diff --git a/pipelines/integration-test/ansible-upgrade.yaml b/pipelines/integration-test/ansible-upgrade.yaml
index e4776602..4e37d7b6 100644
--- a/pipelines/integration-test/ansible-upgrade.yaml
+++ b/pipelines/integration-test/ansible-upgrade.yaml
@@ -57,31 +57,21 @@ spec:
       - name: prepare-molecule-tests
         runAfter:
           - clone-source-code
+        params:
+          - name: container-image
+            value: $(tasks.parse-metadata.results.container-image)
         workspaces:
           - name: work
             workspace: work
-        taskSpec:
-          workspaces:
-            - name: work
-          steps:
-            - name: extract-release-image-content
-              image: "gcr.io/go-containerregistry/crane"
-              args:
-                - export
-                - $(tasks.parse-metadata.results.container-image)
-                - $(workspaces.work.path)/image.tar
-            - name: prepare-tests
-              image: "quay.io/redhat-appstudio/konflux-test:stable"
-              script: |
-                #!/bin/sh
-                set -ex
-
-                # extract the release image content
-                tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path)
-
-                # replace the tas_single_node name with the redhat.artifact_signer.tas_single_node name
-                find $(workspaces.work.path)/ansible/molecule -type f -name "converge.yml" \
-                -exec sed -i  's@name: tas_single_node@name: redhat.artifact_signer.tas_single_node@g' {} +
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/prepare-molecule-tests.yaml
       - name: run-upgrade-test
         runAfter:
           - prepare-molecule-tests
@@ -188,51 +178,15 @@ spec:
                   memory: 4Gi
     finally:
       - name: aws-cleanup
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/aws-cleanup-ec2-instances.yaml
         params:
           - name: run-id
             value: "$(context.pipelineRun.name)"
-        taskSpec:
-          params:
-            - name: run-id
-          volumes:
-            - name: aws-creds
-              secret:
-                secretName: aws-ci-test
-          steps:
-            - name: terminate-instances
-              volumeMounts:
-                - name: aws-creds
-                  mountPath: /creds
-              image: amazon/aws-cli:latest
-              env:
-                - name: AWS_DEFAULT_REGION
-                  value: "eu-north-1"
-              script: |
-                #!/bin/bash
-                set -eu
-                
-                set +x
-                export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY)
-                export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID)
-                set -x
-                
-                # Check for credentials before proceeding (crucial step)
-                if [ -z "${AWS_ACCESS_KEY_ID}" ]; then
-                  echo "ERROR: AWS_ACCESS_KEY_ID environment variable is missing." >&2
-                  exit 1
-                fi
-                
-                INSTANCE_LIST=$(
-                  aws ec2 describe-instances \
-                  --filters "Name=tag:Name,Values=CI-$(params.run-id)*" "Name=instance-state-name,Values=running,pending" \
-                  --query 'Reservations[].Instances[].InstanceId' \
-                  --output text
-                )
-                echo "Instance IDs received for termination: ${INSTANCE_LIST} in ${AWS_DEFAULT_REGION}..."
-                
-                aws ec2 terminate-instances \
-                  --instance-ids ${INSTANCE_LIST} \
-                  --region ${AWS_DEFAULT_REGION} \
-                  --output text
-                
-                echo "Termination request sent for instance ${INSTANCE_LIST}."
diff --git a/pipelines/integration-test/ansible.yaml b/pipelines/integration-test/ansible.yaml
index 53eb737d..3752e96e 100644
--- a/pipelines/integration-test/ansible.yaml
+++ b/pipelines/integration-test/ansible.yaml
@@ -78,31 +78,25 @@ spec:
           - name: output
             workspace: work
       - name: prepare-molecule-tests
+        runAfter:
+          - clone-source-code
+        params:
+          - name: container-image
+            value: $(tasks.parse-metadata.results.container-image)
+          - name: ansible-path
+            value: "artifact-signer-ansible"
         workspaces:
           - name: work
             workspace: work
-        taskSpec:
-          workspaces:
-            - name: work
-          steps:
-            - name: extract-release-image-content
-              image: "gcr.io/go-containerregistry/crane"
-              args:
-                - export
-                - $(tasks.parse-metadata.results.container-image)
-                - $(workspaces.work.path)/image.tar
-            - name: prepare-env
-              image: "quay.io/redhat-appstudio/konflux-test:stable"
-              script: |
-                #!/bin/sh
-                set -ex
-                
-                # extract the release image content
-                tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path)
-                
-                # replace the tas_single_node name with the redhat.artifact_signer.tas_single_node name
-                find $(workspaces.work.path)/artifact-signer-ansible/molecule -type f -name "converge.yml" \
-                -exec sed -i  's@name: tas_single_node@name: redhat.artifact_signer.tas_single_node@g' {} +
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/prepare-molecule-tests.yaml
       - name: run-molecule-tests
         runAfter:
           - prepare-molecule-tests
@@ -145,51 +139,15 @@ spec:
               value: tasks/integration-test/ansible/run-sigstore-e2e-tests.yaml
     finally:
       - name: aws-cleanup
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/aws-cleanup-ec2-instances.yaml
         params:
           - name: run-id
             value: "$(context.pipelineRun.name)"
-        taskSpec:
-          params:
-            - name: run-id
-          volumes:
-            - name: aws-creds
-              secret:
-                secretName: aws-ci-test
-          steps:
-            - name: terminate-instances
-              volumeMounts:
-                - name: aws-creds
-                  mountPath: /creds
-              image: amazon/aws-cli:latest
-              env:
-                - name: AWS_DEFAULT_REGION
-                  value: "eu-north-1"
-              script: |
-                #!/bin/bash
-                set -eu
-                
-                set +x
-                export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY)
-                export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID)
-                set -x
-                
-                # Check for credentials before proceeding (crucial step)
-                if [ -z "${AWS_ACCESS_KEY_ID}" ]; then
-                  echo "ERROR: AWS_ACCESS_KEY_ID environment variable is missing." >&2
-                  exit 1
-                fi
-                
-                INSTANCE_LIST=$(
-                  aws ec2 describe-instances \
-                  --filters "Name=tag:Name,Values=CI-$(params.run-id)*" "Name=instance-state-name,Values=running,pending" \
-                  --query 'Reservations[].Instances[].InstanceId' \
-                  --output text
-                )
-                echo "Instance IDs received for termination: ${INSTANCE_LIST} in ${AWS_DEFAULT_REGION}..."
-                
-                aws ec2 terminate-instances \
-                  --instance-ids ${INSTANCE_LIST} \
-                  --region ${AWS_DEFAULT_REGION} \
-                  --output text
-                
-                echo "Termination request sent for instance ${INSTANCE_LIST}."
diff --git a/pipelines/integration-test/operator-dast.yaml b/pipelines/integration-test/operator-dast.yaml
index 87364dd5..60821d88 100644
--- a/pipelines/integration-test/operator-dast.yaml
+++ b/pipelines/integration-test/operator-dast.yaml
@@ -239,87 +239,29 @@ spec:
         runAfter:
           - install-operator-from-fbc
           - clone-operator-source-code
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/prepare-tests.yaml
+        params:
+          - name: eaasSpaceSecretRef
+            value: $(tasks.provision-eaas-space.results.secretRef)
+          - name: clusterName
+            value: "$(tasks.provision-cluster.results.clusterName)"
+          - name: workdir
+            value: "operator"
+          - name: install-tas
+            value: "true"
+          - name: tas-namespace
+            value: "$(params.TAS_DEPLOY_NAMESPACE)"
         workspaces:
           - name: source-code
             workspace: sources
-        taskSpec:
-          results:
-            - name: oidc-hostname
-              type: string
-              value: "$(steps.install-keycloak.results.oidc-hostname)"
-            - name: fulcio-url
-              type: string
-              value: "$(steps.install-tas.results.fulcio-url)"
-            - name: tsa-url
-              type: string
-              value: "$(steps.install-tas.results.tsa-url)"
-            - name: tuf-url
-              type: string
-              value: "$(steps.install-tas.results.tuf-url)"
-            - name: rekor-url
-              type: string
-              value: "$(steps.install-tas.results.rekor-url)"
-          volumes:
-            - name: credentials
-              emptyDir: { }
-          workspaces:
-            - name: source-code
-          steps:
-            - name: get-kubeconfig
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/konflux-ci/build-definitions.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
-              params:
-                - name: eaasSpaceSecretRef
-                  value: $(tasks.provision-eaas-space.results.secretRef)
-                - name: clusterName
-                  value: "$(tasks.provision-cluster.results.clusterName)"
-                - name: credentials
-                  value: credentials
-            - name: install-keycloak
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-keycloak.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: "$(workspaces.source-code.path)/operator"
-            - name: install-tas
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-tas.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: $(workspaces.source-code.path)/operator
-                - name: tas-namespace
-                  value: "$(params.TAS_DEPLOY_NAMESPACE)"
-                - name: OIDC_ISSUER_URL
-                  value: "$(steps.install-keycloak.results.oidc-issuer-url)"
 # FULCIO DAST testing
       - name: fulcio-dast
         runAfter:
diff --git a/pipelines/integration-test/operator-upgrade.yaml b/pipelines/integration-test/operator-upgrade.yaml
index 7ef3d44f..b8537fd6 100644
--- a/pipelines/integration-test/operator-upgrade.yaml
+++ b/pipelines/integration-test/operator-upgrade.yaml
@@ -231,54 +231,25 @@ spec:
         runAfter:
           - provision-cluster
           - clone-operator-source-code
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/prepare-tests.yaml
+        params:
+          - name: eaasSpaceSecretRef
+            value: $(tasks.provision-eaas-space.results.secretRef)
+          - name: clusterName
+            value: "$(tasks.provision-cluster.results.clusterName)"
+          - name: workdir
+            value: "operator"
         workspaces:
           - name: source-code
             workspace: work
-        taskSpec:
-          results:
-            - name: oidc-hostname
-              type: string
-              value: "$(steps.install-keycloak.results.oidc-hostname)"
-          volumes:
-            - name: credentials
-              emptyDir: { }
-          workspaces:
-            - name: source-code
-          steps:
-            - name: get-kubeconfig
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/konflux-ci/build-definitions.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
-              params:
-                - name: eaasSpaceSecretRef
-                  value: $(tasks.provision-eaas-space.results.secretRef)
-                - name: clusterName
-                  value: "$(tasks.provision-cluster.results.clusterName)"
-                - name: credentials
-                  value: credentials
-            - name: install-keycloak
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-keycloak.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: "$(workspaces.source-code.path)/operator"
       - name: run-operator-upgrade
         runAfter:
           - prepare-tests
diff --git a/pipelines/integration-test/pco-operator-upgrade.yaml b/pipelines/integration-test/pco-operator-upgrade.yaml
index 2603a589..f4d64800 100644
--- a/pipelines/integration-test/pco-operator-upgrade.yaml
+++ b/pipelines/integration-test/pco-operator-upgrade.yaml
@@ -202,90 +202,29 @@ spec:
         runAfter:
           - install-rhtas-operator
           - clone-tas-operator-source-code
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/prepare-tests.yaml
+        params:
+          - name: eaasSpaceSecretRef
+            value: $(tasks.provision-eaas-space.results.secretRef)
+          - name: clusterName
+            value: "$(tasks.provision-cluster.results.clusterName)"
+          - name: workdir
+            value: "tas-operator"
+          - name: install-tas
+            value: "true"
+          - name: tas-namespace
+            value: "$(params.TAS_DEPLOY_NAMESPACE)"
         workspaces:
           - name: source-code
             workspace: work
-        taskSpec:
-          results:
-            - name: oidc-hostname
-              type: string
-              value: "$(steps.install-keycloak.results.oidc-hostname)"
-            - name: fulcio-url
-              type: string
-              value: "$(steps.install-tas.results.fulcio-url)"
-            - name: tsa-url
-              type: string
-              value: "$(steps.install-tas.results.tsa-url)"
-            - name: tuf-url
-              type: string
-              value: "$(steps.install-tas.results.tuf-url)"
-            - name: rekor-url
-              type: string
-              value: "$(steps.install-tas.results.rekor-url)"
-            - name: rekor-ui-url
-              type: string
-              value: "$(steps.install-tas.results.rekor-ui-url)"
-          volumes:
-            - name: credentials
-              emptyDir: { }
-          workspaces:
-            - name: source-code
-          steps:
-            - name: get-kubeconfig
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/konflux-ci/build-definitions.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
-              params:
-                - name: eaasSpaceSecretRef
-                  value: $(tasks.provision-eaas-space.results.secretRef)
-                - name: clusterName
-                  value: "$(tasks.provision-cluster.results.clusterName)"
-                - name: credentials
-                  value: credentials
-            - name: install-keycloak
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-keycloak.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: "$(workspaces.source-code.path)/tas-operator"
-            - name: install-tas
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-tas.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: $(workspaces.source-code.path)/tas-operator
-                - name: tas-namespace
-                  value: "$(params.TAS_DEPLOY_NAMESPACE)"
-                - name: OIDC_ISSUER_URL
-                  value: "$(steps.install-keycloak.results.oidc-issuer-url)"
       - name: run-operator-upgrade
         runAfter:
           - prepare-tests
diff --git a/pipelines/integration-test/policy-controller-fbc-e2e.yaml b/pipelines/integration-test/policy-controller-fbc-e2e.yaml
index 5ef3e482..fe639a0a 100644
--- a/pipelines/integration-test/policy-controller-fbc-e2e.yaml
+++ b/pipelines/integration-test/policy-controller-fbc-e2e.yaml
@@ -191,92 +191,31 @@ spec:
           - install-rhtas-operator
           - clone-tas-operator-source-code
           - install-operator-from-fbc
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/prepare-tests.yaml
+        params:
+          - name: eaasSpaceSecretRef
+            value: $(tasks.provision-eaas-space.results.secretRef)
+          - name: clusterName
+            value: "$(tasks.provision-cluster.results.clusterName)"
+          - name: workdir
+            value: "tas-operator"
+          - name: install-tas
+            value: "true"
+          - name: cluster-platform
+            value: "$(params.CLUSTER_PLATFORM)"
+          - name: tas-namespace
+            value: "$(params.TAS_DEPLOY_NAMESPACE)"
         workspaces:
           - name: source-code
             workspace: work
-        taskSpec:
-          results:
-            - name: oidc-hostname
-              type: string
-              value: "$(steps.install-keycloak.results.oidc-hostname)"
-            - name: fulcio-url
-              type: string
-              value: "$(steps.install-tas.results.fulcio-url)"
-            - name: tsa-url
-              type: string
-              value: "$(steps.install-tas.results.tsa-url)"
-            - name: tuf-url
-              type: string
-              value: "$(steps.install-tas.results.tuf-url)"
-            - name: rekor-url
-              type: string
-              value: "$(steps.install-tas.results.rekor-url)"
-            - name: rekor-ui-url
-              type: string
-              value: "$(steps.install-tas.results.rekor-ui-url)"
-          volumes:
-            - name: credentials
-              emptyDir: { }
-          workspaces:
-            - name: source-code
-          steps:
-            - name: get-kubeconfig
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/konflux-ci/build-definitions.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
-              params:
-                - name: eaasSpaceSecretRef
-                  value: $(tasks.provision-eaas-space.results.secretRef)
-                - name: clusterName
-                  value: "$(tasks.provision-cluster.results.clusterName)"
-                - name: credentials
-                  value: credentials
-            - name: install-keycloak
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-keycloak.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: "$(workspaces.source-code.path)/tas-operator"
-                - name: cluster-platform
-                  value: "$(params.CLUSTER_PLATFORM)"
-            - name: install-tas
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-tas.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: $(workspaces.source-code.path)/tas-operator
-                - name: tas-namespace
-                  value: "$(params.TAS_DEPLOY_NAMESPACE)"
-                - name: OIDC_ISSUER_URL
-                  value: "$(steps.install-keycloak.results.oidc-issuer-url)"
       - name: install-operator-from-fbc
         timeout: "0h5m0s"
         runAfter:
diff --git a/pipelines/integration-test/policy-controller-operator-e2e.yaml b/pipelines/integration-test/policy-controller-operator-e2e.yaml
index ad432b6e..ebd8442d 100644
--- a/pipelines/integration-test/policy-controller-operator-e2e.yaml
+++ b/pipelines/integration-test/policy-controller-operator-e2e.yaml
@@ -185,92 +185,31 @@ spec:
           - install-rhtas-operator
           - clone-tas-operator-source-code
           - install-operator-from-bundle
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/prepare-tests.yaml
+        params:
+          - name: eaasSpaceSecretRef
+            value: $(tasks.provision-eaas-space.results.secretRef)
+          - name: clusterName
+            value: "$(tasks.provision-cluster.results.clusterName)"
+          - name: workdir
+            value: "tas-operator"
+          - name: install-tas
+            value: "true"
+          - name: cluster-platform
+            value: "$(params.CLUSTER_PLATFORM)"
+          - name: tas-namespace
+            value: "$(params.TAS_DEPLOY_NAMESPACE)"
         workspaces:
           - name: source-code
             workspace: work
-        taskSpec:
-          results:
-            - name: oidc-hostname
-              type: string
-              value: "$(steps.install-keycloak.results.oidc-hostname)"
-            - name: fulcio-url
-              type: string
-              value: "$(steps.install-tas.results.fulcio-url)"
-            - name: tsa-url
-              type: string
-              value: "$(steps.install-tas.results.tsa-url)"
-            - name: tuf-url
-              type: string
-              value: "$(steps.install-tas.results.tuf-url)"
-            - name: rekor-url
-              type: string
-              value: "$(steps.install-tas.results.rekor-url)"
-            - name: rekor-ui-url
-              type: string
-              value: "$(steps.install-tas.results.rekor-ui-url)"
-          volumes:
-            - name: credentials
-              emptyDir: { }
-          workspaces:
-            - name: source-code
-          steps:
-            - name: get-kubeconfig
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/konflux-ci/build-definitions.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
-              params:
-                - name: eaasSpaceSecretRef
-                  value: $(tasks.provision-eaas-space.results.secretRef)
-                - name: clusterName
-                  value: "$(tasks.provision-cluster.results.clusterName)"
-                - name: credentials
-                  value: credentials
-            - name: install-keycloak
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-keycloak.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: "$(workspaces.source-code.path)/tas-operator"
-                - name: cluster-platform
-                  value: "$(params.CLUSTER_PLATFORM)"
-            - name: install-tas
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-tas.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: $(workspaces.source-code.path)/tas-operator
-                - name: tas-namespace
-                  value: "$(params.TAS_DEPLOY_NAMESPACE)"
-                - name: OIDC_ISSUER_URL
-                  value: "$(steps.install-keycloak.results.oidc-issuer-url)"
       - name: install-operator-from-bundle
         runAfter:
           - provision-cluster
diff --git a/pipelines/integration-test/rhtas-fbc-e2e.yaml b/pipelines/integration-test/rhtas-fbc-e2e.yaml
index d33611df..4f070f25 100644
--- a/pipelines/integration-test/rhtas-fbc-e2e.yaml
+++ b/pipelines/integration-test/rhtas-fbc-e2e.yaml
@@ -296,63 +296,30 @@ spec:
             values: ["true"]
       - name: prepare-tests
         runAfter:
-          # run after either one
           - install-operator-from-fbc
           - install-operator-from-fbc-olmv1
           - clone-operator-source-code
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/prepare-tests.yaml
+        params:
+          - name: eaasSpaceSecretRef
+            value: $(tasks.provision-eaas-space.results.secretRef)
+          - name: clusterName
+            value: "$(tasks.provision-cluster.results.clusterName)"
+          - name: workdir
+            value: "operator"
+          - name: cluster-platform
+            value: "$(params.CLUSTER_PLATFORM)"
         workspaces:
           - name: source-code
             workspace: work
-        taskSpec:
-          results:
-            - name: oidc-hostname
-              type: string
-              value: "$(steps.install-keycloak.results.oidc-hostname)"
-            - name: oidc-issuer-url
-              type: string
-              value: "$(steps.install-keycloak.results.oidc-issuer-url)"
-          volumes:
-            - name: credentials
-              emptyDir: { }
-          workspaces:
-            - name: source-code
-          steps:
-            - name: get-kubeconfig
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/konflux-ci/build-definitions.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
-              params:
-                - name: eaasSpaceSecretRef
-                  value: $(tasks.provision-eaas-space.results.secretRef)
-                - name: clusterName
-                  value: "$(tasks.provision-cluster.results.clusterName)"
-                - name: credentials
-                  value: credentials
-            - name: install-keycloak
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-keycloak.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: "$(workspaces.source-code.path)/operator"
-                - name: cluster-platform
-                  value: "$(params.CLUSTER_PLATFORM)"
       - name: download-binaries
         workspaces:
           - name: work
diff --git a/pipelines/integration-test/rhtas-operator-e2e.yaml b/pipelines/integration-test/rhtas-operator-e2e.yaml
index d9efd39b..e92b7adb 100644
--- a/pipelines/integration-test/rhtas-operator-e2e.yaml
+++ b/pipelines/integration-test/rhtas-operator-e2e.yaml
@@ -245,59 +245,27 @@ spec:
         runAfter:
           - install-operator-from-bundle
           - clone-operator-source-code
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://github.com/securesign/pipelines.git
+            - name: revision
+              value: main
+            - name: pathInRepo
+              value: tasks/integration-test/prepare-tests.yaml
+        params:
+          - name: eaasSpaceSecretRef
+            value: $(tasks.provision-eaas-space.results.secretRef)
+          - name: clusterName
+            value: "$(tasks.provision-cluster.results.clusterName)"
+          - name: workdir
+            value: "operator"
+          - name: cluster-platform
+            value: "$(params.CLUSTER_PLATFORM)"
         workspaces:
           - name: source-code
             workspace: work
-        taskSpec:
-          results:
-            - name: oidc-hostname
-              type: string
-              value: "$(steps.install-keycloak.results.oidc-hostname)"
-            - name: oidc-issuer-url
-              type: string
-              value: "$(steps.install-keycloak.results.oidc-issuer-url)"
-          volumes:
-            - name: credentials
-              emptyDir: { }
-          workspaces:
-            - name: source-code
-          steps:
-            - name: get-kubeconfig
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/konflux-ci/build-definitions.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
-              params:
-                - name: eaasSpaceSecretRef
-                  value: $(tasks.provision-eaas-space.results.secretRef)
-                - name: clusterName
-                  value: "$(tasks.provision-cluster.results.clusterName)"
-                - name: credentials
-                  value: credentials
-            - name: install-keycloak
-              ref:
-                resolver: git
-                params:
-                  - name: url
-                    value: https://github.com/securesign/pipelines.git
-                  - name: revision
-                    value: main
-                  - name: pathInRepo
-                    value: stepactions/integration-test/install-keycloak.yaml
-              params:
-                - name: credentials
-                  value: credentials
-                - name: KUBECONFIG
-                  value: "$(steps.get-kubeconfig.results.kubeconfig)"
-                - name: workdir
-                  value: "$(workspaces.source-code.path)/operator"
-                - name: cluster-platform
-                  value: "$(params.CLUSTER_PLATFORM)"
       - name: download-binaries
         workspaces:
           - name: work
diff --git a/tasks/integration-test/aws-cleanup-ec2-instances.yaml b/tasks/integration-test/aws-cleanup-ec2-instances.yaml
new file mode 100644
index 00000000..49a0a8e1
--- /dev/null
+++ b/tasks/integration-test/aws-cleanup-ec2-instances.yaml
@@ -0,0 +1,63 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: aws-cleanup-ec2-instances
+spec:
+  description: |
+    Terminates AWS EC2 instances created during integration tests based on run ID tag.
+    Uses aws-ci-test secret credentials to clean up ephemeral test infrastructure.
+  params:
+    - name: run-id
+      type: string
+      description: Pipeline run ID used to tag and identify EC2 instances to terminate
+    - name: aws-region
+      type: string
+      default: "eu-north-1"
+      description: AWS region where EC2 instances are running
+  volumes:
+    - name: aws-creds
+      secret:
+        secretName: aws-ci-test
+  steps:
+    - name: terminate-instances
+      volumeMounts:
+        - name: aws-creds
+          mountPath: /creds
+      image: amazon/aws-cli:latest
+      env:
+        - name: AWS_DEFAULT_REGION
+          value: "$(params.aws-region)"
+      script: |
+        #!/bin/bash
+        set -eu
+
+        set +x
+        export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY)
+        export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID)
+        set -x
+
+        # Check for credentials before proceeding (crucial step)
+        if [ -z "${AWS_ACCESS_KEY_ID}" ]; then
+          echo "ERROR: AWS_ACCESS_KEY_ID environment variable is missing." >&2
+          exit 1
+        fi
+
+        INSTANCE_LIST=$(
+          aws ec2 describe-instances \
+          --filters "Name=tag:Name,Values=CI-$(params.run-id)*" "Name=instance-state-name,Values=running,pending" \
+          --query 'Reservations[].Instances[].InstanceId' \
+          --output text
+        )
+        if [ -z "${INSTANCE_LIST}" ]; then
+          echo "No instances found to terminate."
+          exit 0
+        fi
+
+        echo "Instance IDs received for termination: ${INSTANCE_LIST} in ${AWS_DEFAULT_REGION}..."
+
+        aws ec2 terminate-instances \
+          --instance-ids ${INSTANCE_LIST} \
+          --region ${AWS_DEFAULT_REGION} \
+          --output text
+
+        echo "Termination request sent for instance ${INSTANCE_LIST}."
diff --git a/tasks/integration-test/prepare-molecule-tests.yaml b/tasks/integration-test/prepare-molecule-tests.yaml
new file mode 100644
index 00000000..d203a697
--- /dev/null
+++ b/tasks/integration-test/prepare-molecule-tests.yaml
@@ -0,0 +1,41 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: prepare-molecule-tests
+spec:
+  description: |
+    Extracts a container image and prepares the Ansible molecule test environment
+    by replacing role names in converge.yml files.
+  params:
+    - name: container-image
+      type: string
+      description: The container image URL to extract (e.g., from Snapshot)
+    - name: ansible-path
+      type: string
+      description: Path to the Ansible directory relative to workspace (e.g., "ansible" or "artifact-signer-ansible")
+      default: "ansible"
+  workspaces:
+    - name: work
+      description: Workspace where the image will be extracted and processed
+  steps:
+    - name: extract-release-image-content
+      image: "gcr.io/go-containerregistry/crane"
+      env:
+        - name: DOCKER_CONFIG
+          value: /tmp/empty-docker-config
+      args:
+        - export
+        - $(params.container-image)
+        - $(workspaces.work.path)/image.tar
+    - name: prepare-env
+      image: "quay.io/redhat-appstudio/konflux-test:stable"
+      script: |
+        #!/bin/sh
+        set -ex
+
+        # extract the release image content
+        tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path)
+
+        # replace the tas_single_node name with the redhat.artifact_signer.tas_single_node name
+        find $(workspaces.work.path)/$(params.ansible-path)/molecule -type f -name "converge.yml" \
+        -exec sed -i  's@name: tas_single_node@name: redhat.artifact_signer.tas_single_node@g' {} +
diff --git a/tasks/integration-test/prepare-tests.yaml b/tasks/integration-test/prepare-tests.yaml
new file mode 100644
index 00000000..d7d30b38
--- /dev/null
+++ b/tasks/integration-test/prepare-tests.yaml
@@ -0,0 +1,159 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: prepare-tests
+spec:
+  description: |
+    Prepares the ephemeral test environment by getting cluster credentials,
+    installing Keycloak for OIDC, and optionally installing TAS components.
+  params:
+    - name: eaasSpaceSecretRef
+      type: string
+      description: Secret reference for EaaS space credentials
+    - name: clusterName
+      type: string
+      description: Name of the ephemeral cluster
+    - name: workdir
+      type: string
+      description: Subdirectory within the source-code workspace (e.g., "operator" or "tas-operator")
+    - name: cluster-platform
+      type: string
+      default: "hypershift"
+      description: Cluster platform type
+    - name: tas-namespace
+      type: string
+      default: "trusted-artifact-signer"
+      description: Namespace for TAS deployment
+    - name: install-tas
+      type: string
+      default: "false"
+      description: Whether to install TAS components (true/false)
+  results:
+    - name: oidc-hostname
+      type: string
+      description: Keycloak OIDC hostname
+    - name: oidc-issuer-url
+      type: string
+      description: Keycloak OIDC issuer URL
+    - name: fulcio-url
+      type: string
+      description: Fulcio service URL (only when install-tas=true)
+    - name: tsa-url
+      type: string
+      description: TSA service URL (only when install-tas=true)
+    - name: tuf-url
+      type: string
+      description: TUF service URL (only when install-tas=true)
+    - name: rekor-url
+      type: string
+      description: Rekor service URL (only when install-tas=true)
+    - name: rekor-ui-url
+      type: string
+      description: Rekor UI service URL (only when install-tas=true)
+  workspaces:
+    - name: source-code
+      description: Workspace containing operator source code
+  volumes:
+    - name: credentials
+      emptyDir: {}
+  steps:
+    - name: get-kubeconfig
+      ref:
+        resolver: git
+        params:
+          - name: url
+            value: https://github.com/konflux-ci/build-definitions.git
+          - name: revision
+            value: main
+          - name: pathInRepo
+            value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
+      params:
+        - name: eaasSpaceSecretRef
+          value: $(params.eaasSpaceSecretRef)
+        - name: clusterName
+          value: $(params.clusterName)
+        - name: credentials
+          value: credentials
+    - name: install-keycloak
+      ref:
+        resolver: git
+        params:
+          - name: url
+            value: https://github.com/securesign/pipelines.git
+          - name: revision
+            value: main
+          - name: pathInRepo
+            value: stepactions/integration-test/install-keycloak.yaml
+      params:
+        - name: credentials
+          value: credentials
+        - name: KUBECONFIG
+          value: $(steps.get-kubeconfig.results.kubeconfig)
+        - name: workdir
+          value: "$(workspaces.source-code.path)/$(params.workdir)"
+        - name: cluster-platform
+          value: $(params.cluster-platform)
+    - name: install-tas
+      ref:
+        resolver: git
+        params:
+          - name: url
+            value: https://github.com/securesign/pipelines.git
+          - name: revision
+            value: main
+          - name: pathInRepo
+            value: stepactions/integration-test/install-tas.yaml
+      params:
+        - name: credentials
+          value: credentials
+        - name: KUBECONFIG
+          value: $(steps.get-kubeconfig.results.kubeconfig)
+        - name: workdir
+          value: "$(workspaces.source-code.path)/$(params.workdir)"
+        - name: tas-namespace
+          value: $(params.tas-namespace)
+        - name: OIDC_ISSUER_URL
+          value: $(steps.install-keycloak.results.oidc-issuer-url)
+      when:
+        - input: "$(params.install-tas)"
+          operator: in
+          values: ["true"]
+    - name: set-results
+      image: quay.io/redhat-appstudio/konflux-test:stable
+      env:
+        - name: OIDC_HOSTNAME
+          value: "$(steps.install-keycloak.results.oidc-hostname)"
+        - name: OIDC_ISSUER_URL
+          value: "$(steps.install-keycloak.results.oidc-issuer-url)"
+        - name: INSTALL_TAS
+          value: "$(params.install-tas)"
+        - name: FULCIO_URL
+          value: "$(steps.install-tas.results.fulcio-url)"
+        - name: TSA_URL
+          value: "$(steps.install-tas.results.tsa-url)"
+        - name: TUF_URL
+          value: "$(steps.install-tas.results.tuf-url)"
+        - name: REKOR_URL
+          value: "$(steps.install-tas.results.rekor-url)"
+        - name: REKOR_UI_URL
+          value: "$(steps.install-tas.results.rekor-ui-url)"
+      script: |
+        #!/bin/sh
+        set -e
+
+        echo -n "$OIDC_HOSTNAME" > $(results.oidc-hostname.path)
+        echo -n "$OIDC_ISSUER_URL" > $(results.oidc-issuer-url.path)
+
+        if [ "$INSTALL_TAS" = "true" ]; then
+          echo -n "$FULCIO_URL" > $(results.fulcio-url.path)
+          echo -n "$TSA_URL" > $(results.tsa-url.path)
+          echo -n "$TUF_URL" > $(results.tuf-url.path)
+          echo -n "$REKOR_URL" > $(results.rekor-url.path)
+          echo -n "$REKOR_UI_URL" > $(results.rekor-ui-url.path)
+        else
+          echo -n "" > $(results.fulcio-url.path)
+          echo -n "" > $(results.tsa-url.path)
+          echo -n "" > $(results.tuf-url.path)
+          echo -n "" > $(results.rekor-url.path)
+          echo -n "" > $(results.rekor-ui-url.path)
+        fi