err)
+	action := "correlation_rule.activate"
+	if !active {
+		action = "correlation_rule.deactivate"
+	}
+	audit.Record(c, audit_connectors.Event{Action: action}, audit_domain.CORRELATION_RULE_UPDATE_ATTEMPT, audit_domain.CORRELATION_RULE_UPDATE_SUCCESS, err)
 	if err != nil {
 		writeCorrelationError(c, err)
 		return
diff --git a/backend/modules/eventprocessing/usecase/pipeline_writer.go b/backend/modules/eventprocessing/usecase/pipeline_writer.go
index fd7c8d1ef..bd2ea2005 100644
--- a/backend/modules/eventprocessing/usecase/pipeline_writer.go
+++ b/backend/modules/eventprocessing/usecase/pipeline_writer.go
@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"sort"
 	"sync"
+	"time"
 
 	"gopkg.in/yaml.v3"
 )
@@ -102,6 +103,12 @@ func (w *pipelineWriter) SetRuleDisabled(identity string, disabled bool) error {
 	return w.writeTenantsLocked()
 }
 
+// PokeRuleReload bumps a rule file's mtime without changing its content.
+func (w *pipelineWriter) PokeRuleReload(absPath string) {
+	now := time.Now()
+	_ = os.Chtimes(absPath, now, now)
+}
+
 // DisabledRuleSet returns a snapshot of the currently disabled rule identities.
 func (w *pipelineWriter) DisabledRuleSet() map[string]bool {
 	w.mu.Lock()
diff --git a/backend/modules/eventprocessing/usecase/rule_store.go b/backend/modules/eventprocessing/usecase/rule_store.go
index f9863bd3a..95814ba01 100644
--- a/backend/modules/eventprocessing/usecase/rule_store.go
+++ b/backend/modules/eventprocessing/usecase/rule_store.go
@@ -368,6 +368,13 @@ func (s *RuleStore) SetEnabled(relPath string, enabled bool) (bool, error) {
 		return false, err
 	}
 	sr.enabled = enabled
+
+	dir := s.userDir
+	if sr.system {
+		dir = s.systemDir
+	}
+	s.writer.PokeRuleReload(filepath.Join(dir, relPath))
+
 	return true, nil
 }
 
diff --git a/plugins/gcp/go.mod b/plugins/gcp/go.mod
index c8ef0e71e..dbece3db7 100644
--- a/plugins/gcp/go.mod
+++ b/plugins/gcp/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/threatwinds/go-sdk v1.1.26
 	golang.org/x/crypto v0.54.0
-	google.golang.org/api v0.289.0
+	google.golang.org/api v0.290.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
diff --git a/plugins/gcp/go.sum b/plugins/gcp/go.sum
index 7bf748ac0..ef4b00b40 100644
--- a/plugins/gcp/go.sum
+++ b/plugins/gcp/go.sum
@@ -252,8 +252,8 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.289.0 h1:DmH0c6NigNFmsvsohM9bxv+MzVhag3aGHnojA5fFQjc=
-google.golang.org/api v0.289.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8=
+google.golang.org/api v0.290.0 h1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A=
+google.golang.org/api v0.290.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=