diff --git a/CHANGES.md b/CHANGES.md
index 5aed4ae6b..c38392edc 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,26 @@
 # Release Notes
 
+## 2.29.0
+
+This release brings 1st class support for newer Pip's
+`--keyring-provider` option. Previously you could only use `keyring`
+based authentication via `--use-pip-config` and either the
+`PIP_KEYRING_PROVIDER` environment variable or Pip config files.
+Although using `--keyring-provider import` is generally unusable in the
+face of Pex hermeticity strictures, `--keyring-provider subprocess` is
+viable; just ensure you have a keyring provider on the `PATH`. You can
+read more [here][Pip-KRP-subprocess].
+
+This release also brings [PEP-723][PEP-723] support to Pex locks. You
+can now pass `pex3 lock {create,sync,update} --exe <script> ...` to
+include the PEP-723 declared script requirements in the lock.
+
+* add `--keyring-provider` flag to configure keyring-based authentication (#2592)
+* Support locking PEP-723 requirements. (#2642)
+
+[Pip-KRP-subprocess]: https://pip.pypa.io/en/stable/topics/authentication/#using-keyring-as-a-command-line-application
+[PEP-723]: https://peps.python.org/pep-0723
+
 ## 2.28.1
 
 This release upgrades `science` for use in building PEX scies with
diff --git a/RELEASE.rst b/RELEASE.rst
index 7c44cf057..e2485c6b7 100644
--- a/RELEASE.rst
+++ b/RELEASE.rst
@@ -69,12 +69,3 @@ If you're on macOS and commit signing fails, try setting ``export GPG_TTY=$(tty)
 
 Open the Release workflow run and wait for it to go green:
 https://github.com/pex-tool/pex/actions?query=workflow%3ARelease+branch%3Av2.1.29
-
-Edit the Github Release Page
-----------------------------
-
-Open the release page for edit:
-https://github.com/pex-tool/pex/releases/edit/v2.1.29
-
-1. Copy and paste the most recent CHANGES.rst section.
-2. Adapt the syntax from RestructuredText to Markdown (e.g. remove RST links ```PR #... <...>`_``).
diff --git a/pex/bin/pex.py b/pex/bin/pex.py
index 1e3efd5dc..8b3ace8d1 100644
--- a/pex/bin/pex.py
+++ b/pex/bin/pex.py
@@ -31,7 +31,7 @@
 from pex.enum import Enum
 from pex.fetcher import URLFetcher
 from pex.inherit_path import InheritPath
-from pex.interpreter_constraints import InterpreterConstraint, InterpreterConstraints
+from pex.interpreter_constraints import InterpreterConstraints
 from pex.layout import Layout, ensure_installed
 from pex.orderedset import OrderedSet
 from pex.pep_427 import InstallableType
@@ -56,6 +56,7 @@
     PipConfiguration,
 )
 from pex.resolve.resolvers import Unsatisfiable, sorted_requirements
+from pex.resolve.script_metadata import apply_script_metadata
 from pex.result import Error, ResultError, catch, try_
 from pex.scie import ScieConfiguration
 from pex.targets import Targets
@@ -1163,14 +1164,16 @@ def configure_requirements_and_targets(
 
     requirement_configuration = requirement_options.configure(options)
     target_config = target_options.configure(options, pip_configuration=pip_configuration)
-    script_metadata = ScriptMetadata()
+    script_metadata = None  # type: Optional[ScriptMetadata]
 
     if options.executable and options.enable_script_metadata:
-        with open(options.executable) as fp:
-            script_metadata = ScriptMetadata.parse(fp.read(), source=fp.name)
-
+        script_metadata_application = apply_script_metadata(
+            [options.executable],
+            requirement_configuration=requirement_configuration,
+            target_configuration=target_config,
+        )
+        script_metadata = script_metadata_application.scripts[0]
         if script_metadata.dependencies:
-            requirements = OrderedSet(str(req) for req in script_metadata.dependencies)
             TRACER.log(
                 "Will resolve dependencies discovered in PEP-723 script metadata from {source}"
                 "{in_addition_to}: {dependencies}".format(
@@ -1180,34 +1183,25 @@ def configure_requirements_and_targets(
                         if requirement_configuration.has_requirements
                         else ""
                     ),
-                    dependencies=" ".join(requirements),
+                    dependencies=" ".join(
+                        OrderedSet(str(req) for req in script_metadata.dependencies)
+                    ),
                 )
             )
-            if requirement_configuration.requirements:
-                requirements.update(requirement_configuration.requirements)
-            requirement_configuration = attr.evolve(
-                requirement_configuration,
-                requirements=requirements,
-            )
+        requirement_configuration = script_metadata_application.requirement_configuration
 
         if (
             script_metadata.requires_python
             and not target_config.interpreter_configuration.interpreter_constraints
         ):
-            interpreter_constraint = InterpreterConstraint(script_metadata.requires_python)
             TRACER.log(
                 "Will target interpreters matching requires-python discovered in PEP-723 script "
                 "metadata from {source}: {interpreter_constraint}".format(
-                    source=script_metadata.source, interpreter_constraint=interpreter_constraint
+                    source=options.executable,
+                    interpreter_constraint=script_metadata.requires_python,
                 )
             )
-            target_config = attr.evolve(
-                target_config,
-                interpreter_configuration=attr.evolve(
-                    target_config.interpreter_configuration,
-                    interpreter_constraints=InterpreterConstraints((interpreter_constraint,)),
-                ),
-            )
+        target_config = script_metadata_application.target_configuration
 
     try:
         targets = target_config.resolve_targets()
@@ -1216,7 +1210,7 @@ def configure_requirements_and_targets(
     except target_configuration.InterpreterConstraintsNotSatisfied as e:
         return Error(str(e), exit_code=CANNOT_SETUP_INTERPRETER)
 
-    if script_metadata.requires_python:
+    if script_metadata and script_metadata.requires_python:
         incompatible_targets = []  # type: List[str]
         for target in targets.unique_targets():
             if not target.requires_python_applies(
diff --git a/pex/cli/commands/lock.py b/pex/cli/commands/lock.py
index 740962931..cb0970a36 100644
--- a/pex/cli/commands/lock.py
+++ b/pex/cli/commands/lock.py
@@ -63,6 +63,7 @@
 from pex.resolve.resolved_requirement import Fingerprint, Pin
 from pex.resolve.resolver_configuration import LockRepositoryConfiguration, PipConfiguration
 from pex.resolve.resolver_options import parse_lockfile
+from pex.resolve.script_metadata import ScriptMetadataApplication, apply_script_metadata
 from pex.resolve.target_configuration import InterpreterConstraintsNotSatisfied, TargetConfiguration
 from pex.result import Error, Ok, Result, try_
 from pex.sorted_tuple import SortedTuple
@@ -397,6 +398,54 @@ def _no_updates(self):
         )
 
 
+@attr.s(frozen=True)
+class LockingConfiguration(object):
+    requirement_configuration = attr.ib()  # type: RequirementConfiguration
+    target_configuration = attr.ib()  # type: TargetConfiguration
+    lock_configuration = attr.ib()  # type: LockConfiguration
+    script_metadata_application = attr.ib(default=None)  # type: Optional[ScriptMetadataApplication]
+
+    def check_scripts(self, targets):
+        # type: (Targets) -> Optional[Error]
+
+        if self.script_metadata_application is None:
+            return None
+
+        errors = []  # type: List[str]
+        for target in targets.unique_targets():
+            scripts = self.script_metadata_application.target_does_not_apply(target)
+            if scripts:
+                errors.append(
+                    "{target} is not compatible with {count} {scripts}:\n"
+                    "{script_incompatibilities}".format(
+                        target=target.render_description(),
+                        count=len(scripts),
+                        scripts=pluralize(scripts, "script"),
+                        script_incompatibilities="\n".join(
+                            "   + {source} requires Python '{requires_python}'".format(
+                                source=script.source,
+                                requires_python=script.requires_python,
+                            )
+                            for script in scripts
+                        ),
+                    )
+                )
+        if errors:
+            return Error(
+                "PEP-723 scripts were specified that are incompatible with {count} lock "
+                "{targets}:\n{errors}".format(
+                    count=len(errors),
+                    targets=pluralize(errors, "target"),
+                    errors="\n".join(
+                        "{index}. {error}".format(index=index, error=error)
+                        for index, error in enumerate(errors, start=1)
+                    ),
+                )
+            )
+
+        return None
+
+
 class Lock(OutputMixin, JsonMixin, BuildTimeCommand):
     """Operate on PEX lock files."""
 
@@ -427,6 +476,17 @@ def _add_resolve_options(cls, parser):
             title="Requirement options",
             description="Indicate which distributions should be resolved",
         )
+        options_group.add_argument(
+            "--exe",
+            "--script",
+            dest="scripts",
+            default=[],
+            action="append",
+            help=(
+                "Specify scripts with PEP-723 metadata to gather requirements and interpreter "
+                "constraints from as lock inputs."
+            ),
+        )
         requirement_options.register(options_group)
         project.register_options(
             options_group,
@@ -867,13 +927,13 @@ def _resolve_targets(
             complete_platforms=target_config.complete_platforms,
         )
 
-    def _gather_requirements(
+    def _merge_project_requirements(
         self,
+        requirement_configuration,  # type: RequirementConfiguration
         pip_configuration,  # type: PipConfiguration
         targets,  # type: Targets
     ):
         # type: (...) -> RequirementConfiguration
-        requirement_configuration = requirement_options.configure(self.options)
         group_requirements = project.get_group_requirements(self.options)
         projects = project.get_projects(self.options)
         if not projects and not group_requirements:
@@ -898,15 +958,19 @@ def _gather_requirements(
                 )
         return attr.evolve(requirement_configuration, requirements=requirements)
 
-    def _create(self):
-        # type: () -> Result
-
-        pip_configuration = resolver_options.create_pip_configuration(
-            self.options, use_system_time=False
-        )
+    def _locking_configuration(self, pip_configuration):
+        # type: (PipConfiguration) -> Union[LockingConfiguration, Error]
+        requirement_configuration = requirement_options.configure(self.options)
         target_configuration = target_options.configure(
             self.options, pip_configuration=pip_configuration
         )
+        script_metadata_application = None  # type: Optional[ScriptMetadataApplication]
+        if self.options.scripts:
+            script_metadata_application = apply_script_metadata(
+                self.options.scripts, requirement_configuration, target_configuration
+            )
+            requirement_configuration = script_metadata_application.requirement_configuration
+            target_configuration = script_metadata_application.target_configuration
         if self.options.style == LockStyle.UNIVERSAL:
             lock_configuration = LockConfiguration(
                 style=LockStyle.UNIVERSAL,
@@ -928,14 +992,28 @@ def _create(self):
                 style=self.options.style,
                 elide_unused_requires_dist=self.options.elide_unused_requires_dist,
             )
+        return LockingConfiguration(
+            requirement_configuration,
+            target_configuration,
+            lock_configuration,
+            script_metadata_application=script_metadata_application,
+        )
+
+    def _create(self):
+        # type: () -> Result
 
+        pip_configuration = resolver_options.create_pip_configuration(
+            self.options, use_system_time=False
+        )
+        locking_configuration = try_(self._locking_configuration(pip_configuration))
         targets = try_(
             self._resolve_targets(
                 action="creating",
                 style=self.options.style,
-                target_configuration=target_configuration,
+                target_configuration=locking_configuration.target_configuration,
             )
         )
+        try_(locking_configuration.check_scripts(targets))
         pip_configuration = try_(
             finalize_resolve_config(
                 resolver_configuration=pip_configuration,
@@ -943,12 +1021,14 @@ def _create(self):
                 context="lock creation",
             )
         )
-        requirement_configuration = self._gather_requirements(pip_configuration, targets)
+        requirement_configuration = self._merge_project_requirements(
+            locking_configuration.requirement_configuration, pip_configuration, targets
+        )
         dependency_config = dependency_configuration.configure(self.options)
         self._dump_lockfile(
             try_(
                 create(
-                    lock_configuration=lock_configuration,
+                    lock_configuration=locking_configuration.lock_configuration,
                     requirement_configuration=requirement_configuration,
                     targets=targets,
                     pip_configuration=pip_configuration,
@@ -1571,35 +1651,11 @@ def _sync(self):
         )
         production_assert(isinstance(resolver_configuration, LockRepositoryConfiguration))
         pip_configuration = resolver_configuration.pip_configuration
+        locking_configuration = try_(self._locking_configuration(pip_configuration))
         dependency_config = dependency_configuration.configure(self.options)
-
-        target_configuration = target_options.configure(
-            self.options, pip_configuration=pip_configuration
-        )
-        if self.options.style == LockStyle.UNIVERSAL:
-            lock_configuration = LockConfiguration(
-                style=LockStyle.UNIVERSAL,
-                requires_python=tuple(
-                    str(interpreter_constraint.requires_python)
-                    for interpreter_constraint in target_configuration.interpreter_constraints
-                ),
-                target_systems=tuple(self.options.target_systems),
-                elide_unused_requires_dist=self.options.elide_unused_requires_dist,
-            )
-        elif self.options.target_systems:
-            return Error(
-                "The --target-system option only applies to --style {universal} locks.".format(
-                    universal=LockStyle.UNIVERSAL.value
-                )
-            )
-        else:
-            lock_configuration = LockConfiguration(
-                style=self.options.style,
-                elide_unused_requires_dist=self.options.elide_unused_requires_dist,
-            )
-
         lock_file_path = self.options.lock
         if os.path.exists(lock_file_path):
+            lock_configuration = locking_configuration.lock_configuration
             build_configuration = pip_configuration.build_configuration
             original_lock_file = try_(parse_lockfile(self.options, lock_file_path=lock_file_path))
             lock_file = attr.evolve(
@@ -1629,8 +1685,18 @@ def _sync(self):
                     dependency_config=dependency_config,
                 )
             )
-            requirement_configuration = self._gather_requirements(
-                pip_configuration, lock_update_request.targets
+            try_(locking_configuration.check_scripts(lock_update_request.targets))
+            pip_configuration = try_(
+                finalize_resolve_config(
+                    resolver_configuration=pip_configuration,
+                    targets=lock_update_request.targets,
+                    context="lock syncing",
+                )
+            )
+            requirement_configuration = self._merge_project_requirements(
+                locking_configuration.requirement_configuration,
+                pip_configuration,
+                lock_update_request.targets,
             )
             lock_update = lock_update_request.sync(
                 requirement_configuration=requirement_configuration,
@@ -1644,13 +1710,23 @@ def _sync(self):
                 self._resolve_targets(
                     action="creating",
                     style=self.options.style,
-                    target_configuration=target_configuration,
+                    target_configuration=locking_configuration.target_configuration,
+                )
+            )
+            try_(locking_configuration.check_scripts(targets))
+            pip_configuration = try_(
+                finalize_resolve_config(
+                    resolver_configuration=pip_configuration,
+                    targets=targets,
+                    context="lock creation",
                 )
             )
-            requirement_configuration = self._gather_requirements(pip_configuration, targets)
+            requirement_configuration = self._merge_project_requirements(
+                locking_configuration.requirement_configuration, pip_configuration, targets
+            )
             lockfile = try_(
                 create(
-                    lock_configuration=lock_configuration,
+                    lock_configuration=locking_configuration.lock_configuration,
                     requirement_configuration=requirement_configuration,
                     targets=targets,
                     pip_configuration=pip_configuration,
diff --git a/pex/resolve/script_metadata.py b/pex/resolve/script_metadata.py
new file mode 100644
index 000000000..24c5b6e88
--- /dev/null
+++ b/pex/resolve/script_metadata.py
@@ -0,0 +1,141 @@
+# Copyright 2025 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+from __future__ import absolute_import
+
+from textwrap import dedent
+
+from pex import specifier_sets
+from pex.interpreter_constraints import InterpreterConstraint, InterpreterConstraints
+from pex.orderedset import OrderedSet
+from pex.pep_723 import ScriptMetadata
+from pex.resolve.requirement_configuration import RequirementConfiguration
+from pex.resolve.resolvers import Unsatisfiable
+from pex.resolve.target_configuration import InterpreterConfiguration, TargetConfiguration
+from pex.specifier_sets import UnsatisfiableSpecifierSet
+from pex.targets import Target
+from pex.third_party.packaging.specifiers import SpecifierSet
+from pex.typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from typing import List, Optional, Sequence, Tuple
+
+    import attr  # vendor:skip
+
+else:
+    from pex.third_party import attr
+
+
+@attr.s(frozen=True)
+class ScriptMetadataApplication(object):
+    scripts = attr.ib()  # type: Tuple[ScriptMetadata, ...]
+    requirement_configuration = attr.ib()  # type: RequirementConfiguration
+    target_configuration = attr.ib()  # type: TargetConfiguration
+
+    def target_does_not_apply(self, target):
+        # type: (Target) -> Tuple[ScriptMetadata, ...]
+        return tuple(
+            script
+            for script in self.scripts
+            if not target.requires_python_applies(
+                requires_python=script.requires_python, source=script.source
+            )
+        )
+
+
+def apply_script_metadata(
+    scripts,  # type: Sequence[str]
+    requirement_configuration=None,  # type: Optional[RequirementConfiguration]
+    target_configuration=None,  # type: Optional[TargetConfiguration]
+):
+    # type: (...) -> ScriptMetadataApplication
+
+    script_metadatas = []  # type: List[ScriptMetadata]
+    requirements = OrderedSet(
+        requirement_configuration.requirements
+        if requirement_configuration and requirement_configuration.requirements
+        else ()
+    )  # type: OrderedSet[str]
+    requires_python = SpecifierSet()
+    for script in scripts:
+        with open(script) as fp:
+            script_metadata = ScriptMetadata.parse(fp.read(), source=fp.name)
+        script_metadatas.append(script_metadata)
+        requirements.update(map(str, script_metadata.dependencies))
+        requires_python &= script_metadata.requires_python
+
+    if isinstance(specifier_sets.as_range(requires_python), UnsatisfiableSpecifierSet):
+        raise Unsatisfiable(
+            dedent(
+                """\
+                The requires-python metadata of two or more of the specified scripts is in conflict.
+                Given the scripts: {scripts} and {script}
+                The resulting Python requirement is '{requires_python}' which is not satisfiable.
+                """
+            ).format(
+                scripts=", ".join(scripts[:-1]), script=scripts[-1], requires_python=requires_python
+            )
+        )
+
+    if target_configuration and requires_python:
+        interpreter_constraints = (
+            target_configuration.interpreter_configuration.interpreter_constraints.constraints
+        )
+        if interpreter_constraints:
+            ics = []  # type: List[InterpreterConstraint]
+            for interpreter_constraint in interpreter_constraints:
+                merged_requires_python = interpreter_constraint.requires_python & requires_python
+                if isinstance(
+                    specifier_sets.as_range(merged_requires_python), UnsatisfiableSpecifierSet
+                ):
+                    raise Unsatisfiable(
+                        "The requires-python metadata of one or more specified scripts is "
+                        "in conflict with specified `--interpreter-constraint "
+                        "'{interpreter_constraint}'` resulting in a Python requirement of "
+                        "'{requires_python}' which is not satisfiable.".format(
+                            interpreter_constraint=interpreter_constraint,
+                            requires_python=requires_python,
+                        ),
+                    )
+                ics.append(attr.evolve(interpreter_constraint, specifier=merged_requires_python))
+
+            target_config = attr.evolve(
+                target_configuration,
+                interpreter_configuration=attr.evolve(
+                    target_configuration.interpreter_configuration,
+                    interpreter_constraints=InterpreterConstraints(constraints=tuple(ics)),
+                ),
+            )
+        else:
+            target_config = attr.evolve(
+                target_configuration,
+                interpreter_configuration=attr.evolve(
+                    target_configuration.interpreter_configuration,
+                    interpreter_constraints=InterpreterConstraints(
+                        constraints=tuple([InterpreterConstraint(requires_python)])
+                    ),
+                ),
+            )
+    elif target_configuration:
+        target_config = target_configuration
+    elif not requires_python:
+        target_config = TargetConfiguration()
+    else:
+        target_config = TargetConfiguration(
+            interpreter_configuration=InterpreterConfiguration(
+                interpreter_constraints=InterpreterConstraints(
+                    constraints=tuple([InterpreterConstraint(requires_python)])
+                )
+            )
+        )
+
+    if requirement_configuration:
+        requirement_config = attr.evolve(requirement_configuration, requirements=requirements)
+    else:
+        requirement_config = RequirementConfiguration(requirements=requirements)
+
+    return ScriptMetadataApplication(
+        scripts=tuple(script_metadatas),
+        requirement_configuration=requirement_config,
+        target_configuration=target_config,
+    )
diff --git a/pex/version.py b/pex/version.py
index 2adc177b9..39be95acf 100644
--- a/pex/version.py
+++ b/pex/version.py
@@ -1,4 +1,4 @@
 # Copyright 2015 Pex project contributors.
 # Licensed under the Apache License, Version 2.0 (see LICENSE).
 
-__version__ = "2.28.1"
+__version__ = "2.29.0"
diff --git a/tests/integration/cli/commands/test_lock_script_metadata.py b/tests/integration/cli/commands/test_lock_script_metadata.py
new file mode 100644
index 000000000..d4dfbe5b9
--- /dev/null
+++ b/tests/integration/cli/commands/test_lock_script_metadata.py
@@ -0,0 +1,233 @@
+# Copyright 2025 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+from __future__ import absolute_import
+
+import os
+import re
+from textwrap import dedent
+
+import pytest
+
+from pex.interpreter import PythonInterpreter
+from pex.typing import TYPE_CHECKING
+from testing import run_pex_command
+from testing.cli import run_pex3
+from testing.pytest.tmp import Tempdir
+
+if TYPE_CHECKING:
+    from typing import Union
+
+    import colors  # vendor:skip
+    from typing_extensions import Literal
+else:
+    from pex.third_party import colors
+
+
+@pytest.fixture
+def script(tmpdir):
+    # type: (Tempdir) -> str
+
+    script = tmpdir.join("script.py")
+    with open(script, "w") as fp:
+        fp.write(
+            dedent(
+                """\
+                # /// script
+                # dependencies = ["cowsay==5.0"]
+                # ///
+
+                import cowsay
+
+
+                print(cowsay.get_output_string("cow", "Moo!"))
+                """
+            )
+        )
+    return script
+
+
+def assert_lock_script_simple(
+    lock,  # type: str
+    script,  # type: str
+    expected_message="| Moo! |",  # type: str
+):
+    # type: (...) -> None
+
+    run_pex_command(args=["--lock", lock, "--exe", script]).assert_success(
+        expected_output_re=r".*{message}.*".format(message=re.escape(expected_message)),
+        re_flags=re.DOTALL,
+    )
+
+
+def test_lock_create_script_simple(
+    tmpdir,  # type: Tempdir
+    script,  # type: str
+):
+    # type: (...) -> None
+
+    lock = tmpdir.join("lock.json")
+    run_pex3("lock", "create", "--script", script, "-o", lock).assert_success()
+    assert_lock_script_simple(lock, script)
+
+
+def test_lock_sync_script_simple(
+    tmpdir,  # type: Tempdir
+    script,  # type: str
+    current_interpreter,  # type: PythonInterpreter
+):
+    # type: (...) -> None
+
+    lock = tmpdir.join("lock.json")
+    run_pex3("lock", "sync", "--script", script, "--lock", lock).assert_success()
+    assert_lock_script_simple(lock, script)
+
+    with open(script, "w") as fp:
+        fp.write(
+            dedent(
+                """\
+                # /// script
+                # dependencies = ["ansicolors==1.1.8", "cowsay==5.0"]
+                # ///
+
+                import colors
+                import cowsay
+
+
+                print(cowsay.get_output_string("cow", colors.green("Moo!")))
+                """
+            )
+        )
+    run_pex3("lock", "sync", "--script", script, "--lock", lock).assert_success(
+        expected_error_re=re.escape(
+            dedent(
+                """\
+                Updates for lock generated by {platform}:
+                  Added ansicolors 1.1.8
+                Updates to lock input requirements:
+                  Added 'ansicolors==1.1.8'
+                """
+            ).format(platform=current_interpreter.platform.tag)
+        ),
+    )
+    assert_lock_script_simple(
+        lock, script, expected_message="| {message} |".format(message=colors.green("Moo!"))
+    )
+
+
+@pytest.fixture
+def script2(tmpdir):
+    # type: (Tempdir) -> str
+
+    script2 = tmpdir.join("script2.py")
+    with open(script2, "w") as fp:
+        fp.write(
+            dedent(
+                """\
+                # /// script
+                # dependencies = ["ansicolors==1.1.8"]
+                # ///
+
+                import colors
+
+
+                print(colors.green("Moo!"))
+                """
+            )
+        )
+    return script2
+
+
+def assert_lock_script_multiple(
+    lock,  # type: str
+    script,  # type: str
+    script2,  # type: str
+):
+    # type: (...) -> None
+    run_pex_command(args=["--lock", lock, "--exe", script]).assert_success(
+        expected_output_re=r".*{message}.*".format(message=re.escape("| Moo! |")),
+        re_flags=re.DOTALL,
+    )
+    run_pex_command(args=["--lock", lock, "--exe", script2]).assert_success(
+        expected_output_re=re.escape(
+            "{message}{eol}".format(message=colors.green("Moo!"), eol=os.linesep)
+        )
+    )
+
+
+def test_lock_create_script_multiple(
+    tmpdir,  # type: Tempdir
+    script,  # type: str
+    script2,  # type: str
+):
+    # type: (...) -> None
+
+    lock = tmpdir.join("lock.json")
+    run_pex3("lock", "create", "--script", script, "--script", script2, "-o", lock).assert_success()
+    assert_lock_script_multiple(lock, script, script2)
+
+
+def test_lock_sync_script_multiple(
+    tmpdir,  # type: Tempdir
+    script,  # type: str
+    script2,  # type: str
+):
+    # type: (...) -> None
+
+    lock = tmpdir.join("lock.json")
+    run_pex3(
+        "lock", "sync", "--script", script, "--script", script2, "--lock", lock
+    ).assert_success()
+    assert_lock_script_multiple(lock, script, script2)
+
+
+@pytest.fixture
+def script3(tmpdir):
+    # type: (Tempdir) -> str
+
+    script3 = tmpdir.join("script3.py")
+    with open(script3, "w") as fp:
+        fp.write(
+            dedent(
+                """\
+                # /// script
+                # requires-python = "==3.13.*"
+                # ///
+                """
+            )
+        )
+    return script3
+
+
+def assert_lock_script_conflict(
+    verb,  # type: Union[Literal["create"], Literal["sync"]]
+    script,  # type: str
+    *extra_args  # type: str
+):
+    # type: (...) -> None
+
+    run_pex3(
+        "lock", verb, "--platform", "linux-aarch64-cp-39-cp39", "--script", script, *extra_args
+    ).assert_failure(
+        expected_error_re=re.escape(
+            dedent(
+                """\
+                PEP-723 scripts were specified that are incompatible with 1 lock target:
+                1. abbreviated platform cp39-cp39-linux_aarch64 is not compatible with 1 script:
+                   + {script} requires Python '==3.13.*'
+                """
+            ).format(script=script)
+        ),
+        re_flags=re.DOTALL | re.MULTILINE,
+    )
+
+
+def test_lock_script_conflict(
+    tmpdir,  # type: Tempdir
+    script3,  # type: str
+):
+    # type: (...) -> None
+
+    lock = tmpdir.join("lock.json")
+    assert_lock_script_conflict("create", script3, "-o", lock)
+    assert_lock_script_conflict("sync", script3, "--lock", lock)
diff --git a/tests/resolve/test_script_metadata.py b/tests/resolve/test_script_metadata.py
new file mode 100644
index 000000000..063be6245
--- /dev/null
+++ b/tests/resolve/test_script_metadata.py
@@ -0,0 +1,179 @@
+# Copyright 2025 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+from __future__ import absolute_import
+
+import re
+from textwrap import dedent
+
+import pytest
+
+from pex.dist_metadata import Requirement
+from pex.interpreter_constraints import InterpreterConstraints
+from pex.pep_723 import ScriptMetadata
+from pex.resolve import script_metadata
+from pex.resolve.resolvers import Unsatisfiable
+from pex.resolve.target_configuration import InterpreterConfiguration, TargetConfiguration
+from pex.third_party.packaging.specifiers import SpecifierSet
+from testing.pytest.tmp import Tempdir
+
+
+@pytest.fixture
+def script(tmpdir):
+    # type: (Tempdir) -> str
+
+    script = tmpdir.join("script.py")
+    with open(script, "w") as fp:
+        fp.write(
+            dedent(
+                """\
+                # /// script
+                # dependencies = ["cowsay==5.0"]
+                # requires-python = ">=3.8"
+                # ///
+                """
+            )
+        )
+    return script
+
+
+def test_single(script):
+    # type: (str) -> None
+
+    result = script_metadata.apply_script_metadata([script])
+    assert (
+        tuple(
+            [
+                ScriptMetadata(
+                    dependencies=tuple([Requirement.parse("cowsay==5.0")]),
+                    requires_python=SpecifierSet(">=3.8"),
+                    source=script,
+                )
+            ]
+        )
+        == result.scripts
+    )
+    assert result.requirement_configuration.requirements is not None
+    assert ["cowsay==5.0"] == list(result.requirement_configuration.requirements)
+    assert (
+        InterpreterConstraints.parse(">=3.8")
+        == result.target_configuration.interpreter_configuration.interpreter_constraints
+    )
+
+
+@pytest.fixture
+def script2(tmpdir):
+    # type: (Tempdir) -> str
+
+    script2 = tmpdir.join("script2.py")
+    with open(script2, "w") as fp:
+        fp.write(
+            dedent(
+                """\
+                # /// script
+                # dependencies = ["ansicolors==1.1.8"]
+                # requires-python = "<3.14"
+                # ///
+                """
+            )
+        )
+    return script2
+
+
+def test_multiple(
+    script,  # type: str
+    script2,  # type: str
+):
+    # type: (...) -> None
+
+    result = script_metadata.apply_script_metadata(
+        [script, script2],
+        target_configuration=TargetConfiguration(
+            interpreter_configuration=InterpreterConfiguration(
+                interpreter_constraints=InterpreterConstraints.parse("!=3.10.*")
+            )
+        ),
+    )
+    assert (
+        ScriptMetadata(
+            dependencies=tuple([Requirement.parse("cowsay==5.0")]),
+            requires_python=SpecifierSet(">=3.8"),
+            source=script,
+        ),
+        ScriptMetadata(
+            dependencies=tuple([Requirement.parse("ansicolors==1.1.8")]),
+            requires_python=SpecifierSet("<3.14"),
+            source=script2,
+        ),
+    ) == result.scripts
+    assert result.requirement_configuration.requirements is not None
+    assert ["cowsay==5.0", "ansicolors==1.1.8"] == list(
+        result.requirement_configuration.requirements
+    )
+    assert (
+        InterpreterConstraints.parse(">=3.8,!=3.10.*,<3.14")
+        == result.target_configuration.interpreter_configuration.interpreter_constraints
+    )
+
+
+@pytest.fixture
+def script3(tmpdir):
+    # type: (Tempdir) -> str
+
+    script3 = tmpdir.join("script3.py")
+    with open(script3, "w") as fp:
+        fp.write(
+            dedent(
+                """\
+                # /// script
+                # requires-python = "<3.8"
+                # ///
+                """
+            )
+        )
+    return script3
+
+
+def test_script_conflict(
+    script,  # type: str
+    script2,  # type: str
+    script3,  # type: str
+):
+    # type: (...) -> None
+
+    with pytest.raises(
+        Unsatisfiable,
+        match=re.escape(
+            "The requires-python metadata of two or more of the specified scripts is in conflict.\n"
+            "Given the scripts: {script}, {script2} and {script3}\n"
+            "The resulting Python requirement is '{requires_python}' which is not "
+            "satisfiable.\n".format(
+                script=script,
+                script2=script2,
+                script3=script3,
+                requires_python=SpecifierSet("<3.8,>=3.8,<3.14"),
+            )
+        ),
+    ):
+        script_metadata.apply_script_metadata([script, script2, script3])
+
+
+def test_ic_conflict(script):
+    # type: (str) -> None
+
+    with pytest.raises(
+        Unsatisfiable,
+        match=re.escape(
+            "The requires-python metadata of one or more specified scripts is in conflict with "
+            "specified `--interpreter-constraint '<3.8'` resulting in a Python requirement of "
+            "'>=3.8' which is not satisfiable."
+        ),
+    ):
+        script_metadata.apply_script_metadata(
+            [script],
+            target_configuration=TargetConfiguration(
+                interpreter_configuration=InterpreterConfiguration(
+                    interpreter_constraints=InterpreterConstraints.parse("<3.8")
+                )
+            ),
+        )