diff --git a/.gitlab/ci/centos.yml b/.gitlab/ci/centos.yml
index 1fa13ffc6..74e0fcf42 100644
--- a/.gitlab/ci/centos.yml
+++ b/.gitlab/ci/centos.yml
@@ -10,7 +10,8 @@
       libblkid-devel libpwquality-devel libselinux-devel libssh-devel libtool
       libuuid-devel make popt-devel libsepol-devel nc openssh-clients passwd
       pkgconfig sharutils sshpass tar uuid-devel vim-common device-mapper
-      expect gettext git jq keyutils openssl-devel openssl gem
+      expect gettext git jq keyutils openssl-devel openssl gem swtpm swtpm-tools
+      tpm2-tools
     - sudo gem install asciidoctor
     - sudo -E git clean -xdf
     - ./autogen.sh
@@ -28,6 +29,7 @@ test-main-commit-centos-stream9:
   interruptible: true
   variables:
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $RUN_SYSTEMD_PLUGIN_TEST != null
       when: never
@@ -49,6 +51,7 @@ test-mergerq-centos-stream9:
   interruptible: true
   variables:
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $RUN_SYSTEMD_PLUGIN_TEST != null
       when: never
diff --git a/.gitlab/ci/debian.yml b/.gitlab/ci/debian.yml
index 847feb81b..c228ded29 100644
--- a/.gitlab/ci/debian.yml
+++ b/.gitlab/ci/debian.yml
@@ -3,16 +3,14 @@
     - .fail_if_coredump_generated
   before_script:
     - sudo apt-get -y update
-    - >
-      [ -z "$RUN_SYSTEMD_PLUGIN_TEST" ] ||
-      sudo apt-get -y install -y -qq swtpm meson ninja-build python3-jinja2
-      gperf libcap-dev libtss2-dev libmount-dev swtpm-tools
     - >
       sudo apt-get -y install -y -qq git gcc make autoconf automake autopoint
       pkgconf libtool libtool-bin gettext libssl-dev libdevmapper-dev
       libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev
       tar libargon2-dev libpwquality-dev sharutils dmsetup jq xxd expect
       keyutils netcat-openbsd passwd openssh-client sshpass asciidoctor
+      swtpm meson ninja-build python3-jinja2 gperf libcap-dev libtss2-dev
+      libmount-dev swtpm-tools tpm2-tools
     - sudo apt-get -y build-dep cryptsetup
     - sudo -E git clean -xdf
     - ./autogen.sh
@@ -29,6 +27,7 @@ test-mergerq-job-debian:
   variables:
     DISTRO: cryptsetup-debian-12
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -49,6 +48,7 @@ test-main-commit-job-debian:
   variables:
     DISTRO: cryptsetup-debian-12
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -70,6 +70,7 @@ test-mergerq-job-debian-meson:
   variables:
     DISTRO: cryptsetup-debian-12
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -91,6 +92,7 @@ test-main-commit-job-debian-meson:
   variables:
     DISTRO: cryptsetup-debian-12
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
diff --git a/.gitlab/ci/fedora.yml b/.gitlab/ci/fedora.yml
index 0d3ade47b..dc3ccb079 100644
--- a/.gitlab/ci/fedora.yml
+++ b/.gitlab/ci/fedora.yml
@@ -4,11 +4,6 @@
   extends:
     - .fail_if_coredump_generated
   before_script:
-    - >
-      [ -z "$RUN_SYSTEMD_PLUGIN_TEST" ] ||
-      sudo dnf -y -q install
-      swtpm meson ninja-build python3-jinja2 gperf libcap-devel tpm2-tss-devel
-      libmount-devel swtpm-tools
     - >
       sudo dnf -y -q install
       autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
@@ -16,7 +11,8 @@
       libssh-devel libtool libuuid-devel make popt-devel
       libsepol-devel.x86_64 netcat openssh-clients passwd pkgconfig sharutils
       sshpass tar uuid-devel vim-common device-mapper expect gettext git jq
-      keyutils openssl-devel openssl asciidoctor
+      keyutils openssl-devel openssl asciidoctor swtpm meson ninja-build
+      python3-jinja2 gperf libcap-devel tpm2-tss-devel libmount-devel swtpm-tools
     - sudo -E git clean -xdf
     - ./autogen.sh
     - ./configure --enable-fips --enable-pwquality --enable-libargon2 --with-crypto_backend=openssl --enable-asciidoc
@@ -32,6 +28,7 @@ test-main-commit-job-rawhide:
   allow_failure: true
   variables:
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -52,6 +49,7 @@ test-mergerq-job-rawhide:
   allow_failure: true
   variables:
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
diff --git a/.gitlab/ci/ubuntu.yml b/.gitlab/ci/ubuntu.yml
index b72f0d328..85097423b 100644
--- a/.gitlab/ci/ubuntu.yml
+++ b/.gitlab/ci/ubuntu.yml
@@ -3,16 +3,14 @@
     - .fail_if_coredump_generated
   before_script:
     - sudo apt-get -y update
-    - >
-      [ -z "$RUN_SYSTEMD_PLUGIN_TEST" ] ||
-      sudo apt-get -y install -y -qq swtpm meson ninja-build python3-jinja2
-      gperf libcap-dev libtss2-dev libmount-dev swtpm-tools
     - >
       sudo apt-get -y install -y -qq git gcc make autoconf automake autopoint
       pkgconf libtool libtool-bin gettext libssl-dev libdevmapper-dev
       libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev
       tar libargon2-dev libpwquality-dev sharutils dmsetup jq xxd expect
       keyutils netcat-openbsd passwd openssh-client sshpass asciidoctor
+      swtpm meson ninja-build python3-jinja2 gperf libcap-dev libtss2-dev
+      libmount-dev swtpm-tools tpm2-tools
     # scsi_debug, gost crypto
     - sudo apt-get -y install dkms linux-headers-$(uname -r) linux-modules-extra-$(uname -r) gost-crypto-dkms
     - sudo apt-get -y build-dep cryptsetup
@@ -31,6 +29,7 @@ test-mergerq-job-ubuntu:
   variables:
     DISTRO: cryptsetup-ubuntu-2404
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -51,6 +50,7 @@ test-main-commit-job-ubuntu:
   variables:
     DISTRO: cryptsetup-ubuntu-2404
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -72,6 +72,7 @@ test-mergerq-job-ubuntu-meson:
   variables:
     DISTRO: cryptsetup-ubuntu-2404
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -93,6 +94,7 @@ test-main-commit-job-ubuntu-meson:
   variables:
     DISTRO: cryptsetup-ubuntu-2404
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never