diff --git a/.github/actions/create_workflow_report/ci_run_report.html.jinja b/.github/actions/create_workflow_report/ci_run_report.html.jinja
index a92c1aa34e3a0..38ef85dad467f 100644
--- a/.github/actions/create_workflow_report/ci_run_report.html.jinja
+++ b/.github/actions/create_workflow_report/ci_run_report.html.jinja
@@ -5,6 +5,9 @@
   <meta http-equiv="content-type" content="text/html; charset=UTF-8">
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  {%- if is_preview %}
+  <meta http-equiv="Cache-Control" content="max-age=300">
+  {%- endif %}
   <style>
     /* Base colors for Altinity */
     :root {
@@ -223,6 +226,8 @@
           element.className = element.className.replace(regex_dir, '') + dir
         }
         function getValue(element) {
+          var childWithSort = element.querySelector('[data-sort]')
+          if (childWithSort) return childWithSort.getAttribute('data-sort')
           return (
             (alt_sort && element.getAttribute('data-sort-alt')) ||
             element.getAttribute('data-sort') || element.innerText
diff --git a/.github/grype/run_grype_scan.sh b/.github/grype/run_grype_scan.sh
index af428e37d669f..9cf99e9f9f9cb 100755
--- a/.github/grype/run_grype_scan.sh
+++ b/.github/grype/run_grype_scan.sh
@@ -3,7 +3,7 @@ set -e
 
 IMAGE=$1
 
-GRYPE_VERSION=${GRYPE_VERSION:-"v0.92.2"}
+GRYPE_VERSION=${GRYPE_VERSION:-"v0.115.0"}
 
 docker pull $IMAGE
 docker pull anchore/grype:${GRYPE_VERSION}
diff --git a/.github/workflows/fast_builds.yml b/.github/workflows/fast_builds.yml
new file mode 100644
index 0000000000000..8d8762414851e
--- /dev/null
+++ b/.github/workflows/fast_builds.yml
@@ -0,0 +1,301 @@
+# yamllint disable rule:comments-indentation
+name: Fast Builds
+run-name: "${{ github.event.inputs.workflow_name || ' ' }}"
+
+env:
+  # Force the stdout and stderr streams to be unbuffered
+  PYTHONUNBUFFERED: 1
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  CLICKHOUSE_TEST_STAT_LOGIN: ${{ secrets.CLICKHOUSE_TEST_STAT_LOGIN }}
+  CLICKHOUSE_TEST_STAT_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
+  CLICKHOUSE_TEST_STAT_URL: ${{ secrets.CLICKHOUSE_TEST_STAT_URL }}
+  DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+  ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+
+on: # yamllint disable-line rule:truthy
+  workflow_dispatch:
+    inputs:
+      workflow_name:
+        description: 'Name of the workflow'
+        required: false
+        type: string
+
+jobs:
+  RunConfig:
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    outputs:
+      data: ${{ steps.runconfig.outputs.CI_DATA }}
+    steps:
+      - name: Check out repository code
+        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
+        with:
+          clear-repository: true # to ensure correct digests
+          fetch-depth: 0 # to get version
+          filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
+      - name: PrepareRunConfig
+        id: runconfig
+        run: |
+            echo "::group::configure CI run"
+            python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --configure --workflow FastBuilds --outfile ${{ runner.temp }}/ci_run_data.json
+            echo "::endgroup::"
+            echo "::group::CI run configure results"
+            python3 -m json.tool ${{ runner.temp }}/ci_run_data.json
+            echo "::endgroup::"
+            {
+              echo 'CI_DATA<<EOF'
+              cat  ${{ runner.temp }}/ci_run_data.json
+              echo 'EOF'
+            } >> "$GITHUB_OUTPUT"
+      - name: Re-create GH statuses for skipped jobs if any
+        run: |
+            python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --infile ${{ runner.temp }}/ci_run_data.json --update-gh-statuses
+      - name: Note report location to summary
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number || 0 }}
+          COMMIT_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+        run: |
+          REPORT_LINK=https://s3.amazonaws.com/altinity-build-artifacts/$PR_NUMBER/$COMMIT_SHA/ci_run_report.html
+          echo "Workflow Run Report: [View Report]($REPORT_LINK)" >> $GITHUB_STEP_SUMMARY
+
+  BuildDockers:
+    needs: [RunConfig]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/docker_test_images.yml
+    secrets: inherit
+    with:
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  BuilderDebRelease:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_release
+      checkout_depth: 0
+      data: ${{ needs.RunConfig.outputs.data }}
+      # always rebuild on release branches to be able to publish from any commit
+      force: true
+
+  BuilderDebAarch64:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_aarch64
+      checkout_depth: 0
+      data: ${{ needs.RunConfig.outputs.data }}
+      # always rebuild on release branches to be able to publish from any commit
+      force: true
+      runner_type: builder-aarch64
+
+  BuilderDebAsan:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_asan
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  BuilderDebUBsan:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_ubsan
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  BuilderDebTsan:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_tsan
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  BuilderDebDebug:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_debug
+      data: ${{ needs.RunConfig.outputs.data }}
+      force: true
+
+  DockerServerImage:
+    needs: [RunConfig, BuilderDebRelease, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Docker server image
+      runner_type: altinity-func-tester
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  DockerKeeperImage:
+    needs: [RunConfig, BuilderDebRelease, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Docker keeper image
+      runner_type: altinity-func-tester
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  GrypeScan:
+    needs: [RunConfig, DockerServerImage, DockerKeeperImage]
+    if: ${{ !failure() && !cancelled() }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: server
+            suffix: ''
+          - image: server
+            suffix: '-alpine'
+          - image: keeper
+            suffix: ''
+    uses: ./.github/workflows/grype_scan.yml
+    secrets: inherit
+    with:
+      docker_image: altinityinfra/clickhouse-${{ matrix.image }}
+      version: ${{ fromJson(needs.RunConfig.outputs.data).version }}
+      tag-suffix: ${{ matrix.suffix }}
+
+  Builds_Report:
+    # run report check for failed builds to indicate the CI error
+    if: ${{ !cancelled() && needs.RunConfig.result == 'success' && contains(fromJson(needs.RunConfig.outputs.data).jobs_data.jobs_to_do, 'Builds') }}
+    needs: [RunConfig, BuilderDebRelease, BuilderDebAarch64, BuilderDebAsan, BuilderDebUBsan, BuilderDebTsan, BuilderDebDebug]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    steps:
+      - name: Check out repository code
+        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
+      - name: Download reports
+        run: |
+          python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --infile ${{ toJson(needs.RunConfig.outputs.data) }} --pre --job-name Builds
+      - name: Builds report
+        run: |
+          cd "$GITHUB_WORKSPACE/tests/ci"
+          python3 ./build_report_check.py --reports package_release package_aarch64 package_asan package_ubsan package_tsan package_debug
+      - name: Set status
+        # NOTE(vnemkov): generate and upload the report even if previous step failed
+        if: success() || failure()
+        run: |
+          python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --infile ${{ toJson(needs.RunConfig.outputs.data) }} --post --job-name Builds
+
+  InstallPackagesTestRelease:
+    needs: [RunConfig, BuilderDebRelease]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Install packages (release)
+      runner_type: altinity-func-tester
+      data: ${{ needs.RunConfig.outputs.data }}
+      run_command: |
+        python3 install_check.py "$CHECK_NAME"
+
+  InstallPackagesTestAarch64:
+    needs: [RunConfig, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Install packages (aarch64)
+      runner_type: altinity-func-tester-aarch64
+      data: ${{ needs.RunConfig.outputs.data }}
+      run_command: |
+        python3 install_check.py "$CHECK_NAME"
+
+  FunctionalStatelessTestRelease:
+    needs: [RunConfig, BuilderDebRelease]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Stateless tests (release)
+      runner_type: altinity-func-tester, 16c
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  FunctionalStatelessTestAarch64:
+    needs: [RunConfig, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Stateless tests (aarch64)
+      runner_type: altinity-func-tester-aarch64, 16c
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  SignRelease:
+    needs: [RunConfig, BuilderDebRelease]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_sign.yml
+    secrets: inherit
+    with:
+      test_name: Sign release
+      runner_type: altinity-style-checker
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  SignAarch64:
+    needs: [RunConfig, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_sign.yml
+    secrets: inherit
+    with:
+      test_name: Sign aarch64
+      runner_type: altinity-style-checker-aarch64
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  FinishCheck:
+    if: ${{ !cancelled() }}
+    needs:
+      - RunConfig
+      - DockerServerImage
+      - DockerKeeperImage
+      - Builds_Report
+      - FunctionalStatelessTestRelease
+      - FunctionalStatelessTestAarch64
+      - InstallPackagesTestRelease
+      - InstallPackagesTestAarch64
+      - GrypeScan
+      - SignRelease
+      - SignAarch64
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    steps:
+      - name: Check out repository code
+        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
+        with:
+          clear-repository: true
+      - name: Finish label
+        if: ${{ !failure() }}
+        run: |
+          # update overall ci report
+          python3 ./tests/ci/finish_check.py --wf-status ${{ contains(needs.*.result, 'failure') && 'failure' || 'success' }}
+      - name: Check Workflow results
+        if: ${{ !cancelled() }}
+        run: |
+          export WORKFLOW_RESULT_FILE="/tmp/workflow_results.json"
+          cat > "$WORKFLOW_RESULT_FILE" << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          python3 ./tests/ci/ci_buddy.py --check-wf-status
+      - name: Finalize workflow report
+        if: ${{ !cancelled() }}
+        uses: ./.github/actions/create_workflow_report
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
+          CHECKS_DATABASE_USER: ${{ secrets.CLICKHOUSE_TEST_STAT_LOGIN }}
+          CHECKS_DATABASE_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
+        with:
+          final: true
diff --git a/.github/workflows/grype_scan.yml b/.github/workflows/grype_scan.yml
index e75043f03fe67..4bd5cea72cc3c 100644
--- a/.github/workflows/grype_scan.yml
+++ b/.github/workflows/grype_scan.yml
@@ -30,7 +30,7 @@ env:
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-  GRYPE_VERSION: "v0.92.2-arm64v8"
+  GRYPE_VERSION: "v0.115.0-arm64v8"
 
 jobs:
     grype_scan:
@@ -50,7 +50,7 @@ jobs:
             sudo apt-get install -y python3-pip python3-venv
             python3 -m venv venv
             source venv/bin/activate
-            pip install --upgrade requests chardet urllib3 unidiff boto3 PyGithub
+            pip install --upgrade requests chardet urllib3 unidiff 'boto3==1.43.33' PyGithub
             pip install testflows==$TESTFLOWS_VERSION awscli==1.33.28
             echo PATH=$PATH >>$GITHUB_ENV
 
diff --git a/.github/workflows/regression-reusable-suite.yml b/.github/workflows/regression-reusable-suite.yml
index edf264ca88ab1..677cd35a1aa22 100644
--- a/.github/workflows/regression-reusable-suite.yml
+++ b/.github/workflows/regression-reusable-suite.yml
@@ -67,7 +67,7 @@ jobs:
       AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
       # Docker credentials
       DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_TOKEN }}
       # Database credentials
       CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
       CHECKS_DATABASE_USER: ${{ secrets.CLICKHOUSE_TEST_STAT_LOGIN }}
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index c23693bd330cf..a5ce914c0cad8 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -60,8 +60,8 @@ name: Regression test workflow - Release
       DOCKER_USERNAME:
         description: username of the docker user.
         required: true
-      DOCKER_PASSWORD:
-        description: password to the docker user.
+      DOCKER_TOKEN:
+        description: token of the docker user.
         required: true
       REGRESSION_AWS_S3_BUCKET:
         description: aws s3 bucket used for regression tests.
@@ -90,7 +90,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        SUITE: [aes_encryption, atomic_insert, base_58, clickhouse_keeper_failover, data_types, datetime64_extended_range, disk_level_encryption, dns, engines, example, extended_precision_data_types, functions, jwt_authentication, kafka, kerberos, key_value, lightweight_delete, memory, part_moves_between_shards, selects, session_timezone, settings, swarms, version, window_functions]
+        SUITE: [aes_encryption, atomic_insert, base_58, clickhouse_keeper_failover, data_types, datetime64_extended_range, disk_level_encryption, dns, engines, example, extended_precision_data_types, functions, jwt_authentication, kafka, kerberos, key_value, memory, part_moves_between_shards, selects, session_timezone, settings, swarms, version, window_functions]
     uses: ./.github/workflows/regression-reusable-suite.yml
     with:
       ref: ${{ inputs.commit }}
@@ -103,6 +103,33 @@ jobs:
       job_name: ${{ matrix.SUITE }}
     secrets: inherit
 
+  LightweightDelete:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - PART: 1
+            FILTER: --only "/lightweight delete/disk space/*"
+          - PART: 2
+            FILTER: --only "/lightweight delete/hard restart/*"
+          - PART: 3
+            FILTER: --skip "/lightweight delete/disk space/*" "/lightweight delete/hard restart/*" "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
+          - PART: 4
+            FILTER: --only "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: lightweight_delete
+      suite_executable: regression.py
+      timeout_minutes: 300
+      runner_type: ${{ inputs.runner_type }}
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: lightweight_delete
+      extra_args: ${{ matrix.FILTER }}
+    secrets: inherit
+
   AggregateFunctions:
     strategy:
       fail-fast: false
diff --git a/.github/workflows/release_branches.yml b/.github/workflows/release_branches.yml
index 405b3e017ebc8..4a30dee7e524e 100644
--- a/.github/workflows/release_branches.yml
+++ b/.github/workflows/release_branches.yml
@@ -283,7 +283,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (release)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestAarch64:
     needs: [RunConfig, BuilderDebAarch64]
@@ -292,7 +292,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (aarch64)
-      runner_type: altinity-func-tester-aarch64
+      runner_type: altinity-func-tester-aarch64, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestAsan:
     needs: [RunConfig, BuilderDebAsan]
@@ -301,7 +301,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (asan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 32g
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestTsan:
     needs: [RunConfig, BuilderDebTsan]
@@ -310,7 +310,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (tsan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 32g
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestUBsan:
     needs: [RunConfig, BuilderDebUBsan]
@@ -319,7 +319,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (ubsan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 32g
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestDebug:
     needs: [RunConfig, BuilderDebDebug]
@@ -328,7 +328,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (debug)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
 ##############################################################################################
 ######################################### STRESS TESTS #######################################
@@ -379,7 +379,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Integration tests (asan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   IntegrationTestsAnalyzerAsan:
     needs: [RunConfig, BuilderDebAsan]
@@ -388,7 +388,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Integration tests (asan, old analyzer)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   IntegrationTestsTsan:
     needs: [RunConfig, BuilderDebTsan]
@@ -397,7 +397,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Integration tests (tsan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   IntegrationTestsRelease:
     needs: [RunConfig, BuilderDebRelease]
@@ -406,7 +406,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Integration tests (release)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
 #############################################################################################
 ##################################### REGRESSION TESTS ######################################
@@ -418,10 +418,10 @@ jobs:
     secrets: inherit
     with:
       runner_type: altinity-regression-tester
-      commit: e1f4e6ae0d862388e113cbc74b8dab32b9db64fc
+      commit: release
       arch: release
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-      timeout_minutes: 300
+      timeout_minutes: 210
   RegressionTestsAarch64:
     needs: [RunConfig, BuilderDebAarch64]
     if: ${{ !failure() && !cancelled() && !contains(fromJson(needs.RunConfig.outputs.data).ci_settings.exclude_keywords, 'regression') && !contains(fromJson(needs.RunConfig.outputs.data).ci_settings.exclude_keywords, 'aarch64')}}
@@ -429,10 +429,10 @@ jobs:
     secrets: inherit
     with:
       runner_type: altinity-regression-tester-aarch64
-      commit: e1f4e6ae0d862388e113cbc74b8dab32b9db64fc
+      commit: release
       arch: aarch64
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-      timeout_minutes: 300
+      timeout_minutes: 210
   SignRelease:
     needs: [RunConfig, BuilderDebRelease]
     if: ${{ !failure() && !cancelled() }}
@@ -478,6 +478,7 @@ jobs:
       - RegressionTestsAarch64
       - GrypeScan
       - SignRelease
+      - SignAarch64
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
     steps:
       - name: Check out repository code
diff --git a/.github/workflows/reusable_build.yml b/.github/workflows/reusable_build.yml
index fd2e44fc16cad..747b907f126b6 100644
--- a/.github/workflows/reusable_build.yml
+++ b/.github/workflows/reusable_build.yml
@@ -53,8 +53,12 @@ jobs:
   Build:
     name: Build-${{inputs.build_name}}
     if: ${{ contains(fromJson(inputs.data).jobs_data.jobs_to_do, inputs.build_name) || inputs.force }}
+    timeout-minutes: 150
     env:
       GITHUB_JOB_OVERRIDDEN: Build-${{inputs.build_name}}
+      # Abort a submodule fetch stalled below 1 KB/s for 60 s, so .github/retry.sh can retry it.
+      GIT_HTTP_LOW_SPEED_LIMIT: 1000
+      GIT_HTTP_LOW_SPEED_TIME: 60
     runs-on: [self-hosted, altinity-on-demand, altinity-builder]
     steps:
       - name: Check out repository code
diff --git a/.github/workflows/reusable_sign.yml b/.github/workflows/reusable_sign.yml
index 7bfed27583596..c2126cb73e752 100644
--- a/.github/workflows/reusable_sign.yml
+++ b/.github/workflows/reusable_sign.yml
@@ -116,14 +116,14 @@ jobs:
           ${{secrets.secret_envs}}
           DOCKER_TAG<<DOCKER_JSON
           ${{ toJson(fromJson(inputs.data).docker_data.images) }}
+          DOCKER_JSON
           TEMP_PATH=${{runner.temp}}/signed
           REPORTS_PATH=${{runner.temp}}/reports_dir
-          DOCKER_JSON
           EOF
       - name: Common setup
         uses: ./.github/actions/common_setup
         with:
-          job_type: test
+          job_type: signed
       - name: Docker setup
         uses: ./.github/actions/docker_setup
       - name: Setup batch
@@ -160,7 +160,9 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: ${{inputs.test_name}} signed-hashes
-          path: ${{ env.TEMP_PATH }}/*.gpg
+          path: |
+            ${{ env.TEMP_PATH }}/*.gpg
+            ${{ env.TEMP_PATH }}/signing_pubkey.asc
       - name: Clean
         if: always()
         uses: ./.github/actions/clean
diff --git a/ci/jobs/functional_stateless_tests.py b/ci/jobs/functional_stateless_tests.py
index 4c14e3fa1e431..15aa0ad459225 100644
--- a/ci/jobs/functional_stateless_tests.py
+++ b/ci/jobs/functional_stateless_tests.py
@@ -1,5 +1,4 @@
 import argparse
-import os
 import time
 from pathlib import Path
 
@@ -62,15 +61,6 @@ def main():
         if "/" in to:
             batch_num, total_batches = map(int, to.split("/"))
 
-    # TODO: find a way to work with Azure secret so it's ok for local tests as well, for now keep azure disabled
-    os.environ["AZURE_CONNECTION_STRING"] = Shell.get_output(
-        f"aws ssm get-parameter --region us-east-1 --name azure_connection_string --with-decryption --output text --query Parameter.Value",
-        verbose=True,
-    )
-    no_azure = False
-    if not os.environ["AZURE_CONNECTION_STRING"]:
-        no_azure = True
-
     ch_path = args.ch_path
     assert (
         Path(ch_path + "/clickhouse").is_file()
@@ -109,7 +99,7 @@ def main():
             f"ln -sf {ch_path}/clickhouse {ch_path}/clickhouse-format",
             f"rm -rf {temp_dir}/etc/ && mkdir -p {temp_dir}/etc/clickhouse-client {temp_dir}/etc/clickhouse-server",
             f"cp programs/server/config.xml programs/server/users.xml {temp_dir}/etc/clickhouse-server/",
-            f"./tests/config/install.sh {temp_dir}/etc/clickhouse-server {temp_dir}/etc/clickhouse-client --s3-storage {'--no-azure' if no_azure else ''}",
+            f"./tests/config/install.sh {temp_dir}/etc/clickhouse-server {temp_dir}/etc/clickhouse-client --s3-storage",
             # clickhouse benchmark segfaults with --config-path, so provide client config by its default location
             f"cp {temp_dir}/etc/clickhouse-client/* /etc/clickhouse-client/",
             # update_path_ch_config,
@@ -140,6 +130,9 @@ def main():
         res = res and Shell.check(
             "aws s3 ls s3://test --endpoint-url http://localhost:11111/", verbose=True
         )
+        azurite_log = f"{temp_dir}/azurite.log"
+        res = res and CH.start_azurite(log_file_path=azurite_log)
+        logs_to_attach += [azurite_log]
         res = res and CH.log_cluster_config()
         res = res and CH.start()
         res = res and CH.wait_ready()
diff --git a/ci/jobs/scripts/clickhouse_proc.py b/ci/jobs/scripts/clickhouse_proc.py
index 08ea848e5ce41..3634b08e2a309 100644
--- a/ci/jobs/scripts/clickhouse_proc.py
+++ b/ci/jobs/scripts/clickhouse_proc.py
@@ -59,6 +59,22 @@ def start_minio(self, test_type, log_file_path):
         print(f"Started setup_minio.sh asynchronously with PID {process.pid}")
         return True
 
+    def start_azurite(self, log_file_path):
+        command = f"cd {temp_dir} && azurite-blob --blobHost 0.0.0.0 --blobPort 10000 --silent --inMemoryPersistence"
+        with open(log_file_path, "w") as log_file:
+            process = subprocess.Popen(
+                command, stdout=log_file, stderr=subprocess.STDOUT, shell=True
+            )
+        print(f"Started azurite asynchronously with PID {process.pid}")
+        if Shell.check(
+            "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:10000/ | grep -qE '400|200'",
+            verbose=False,
+            retries=6,
+        ):
+            return True
+        print("Failed to start azurite")
+        return False
+
     @staticmethod
     def log_cluster_config():
         return Shell.check(
diff --git a/docker/server/Dockerfile.ubuntu b/docker/server/Dockerfile.ubuntu
index bb6218b1a4a30..1842fbfc37fc5 100644
--- a/docker/server/Dockerfile.ubuntu
+++ b/docker/server/Dockerfile.ubuntu
@@ -7,12 +7,13 @@ ARG DEBIAN_FRONTEND=noninteractive
 # ARG for quick switch to a given ubuntu mirror
 ARG apt_archive="http://archive.ubuntu.com"
 
-# We shouldn't use `apt upgrade` to not change the upstream image. It's updated biweekly
+# Upgrade already installed Ubuntu packages to apply available security fixes
+# without installing recommended packages.
 
 # user/group precreated explicitly with fixed uid/gid on purpose.
 # It is especially important for rootless containers: in that case entrypoint
 # can't do chown and owners of mounted volumes should be configured externally.
-# We do that in advance at the begining of Dockerfile before any packages will be
+# We do that in advance at the beginning of Dockerfile before any packages will be
 # installed to prevent picking those uid / gid by some unrelated software.
 # The same uid / gid (101) is used both for alpine and ubuntu.
 RUN sed -i "s|http://archive.ubuntu.com|${apt_archive}|g" /etc/apt/sources.list \
@@ -24,6 +25,8 @@ RUN sed -i "s|http://archive.ubuntu.com|${apt_archive}|g" /etc/apt/sources.list
         locales \
         tzdata \
         wget \
+    && apt-get upgrade --yes --no-install-recommends \
+    && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /var/cache/debconf /tmp/*
 
 #docker-official-library:off
diff --git a/tests/ci/build_download_helper.py b/tests/ci/build_download_helper.py
index e732c324f0769..d10af5f2bedb8 100644
--- a/tests/ci/build_download_helper.py
+++ b/tests/ci/build_download_helper.py
@@ -154,6 +154,16 @@ def read_build_urls(build_name: str, reports_path: Union[Path, str]) -> List[str
     if artifact_report.is_file():
         with open(artifact_report, "r", encoding="utf-8") as f:
             return json.load(f)["build_urls"]  # type: ignore
+    pr_info = None
+    try:
+        from pr_info import PRInfo  # pylint: disable=import-outside-toplevel
+
+        pr_info = PRInfo()
+    except Exception as ex:
+        logger.warning("Failed to init PRInfo while selecting build report: %s", ex)
+
+    reports_by_sha = []  # type: List[List[str]]
+    fallback_reports = []  # type: List[List[str]]
     for root, _, files in os.walk(reports_path):
         for file in files:
             if file.endswith(f"_{build_name}.json"):
@@ -162,7 +172,29 @@ def read_build_urls(build_name: str, reports_path: Union[Path, str]) -> List[str
                     os.path.join(root, file), "r", encoding="utf-8"
                 ) as file_handler:
                     build_report = json.load(file_handler)
-                    return build_report["build_urls"]  # type: ignore
+                    build_urls = build_report.get("build_urls", [])
+                    if not isinstance(build_urls, list):
+                        continue
+                    fallback_reports.append(build_urls)
+                    if pr_info and pr_info.sha and any(
+                        f"/{pr_info.sha}/" in str(url) for url in build_urls
+                    ):
+                        reports_by_sha.append(build_urls)
+
+    if reports_by_sha:
+        logger.info(
+            "Using build report matched by SHA [%s] for [%s]",
+            pr_info.sha if pr_info else "",
+            build_name,
+        )
+        return reports_by_sha[0]
+
+    if fallback_reports:
+        logger.warning(
+            "No SHA-matched build report found for [%s], fallback to first discovered",
+            build_name,
+        )
+        return fallback_reports[0]
 
     logger.info("A build report is not found for %s", build_name)
     return []
diff --git a/tests/ci/ci.py b/tests/ci/ci.py
index bd9c2d66769bd..08c92c0f6b75a 100755
--- a/tests/ci/ci.py
+++ b/tests/ci/ci.py
@@ -303,6 +303,10 @@ def _pre_action(s3, job_name, batch, indata, pr_info):
         #   testing), otherwise reports won't be found
         if not (pr_info.is_scheduled or pr_info.is_dispatched):
             report_prefix = Utils.normalize_string(pr_info.head_ref)
+    elif isinstance(pr_info.ref, str) and pr_info.ref.startswith("refs/tags/"):
+        # For tag-triggered runs, use tag name as prefix to avoid downloading
+        # reports from other runs with the same digest.
+        report_prefix = Utils.normalize_string(pr_info.head_ref)
     elif pr_info.is_pr:
         report_prefix = str(pr_info.number)
     print(
diff --git a/tests/ci/ci_config.py b/tests/ci/ci_config.py
index 58d884788db7a..c6141fa2244b9 100644
--- a/tests/ci/ci_config.py
+++ b/tests/ci/ci_config.py
@@ -53,6 +53,25 @@ class CI:
                 JobNames.LIBFUZZER_TEST,
             ]
         ),
+        WorkFlowNames.FAST_BUILDS: LabelConfig(
+            run_jobs=[
+                BuildNames.PACKAGE_RELEASE,
+                BuildNames.PACKAGE_AARCH64,
+                BuildNames.PACKAGE_ASAN,
+                BuildNames.PACKAGE_UBSAN,
+                BuildNames.PACKAGE_TSAN,
+                BuildNames.PACKAGE_DEBUG,
+                JobNames.BUILD_CHECK,
+                JobNames.DOCKER_SERVER,
+                JobNames.DOCKER_KEEPER,
+                JobNames.INSTALL_TEST_AMD,
+                JobNames.INSTALL_TEST_AARCH64,
+                JobNames.STATELESS_TEST_RELEASE,
+                JobNames.STATELESS_TEST_AARCH64,
+                JobNames.SIGN_RELEASE,
+                JobNames.SIGN_AARCH64,
+            ]
+        ),
     }  # type: Dict[str, LabelConfig]
 
     TAG_CONFIGS = {
diff --git a/tests/ci/ci_definitions.py b/tests/ci/ci_definitions.py
index 3ef4d7ad9a6f8..8d818dc2f15e7 100644
--- a/tests/ci/ci_definitions.py
+++ b/tests/ci/ci_definitions.py
@@ -95,6 +95,7 @@ class WorkFlowNames(metaclass=WithIter):
     JEPSEN = "JepsenWorkflow"
     CreateRelease = "CreateRelease"
     NIGHTLY = "NightlyBuilds"
+    FAST_BUILDS = "FastBuilds"
 
 
 class BuildNames(metaclass=WithIter):
diff --git a/tests/ci/clickhouse_helper.py b/tests/ci/clickhouse_helper.py
index 44f75ad6806d7..0ed36cfa43b9a 100644
--- a/tests/ci/clickhouse_helper.py
+++ b/tests/ci/clickhouse_helper.py
@@ -9,7 +9,12 @@
 
 import requests
 
-from env_helper import CLICKHOUSE_TEST_STAT_URL, CLICKHOUSE_TEST_STAT_PASSWORD, CLICKHOUSE_TEST_STAT_LOGIN
+from env_helper import (
+    GITHUB_REPOSITORY,
+    CLICKHOUSE_TEST_STAT_URL,
+    CLICKHOUSE_TEST_STAT_PASSWORD,
+    CLICKHOUSE_TEST_STAT_LOGIN,
+)
 from get_robot_token import get_parameter_from_ssm
 from pr_info import PRInfo
 from report import TestResults
@@ -212,11 +217,11 @@ def prepare_tests_results_for_clickhouse(
     report_url: str,
     check_name: str,
 ) -> List[dict]:
-    pull_request_url = "https://github.com/Altinity/ClickHouse/commits/master"
-    base_ref = "master"
-    head_ref = "master"
-    base_repo = pr_info.repo_full_name
-    head_repo = pr_info.repo_full_name
+    base_ref = pr_info.base_ref
+    base_repo = pr_info.base_name
+    head_ref = pr_info.head_ref
+    head_repo = pr_info.head_name
+    pull_request_url = f"https://github.com/{GITHUB_REPOSITORY}/commits/{head_ref}"
     if pr_info.number != 0:
         pull_request_url = pr_info.pr_html_url
 
diff --git a/tests/ci/s3_helper.py b/tests/ci/s3_helper.py
index 8f66a01ed2013..dafb4f44f4cc7 100644
--- a/tests/ci/s3_helper.py
+++ b/tests/ci/s3_helper.py
@@ -144,7 +144,9 @@ def _upload_file_to_s3(
                 logging.info("Processing file without compression")
             logging.info("File is too large, do not provide content type")
 
-        self.client.upload_file(file_path, bucket_name, s3_path, ExtraArgs=metadata)
+        self.client.upload_file(
+            str(file_path), bucket_name, s3_path, ExtraArgs=metadata
+        )
         url = self.s3_url(bucket_name, s3_path)
         logging.info("Upload %s to %s Meta: %s", file_path, url, metadata)
         return url
@@ -175,7 +177,7 @@ def download_file(
         if Path(local_file_path).is_dir():
             local_file_path = Path(local_file_path) / s3_path.split("/")[-1]
         try:
-            self.client.download_file(bucket, s3_path, local_file_path)
+            self.client.download_file(bucket, s3_path, str(local_file_path))
         except botocore.exceptions.ClientError as e:
             if e.response and e.response["ResponseMetadata"]["HTTPStatusCode"] == 404:
                 assert False, f"No such object [s3://{S3_BUILDS_BUCKET}/{s3_path}]"
@@ -228,7 +230,7 @@ def upload_task(file_path: Path) -> str:
                 for i in range(5):
                     try:
                         self.client.upload_file(
-                            file_path, bucket_name, s3_path, ExtraArgs=metadata
+                            str(file_path), bucket_name, s3_path, ExtraArgs=metadata
                         )
                         break
                     except Exception as ex:
diff --git a/tests/ci/sign_release.py b/tests/ci/sign_release.py
index 8a5827097c8b3..50a0030f274cf 100644
--- a/tests/ci/sign_release.py
+++ b/tests/ci/sign_release.py
@@ -1,18 +1,26 @@
 #!/usr/bin/env python3
-import sys
-import os
+import hashlib
 import logging
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+from build_download_helper import download_builds_filter
 from env_helper import TEMP_PATH, REPO_COPY, REPORT_PATH
-from s3_helper import S3Helper
 from pr_info import PRInfo
-from build_download_helper import download_builds_filter
-import hashlib
-from pathlib import Path
+from report import FAIL, OK, FAILURE, SUCCESS, JobReport, TestResult
+from s3_helper import S3Helper
+from stopwatch import Stopwatch
 
 GPG_BINARY_SIGNING_KEY = os.getenv("GPG_BINARY_SIGNING_KEY")
 GPG_BINARY_SIGNING_PASSPHRASE = os.getenv("GPG_BINARY_SIGNING_PASSPHRASE")
 
 CHECK_NAME = os.getenv("CHECK_NAME", "Sign release")
+GPG_HOME_PATH = Path(TEMP_PATH) / "gpg_home"
+SIGNING_PUBKEY_PATH = Path(TEMP_PATH) / "signing_pubkey.asc"
+
 
 def hash_file(file_path):
     BLOCK_SIZE = 65536 # The size of each read from the file
@@ -32,22 +40,71 @@ def hash_file(file_path):
 
     return hash_file_path
 
-def sign_file(file_path):
-    priv_key_file_path = 'priv.key'
-    with open(priv_key_file_path, 'x') as f:
-        f.write(GPG_BINARY_SIGNING_KEY)
+
+def import_signing_key(gpg_home_path):
+    if not GPG_BINARY_SIGNING_KEY:
+        raise RuntimeError("GPG_BINARY_SIGNING_KEY is not set")
+    if not GPG_BINARY_SIGNING_PASSPHRASE:
+        raise RuntimeError("GPG_BINARY_SIGNING_PASSPHRASE is not set")
+
+    gpg_home_path.mkdir(mode=0o700, parents=True, exist_ok=True)
+    gpg_home_path.chmod(0o700)
+    subprocess.run(
+        ["gpg", "--homedir", str(gpg_home_path), "--batch", "--import"],
+        input=GPG_BINARY_SIGNING_KEY.encode(),
+        check=True,
+    )
+
+
+def export_public_key(gpg_home_path, out_file_path):
+    with open(out_file_path, "wb") as out_file:
+        subprocess.run(
+            ["gpg", "--homedir", str(gpg_home_path), "--armor", "--export"],
+            stdout=out_file,
+            check=True,
+        )
+    print(f"Exported signing public key to {out_file_path}")
+
+
+def sign_file(file_path, gpg_home_path):
 
     out_file_path = f'{file_path}.gpg'
 
-    os.system(f'echo {GPG_BINARY_SIGNING_PASSPHRASE} | gpg --batch --import {priv_key_file_path}')
-    os.system(f'gpg -o {out_file_path} --pinentry-mode=loopback --batch --yes --passphrase {GPG_BINARY_SIGNING_PASSPHRASE} --sign {file_path}')
+    subprocess.run(
+        [
+            "gpg",
+            "--homedir",
+            str(gpg_home_path),
+            "-o",
+            out_file_path,
+            "--pinentry-mode=loopback",
+            "--batch",
+            "--yes",
+            "--passphrase-fd",
+            "0",
+            "--sign",
+            file_path,
+        ],
+        input=f"{GPG_BINARY_SIGNING_PASSPHRASE}\n".encode(),
+        check=True,
+    )
     print(f"Signed {file_path}")
-    os.remove(priv_key_file_path)
 
     return out_file_path
 
+
+def upload_file_to_s3(s3_helper, file_path, s3_path_prefix):
+    s3_path = s3_path_prefix / os.path.basename(file_path)
+    s3_helper.upload_build_file_to_s3(Path(file_path), str(s3_path))
+    print(f'Uploaded file {file_path} to {s3_path}')
+
+
 def main():
+    stopwatch = Stopwatch()
     reports_path = Path(REPORT_PATH)
+    test_results = []
+    state = SUCCESS
+    description = "Signed artifact hashes successfully"
 
     if not os.path.exists(TEMP_PATH):
         os.makedirs(TEMP_PATH)
@@ -65,15 +122,27 @@ def main():
     # downloads `package_release` artifacts generated
     download_builds_filter(CHECK_NAME, reports_path, Path(TEMP_PATH))
 
-    for f in os.listdir(TEMP_PATH):
-        full_path = os.path.join(TEMP_PATH, f)
-        if os.path.isdir(full_path):
-            continue
-        hashed_file_path = hash_file(full_path)
-        signed_file_path = sign_file(hashed_file_path)
-        s3_path = s3_path_prefix / os.path.basename(signed_file_path)
-        s3_helper.upload_build_file_to_s3(Path(signed_file_path), str(s3_path))
-        print(f'Uploaded file {signed_file_path} to {s3_path}')
+    try:
+        import_signing_key(GPG_HOME_PATH)
+
+        for f in os.listdir(TEMP_PATH):
+            full_path = os.path.join(TEMP_PATH, f)
+            if os.path.isdir(full_path):
+                continue
+            hashed_file_path = hash_file(full_path)
+            signed_file_path = sign_file(hashed_file_path, GPG_HOME_PATH)
+            upload_file_to_s3(s3_helper, signed_file_path, s3_path_prefix)
+            test_results.append(TestResult(name=os.path.basename(full_path), status=OK))
+
+        export_public_key(GPG_HOME_PATH, SIGNING_PUBKEY_PATH)
+        upload_file_to_s3(s3_helper, SIGNING_PUBKEY_PATH, s3_path_prefix)
+        test_results.append(TestResult(name=SIGNING_PUBKEY_PATH.name, status=OK))
+    except Exception as ex:
+        state = FAILURE
+        description = f"Failed to sign release artifacts: {ex}"
+        test_results.append(TestResult(name=CHECK_NAME, status=FAIL, raw_logs=str(ex)))
+    finally:
+        shutil.rmtree(GPG_HOME_PATH, ignore_errors=True)
 
     # Signed hashes are:
     # clickhouse-client_22.3.15.2.altinitystable_amd64.deb.sha512.gpg              clickhouse-keeper_22.3.15.2.altinitystable_x86_64.apk.sha512.gpg
@@ -91,6 +160,18 @@ def main():
     # clickhouse-keeper_22.3.15.2.altinitystable_amd64.deb.sha512.gpg              clickhouse-server-22.3.15.2.altinitystable.x86_64.rpm.sha512.gpg
     # clickhouse-keeper-22.3.15.2.altinitystable-amd64.tgz.sha512.gpg              clickhouse.sha512.gpg
 
+    JobReport(
+        description=description,
+        test_results=test_results,
+        status=state,
+        start_time=stopwatch.start_time_str,
+        duration=stopwatch.duration_seconds,
+        additional_files=[],
+    ).dump()
+
+    if state == FAILURE:
+        sys.exit(1)
+
     sys.exit(0)
 
 if __name__ == "__main__":
diff --git a/tests/config/config.d/azure_storage_conf.xml b/tests/config/config.d/azure_storage_conf.xml
index 2624656f7e88d..8b90ee3654f7c 100644
--- a/tests/config/config.d/azure_storage_conf.xml
+++ b/tests/config/config.d/azure_storage_conf.xml
@@ -6,10 +6,8 @@
                 <object_storage_type>azure</object_storage_type>
                 <skip_access_check>false</skip_access_check>
                 <max_single_part_upload_size>33554432</max_single_part_upload_size>
-                <storage_account_url from_env="AZURE_STORAGE_ACCOUNT_URL"/>
-                <container_name from_env="AZURE_CONTAINER_NAME"/>
-                <account_name from_env="AZURE_ACCOUNT_NAME"/>
-                <account_key from_env="AZURE_STORAGE_KEY"/>
+                <container_name>clickhouse-tests</container_name>
+                <connection_string>DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://127.0.0.1:10000/devstoreaccount1;</connection_string>
             </azure>
             <cached_azure>
                 <type>cache</type>
diff --git a/tests/docker_scripts/stress_runner.sh b/tests/docker_scripts/stress_runner.sh
index 682cf00418045..7f8377e4bebd3 100755
--- a/tests/docker_scripts/stress_runner.sh
+++ b/tests/docker_scripts/stress_runner.sh
@@ -54,6 +54,7 @@ export ZOOKEEPER_FAULT_INJECTION=1
 configure
 
 /repo/tests/docker_scripts/setup_minio.sh stateless # to have a proper environment
+azurite-blob --blobHost 0.0.0.0 --blobPort 10000 --silent --inMemoryPersistence &
 
 config_logs_export_cluster /etc/clickhouse-server/config.d/system_logs_export.yaml
 
diff --git a/tests/integration/compose/docker_compose_azurite.yml b/tests/integration/compose/docker_compose_azurite.yml
index 8ae9f7b85ff48..a853e098da727 100644
--- a/tests/integration/compose/docker_compose_azurite.yml
+++ b/tests/integration/compose/docker_compose_azurite.yml
@@ -1,6 +1,6 @@
 services:
   azurite1:
-    image: mcr.microsoft.com/azure-storage/azurite
+    image: altinityinfra/azurite:3.35.0 # NOTE(strtgbb): Use mirror to avoid access denied error from mcr.microsoft.com
     ports:
       - "${AZURITE_PORT}:${AZURITE_PORT}"
     volumes:
diff --git a/tests/integration/compose/docker_compose_glue_catalog.yml b/tests/integration/compose/docker_compose_glue_catalog.yml
index 9fba475bc02a3..b99fc3db12c16 100644
--- a/tests/integration/compose/docker_compose_glue_catalog.yml
+++ b/tests/integration/compose/docker_compose_glue_catalog.yml
@@ -13,7 +13,7 @@ services:
       start_period: 30s
   # TODO: can we simply use with_minio=True instead?
   minio:
-    image: minio/minio:RELEASE.2024-07-31T05-46-26Z
+    image: clickhouse/minio-minio:RELEASE.2024-07-31T05-46-26Z
     environment:
       - MINIO_ROOT_USER=minio
       - MINIO_ROOT_PASSWORD=ClickHouse_Minio_P@ssw0rd
@@ -31,7 +31,7 @@ services:
     depends_on:
       - minio
     # Stick to version with "mc config"
-    image: minio/mc:RELEASE.2025-04-16T18-13-26Z
+    image: clickhouse/minio-mc:RELEASE.2025-04-16T18-13-26Z
     environment:
       - AWS_ACCESS_KEY_ID=minio
       - AWS_SECRET_ACCESS_KEY=ClickHouse_Minio_P@ssw0rd
diff --git a/tests/integration/compose/docker_compose_iceberg_rest_catalog.yml b/tests/integration/compose/docker_compose_iceberg_rest_catalog.yml
index 89663ce5799c1..082c0dd8bfe04 100644
--- a/tests/integration/compose/docker_compose_iceberg_rest_catalog.yml
+++ b/tests/integration/compose/docker_compose_iceberg_rest_catalog.yml
@@ -34,7 +34,7 @@ services:
       start_period: 30s
   # TODO: can we simply use with_minio=True instead?
   minio:
-    image: minio/minio:RELEASE.2024-07-31T05-46-26Z
+    image: clickhouse/minio-minio:RELEASE.2024-07-31T05-46-26Z
     environment:
       - MINIO_ROOT_USER=minio
       - MINIO_ROOT_PASSWORD=ClickHouse_Minio_P@ssw0rd
@@ -52,7 +52,7 @@ services:
     depends_on:
       - minio
     # Stick to version with "mc config"
-    image: minio/mc:RELEASE.2025-04-16T18-13-26Z
+    image: clickhouse/minio-mc:RELEASE.2025-04-16T18-13-26Z
     environment:
       - AWS_ACCESS_KEY_ID=minio
       - AWS_SECRET_ACCESS_KEY=ClickHouse_Minio_P@ssw0rd
diff --git a/tests/integration/compose/docker_compose_minio.yml b/tests/integration/compose/docker_compose_minio.yml
index 39016633f132e..d1d618a3db1da 100644
--- a/tests/integration/compose/docker_compose_minio.yml
+++ b/tests/integration/compose/docker_compose_minio.yml
@@ -1,6 +1,6 @@
 services:
   minio1:
-    image: minio/minio:RELEASE.2024-07-31T05-46-26Z
+    image: clickhouse/minio-minio:RELEASE.2024-07-31T05-46-26Z
     volumes:
       - data1-1:/data1
       - ${MINIO_CERTS_DIR:-}:/certs