diff --git a/.github/grype/run_grype_scan.sh b/.github/grype/run_grype_scan.sh
index af428e37d669f..9cf99e9f9f9cb 100755
--- a/.github/grype/run_grype_scan.sh
+++ b/.github/grype/run_grype_scan.sh
@@ -3,7 +3,7 @@ set -e
 
 IMAGE=$1
 
-GRYPE_VERSION=${GRYPE_VERSION:-"v0.92.2"}
+GRYPE_VERSION=${GRYPE_VERSION:-"v0.115.0"}
 
 docker pull $IMAGE
 docker pull anchore/grype:${GRYPE_VERSION}
diff --git a/.github/workflows/grype_scan.yml b/.github/workflows/grype_scan.yml
index b6ac8e923bcdb..a3a4b644a3848 100644
--- a/.github/workflows/grype_scan.yml
+++ b/.github/workflows/grype_scan.yml
@@ -30,7 +30,7 @@ env:
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-  GRYPE_VERSION: "v0.92.2-arm64v8"
+  GRYPE_VERSION: "v0.115.0-arm64v8"
 
 jobs:
     grype_scan:
diff --git a/ci/jobs/clickbench.py b/ci/jobs/clickbench.py
index f4d056e2fac57..fc98939db03b6 100644
--- a/ci/jobs/clickbench.py
+++ b/ci/jobs/clickbench.py
@@ -18,6 +18,13 @@ def main():
 
         def install():
             res = ch.install_clickbench_config()
+            # The ClickBench `create.sql` attaches `hits` on a cached disk
+            # rooted at `/dev/shm/clickhouse/`; ship the matching server-side
+            # allowed-directory override alongside it.
+            res = res and Shell.check(
+                f"cp ./ci/jobs/scripts/clickbench/filesystem_caches_path.xml {temp_dir}/config.d/",
+                verbose=True,
+            )
             if info.is_local_run:
                 return res
             return res # and ch.create_log_export_config()
diff --git a/ci/jobs/scripts/clickbench/filesystem_caches_path.xml b/ci/jobs/scripts/clickbench/filesystem_caches_path.xml
new file mode 100644
index 0000000000000..0ea04fc1f4fa3
--- /dev/null
+++ b/ci/jobs/scripts/clickbench/filesystem_caches_path.xml
@@ -0,0 +1,13 @@
+<!--
+    The ClickBench `create.sql` attaches the `hits` table on a cached disk
+    rooted at `/dev/shm/clickhouse/`, and the server refuses a cache path
+    outside `custom_cached_disks_base_directory`, so point that at the same root.
+
+    Do not also move `filesystem_caches_path`: it is the root for the named
+    caches in `config.d/storage_conf_local.xml`, and relocating those to the
+    tmpfs on /dev/shm makes the server refuse to start, since their 21 GiB
+    `max_size` exceeds the tmpfs capacity.
+-->
+<clickhouse>
+    <custom_cached_disks_base_directory replace="replace">/dev/shm/clickhouse/</custom_cached_disks_base_directory>
+</clickhouse>
diff --git a/docker/keeper/Dockerfile b/docker/keeper/Dockerfile
index aae7fe7b524f9..4926898872567 100644
--- a/docker/keeper/Dockerfile
+++ b/docker/keeper/Dockerfile
@@ -84,6 +84,8 @@ RUN clickhouse-keeper --version \
     && chown root:clickhouse "${DEFAULT_LOG_DIR}" \
     && chmod ugo+Xrw -R "${DEFAULT_DATA_DIR}" "${DEFAULT_LOG_DIR}" "${DEFAULT_CONFIG_DIR}"
 
+RUN apk update && apk upgrade --no-cache
+
 # /var/lib/clickhouse is necessary due to the current default configuration for Keeper
 VOLUME "${DEFAULT_DATA_DIR}" /var/lib/clickhouse
 EXPOSE 2181 10181 44444 9181
diff --git a/docker/server/Dockerfile.alpine b/docker/server/Dockerfile.alpine
index 4eb936f3c8e7b..c35cbc4e0db1d 100644
--- a/docker/server/Dockerfile.alpine
+++ b/docker/server/Dockerfile.alpine
@@ -89,6 +89,8 @@ RUN mkdir -p \
     && chown root:clickhouse "${DEFAULT_LOG_DIR}" \
     && chmod ugo+Xrw -R "${DEFAULT_DATA_DIR}" "${DEFAULT_LOG_DIR}" "${DEFAULT_CLIENT_CONFIG_DIR}" "${DEFAULT_SERVER_CONFIG_DIR}"
 
+RUN apk update && apk upgrade --no-cache
+
 VOLUME "${DEFAULT_DATA_DIR}"
 EXPOSE 9000 8123 9009
 
diff --git a/tests/integration/test_format_schema_source/test.py b/tests/integration/test_format_schema_source/test.py
index 3441a048d0a4b..635ac4c2b48e9 100644
--- a/tests/integration/test_format_schema_source/test.py
+++ b/tests/integration/test_format_schema_source/test.py
@@ -5,7 +5,11 @@
 
 import helpers.kafka.common as k
 from helpers.client import QueryRuntimeException
-from helpers.cluster import ClickHouseCluster
+from helpers.cluster import ClickHouseCluster, is_arm
+
+# Skip on ARM due to Confluent/Kafka
+if is_arm():
+    pytestmark = pytest.mark.skip
 
 cluster = ClickHouseCluster(__file__)
 instance = cluster.add_instance(
diff --git a/tests/integration/test_s3_cluster/test.py b/tests/integration/test_s3_cluster/test.py
index d4d91b923782a..c154b8a8529f7 100644
--- a/tests/integration/test_s3_cluster/test.py
+++ b/tests/integration/test_s3_cluster/test.py
@@ -125,7 +125,8 @@ def started_cluster():
             "c2.s0_0_1",
             main_configs=["configs/cluster.xml", "configs/named_collections.xml", "configs/hidden_clusters.xml"],
             user_configs=["configs/users.xml"],
-            macros={"replica": "replica2", "shard": "shard1"},
+            # Must be unique per instance: the database disk prefix is .../test-{shard}|{replica}
+            macros={"replica": "replica2_c2", "shard": "shard1"},
             with_zookeeper=True,
             stay_alive=True,
         )
diff --git a/tests/integration/test_storage_iceberg_concurrent/test_concurrent_reads.py b/tests/integration/test_storage_iceberg_concurrent/test_concurrent_reads.py
index 8ce061d9156af..ebd6f89268433 100644
--- a/tests/integration/test_storage_iceberg_concurrent/test_concurrent_reads.py
+++ b/tests/integration/test_storage_iceberg_concurrent/test_concurrent_reads.py
@@ -39,8 +39,10 @@ def test_concurrent_reads(started_cluster_iceberg):
 
     def run_concurrent_queries(i):
         def select(_):
+            # Bound per-query fan-out so the concurrent readers don't exhaust the global thread pool.
             instance.query(
                 f"SELECT * FROM {TABLE_NAME}",
+                settings={"max_threads": 4},
             )
                 
 
diff --git a/tests/queries/0_stateless/05082_kill_and_system_on_cluster_access_types.sh b/tests/queries/0_stateless/05082_kill_and_system_on_cluster_access_types.sh
index 9f246c25da6d2..9147c664dc395 100755
--- a/tests/queries/0_stateless/05082_kill_and_system_on_cluster_access_types.sh
+++ b/tests/queries/0_stateless/05082_kill_and_system_on_cluster_access_types.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Tags: no-encrypted-storage
 
 CUR_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=../shell_config.sh