diff --git a/meta-arm/ci/corstone1000-common.yml b/meta-arm/ci/corstone1000-common.yml
index 0947228..5720b78 100644
--- a/meta-arm/ci/corstone1000-common.yml
+++ b/meta-arm/ci/corstone1000-common.yml
@@ -3,13 +3,40 @@
   includes:
     - ci/base.yml
     - ci/meta-openembedded.yml
-    - ci/poky-tiny.yml
     - ci/meta-secure-core.yml
 
 local_conf_header:
-    extrapackages: |
+  extrapackages: |
     # Intentionally blank to prevent perf from being added to the image in base.yml
 
+  distrosetup: |
+    DISTRO_FEATURES = "usbhost ipv4"
+
+  initramfsetup: |
+    # Telling the build system which image is responsible of the generation of the initramfs rootfs
+    INITRAMFS_IMAGE_BUNDLE = "1"
+    INITRAMFS_IMAGE ?= "core-image-minimal"
+    IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
+    IMAGE_NAME_SUFFIX = ""
+
+    # enable mdev/busybox for init
+    INIT_MANAGER = "mdev-busybox"
+    VIRTUAL-RUNTIME_init_manager = "busybox"
+
+    # prevent the kernel image from being included in the intramfs rootfs
+    PACKAGE_EXCLUDE += "kernel-image-*"
+    # Don't include kernel binary in rootfs /boot path
+    RRECOMMENDS:${KERNEL_PACKAGE_NAME}-base = ""
+
+    # Disable openssl in kmod to shrink the initramfs size
+    PACKAGECONFIG:remove:pn-kmod = "openssl"
+
+    # all optee packages
+    IMAGE_INSTALL += "optee-client"
+
+    # TS PSA API tests commands for crypto, its, ps and iat
+    IMAGE_INSTALL += "packagegroup-ts-tests-psa"
+
 target:
-  - corstone1000-image
+  - corstone1000-flash-firmware-image
   - perf
diff --git a/meta-arm/ci/cve.yml b/meta-arm/ci/cve.yml
new file mode 100644
index 0000000..e2aca0e
--- /dev/null
+++ b/meta-arm/ci/cve.yml
@@ -0,0 +1,19 @@
+header:
+  version: 14
+
+local_conf_header:
+  cve: |
+    INHERIT += "cve-check"
+
+    # Allow the runner environment to provide an API key
+    NVDCVE_API_KEY = "${@d.getVar('BB_ORIGENV').getVar('NVDCVE_API_KEY') or ''}"
+
+    # Just show the warnings for our layers
+    CVE_CHECK_SHOW_WARNINGS = "0"
+    CVE_CHECK_SHOW_WARNINGS:layer-arm-toolchain = "1"
+    CVE_CHECK_SHOW_WARNINGS:layer-meta-arm = "1"
+    CVE_CHECK_SHOW_WARNINGS:layer-meta-arm-bsp = "1"
+    CVE_CHECK_SHOW_WARNINGS:layer-meta-arm-systemready = "1"
+
+    # Ignore the kernel, we sometime carry kernels in meta-arm
+    CVE_CHECK_SHOW_WARNINGS:pn-linux-yocto = "0"
diff --git a/meta-arm/ci/jobs-to-kas b/meta-arm/ci/jobs-to-kas
index eea6e46..df81c2e 100755
--- a/meta-arm/ci/jobs-to-kas
+++ b/meta-arm/ci/jobs-to-kas
@@ -3,17 +3,28 @@
 # This script is expecting an input of machine name, optionally followed by a
 # colon and a list of one or more parameters separated by commas between
 # brackets.  For example, the following are acceptable:
-# corstone1000-mps3
-# fvp-base: [testimage]
-# qemuarm64-secureboot: [clang, glibc, testimage]
+#   corstone1000-mps3
+#   fvp-base: [testimage]
+#   qemuarm64-secureboot: [clang, glibc, testimage]
+# This argument should be quoted to avoid expansion and to be handled
+# as a single value.
+#
+# Any further arguments will be handled as further yml file basenames.
 #
 # Turn this list into a series of yml files separated by colons to pass to kas
 
 set -e -u
 
-FILES="ci/$(echo $1 | cut -d ':' -f 1).yml"
+# First, parse the GitLab CI job name (CI_JOB_NAME via $1) and accumulate a list
+# of Kas files.
+JOBNAME="$1"
+shift
 
-for i in $(echo $1 | cut -s -d ':' -f 2 | sed 's/[][,]//g'); do
+# The base name of the job
+FILES="ci/$(echo $JOBNAME | cut -d ':' -f 1).yml"
+
+# The list of matrix variations
+for i in $(echo $JOBNAME | cut -s -d ':' -f 2 | sed 's/[][,]//g'); do
 	# Given that there are no yml files for gcc or glibc, as those are the
 	# defaults, we can simply ignore those parameters.  They are necessary
 	# to pass in so that matrix can correctly setup all of the permutations
@@ -24,4 +35,9 @@
 	FILES+=":ci/$i.yml"
 done
 
+# Now pick up any further names
+for i in $*; do
+	FILES+=":ci/$i.yml"
+done
+
 echo $FILES
diff --git a/meta-arm/ci/meta-virtualization.yml b/meta-arm/ci/meta-virtualization.yml
index 88f8cdc..f0f6280 100644
--- a/meta-arm/ci/meta-virtualization.yml
+++ b/meta-arm/ci/meta-virtualization.yml
@@ -5,4 +5,4 @@
 
 repos:
   meta-virtualization:
-    url: git://git.yoctoproject.org/meta-virtualization
+    url: https://git.yoctoproject.org/meta-virtualization