diff --git a/OWNERS b/OWNERS
new file mode 100644
index 00000000000..5911dfd3b66
--- /dev/null
+++ b/OWNERS
@@ -0,0 +1,26 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+approvers:
+  - AndreMouche
+  - binshi-bing
+  - bufferflies
+  - CabinfeverB
+  - Connor1996
+  - disksing
+  - huachaohuang
+  - HunDunDM
+  - HuSharp
+  - JmPotato
+  - lhy1024
+  - nolouch
+  - overvenus
+  - qiuyesuifeng
+  - rleungx
+  - siddontang
+  - Yisaer
+  - zhouqiang-cl
+reviewers:
+  - BusyJay
+  - howardlau1999
+  - Luffbee
+  - shafreeck
+  - xhebox
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
new file mode 100644
index 00000000000..516a466c91e
--- /dev/null
+++ b/OWNERS_ALIASES
@@ -0,0 +1,6 @@
+# Sort the member alphabetically.
+aliases:
+  sig-critical-approvers-config:
+    - easonn7
+    - kevin-xianliu
+    - niubell
diff --git a/client/resource_group/controller/OWNERS b/client/resource_group/controller/OWNERS
new file mode 100644
index 00000000000..aa02465dbd9
--- /dev/null
+++ b/client/resource_group/controller/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|config\\.go)$":
+    approvers:
+      - sig-critical-approvers-config
diff --git a/client/tlsutil/OWNERS b/client/tlsutil/OWNERS
new file mode 100644
index 00000000000..211db06feee
--- /dev/null
+++ b/client/tlsutil/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|tlsconfig\\.go)$":
+    approvers:
+      - sig-critical-approvers-config
diff --git a/conf/OWNERS b/conf/OWNERS
new file mode 100644
index 00000000000..1a435c49089
--- /dev/null
+++ b/conf/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|config\\.toml)$":
+    approvers:
+      - sig-critical-approvers-config
diff --git a/pkg/encryption/OWNERS b/pkg/encryption/OWNERS
new file mode 100644
index 00000000000..aa02465dbd9
--- /dev/null
+++ b/pkg/encryption/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|config\\.go)$":
+    approvers:
+      - sig-critical-approvers-config
diff --git a/pkg/mcs/resourcemanager/server/OWNERS b/pkg/mcs/resourcemanager/server/OWNERS
new file mode 100644
index 00000000000..aa02465dbd9
--- /dev/null
+++ b/pkg/mcs/resourcemanager/server/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|config\\.go)$":
+    approvers:
+      - sig-critical-approvers-config
diff --git a/pkg/mcs/resourcemanager/server/manager.go b/pkg/mcs/resourcemanager/server/manager.go
index d11650b48e4..d053d96abfc 100644
--- a/pkg/mcs/resourcemanager/server/manager.go
+++ b/pkg/mcs/resourcemanager/server/manager.go
@@ -129,7 +129,9 @@ func (m *Manager) Init(ctx context.Context) error {
 		return err
 	}
 	// Load resource group meta info from storage.
+	m.Lock()
 	m.groups = make(map[string]*ResourceGroup)
+	m.Unlock()
 	handler := func(k, v string) {
 		group := &rmpb.ResourceGroup{}
 		if err := proto.Unmarshal([]byte(v), group); err != nil {
diff --git a/pkg/mcs/scheduling/server/config/OWNERS b/pkg/mcs/scheduling/server/config/OWNERS
new file mode 100644
index 00000000000..aa02465dbd9
--- /dev/null
+++ b/pkg/mcs/scheduling/server/config/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|config\\.go)$":
+    approvers:
+      - sig-critical-approvers-config
diff --git a/pkg/mcs/tso/server/OWNERS b/pkg/mcs/tso/server/OWNERS
new file mode 100644
index 00000000000..aa02465dbd9
--- /dev/null
+++ b/pkg/mcs/tso/server/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|config\\.go)$":
+    approvers:
+      - sig-critical-approvers-config
diff --git a/pkg/schedule/config/OWNERS b/pkg/schedule/config/OWNERS
new file mode 100644
index 00000000000..ce5d15ddc19
--- /dev/null
+++ b/pkg/schedule/config/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|(config|store_config)\\.go)$":
+    approvers:
+      - sig-critical-approvers-config
diff --git a/pkg/schedule/schedulers/OWNERS b/pkg/schedule/schedulers/OWNERS
new file mode 100644
index 00000000000..ae96e4f1f42
--- /dev/null
+++ b/pkg/schedule/schedulers/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|hot_region_config\\.go)$":
+    approvers:
+      - sig-critical-approvers-config
diff --git a/pkg/utils/etcdutil/health_checker.go b/pkg/utils/etcdutil/health_checker.go
index 51c1808de4a..1bfdd391320 100644
--- a/pkg/utils/etcdutil/health_checker.go
+++ b/pkg/utils/etcdutil/health_checker.go
@@ -273,7 +273,7 @@ func (checker *healthChecker) updateEvictedEps(lastEps, pickedEps []string) {
 	for _, ep := range pickedEps {
 		pickedSet[ep] = true
 	}
-	// Reset the count to 0 if it's in evictedEps but not in the pickedEps.
+	// Reset the count to 0 if it's in `evictedEps` but not in `pickedEps`.
 	checker.evictedEps.Range(func(key, value any) bool {
 		ep := key.(string)
 		count := value.(int)
@@ -286,18 +286,21 @@ func (checker *healthChecker) updateEvictedEps(lastEps, pickedEps []string) {
 		}
 		return true
 	})
-	// Find all endpoints which are in the lastEps but not in the pickedEps,
-	// and add them to the evictedEps.
+	// Find all endpoints which are in `lastEps` and `healthyClients` but not in `pickedEps`,
+	// and add them to the `evictedEps`.
 	for _, ep := range lastEps {
 		if pickedSet[ep] {
 			continue
 		}
+		if hc := checker.loadClient(ep); hc == nil {
+			continue
+		}
 		checker.evictedEps.Store(ep, 0)
 		log.Info("evicted etcd endpoint found",
 			zap.String("endpoint", ep),
 			zap.String("source", checker.source))
 	}
-	// Find all endpoints which are in both pickedEps and evictedEps to
+	// Find all endpoints which are in both `pickedEps` and `evictedEps` to
 	// increase their picked count.
 	for _, ep := range pickedEps {
 		if count, ok := checker.evictedEps.Load(ep); ok {
diff --git a/pkg/utils/etcdutil/health_checker_test.go b/pkg/utils/etcdutil/health_checker_test.go
index 82dd1362ba2..07a8024e63c 100644
--- a/pkg/utils/etcdutil/health_checker_test.go
+++ b/pkg/utils/etcdutil/health_checker_test.go
@@ -35,6 +35,8 @@ func check(re *require.Assertions, testCases []*testCase) {
 		probeCh := make(chan healthProbe, len(tc.healthProbes))
 		for _, probe := range tc.healthProbes {
 			probeCh <- probe
+			// Mock that all the endpoints are healthy.
+			checker.healthyClients.LoadOrStore(probe.ep, &healthyClient{})
 		}
 		close(probeCh)
 		// Pick and filter the endpoints.
@@ -361,3 +363,27 @@ func TestLatencyPick(t *testing.T) {
 	}
 	check(re, testCases)
 }
+
+func TestUpdateEvictedEpsAfterRemoval(t *testing.T) {
+	re := require.New(t)
+	var (
+		checker   = &healthChecker{}
+		lastEps   = []string{"A", "B", "C"}
+		pickedEps = []string{"A", "C"}
+	)
+	// All endpoints are healthy.
+	for _, ep := range lastEps {
+		checker.healthyClients.Store(ep, &healthyClient{})
+	}
+	checker.updateEvictedEps(lastEps, pickedEps)
+	// B should be evicted.
+	_, ok := checker.evictedEps.Load("B")
+	re.True(ok)
+	// Remove the endpoint B to mock member removal.
+	checker.healthyClients.Delete("B")
+	checker.evictedEps.Delete("B")
+	checker.updateEvictedEps(lastEps, pickedEps)
+	// B should not be evicted since it has been removed.
+	_, ok = checker.evictedEps.Load("B")
+	re.False(ok)
+}
diff --git a/server/config/OWNERS b/server/config/OWNERS
new file mode 100644
index 00000000000..179de4843e6
--- /dev/null
+++ b/server/config/OWNERS
@@ -0,0 +1,7 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+options:
+  no_parent_owners: true
+filters:
+  "(OWNERS|(config|service_middleware_config)\\.go)$":
+    approvers:
+      - sig-critical-approvers-config