diff --git a/.github/actions/test/integration/collect-logs/action.yml b/.github/actions/test/integration/collect-logs/action.yml
index 0974c811..51df119b 100644
--- a/.github/actions/test/integration/collect-logs/action.yml
+++ b/.github/actions/test/integration/collect-logs/action.yml
@@ -34,6 +34,44 @@ runs:
         scp $SSH_OPTS $USER@$HV2_IP:/var/log/QEMU.log "serial-VM-QEMU-HV2.log" || true
         scp $SSH_OPTS $USER@$HV2_IP:/var/log/CHV.log "serial-VM-CHV-HV2.log" || true
 
+    - name: Obtain network diagnostics from hypervisors
+      shell: bash
+      run: |
+        KEY=/opt/ssh_host_ed25519_key
+        SSH_OPTS="-i $KEY -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+        USER="root"
+
+        for HV_NAME in HV1 HV2; do
+          IP="192.168.122.$([[ $HV_NAME == HV1 ]] && echo 2 || echo 3)"
+
+          ssh $SSH_OPTS $USER@$IP "
+            echo '=== ip addr ==='
+            ip addr
+            echo '=== ip route ==='
+            ip route
+            echo '=== bridge link ==='
+            bridge link 2>/dev/null || true
+            echo '=== arp -n ==='
+            arp -n 2>/dev/null || ip neigh || true
+            echo '=== iptables -L -n ==='
+            iptables -L -n 2>/dev/null || true
+            echo '=== iptables -t nat -L -n ==='
+            iptables -t nat -L -n 2>/dev/null || true
+            echo '=== virsh net-list ==='
+            virsh net-list --all 2>/dev/null || true
+            echo '=== virsh net-dumpxml default ==='
+            virsh net-dumpxml default 2>/dev/null || true
+            echo '=== dnsmasq leases ==='
+            cat /var/lib/libvirt/dnsmasq/*.leases 2>/dev/null || true
+            echo '=== systemctl status systemd-networkd ==='
+            systemctl status systemd-networkd --no-pager 2>/dev/null || true
+            echo '=== networkctl status ==='
+            networkctl status --no-pager 2>/dev/null || true
+            echo '=== ssh -V ==='
+            ssh -V 2>&1 || true
+          " > "network-diag-${HV_NAME}.log" 2>&1 || true
+        done
+
     - name: Set permissions
       shell: bash
       run: |
diff --git a/.github/actions/test/integration/test/cloudhypervisor/action.yml b/.github/actions/test/integration/test/cloudhypervisor/action.yml
index f3eeabc8..078de40e 100644
--- a/.github/actions/test/integration/test/cloudhypervisor/action.yml
+++ b/.github/actions/test/integration/test/cloudhypervisor/action.yml
@@ -52,7 +52,14 @@ runs:
             IP=\$(virsh -c ch:///session domifaddr VM-CHV | awk '/ipv4/ {print \$4}' | cut -d'/' -f1)
             if [ -z "\$IP" ]; then
               echo "No IP address found for VM. Retrying..."
-            elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' ; then
+            elif (( i >= MAX_ITER - 2 )); then
+              # Show SSH errors on last 3 attempts for debugging
+              if ssh \$SSH_OPTS "\$USER@\$IP" 'exit'; then
+                echo "VM is up at IP: \$IP"
+                ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
+                break
+              fi
+            elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # create a dummy file for verification later
               ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
@@ -60,6 +67,18 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- virsh -c ch:///session domifaddr VM-CHV ---"
+              virsh -c ch:///session domifaddr VM-CHV || true
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- arp -n ---"
+              arp -n 2>/dev/null || ip neigh || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
@@ -111,7 +130,7 @@ runs:
 
           MAX_ITER=15
           for ((i=1; i<=MAX_ITER; i++)); do
-            if ssh \$SSH_OPTS "\$USER@\$IP" 'exit' ; then
+            if ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # verify the migration by checking the dummy file
               if ssh \$SSH_OPTS "\$USER@\$IP" 'test -f /opt/hello.txt'; then
@@ -124,6 +143,14 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
diff --git a/.github/actions/test/integration/test/qemu/action.yml b/.github/actions/test/integration/test/qemu/action.yml
index 0dab0344..e6887e51 100644
--- a/.github/actions/test/integration/test/qemu/action.yml
+++ b/.github/actions/test/integration/test/qemu/action.yml
@@ -50,6 +50,13 @@ runs:
             IP=\$(virsh domifaddr VM-QEMU | awk '/ipv4/ {print \$4}' | cut -d'/' -f1)
             if [ -z "\$IP" ]; then
               echo "No IP address found for VM. Retrying..."
+            elif (( i >= MAX_ITER - 2 )); then
+              # Show SSH errors on last 3 attempts for debugging
+              if ssh \$SSH_OPTS "\$USER@\$IP" 'exit'; then
+                echo "VM is up at IP: \$IP"
+                ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
+                break
+              fi
             elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # create a dummy file for verification later
@@ -58,6 +65,18 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- virsh domifaddr VM-QEMU ---"
+              virsh domifaddr VM-QEMU || true
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- arp -n ---"
+              arp -n 2>/dev/null || ip neigh || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
@@ -122,6 +141,14 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 81ed4189..5c43ec96 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -42,7 +42,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@367d00153a713591f64d1ce409d00586fe6ea5b3
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@bd5e711d06acb6e93da02deb47ad2ce569af0914
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 7bae6870..70850717 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@367d00153a713591f64d1ce409d00586fe6ea5b3
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@bd5e711d06acb6e93da02deb47ad2ce569af0914
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@367d00153a713591f64d1ce409d00586fe6ea5b3
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@bd5e711d06acb6e93da02deb47ad2ce569af0914
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 60763118..bb442ddb 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@367d00153a713591f64d1ce409d00586fe6ea5b3
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@bd5e711d06acb6e93da02deb47ad2ce569af0914
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/features/_autoinstall b/features/_autoinstall
new file mode 120000
index 00000000..4b6159c5
--- /dev/null
+++ b/features/_autoinstall
@@ -0,0 +1 @@
+../gardenlinux/features/_autoinstall
\ No newline at end of file
diff --git a/features/_install b/features/_install
new file mode 120000
index 00000000..63f10b8e
--- /dev/null
+++ b/features/_install
@@ -0,0 +1 @@
+../gardenlinux/features/_install
\ No newline at end of file
diff --git a/features/_readonly b/features/_readonly
new file mode 120000
index 00000000..cd930477
--- /dev/null
+++ b/features/_readonly
@@ -0,0 +1 @@
+../gardenlinux/features/_readonly
\ No newline at end of file
diff --git a/features/_secureboot b/features/_secureboot
new file mode 120000
index 00000000..7a7e5ea5
--- /dev/null
+++ b/features/_secureboot
@@ -0,0 +1 @@
+../gardenlinux/features/_secureboot
\ No newline at end of file
diff --git a/gardenlinux b/gardenlinux
index 367d0015..bd5e711d 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 367d00153a713591f64d1ce409d00586fe6ea5b3
+Subproject commit bd5e711d06acb6e93da02deb47ad2ce569af0914