diff --git a/keps/sig-multicluster/5939-mcs-cluster-selection/README.md b/keps/sig-multicluster/5939-mcs-cluster-selection/README.md
new file mode 100644
index 000000000000..283ac53d7bf0
--- /dev/null
+++ b/keps/sig-multicluster/5939-mcs-cluster-selection/README.md
@@ -0,0 +1,1233 @@
+<!--
+**Note:** When your KEP is complete, all of these comment blocks should be removed.
+
+Follow the guidelines of the [documentation style guide].
+In particular, wrap lines to a reasonable length, to make it
+easier for reviewers to cite specific portions, and to minimize diff churn on
+updates.
+
+[documentation style guide]: https://github.com/kubernetes/community/blob/master/contributors/guide/style-guide.md
+
+To get started with this template:
+
+- [x] **Pick a hosting SIG.**
+  Make sure that the problem space is something the SIG is interested in taking
+  up. KEPs should not be checked in without a sponsoring SIG.
+- [x] **Create an issue in kubernetes/enhancements**
+  When filing an enhancement tracking issue, please make sure to complete all
+  fields in that template. One of the fields asks for a link to the KEP. You
+  can leave that blank until this KEP is filed, and then go back to the
+  enhancement and add the link.
+- [x] **Make a copy of this template directory.**
+  Copy this template into the owning SIG's directory and name it
+  `NNNN-short-descriptive-title`, where `NNNN` is the issue number (with no
+  leading-zero padding) assigned to your enhancement above.
+- [x] **Fill out as much of the kep.yaml file as you can.**
+  At minimum, you should fill in the "Title", "Authors", "Owning-sig",
+  "Status", and date-related fields.
+- [x] **Fill out this file as best you can.**
+  At minimum, you should fill in the "Summary" and "Motivation" sections.
+  These should be easy if you've preflighted the idea of the KEP with the
+  appropriate SIG(s).
+- [x] **Create a PR for this KEP.**
+  Assign it to people in the SIG who are sponsoring this process.
+- [ ] **Merge early and iterate.**
+  Avoid getting hung up on specific details and instead aim to get the goals of
+  the KEP clarified and merged quickly. The best way to do this is to just
+  start with the high-level sections and fill out details incrementally in
+  subsequent PRs.
+
+Just because a KEP is merged does not mean it is complete or approved. Any KEP
+marked as `provisional` is a working document and subject to change. You can
+denote sections that are under active debate as follows:
+
+```
+<<[UNRESOLVED optional short context or usernames ]>>
+Stuff that is being argued.
+<<[/UNRESOLVED]>>
+```
+
+When editing KEPS, aim for tightly-scoped, single-topic PRs to keep discussions
+focused. If you disagree with what is already in a document, open a new PR
+with suggested changes.
+
+One KEP corresponds to one "feature" or "enhancement" for its whole lifecycle.
+You do not need a new KEP to move from beta to GA, for example. If
+new details emerge that belong in the KEP, edit the KEP. Once a feature has become
+"implemented", major changes should get new KEPs.
+
+The canonical place for the latest set of instructions (and the likely source
+of this file) is [here](/keps/NNNN-kep-template/README.md).
+
+**Note:** Any PRs to move a KEP to `implementable`, or significant changes once
+it is marked `implementable`, must be approved by each of the KEP approvers.
+If none of those approvers are still appropriate, then changes to that list
+should be approved by the remaining approvers and/or the owning SIG (or
+SIG Architecture for cross-cutting KEPs).
+-->
+# KEP-5939: Cluster Selection for Multi-Cluster Services
+
+<!--
+This is the title of your KEP. Keep it short, simple, and descriptive. A good
+title can help communicate what the KEP is and should be considered as part of
+any review.
+-->
+
+<!--
+A table of contents is helpful for quickly jumping to sections of a KEP and for
+highlighting any additional information provided beyond the standard KEP
+template.
+
+Ensure the TOC is wrapped with
+  <code>&lt;!-- toc --&rt;&lt;!-- /toc --&rt;</code>
+tags, and then generate with `hack/update-toc.sh`.
+-->
+
+<!-- toc -->
+- [Release Signoff Checklist](#release-signoff-checklist)
+- [Summary](#summary)
+- [Motivation](#motivation)
+  - [Goals](#goals)
+  - [Non-Goals](#non-goals)
+- [Proposal](#proposal)
+  - [User Stories](#user-stories)
+    - [Story 1: Locality-based failover](#story-1-locality-based-failover)
+    - [Story 2: Multi-dimension selection with arbitrary properties](#story-2-multi-dimension-selection-with-arbitrary-properties)
+    - [Story 3: Data sovereignty with no fallback](#story-3-data-sovereignty-with-no-fallback)
+  - [Notes/Constraints/Caveats](#notesconstraintscaveats)
+  - [Risks and Mitigations](#risks-and-mitigations)
+- [Design Details](#design-details)
+  - [API Overview](#api-overview)
+    - [Label Selector](#label-selector)
+    - [Validation](#validation)
+  - [Cluster Selection Algorithm](#cluster-selection-algorithm)
+  - [Interaction with Service Traffic Distribution](#interaction-with-service-traffic-distribution)
+  - [Reading ClusterProperties from Constituent Clusters](#reading-clusterproperties-from-constituent-clusters)
+  - [Reference Implementation in kubernetes-sigs/mcs-api](#reference-implementation-in-kubernetes-sigsmcs-api)
+  - [Conflict Resolution](#conflict-resolution)
+  - [Test Plan](#test-plan)
+      - [Prerequisite testing updates](#prerequisite-testing-updates)
+      - [Unit tests](#unit-tests)
+      - [Integration tests](#integration-tests)
+      - [e2e tests](#e2e-tests)
+  - [Graduation Criteria](#graduation-criteria)
+    - [Alpha -&gt; Beta graduation](#alpha---beta-graduation)
+    - [Beta -&gt; GA graduation](#beta---ga-graduation)
+  - [Upgrade / Downgrade Strategy](#upgrade--downgrade-strategy)
+  - [Version Skew Strategy](#version-skew-strategy)
+- [Production Readiness Review Questionnaire](#production-readiness-review-questionnaire)
+  - [Feature Enablement and Rollback](#feature-enablement-and-rollback)
+  - [Rollout, Upgrade and Rollback Planning](#rollout-upgrade-and-rollback-planning)
+  - [Monitoring Requirements](#monitoring-requirements)
+  - [Dependencies](#dependencies)
+  - [Scalability](#scalability)
+  - [Troubleshooting](#troubleshooting)
+- [Implementation History](#implementation-history)
+- [Drawbacks](#drawbacks)
+- [Alternatives](#alternatives)
+- [Infrastructure Needed (Optional)](#infrastructure-needed-optional)
+<!-- /toc -->
+
+## Release Signoff Checklist
+
+<!--
+**ACTION REQUIRED:** In order to merge code into a release, there must be an
+issue in [kubernetes/enhancements] referencing this KEP and targeting a release
+milestone **before the [Enhancement Freeze](https://git.k8s.io/sig-release/releases)
+of the targeted release**.
+
+For enhancements that make changes to code or processes/procedures in core
+Kubernetes—i.e., [kubernetes/kubernetes], we require the following Release
+Signoff checklist to be completed.
+
+Check these off as they are completed for the Release Team to track. These
+checklist items _must_ be updated for the enhancement to be released.
+-->
+
+Items marked with (R) are required *prior to targeting to a milestone / release*.
+
+- [ ] (R) Enhancement issue in release milestone, which links to KEP dir in [kubernetes/enhancements] (not the initial KEP PR)
+- [ ] (R) KEP approvers have approved the KEP status as `implementable`
+- [ ] (R) Design details are appropriately documented
+- [ ] (R) Test plan is in place, giving consideration to SIG Architecture and SIG Testing input (including test refactors)
+  - [ ] e2e Tests for all Beta API Operations (endpoints)
+  - [ ] (R) Ensure GA e2e tests meet requirements for [Conformance Tests](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/conformance-tests.md)
+  - [ ] (R) Minimum Two Week Window for GA e2e tests to prove flake free
+- [ ] (R) Graduation criteria is in place
+  - [ ] (R) [all GA Endpoints](https://github.com/kubernetes/community/pull/1806) must be hit by [Conformance Tests](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/conformance-tests.md) within one minor version of promotion to GA
+- [ ] (R) Production readiness review completed
+- [ ] (R) Production readiness review approved
+- [ ] "Implementation History" section is up-to-date for milestone
+- [ ] User-facing documentation has been created in [kubernetes/website], for publication to [kubernetes.io]
+- [ ] Supporting documentation—e.g., additional design documents, links to mailing list discussions/SIG meetings, relevant PRs/issues, release notes
+
+<!--
+**Note:** This checklist is iterative and should be reviewed and updated every time this enhancement is being considered for a milestone.
+-->
+
+[kubernetes.io]: https://kubernetes.io/
+[kubernetes/enhancements]: https://git.k8s.io/enhancements
+[kubernetes/kubernetes]: https://git.k8s.io/kubernetes
+[kubernetes/website]: https://git.k8s.io/website
+[MCS-API]: /keps/sig-multicluster/1645-multi-cluster-services-api
+[ClusterProperty]: /keps/sig-multicluster/2149-clusterid
+[PlacementDecision]: /keps/sig-multicluster/5313-placement-decision-api
+[mcs-api-repo]: https://github.com/kubernetes-sigs/mcs-api
+
+## Summary
+
+<!--
+This section is incredibly important for producing high-quality, user-focused
+documentation such as release notes or a development roadmap. It should be
+possible to collect this information before implementation begins, in order to
+avoid requiring implementors to split their attention between writing release
+notes and implementing the feature itself. KEP editors and SIG Docs
+should help to ensure that the tone and content of the `Summary` section is
+useful for a wide audience.
+
+A good summary is probably at least a paragraph in length.
+-->
+
+The [Multi-Cluster Services API (MCS-API)][MCS-API] lets users export
+a Kubernetes `Service` with `ServiceExport` so that it becomes
+consumable across a clusterset. When the same `Service` is exported
+from multiple clusters, each importing cluster gets a single
+automatically generated `ServiceImport`.
+
+Today there is no standard way to express a preference over which
+clusters should receive traffic. A consumer in `eu-west` has no way
+to say "prefer my own cluster, then my region, then anywhere else".
+
+This KEP introduces a **cluster selection** concept for directing
+traffic. It adds an ordered `clusterSelectors` field to
+`ServiceExport` that lets users select subsets of constituent
+clusters based on [`ClusterProperty`][ClusterProperty] values.
+
+Each entry can use a standard Kubernetes `metav1.LabelSelector` with
+a special `@SameAsImporter@` value. If no entry matches clusters with
+available endpoints, configurable fallback behavior applies and
+defaults to all clusters.
+
+## Motivation
+
+<!--
+This section is for explicitly listing the motivation, goals, and non-goals of
+this KEP.  Describe why the change is important and the benefits to users. The
+motivation section can optionally provide links to [experience reports] to
+demonstrate the interest in a KEP within the wider Kubernetes community.
+
+[experience reports]: https://github.com/golang/go/wiki/ExperienceReports
+-->
+
+MCS-API already supports existing Service fields that help steer
+traffic such as `trafficDistribution` (for example, `PreferSameZone`)
+and `internalTrafficPolicy`. These work across clusters. However, they
+only function at the host or zone level.
+
+Real-world multi-cluster deployments span regions, countries, and
+continents. Users need the ability to keep traffic local for latency
+and cost reasons, with well-defined fallback behavior when local
+endpoints are unavailable. Without a standard API for this, every
+MCS-API implementation has its own mechanism, typically through
+annotations (for example, Cilium's
+[Service Affinity](https://docs.cilium.io/en/stable/network/clustermesh/affinity/)
+annotation which is limited to only select the local cluster or all remote
+clusters). A standard CRD field allows more expressive cluster selection
+and makes configurations portable across implementations.
+
+### Goals
+
+<!--
+List the specific goals of the KEP. What is it trying to achieve? How will we
+know that this has succeeded?
+-->
+
+- Allow users to steer traffic to a number of preferred clusters.
+- Act as an additional layer on top of `trafficDistribution` and
+  similar Service API fields, not a replacement.
+- Use [`ClusterProperty`][ClusterProperty] as the source of cluster
+  metadata for selection.
+- Support arbitrary (user-defined) `ClusterProperty` keys, not only
+  a pre-defined set.
+- Support various selection criteria over `ClusterProperty`,
+  including "same value as the importing cluster" and arbitrary
+  values.
+- Define an unambiguous algorithm that can be implemented by any
+  MCS-API implementation and by third-party integrations such as
+  Gateway API.
+
+### Non-Goals
+
+<!--
+What is out of scope for this KEP? Listing non-goals helps to focus discussion
+and make progress.
+-->
+
+- Select individual endpoints. This KEP is only about selecting
+  clusters.
+- Introduce complex routing rules, as those should be handled by
+  service-mesh or Gateway API implementations.
+
+## Proposal
+
+<!--
+This is where we get down to the specifics of what the proposal actually is.
+This should have enough detail that reviewers can understand exactly what
+you're proposing, but should not include things like API designs or
+implementation. What is the desired outcome and how do we measure success?.
+The "Design Details" section below is for the real
+nitty-gritty.
+-->
+
+This KEP builds on two existing building blocks:
+
+1. **[MCS-API]**: provides `ServiceExport`/`ServiceImport` and the conflict
+    resolution model.
+
+2. **[About API / `ClusterProperty`][ClusterProperty]**: provides a standard
+    way to attach key/value metadata to clusters. This KEP uses those
+    properties as the data source for cluster selection.
+
+New fields `clusterSelectors` and `clusterSelectorsFallbackPolicy` are added
+to `ServiceExport.spec`. They are globally reconciled with an exact match
+resolution to `ServiceImport.spec` so that all constituent clusters get
+the same behavior. In case of conflict, the values of these fields
+are resolved to those of the oldest `ServiceExport`.
+
+The `clusterSelectors` field is an ordered list of entries. Each
+entry defines a set of clusters whose endpoints should be preferred.
+The list is evaluated in order: the first entry that matches clusters
+with at least one available endpoint is used. The
+`clusterSelectorsFallbackPolicy` field controls what happens when no
+entry matches. It defaults to `"AllClusters"` (fallback to all
+constituent clusters) and can be set to `"None"` to suppress fallback
+entirely.
+
+Each entry in `clusterSelectors` can select clusters based on different
+criteria. Currently only a standard Kubernetes `metav1.LabelSelector`
+(as used in `NetworkPolicy`, `Deployment`, and similar APIs)
+evaluated against `ClusterProperty` key/value pairs is supported.
+
+### User Stories
+
+<!--
+Detail the things that people will be able to do if this KEP is implemented.
+Include as much detail as possible so that people can understand the "how" of
+the system. The goal here is to make this feel real for users without getting
+bogged down.
+-->
+
+#### Story 1: Locality-based failover
+
+A platform team exports `api` from multiple clusters across regions.
+They want each cluster to prefer its own endpoints first, then the same
+region, then the same continent, then fallback to all clusters.
+
+```yaml
+apiVersion: multicluster.x-k8s.io/v1beta1
+kind: ServiceExport
+metadata:
+  name: api
+spec:
+  clusterSelectors:
+    - propertySelector:
+        matchExpressions:
+          - key: cluster.clusterset.k8s.io
+            operator: In
+            values:
+              - "@SameAsImporter@"
+    - propertySelector:
+        matchLabels:
+          region.topology.k8s.io: "@SameAsImporter@"
+    - propertySelector:
+        matchLabels:
+          continent.topology.k8s.io: "@SameAsImporter@"
+```
+
+This can be combined with the Service-level `trafficDistribution: PreferSameZone`
+to further prefer same-zone endpoints within the selected cluster(s).
+
+#### Story 2: Multi-dimension selection with arbitrary properties
+
+Some workloads require selection rules combining multiple dimensions.
+For example, an ML inference service may run across clusters with
+different GPU capabilities. Rules combining some form of locality
+and GPU tiering might be needed.
+
+The following rules prefer clusters in the same continent with
+high-end GPUs, then clusters in the same continent with any GPU,
+then any cluster with a GPU.
+
+```yaml
+apiVersion: multicluster.x-k8s.io/v1beta1
+kind: ServiceExport
+metadata:
+  name: inference-server
+spec:
+  clusterSelectors:
+    # Same continent with high-end GPU
+    - propertySelector:
+        matchLabels:
+          continent.topology.k8s.io: "@SameAsImporter@"
+          gpu-tier.mycompany.com: "high"
+    # Same continent with any GPU
+    - propertySelector:
+        matchLabels:
+          continent.topology.k8s.io: "@SameAsImporter@"
+        matchExpressions:
+          - key: gpu-tier.mycompany.com
+            operator: Exists
+    # Any cluster with a GPU
+    - propertySelector:
+        matchExpressions:
+          - key: gpu-tier.mycompany.com
+            operator: Exists
+```
+
+Note that `continent.topology.k8s.io` is not a standard key as of today.
+
+#### Story 3: Data sovereignty with no fallback
+
+Some regulatory constraints require that traffic never reaches certain
+clusters, even when preferred ones are unavailable. Rather than
+splitting into separate clustersets, teams can keep a single clusterset
+and use `clusterSelectorsFallbackPolicy: None` to prevent fallback:
+
+```yaml
+apiVersion: multicluster.x-k8s.io/v1beta1
+kind: ServiceExport
+metadata:
+  name: customer-data-api
+spec:
+  clusterSelectorsFallbackPolicy: None
+  clusterSelectors:
+    - propertySelector:
+        matchLabels:
+          compliance.mycompany.com: "gdpr"
+```
+
+### Notes/Constraints/Caveats
+
+<!--
+What are the caveats to the proposal?
+What are some important details that didn't come across above?
+Go in to as much detail as necessary here.
+This might be a good place to talk about core concepts and how they relate.
+-->
+
+Cluster selection only applies to `ClusterIP` (non-headless)
+multi-cluster services. Headless `ServiceImport`s return individual
+pod IPs via DNS and are not compatible with cluster selection. If
+`clusterSelectors` is set on a `ServiceExport` for a headless
+service, a condition type `Valid` with reason `InvalidServiceType`
+and status `"False"` will be set on the `ServiceExport`.
+
+How implementations gather `ClusterProperty` data from constituent
+clusters is implementation specific. This KEP does not prescribe
+infrastructure requirements that may not fit all deployment models and
+may be revisited later if a standard mechanism is needed.
+
+CEL expressions as additional selection criteria (alongside
+`propertySelector`) are planned for a future iteration of this KEP.
+The design space (per-candidate boolean vs list-based evaluation,
+CEL cost estimation, CEL library configuration) requires further
+discussion and expertise. Each entry in `clusterSelectors` is
+designed to be extended with an `expression` field later.
+
+Externally-driven cluster selection (for example, having an
+external controller populate the selection via a
+[`PlacementDecision`][PlacementDecision]) is out of scope for now.
+The current version of this KEP only provides inline selection on
+`ServiceExport` via `ClusterProperty` data.
+
+Future selection criteria (such as CEL expressions or
+externally-driven selection) would be added as additional fields
+on each entry in `clusterSelectors`. Within a single entry,
+criteria would be mutually exclusive: for example, a user could
+not combine `propertySelector` and a CEL expression in the same
+entry, but could use `propertySelector` in one entry and a CEL
+expression in another with the usual ordered fallback between them.
+
+### Risks and Mitigations
+
+<!--
+What are the risks of this proposal, and how do we mitigate? Think broadly.
+For example, consider both security and how this will impact the larger
+Kubernetes ecosystem.
+
+How will security be reviewed, and by whom?
+
+How will UX be reviewed, and by whom?
+
+Consider including folks who also work outside the SIG or subproject.
+-->
+
+## Design Details
+
+<!--
+This section should contain enough information that the specifics of your
+change are understandable. This may include API specs (though not always
+required) or even code snippets. If there's any ambiguity about HOW your
+proposal will be implemented, this is the place to discuss them.
+-->
+
+### API Overview
+
+The `ServiceExport.spec` gains `clusterSelectors` and
+`clusterSelectorsFallbackPolicy` fields:
+
+```go
+type ServiceExportSpec struct {
+    // ... existing fields ...
+
+    // ClusterSelectors is an ordered list of cluster selectors.
+    // Each entry defines a preferred set of clusters. The first
+    // entry whose matching clusters have ready or serving endpoints
+    // is used. If no entry matches, the behavior depends on
+    // ClusterSelectorsFallbackPolicy.
+    // +optional
+    // +listType=atomic
+    // +kubebuilder:validation:items:MaxItems:=16
+    ClusterSelectors []ClusterSelector `json:"clusterSelectors,omitempty"`
+
+    // ClusterSelectorsFallbackPolicy controls what happens when no
+    // ClusterSelector entry matches.
+    //
+    // "AllClusters" (default): fallback to all constituent clusters.
+    // "None": do not fallback. The service has no endpoints
+    // and is effectively unavailable.
+    //
+    // +optional
+    // +kubebuilder:default="AllClusters"
+    // +kubebuilder:validation:Enum=AllClusters;None
+    ClusterSelectorsFallbackPolicy *FallbackPolicy `json:"clusterSelectorsFallbackPolicy,omitempty"`
+}
+
+// FallbackPolicy defines the behavior when no ClusterSelector matches.
+// +kubebuilder:validation:Enum=AllClusters;None
+type FallbackPolicy string
+
+const (
+    // FallbackAllClusters falls back to all constituent clusters.
+    FallbackAllClusters FallbackPolicy = "AllClusters"
+    // FallbackNone does not fallback. The service has no endpoints
+    // and is effectively unavailable.
+    FallbackNone FallbackPolicy = "None"
+)
+```
+
+The `ServiceImport.spec` gains the same fields, populated by the
+mcs-controller after conflict resolution:
+
+```go
+type ServiceImportSpec struct {
+    // ... existing fields ...
+
+    // ClusterSelectors is the reconciled ordered list of cluster
+    // selectors, derived from the constituent ServiceExports.
+    // +optional
+    // +listType=atomic
+    // +kubebuilder:validation:items:MaxItems:=16
+    ClusterSelectors []ClusterSelector `json:"clusterSelectors,omitempty"`
+
+    // ClusterSelectorsFallbackPolicy is the reconciled fallback
+    // policy, derived from the constituent ServiceExports.
+    // +optional
+    // +kubebuilder:default="AllClusters"
+    // +kubebuilder:validation:Enum=AllClusters;None
+    ClusterSelectorsFallbackPolicy *FallbackPolicy `json:"clusterSelectorsFallbackPolicy,omitempty"`
+}
+```
+
+The `ClusterSelector` type is defined as follows:
+
+```go
+// ClusterSelector selects a set of clusters.
+type ClusterSelector struct {
+    // PropertySelector selects clusters by matching ClusterProperty
+    // key/value pairs using standard label selector semantics.
+    // The special value "@SameAsImporter@" in matchLabels values or
+    // matchExpressions values means "use the same value as the
+    // importing cluster for this key."
+    // +required
+    PropertySelector *metav1.LabelSelector `json:"propertySelector"`
+}
+```
+
+#### Label Selector
+
+When `propertySelector` is set, it uses the same standard Kubernetes
+`metav1.LabelSelector` (as in `NetworkPolicy`, `Deployment`, and
+similar APIs) evaluated against each constituent cluster's
+`ClusterProperty` map. Both `matchLabels` and `matchExpressions` are
+supported.
+
+The special value `@SameAsImporter@` may be used in `matchLabels`
+values and `matchExpressions` values (with `In` or `NotIn` operators).
+It is replaced by the importing cluster's actual property value for
+the corresponding key, or by an empty string if the importing cluster
+does not have that key. Similarly to `trafficDistribution`, this lets
+users say "prefer clusters in the same region as me" without
+hard-coding a specific region, while keeping the MCS-API property
+that all `ServiceExport`s for a given service carry the same
+configuration across all constituent clusters.
+
+Implementations may choose to replace `@SameAsImporter@` with the
+local cluster's actual value when populating the `ServiceImport`, so
+that the resolved selectors are directly readable without further
+interpretation when consuming a `ServiceImport`.
+
+#### Validation
+
+Every entry in the `clusterSelectors` list must have `propertySelector`
+set. An entry with an empty or missing `propertySelector` is invalid.
+A condition type `Valid` with reason `InvalidClusterSelector` and
+status `"False"` will be set on the `ServiceExport`.
+
+When future selection criteria are added to entries in
+`clusterSelectors` (such as a CEL expression field), each entry must
+use only one selection criteria. Setting multiple fields on
+the same entry (for example, both `propertySelector` and a CEL
+expression) is invalid and will similarly raise the
+`InvalidClusterSelector` condition.
+
+### Cluster Selection Algorithm
+
+The algorithm is evaluated in each importing cluster independently:
+
+1. If `clusterSelectors` is empty or unset, use all endpoints from all
+   constituent clusters (no filtering).
+2. For each selector in `clusterSelectors` (in order):
+   1. Find all constituent clusters that match and collect their
+      endpoints.
+   2. If at least one of those endpoints is available (if it has
+      a `ready` or `serving` condition set to `true`), use that set
+      of endpoints and stop.
+3. If no cluster selector matched:
+   - If `clusterSelectorsFallbackPolicy` is `"AllClusters"` (the
+     default), use all endpoints from all constituent clusters.
+   - If `clusterSelectorsFallbackPolicy` is `"None"`, the service
+     has no endpoints and is effectively unavailable.
+
+When the active selector changes (for example, because the preferred
+clusters lost all ready endpoints), implementations should not
+instantly drop existing connections. How this is handled (for example,
+connection draining, graceful transition) is implementation specific,
+but implementations should make a best effort to avoid abrupt
+connection termination.
+
+### Interaction with Service Traffic Distribution
+
+Cluster selection runs before Service-level `trafficDistribution`
+(for example, `PreferSameZone`). If `clusterSelectors` narrows the
+set of eligible clusters, `trafficDistribution` still applies within
+the resulting endpoints.
+
+For the time being, cluster selection is **not**
+`trafficDistribution`-aware. If the preferred clusters have available
+endpoints, they are selected even if none of those endpoints are in
+the same zone as the consumer. `trafficDistribution` does not cause
+fallback to the next cluster selector.
+
+Configuring cluster selection `trafficDistribution`-awareness could
+be explored later if use cases emerge.
+
+### Reading ClusterProperties from Constituent Clusters
+
+How an implementation gathers `ClusterProperty` data from constituent
+clusters is implementation specific. Implementations for instance may:
+- Query remote clusters directly and keep the data in memory.
+- Use a hub cluster or central registry.
+- Reflect `ClusterProfile` objects locally.
+
+This KEP does not prescribe a mechanism. If a standard mechanism
+is needed in the future, this may be addressed in a follow-up.
+
+### Reference Implementation in kubernetes-sigs/mcs-api
+
+The [`kubernetes-sigs/mcs-api`][mcs-api-repo] repository will provide
+the CRD types for the new `clusterSelectors` field on `ServiceExport`
+and `ServiceImport`, along with a generic `PreparedSelector` API for
+evaluating selectors:
+
+```go
+// Cluster represents a cluster in the clusterset. Implementations
+// provide their own backing type.
+type Cluster interface {
+    // GetID returns the cluster ID (typically the value of the
+    // cluster.clusterset.k8s.io ClusterProperty).
+    GetID() string
+    // GetProperties returns the ClusterProperty key/value pairs.
+    GetProperties() map[string]string
+}
+
+// PreparedSelector is a compiled ClusterSelector ready for evaluation.
+type PreparedSelector[T Cluster] interface {
+    // SelectClusters returns the subset of candidates that match.
+    SelectClusters(candidates []T) ([]T, error)
+}
+
+// PrepareSelector compiles a ClusterSelector for the given importer.
+// It resolves any @SameAsImporter@ placeholders using the importer's
+// properties, then parses the label selector using the standard
+// Kubernetes LabelSelectorAsSelector function. The returned
+// PreparedSelector is bound to this importer and can be reused
+// across evaluations.
+func PrepareSelector[T Cluster](selector ClusterSelector, importer T) (PreparedSelector[T], error)
+```
+
+The full selection algorithm (iterating selectors, checking endpoint
+readiness, fallback, caching) is implementation-specific.
+
+### Conflict Resolution
+
+`clusterSelectors` and `clusterSelectorsFallbackPolicy` are global
+properties of the multi-cluster service. They follow the standard
+MCS-API conflict resolution policy:
+
+- All `ServiceExport`s for the same service must agree on
+  `clusterSelectors` as a whole (the entire ordered list must match
+  exactly) and similarly on `clusterSelectorsFallbackPolicy`.
+  If they disagree, precedence is given to the oldest `ServiceExport`
+  (by `creationTimestamp`).
+- A `Conflict` condition with status `True` is set on all
+  `ServiceExport`s with a `ClusterSelectorsConflict` or
+  `ClusterSelectorsFallbackPolicyConflict` reason.
+- The resolved value is written to the `ServiceImport` by the
+  mcs-controller.
+
+### Test Plan
+
+<!--
+**Note:** *Not required until targeted at a release.*
+The goal is to ensure that we don't accept enhancements with inadequate testing.
+
+All code is expected to have adequate tests (eventually with coverage
+expectations). Please adhere to the [Kubernetes testing guidelines][testing-guidelines]
+when drafting this test plan.
+
+[testing-guidelines]: https://git.k8s.io/community/contributors/devel/sig-testing/testing.md
+-->
+
+[x] I/we understand the owners of the involved components may require updates to
+existing tests to make this code solid enough prior to committing the changes necessary
+to implement this enhancement.
+
+##### Prerequisite testing updates
+
+<!--
+Based on reviewers feedback describe what additional tests need to be added prior
+implementing this enhancement to ensure the enhancements have also solid foundations.
+-->
+
+##### Unit tests
+
+<!--
+In principle every added code should have complete unit test coverage, so providing
+the exact set of tests will not bring additional value.
+However, if complete unit test coverage is not possible, explain the reason of it
+together with explanation why this is acceptable.
+-->
+
+<!--
+Additionally, for Alpha try to enumerate the core package you will be touching
+to implement this enhancement and provide the current unit coverage for those
+in the form of:
+- <package>: <date> - <current test coverage>
+The data can be easily read from:
+https://testgrid.k8s.io/sig-testing-canaries#ci-kubernetes-coverage-unit
+
+This can inform certain test coverage improvements that we want to do before
+extending the production code to implement this enhancement.
+-->
+
+
+##### Integration tests
+
+<!--
+Integration tests are contained in https://git.k8s.io/kubernetes/test/integration.
+Integration tests allow control of the configuration parameters used to start the binaries under test.
+This is different from e2e tests which do not allow configuration of parameters.
+Doing this allows testing non-default options and multiple different and potentially conflicting command line options.
+For more details, see https://github.com/kubernetes/community/blob/master/contributors/devel/sig-testing/testing-strategy.md
+
+If integration tests are not necessary or useful, explain why.
+-->
+
+<!--
+This question should be filled when targeting a release.
+For Alpha, describe what tests will be added to ensure proper quality of the enhancement.
+
+For Beta and GA, document that tests have been written,
+have been executed regularly, and have been stable.
+This can be done with:
+- permalinks to the GitHub source code
+- links to the periodic job (typically https://testgrid.k8s.io/sig-release-master-blocking#integration-master), filtered by the test name
+- a search in the Kubernetes bug triage tool (https://storage.googleapis.com/k8s-triage/index.html)
+-->
+
+
+##### e2e tests
+
+<!--
+This question should be filled when targeting a release.
+For Alpha, describe what tests will be added to ensure proper quality of the enhancement.
+
+For Beta and GA, document that tests have been written,
+have been executed regularly, and have been stable.
+This can be done with:
+- permalinks to the GitHub source code
+- links to the periodic job (typically a job owned by the SIG responsible for the feature), filtered by the test name
+- a search in the Kubernetes bug triage tool (https://storage.googleapis.com/k8s-triage/index.html)
+
+We expect no non-infra related flakes in the last month as a GA graduation criteria.
+If e2e tests are not necessary or useful, explain why.
+-->
+
+
+### Graduation Criteria
+
+<!--
+**Note:** *Not required until targeted at a release.*
+
+Define graduation milestones.
+
+These may be defined in terms of API maturity, [feature gate] graduations, or as
+something else. The KEP should keep this high-level with a focus on what
+signals will be looked at to determine graduation.
+
+Consider the following in developing the graduation criteria for this enhancement:
+- [Maturity levels (`alpha`, `beta`, `stable`)][maturity-levels]
+- [Feature gate][feature gate] lifecycle
+- [Deprecation policy][deprecation-policy]
+
+Clearly define what graduation means by either linking to the [API doc
+definition](https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-versioning)
+or by redefining what graduation means.
+
+In general we try to use the same stages (alpha, beta, GA), regardless of how the
+functionality is accessed.
+
+[feature gate]: https://git.k8s.io/community/contributors/devel/sig-architecture/feature-gates.md
+[maturity-levels]: https://git.k8s.io/community/contributors/devel/sig-architecture/api_changes.md#alpha-beta-and-stable-versions
+[deprecation-policy]: https://kubernetes.io/docs/reference/using-api/deprecation-policy/
+
+Below are some examples to consider, in addition to the aforementioned [maturity levels][maturity-levels].
+-->
+
+#### Alpha -> Beta graduation
+
+- At least two implementations supporting the feature.
+- Some conformance tests have been implemented and at least two
+  implementations have passed those tests.
+- Support for CEL expressions is specified as additional selection
+  criteria, or explicitly ruled out.
+
+#### Beta -> GA graduation
+
+- KEP-1645 and KEP-2149 have both graduated to stable.
+- Conformance tests are mature and extensive.
+- Most MCS-API implementations support the feature and pass
+  the conformance tests.
+- Support for external cluster selection mechanisms (for example,
+  `PlacementDecision`) is specified as additional selection
+  criteria, or explicitly ruled out.
+
+### Upgrade / Downgrade Strategy
+
+<!--
+If applicable, how will the component be upgraded and downgraded? Make sure
+this is in the test plan.
+
+Consider the following in developing an upgrade/downgrade strategy for this
+enhancement:
+- What changes (in invocations, configurations, API use, etc.) is an existing
+  cluster required to make on upgrade, in order to maintain previous behavior?
+- What changes (in invocations, configurations, API use, etc.) is an existing
+  cluster required to make on upgrade, in order to make use of the enhancement?
+-->
+
+### Version Skew Strategy
+
+<!--
+If applicable, how will the component handle version skew with other
+components? What are the guarantees? Make sure this is in the test plan.
+
+Consider the following in developing a version skew strategy for this
+enhancement:
+- Does this enhancement involve coordinating behavior in the control plane and nodes?
+- How does an n-3 kubelet or kube-proxy without this feature available behave when this feature is used?
+- How does an n-1 kube-controller-manager or kube-scheduler without this feature available behave when this feature is used?
+- Will any other components on the node change? For example, changes to CSI,
+  CRI or CNI may require updating that component before the kubelet.
+-->
+
+## Production Readiness Review Questionnaire
+
+<!--
+
+Production readiness reviews are intended to ensure that features merging into
+Kubernetes are observable, scalable and supportable; can be safely operated in
+production environments, and can be disabled or rolled back in the event they
+cause increased failures in production. See more in the PRR KEP at
+https://git.k8s.io/enhancements/keps/sig-architecture/1194-prod-readiness.
+
+The production readiness review questionnaire must be completed and approved
+for the KEP to move to `implementable` status and be included in the release.
+
+In some cases, the questions below should also have answers in `kep.yaml`. This
+is to enable automation to verify the presence of the review, and to reduce review
+burden and latency.
+
+The KEP must have a approver from the
+[`prod-readiness-approvers`](http://git.k8s.io/enhancements/OWNERS_ALIASES)
+team. Please reach out on the
+[#prod-readiness](https://kubernetes.slack.com/archives/CPNHUMN74) channel if
+you need any help or guidance.
+-->
+
+### Feature Enablement and Rollback
+
+<!--
+This section must be completed when targeting alpha to a release.
+-->
+
+###### How can this feature be enabled / disabled in a live cluster?
+
+<!--
+Pick one of these and delete the rest.
+
+Documentation is available on [feature gate lifecycle] and expectations, as
+well as the [existing list] of feature gates.
+
+[feature gate lifecycle]: https://git.k8s.io/community/contributors/devel/sig-architecture/feature-gates.md
+[existing list]: https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/
+-->
+
+
+###### Does enabling the feature change any default behavior?
+
+<!--
+Any change of default behavior may be surprising to users or break existing
+automations, so be extremely careful here.
+-->
+
+###### Can the feature be disabled once it has been enabled (i.e. can we roll back the enablement)?
+
+<!--
+Describe the consequences on existing workloads (e.g., if this is a runtime
+feature, can it break the existing applications?).
+
+Feature gates are typically disabled by setting the flag to `false` and
+restarting the component. No other changes should be necessary to disable the
+feature.
+
+NOTE: Also set `disable-supported` to `true` or `false` in `kep.yaml`.
+-->
+
+###### What happens if we reenable the feature if it was previously rolled back?
+
+###### Are there any tests for feature enablement/disablement?
+
+<!--
+The e2e framework does not currently support enabling or disabling feature
+gates. However, unit tests in each component dealing with managing data, created
+with and without the feature, are necessary. At the very least, think about
+conversion tests if API types are being modified.
+
+Additionally, for features that are introducing a new API field, unit tests that
+are exercising the `switch` of feature gate itself (what happens if I disable a
+feature gate after having objects written with the new field) are also critical.
+You can take a look at one potential example of such test in:
+https://github.com/kubernetes/kubernetes/pull/97058/files#diff-7826f7adbc1996a05ab52e3f5f02429e94b68ce6bce0dc534d1be636154fded3R246-R282
+-->
+
+### Rollout, Upgrade and Rollback Planning
+
+<!--
+This section must be completed when targeting beta to a release.
+-->
+
+###### How can a rollout or rollback fail? Can it impact already running workloads?
+
+<!--
+Try to be as paranoid as possible - e.g., what if some components will restart
+mid-rollout?
+
+Be sure to consider highly-available clusters, where, for example,
+feature flags will be enabled on some API servers and not others during the
+rollout. Similarly, consider large clusters and how enablement/disablement
+will rollout across nodes.
+-->
+
+###### What specific metrics should inform a rollback?
+
+<!--
+What signals should users be paying attention to when the feature is young
+that might indicate a serious problem?
+-->
+
+###### Were upgrade and rollback tested? Was the upgrade->downgrade->upgrade path tested?
+
+<!--
+Describe manual testing that was done and the outcomes.
+Longer term, we may want to require automated upgrade/rollback tests, but we
+are missing a bunch of machinery and tooling and can't do that now.
+-->
+
+###### Is the rollout accompanied by any deprecations and/or removals of features, APIs, fields of API types, flags, etc.?
+
+<!--
+Even if applying deprecation policies, they may still surprise some users.
+-->
+
+### Monitoring Requirements
+
+<!--
+This section must be completed when targeting beta to a release.
+
+For GA, this section is required: approvers should be able to confirm the
+previous answers based on experience in the field.
+-->
+
+###### How can an operator determine if the feature is in use by workloads?
+
+<!--
+Ideally, this should be a metric. Operations against the Kubernetes API (e.g.,
+checking if there are objects with field X set) may be a last resort. Avoid
+logs or events for this purpose.
+-->
+
+###### How can someone using this feature know that it is working for their instance?
+
+<!--
+For instance, if this is a pod-related feature, it should be possible to determine if the feature is functioning properly
+for each individual pod.
+Pick one more of these and delete the rest.
+Please describe all items visible to end users below with sufficient detail so that they can verify correct enablement
+and operation of this feature.
+Recall that end users cannot usually observe component logs or access metrics.
+-->
+
+###### What are the reasonable SLOs (Service Level Objectives) for the enhancement?
+
+<!--
+This is your opportunity to define what "normal" quality of service looks like
+for a feature.
+
+It's impossible to provide comprehensive guidance, but at the very
+high level (needs more precise definitions) those may be things like:
+  - per-day percentage of API calls finishing with 5XX errors <= 1%
+  - 99% percentile over day of absolute value from (job creation time minus expected
+    job creation time) for cron job <= 10%
+  - 99.9% of /health requests per day finish with 200 code
+
+These goals will help you determine what you need to measure (SLIs) in the next
+question.
+-->
+
+###### What are the SLIs (Service Level Indicators) an operator can use to determine the health of the service?
+
+<!--
+Pick one more of these and delete the rest.
+-->
+
+- [ ] Metrics
+  - Metric name:
+  - [Optional] Aggregation method:
+  - Components exposing the metric:
+- [ ] Other (treat as last resort)
+  - Details:
+
+###### Are there any missing metrics that would be useful to have to improve observability of this feature?
+
+<!--
+Describe the metrics themselves and the reasons why they weren't added (e.g., cost,
+implementation difficulties, etc.).
+-->
+
+### Dependencies
+
+<!--
+This section must be completed when targeting beta to a release.
+-->
+
+###### Does this feature depend on any specific services running in the cluster?
+
+<!--
+Think about both cluster-level services (e.g. metrics-server) as well
+as node-level agents (e.g. specific version of CRI). Focus on external or
+optional services that are needed. For example, if this feature depends on
+a cloud provider API, or upon an external software-defined storage or network
+control plane.
+
+For each of these, fill in the following—thinking about running existing user workloads
+and creating new ones, as well as about cluster-level services (e.g. DNS):
+  - [Dependency name]
+    - Usage description:
+      - Impact of its outage on the feature:
+      - Impact of its degraded performance or high-error rates on the feature:
+-->
+
+### Scalability
+
+<!--
+For alpha, this section is encouraged: reviewers should consider these questions
+and attempt to answer them.
+
+For beta, this section is required: reviewers must answer these questions.
+
+For GA, this section is required: approvers should be able to confirm the
+previous answers based on experience in the field.
+-->
+
+###### Will enabling / using this feature result in any new API calls?
+
+<!--
+Describe them, providing:
+  - API call type (e.g. PATCH pods)
+  - estimated throughput
+  - originating component(s) (e.g. Kubelet, Feature-X-controller)
+Focusing mostly on:
+  - components listing and/or watching resources they didn't before
+  - API calls that may be triggered by changes of some Kubernetes resources
+    (e.g. update of object X triggers new updates of object Y)
+  - periodic API calls to reconcile state (e.g. periodic fetching state,
+    heartbeats, leader election, etc.)
+-->
+
+###### Will enabling / using this feature result in introducing new API types?
+
+<!--
+Describe them, providing:
+  - API type
+  - Supported number of objects per cluster
+  - Supported number of objects per namespace (for namespace-scoped objects)
+-->
+
+###### Will enabling / using this feature result in any new calls to the cloud provider?
+
+<!--
+Describe them, providing:
+  - Which API(s):
+  - Estimated increase:
+-->
+
+###### Will enabling / using this feature result in increasing size or count of the existing API objects?
+
+<!--
+Describe them, providing:
+  - API type(s):
+  - Estimated increase in size: (e.g., new annotation of size 32B)
+  - Estimated amount of new objects: (e.g., new Object X for every existing Pod)
+-->
+
+###### Will enabling / using this feature result in increasing time taken by any operations covered by existing SLIs/SLOs?
+
+<!--
+Look at the [existing SLIs/SLOs].
+
+Think about adding additional work or introducing new steps in between
+(e.g. need to do X to start a container), etc. Please describe the details.
+
+[existing SLIs/SLOs]: https://git.k8s.io/community/sig-scalability/slos/slos.md#kubernetes-slisslos
+-->
+
+###### Will enabling / using this feature result in non-negligible increase of resource usage (CPU, RAM, disk, IO, ...) in any components?
+
+<!--
+Things to keep in mind include: additional in-memory state, additional
+non-trivial computations, excessive access to disks (including increased log
+volume), significant amount of data sent and/or received over network, etc.
+This through this both in small and large cases, again with respect to the
+[supported limits].
+
+[supported limits]: https://git.k8s.io/community//sig-scalability/configs-and-limits/thresholds.md
+-->
+
+###### Can enabling / using this feature result in resource exhaustion of some node resources (PIDs, sockets, inodes, etc.)?
+
+<!--
+Focus not just on happy cases, but primarily on more pathological cases
+(e.g. probes taking a minute instead of milliseconds, failed pods consuming resources, etc.).
+If any of the resources can be exhausted, how this is mitigated with the existing limits
+(e.g. pods per node) or new limits added by this KEP?
+
+Are there any tests that were run/should be run to understand performance characteristics better
+and validate the declared limits?
+-->
+
+### Troubleshooting
+
+<!--
+This section must be completed when targeting beta to a release.
+
+For GA, this section is required: approvers should be able to confirm the
+previous answers based on experience in the field.
+
+The Troubleshooting section currently serves the `Playbook` role. We may consider
+splitting it into a dedicated `Playbook` document (potentially with some monitoring
+details). For now, we leave it here.
+-->
+
+###### How does this feature react if the API server and/or etcd is unavailable?
+
+###### What are other known failure modes?
+
+<!--
+For each of them, fill in the following information by copying the below template:
+  - [Failure mode brief description]
+    - Detection: How can it be detected via metrics? Stated another way:
+      how can an operator troubleshoot without logging into a master or worker node?
+    - Mitigations: What can be done to stop the bleeding, especially for already
+      running user workloads?
+    - Diagnostics: What are the useful log messages and their required logging
+      levels that could help debug the issue?
+      Not required until feature graduated to beta.
+    - Testing: Are there any tests for failure mode? If not, describe why.
+-->
+
+###### What steps should be taken if SLOs are not being met to determine the problem?
+
+## Implementation History
+
+<!--
+Major milestones in the lifecycle of a KEP should be tracked in this section.
+Major milestones might include:
+- the `Summary` and `Motivation` sections being merged, signaling SIG acceptance
+- the `Proposal` section being merged, signaling agreement on a proposed design
+- the date implementation started
+- the first Kubernetes release where an initial version of the KEP was available
+- the version of Kubernetes where the KEP graduated to general availability
+- when the KEP was retired or superseded
+-->
+
+## Drawbacks
+
+<!--
+Why should this KEP _not_ be implemented?
+-->
+
+`@SameAsImporter@` is a placeholder value overloading standard
+`metav1.LabelSelector` values, which is unusual in the Kubernetes
+ecosystem. The About API (KEP-2149) also places no
+character restrictions on general `ClusterProperty` values, so a
+property value `@SameAsImporter@` would be indistinguishable from the
+placeholder. In practice this is unlikely, and the convenience for
+common use cases justifies it.
+
+## Alternatives
+
+<!--
+What other approaches did you consider, and why did you rule them out? These do
+not need to be as detailed as the proposal, but should include enough
+information to express the idea and why it was not acceptable.
+-->
+
+## Infrastructure Needed (Optional)
+
+<!--
+Use this section if you need things from the project/SIG. Examples include a
+new subproject, repos requested, or GitHub details. Listing these here allows a
+SIG to get the process for these resources started right away.
+-->
diff --git a/keps/sig-multicluster/5939-mcs-cluster-selection/kep.yaml b/keps/sig-multicluster/5939-mcs-cluster-selection/kep.yaml
new file mode 100644
index 000000000000..7be0a7becf52
--- /dev/null
+++ b/keps/sig-multicluster/5939-mcs-cluster-selection/kep.yaml
@@ -0,0 +1,22 @@
+title: Cluster Selection for Multi-Cluster Services
+kep-number: 5939
+authors:
+  - "@MrFreezeex"
+owning-sig: sig-multicluster
+# TODO: check with sig-network
+# participating-sigs:
+#   - sig-network
+status: implementable
+creation-date: 2026-03-01
+reviewers:
+  - TBD
+approvers:
+  - "@skitt"
+  - "@jeremyot"
+
+see-also:
+  - "/keps/sig-multicluster/1645-multi-cluster-services-api"
+  - "/keps/sig-multicluster/2149-clusterid"
+
+latest-milestone: "0.0"
+stage: alpha