diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7e0e7983329..bdad395ab4f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -45,7 +45,6 @@ workflow:
         JOB_PRIORITY: 75
         # fast-fail in merge pipelines: stop early if we get this many unexpected fails/crashes
         DEQP_RUNNER_MAX_FAILS: 40
-        S3_PROJECT_PATH: ${CI_MERGE_REQUEST_SOURCE_PROJECT_PATH}
     # Post-merge pipeline
     - if: &is-post-merge $GITLAB_USER_LOGIN == "marge-bot" && $CI_PIPELINE_SOURCE == "push"
       variables:
@@ -54,8 +53,6 @@ workflow:
         FDO_RUNNER_JOB_PRIORITY_TAG_AARCH64: priority:high-aarch64
     # Pre-merge pipeline (because merge pipelines are already caught above)
     - if: &is-merge-request $CI_PIPELINE_SOURCE == "merge_request_event"
-      variables:
-        S3_PROJECT_PATH: ${CI_MERGE_REQUEST_SOURCE_PROJECT_PATH}
     # Push to a branch on a fork
     - if: &is-push-to-fork $CI_PROJECT_NAMESPACE != "mesa" && $CI_PIPELINE_SOURCE == "push"
     # Nightly pipeline
@@ -107,11 +104,8 @@ variables:
   S3_TRACIE_PRIVATE_BUCKET: mesa-tracie-private
   # Base path used for various artifacts
   S3_BASE_PATH: "${S3_HOST}/${S3_KERNEL_BUCKET}"
-  # Since GitLab 18.2.2, the JWT subject for MRs are the target project path
-  # This can be overridden by the variables in the workflow rules
-  S3_PROJECT_PATH: ${CI_PROJECT_PATH}
   # per-pipeline artifact storage on MinIO
-  PIPELINE_ARTIFACTS_BASE: ${S3_HOST}/${S3_ARTIFACTS_BUCKET}/${S3_PROJECT_PATH}/${CI_PIPELINE_ID}
+  PIPELINE_ARTIFACTS_BASE: ${S3_HOST}/${S3_ARTIFACTS_BUCKET}/${CI_PROJECT_PATH}/${CI_PIPELINE_ID}
   # per-job artifact storage on MinIO
   JOB_ARTIFACTS_BASE: ${PIPELINE_ARTIFACTS_BASE}/${CI_JOB_ID}
   # reference images stored for traces
diff --git a/.gitlab-ci/conditional-build-image-tags.yml b/.gitlab-ci/conditional-build-image-tags.yml
index d237c84b1b9..9c677be89b2 100644
--- a/.gitlab-ci/conditional-build-image-tags.yml
+++ b/.gitlab-ci/conditional-build-image-tags.yml
@@ -1,7 +1,7 @@
 variables:
-  CONDITIONAL_BUILD_ANDROID_CTS_TAG: b0f48de11f870c340c4c4ad4ac2b8f13
+  CONDITIONAL_BUILD_ANDROID_CTS_TAG: b018634d732f438027ec58c0383615e7
   CONDITIONAL_BUILD_ANGLE_TAG: 683d14557a9adc5f1b22acf880dad28e
   CONDITIONAL_BUILD_CROSVM_TAG: 4079babd375b09761d59eacb25a0598a
-  CONDITIONAL_BUILD_FLUSTER_TAG: 7c6f5e2af781cd4e39358500c1549541
+  CONDITIONAL_BUILD_FLUSTER_TAG: e13f8521875ebd70e207ec0f6f3d3e5b
   CONDITIONAL_BUILD_PIGLIT_TAG: ba6cc303aa3ffe5eb580af101693266c
-  CONDITIONAL_BUILD_VKD3D_PROTON_TAG: 1c4dc78fc625134a2fc0a352cc6368b0
+  CONDITIONAL_BUILD_VKD3D_PROTON_TAG: 167feb963fb512795aeddc9d1588bc7c
diff --git a/.gitlab-ci/container/build-android-cts.sh b/.gitlab-ci/container/build-android-cts.sh
index bfbe72dd5c9..a57227160dd 100644
--- a/.gitlab-ci/container/build-android-cts.sh
+++ b/.gitlab-ci/container/build-android-cts.sh
@@ -61,7 +61,7 @@ else
     # the extraction is faster, also LAVA overlays don't support zip compression.
     tar --zstd -cf "${CTS_FILENAME}.tar.zst" /android-cts
     ci-fairy s3cp --token-file "${S3_JWT_FILE}" "${CTS_FILENAME}.tar.zst" \
-        "https://${S3_BASE_PATH}/${S3_PROJECT_PATH}/${ARTIFACT_PATH}"
+        "https://${S3_BASE_PATH}/${CI_PROJECT_PATH}/${ARTIFACT_PATH}"
 fi
 
 section_end android-cts
diff --git a/.gitlab-ci/container/build-android-x86_64-llvm.sh b/.gitlab-ci/container/build-android-x86_64-llvm.sh
index 1ab42ed3f58..f79cb1bc7e0 100755
--- a/.gitlab-ci/container/build-android-x86_64-llvm.sh
+++ b/.gitlab-ci/container/build-android-x86_64-llvm.sh
@@ -9,7 +9,7 @@ set -exu
 
 # If CI vars are not set, assign an empty value, this prevents -u to fail
 : "${CI:=}"
-: "${S3_PROJECT_PATH:=}"
+: "${CI_PROJECT_PATH:=}"
 
 # Early check for required env variables, relies on `set -u`
 : "$ANDROID_NDK_VERSION"
@@ -116,7 +116,7 @@ tar --zstd -cf "${ANDROID_LLVM_ARTIFACT_NAME}.tar.zst" "$LLVM_INSTALL_PREFIX"
 # version does not change, and delete it.
 # The file is not deleted for non-CI because it can be useful in local runs.
 if [ -n "$CI" ]; then
-  ci-fairy s3cp --token-file "${S3_JWT_FILE}" "${ANDROID_LLVM_ARTIFACT_NAME}.tar.zst" "https://${S3_HOST}/${S3_ANDROID_BUCKET}/${S3_PROJECT_PATH}/${ANDROID_LLVM_ARTIFACT_NAME}.tar.zst"
+  ci-fairy s3cp --token-file "${S3_JWT_FILE}" "${ANDROID_LLVM_ARTIFACT_NAME}.tar.zst" "https://${S3_HOST}/${S3_ANDROID_BUCKET}/${CI_PROJECT_PATH}/${ANDROID_LLVM_ARTIFACT_NAME}.tar.zst"
   rm "${ANDROID_LLVM_ARTIFACT_NAME}.tar.zst"
 fi
 
diff --git a/.gitlab-ci/container/build-fluster.sh b/.gitlab-ci/container/build-fluster.sh
index ac54437770e..79b133450c9 100644
--- a/.gitlab-ci/container/build-fluster.sh
+++ b/.gitlab-ci/container/build-fluster.sh
@@ -45,7 +45,7 @@ else
     # Build fluster vectors archive and upload it
     tar --zstd -cf "vectors.tar.zst" fluster/resources/
     ci-fairy s3cp --token-file "${S3_JWT_FILE}" "vectors.tar.zst" \
-        "https://${S3_BASE_PATH}/${S3_PROJECT_PATH}/${ARTIFACT_PATH}"
+        "https://${S3_BASE_PATH}/${CI_PROJECT_PATH}/${ARTIFACT_PATH}"
     mv fluster/ /
 fi
 
diff --git a/.gitlab-ci/container/build-vkd3d-proton.sh b/.gitlab-ci/container/build-vkd3d-proton.sh
index af68cf2e696..b0ed2c619c2 100644
--- a/.gitlab-ci/container/build-vkd3d-proton.sh
+++ b/.gitlab-ci/container/build-vkd3d-proton.sh
@@ -58,7 +58,7 @@ else
   echo "Uploaded vkd3d-proton not found, reuploading..."
   tar --zstd -cf "$VKD3D_PROTON_S3_ARTIFACT" -C / "${VKD3D_PROTON_DST_DIR#/}" "${VKD3D_PROTON_WINE_DIR#/}"
   ci-fairy s3cp --token-file "${S3_JWT_FILE}" "$VKD3D_PROTON_S3_ARTIFACT" \
-    "https://${S3_BASE_PATH}/${S3_PROJECT_PATH}/${ARTIFACT_PATH}"
+    "https://${S3_BASE_PATH}/${CI_PROJECT_PATH}/${ARTIFACT_PATH}"
   rm "$VKD3D_PROTON_S3_ARTIFACT"
 fi
 
diff --git a/.gitlab-ci/container/fdo_cntr_export.sh b/.gitlab-ci/container/fdo_cntr_export.sh
index c241393d88e..b0b04ad8775 100644
--- a/.gitlab-ci/container/fdo_cntr_export.sh
+++ b/.gitlab-ci/container/fdo_cntr_export.sh
@@ -78,4 +78,4 @@ buildah rm "$container"
 curl --fail --retry-connrefused --retry 4 --retry-delay 30 \
   --header "Authorization: Bearer $(cat "${S3_JWT_FILE}")" \
   -X PUT --form file=@"$ROOTFSTAR" \
-  "https://${S3_HOST}/${S3_KERNEL_BUCKET}/${S3_PROJECT_PATH}/${CI_JOB_NAME}:${FDO_DISTRIBUTION_TAG}"
+  "https://${S3_HOST}/${S3_KERNEL_BUCKET}/${CI_PROJECT_PATH}/${CI_JOB_NAME}:${FDO_DISTRIBUTION_TAG}"
diff --git a/.gitlab-ci/image-tags.yml b/.gitlab-ci/image-tags.yml
index 04e8e2bee92..ee43d9162e5 100644
--- a/.gitlab-ci/image-tags.yml
+++ b/.gitlab-ci/image-tags.yml
@@ -19,12 +19,12 @@ include:
   - .gitlab-ci/conditional-build-image-tags.yml
 
 variables:
-  DEBIAN_BUILD_BASE_TAG: "20250917-two-rust"
-  DEBIAN_BUILD_TAG: "20250917-two-rust"
+  DEBIAN_BUILD_BASE_TAG: "20250926-gitlab"
+  DEBIAN_BUILD_TAG: "20250926-gitlab"
 
-  DEBIAN_TEST_BASE_TAG: "20250901-trixie2"
-  DEBIAN_TEST_ANDROID_TAG: "20250917-two-rust"
-  DEBIAN_TEST_GL_TAG: "20250911-piglit"
+  DEBIAN_TEST_BASE_TAG: "20250926-gitlab"
+  DEBIAN_TEST_ANDROID_TAG: "20250926-gitlab"
+  DEBIAN_TEST_GL_TAG: "20250926-gitlab"
   DEBIAN_TEST_VIDEO_TAG: "20250813-vector"
   DEBIAN_TEST_VK_TAG: "20250911-piglit"
 
diff --git a/.gitlab-ci/piglit/piglit-traces.sh b/.gitlab-ci/piglit/piglit-traces.sh
index 846427a4b20..bdaaaddc402 100755
--- a/.gitlab-ci/piglit/piglit-traces.sh
+++ b/.gitlab-ci/piglit/piglit-traces.sh
@@ -115,7 +115,7 @@ replay_s3_upload_images() {
 
         __TRACE="${line%-*-*}"
         if grep -q "^$__PREFIX/$__TRACE: pass$" ".gitlab-ci/piglit/$PIGLIT_RESULTS.txt.orig"; then
-            if [ "x$S3_PROJECT_PATH" != "x$FDO_UPSTREAM_REPO" ]; then
+            if [ "x$CI_PROJECT_PATH" != "x$FDO_UPSTREAM_REPO" ]; then
                 continue
             fi
             __S3_PATH="$PIGLIT_REPLAY_REFERENCE_IMAGES_BASE"
diff --git a/.gitlab-ci/setup-test-env.sh b/.gitlab-ci/setup-test-env.sh
index 21a152333e0..1ee8690b4bd 100755
--- a/.gitlab-ci/setup-test-env.sh
+++ b/.gitlab-ci/setup-test-env.sh
@@ -300,7 +300,7 @@ function find_s3_project_artifact() {
     x_off
     local artifact_path="$1"
 
-    for project in "${FDO_UPSTREAM_REPO}" "${S3_PROJECT_PATH}"; do
+    for project in "${FDO_UPSTREAM_REPO}" "${CI_PROJECT_PATH}"; do
         local full_path="${FDO_HTTP_CACHE_URI:-}${S3_BASE_PATH}/${project}/${artifact_path}"
         if curl-with-retry -s --head "https://${full_path}" >/dev/null; then
             echo "https://${full_path}"