diff --git a/.github/workflows/beekeeper.yml b/.github/workflows/beekeeper.yml
index c2448465d7f..48976572f20 100644
--- a/.github/workflows/beekeeper.yml
+++ b/.github/workflows/beekeeper.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches:
       - "**"
+  push:
+    branches:
+      - master
 
 env:
   K3S_VERSION: "v1.31.10+k3s1"
@@ -25,24 +28,23 @@ env:
   AWS_EC2_METADATA_DISABLED: true
   AWS_ENDPOINT: fra1.digitaloceanspaces.com
   VERTAG: ${GITHUB_RUN_ID}
+  P2P_WSS_ENABLE: true
+  PEBBLE_IMAGE_TAG: "2.9.0"
+  P2P_FORGE_IMAGE_TAG: "v0.7.0"
+  PEBBLE_CERTIFICATE_VALIDITY_PERIOD: "500"
 jobs:
   init:
     name: Init
     runs-on: ubuntu-latest
     outputs:
       msg: ${{ steps.commit.outputs.msg }}
+      p2p_changed: ${{ steps.p2p.outputs.changed }}
     steps:
       - name: Checkout
         uses: actions/checkout@v5
-        if: github.event.action != 'beekeeper'
         with:
           fetch-depth: 0
-      - name: Checkout
-        uses: actions/checkout@v5
-        if: github.event.action == 'beekeeper'
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.client_payload.ref }}
+          ref: ${{ github.event.action == 'beekeeper' && github.event.client_payload.ref || github.sha }}
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
@@ -60,8 +62,27 @@ jobs:
       - name: Get Commit Message
         id: commit
         run: |
-          MSG=$(git log --format=%s -n 1 ${{github.event.after}})
+          MSG=$(git log --format=%s -n 1 ${{ github.event.after || github.sha }})
           echo "msg=${MSG}" >> $GITHUB_OUTPUT
+      - name: Detect P2P connectivity-related changes (pull_request only)
+        id: p2p
+        run: |
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            echo "changed=skip" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          git fetch origin "${{ github.base_ref }}" --depth=1
+          # Paths that can affect ci-autotls behavior:
+          # - /addresses, /connect, /peers API surface
+          # - p2p/libp2p WSS/AutoTLS transport and handshake
+          # - node wiring + topology/hive/addressbook integration
+          # - swarm address identity types and p2p deps
+          if git diff --name-only "origin/${{ github.base_ref }}...HEAD" | grep -qE \
+            '^(pkg/(p2p|topology|hive|addressbook|bzz|node|swarm)/|pkg/api/(api|router|p2p|peer)\.go|cmd/bee/cmd/(cmd|start)\.go|\.github/workflows/beekeeper\.yml|go\.mod|go\.sum)'; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "changed=false" >> $GITHUB_OUTPUT
+          fi
       - name: Build - 0
         run: |
           make binary
@@ -99,6 +120,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: [init]
     steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.action == 'beekeeper' && github.event.client_payload.ref || github.sha }}
       - name: Cache
         uses: actions/cache@v4
         with:
@@ -113,19 +139,17 @@ jobs:
         run: |
           chmod +x bee-1 beekeeper .github/bin/beekeeper_artifacts.sh
           mv .beekeeper.yaml ~/.beekeeper.yaml
-          mkdir ~/.beekeeper && mv local.yaml ~/.beekeeper/local.yaml
+          mkdir -p ~/.beekeeper && mv local.yaml ~/.beekeeper/local.yaml
           mv bee-1 bee
           sudo mv beekeeper /usr/local/bin/beekeeper
       - name: Prepare local cluster
-        run: |
-          timeout ${TIMEOUT} make beelocal OPTS='ci skip-vet' ACTION=prepare
+        run: timeout ${TIMEOUT} make beelocal OPTS='ci skip-vet' ACTION=prepare
       - name: Set kube config
         run: |
           mkdir -p ~/.kube
           cp /etc/rancher/k3s/k3s.yaml ~/.kube/config
       - name: Set local cluster
-        run: |
-          timeout ${TIMEOUT} make deploylocal BEEKEEPER_CLUSTER=local-dns
+        run: timeout ${TIMEOUT} make deploylocal BEEKEEPER_CLUSTER=local-dns
       - name: Test pingpong
         id: pingpong
         run: timeout ${TIMEOUT} bash -c 'until beekeeper check --cluster-name local-dns --checks ci-pingpong; do echo "waiting for pingpong..."; sleep .3; done'
@@ -182,7 +206,7 @@ jobs:
       - name: Test feeds
         id: feeds
         run: timeout ${TIMEOUT} beekeeper check --cluster-name local-dns --checks=ci-feed
-      - name: Collect debug artifacts
+      - name: Collect debug artifacts (local-dns)
         if: failure()
         run: |
           bash .github/bin/beekeeper_artifacts.sh local-dns
@@ -193,8 +217,8 @@ jobs:
           if ${{ steps.pss.outcome=='failure' }}; then FAILED=pss; fi
           if ${{ steps.soc.outcome=='failure' }}; then FAILED=soc; fi
           if ${{ steps.gsoc.outcome=='failure' }}; then FAILED=gsoc; fi
-          if ${{ steps.pushsync-chunks-1.outcome=='failure' }}; then FAILED=pushsync-chunks-1; fi
-          if ${{ steps.pushsync-chunks-2.outcome=='failure' }}; then FAILED=pushsync-chunks-2; fi
+          if ${{ steps.pushsync-chunks-1.outcome=='failure' }}; then FAILED=pushsync-chunks; fi
+          if ${{ steps.pushsync-chunks-2.outcome=='failure' }}; then FAILED=pushsync-light-chunks; fi
           if ${{ steps.retrieval.outcome=='failure' }}; then FAILED=retrieval; fi
           if ${{ steps.manifest.outcome=='failure' }}; then FAILED=manifest; fi
           if ${{ steps.manifest-v1.outcome=='failure' }}; then FAILED=manifest-v1; fi
@@ -202,9 +226,9 @@ jobs:
           if ${{ steps.stake.outcome=='failure' }}; then FAILED=stake; fi
           if ${{ steps.withdraw.outcome=='failure' }}; then FAILED=withdraw; fi
           if ${{ steps.redundancy.outcome=='failure' }}; then FAILED=redundancy; fi
-          if ${{ steps.feeds.outcome=='failure' }}; then FAILED=feeds; fi
-          if ${{ steps.feeds-v1.outcome=='failure' }}; then FAILED=feeds-v1; fi
           if ${{ steps.act.outcome=='failure' }}; then FAILED=act; fi
+          if ${{ steps.feeds-v1.outcome=='failure' }}; then FAILED=feeds-v1; fi
+          if ${{ steps.feeds.outcome=='failure' }}; then FAILED=feeds; fi
           curl -sSf -X POST -H "Content-Type: application/json" -d "{\"text\": \"**${RUN_TYPE}** Beekeeper Error\nBranch: \`${{ github.head_ref }}\`\nUser: @${{ github.event.pull_request.user.login }}\nDebugging artifacts: [click](https://$BUCKET_NAME.$AWS_ENDPOINT/artifacts_$VERTAG.tar.gz)\nStep failed: \`${FAILED}\`\"}" https://beehive.ethswarm.org/hooks/${{ secrets.TUNSHELL_KEY }}
           echo "Failed test: ${FAILED}"
       - name: Create tunshell session for debug
@@ -220,11 +244,82 @@ jobs:
         with:
           name: debug-dump
           path: dump/
+  beekeeper-autotls:
+    name: Integration tests (autotls)
+    if: |
+      github.event_name == 'repository_dispatch' ||
+      (github.event_name == 'push' && github.ref == 'refs/heads/master') ||
+      (github.event_name == 'pull_request' && needs.init.outputs.p2p_changed == 'true')
+    runs-on: ubuntu-latest
+    needs: [init]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.action == 'beekeeper' && github.event.client_payload.ref || github.sha }}
+      - name: Cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            /tmp/k3s-${{ env.K3S_VERSION }}
+          key: k3s-${{ env.K3S_VERSION }}
+      - name: "Download Artifact"
+        uses: actions/download-artifact@v4
+        with:
+          name: temp-artifacts
+      - name: Unpack artifacts
+        run: |
+          chmod +x bee-1 beekeeper .github/bin/beekeeper_artifacts.sh
+          mv .beekeeper.yaml ~/.beekeeper.yaml
+          mkdir -p ~/.beekeeper && mv local.yaml ~/.beekeeper/local.yaml
+          mv bee-1 bee
+          sudo mv beekeeper /usr/local/bin/beekeeper
+      - name: Prepare local cluster
+        run: timeout ${TIMEOUT} make beelocal OPTS='ci skip-vet' ACTION=prepare
+      - name: Set kube config
+        run: |
+          mkdir -p ~/.kube
+          cp /etc/rancher/k3s/k3s.yaml ~/.kube/config
+      - name: Set local cluster (local-dns-autotls)
+        run: timeout ${TIMEOUT} make deploylocal BEEKEEPER_CLUSTER=local-dns-autotls
+      - name: Test pingpong (autotls)
+        id: pingpong-autotls
+        run: timeout ${TIMEOUT} bash -c 'until beekeeper check --cluster-name local-dns-autotls --checks ci-pingpong; do echo "waiting for pingpong..."; sleep .3; done'
+      - name: Test fullconnectivity (autotls)
+        id: fullconnectivity-autotls
+        run: timeout ${TIMEOUT} bash -c 'until beekeeper check --cluster-name local-dns-autotls --checks=ci-full-connectivity; do echo "waiting for full connectivity..."; sleep .3; done'
+      - name: Test retrieval (autotls)
+        id: retrieval-autotls
+        run: timeout ${TIMEOUT} beekeeper check --cluster-name local-dns-autotls --checks=ci-retrieval
+      - name: Test autotls
+        id: autotls
+        run: timeout ${TIMEOUT} beekeeper check --cluster-name local-dns-autotls --checks=ci-autotls
+      - name: Collect debug artifacts (autotls)
+        if: failure()
+        run: |
+          bash .github/bin/beekeeper_artifacts.sh local-dns-autotls
+          export FAILED='no-test'
+          if ${{ steps.pingpong-autotls.outcome=='failure' }}; then FAILED=pingpong; fi
+          if ${{ steps.fullconnectivity-autotls.outcome=='failure' }}; then FAILED=fullconnectivity; fi
+          if ${{ steps.retrieval-autotls.outcome=='failure' }}; then FAILED=retrieval; fi
+          if ${{ steps.autotls.outcome=='failure' }}; then FAILED=autotls; fi
+          curl -sSf -X POST -H "Content-Type: application/json" -d "{\"text\": \"**${RUN_TYPE}** Beekeeper Autotls Error\nBranch: \`${{ github.head_ref }}\`\nUser: @${{ github.event.pull_request.user.login }}\nDebugging artifacts: [click](https://$BUCKET_NAME.$AWS_ENDPOINT/artifacts_$VERTAG.tar.gz)\nStep failed: \`${FAILED}\`\"}" https://beehive.ethswarm.org/hooks/${{ secrets.TUNSHELL_KEY }}
+          echo "Failed test: ${FAILED}"
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: debug-dump-autotls
+          path: dump/
   retag:
     name: Retag and Trigger ArgoCD
     env:
       TIMEOUT: 10m
-    needs: [beekeeper]
+    needs: [beekeeper, beekeeper-autotls]
+    if: |
+      always() &&
+      needs.beekeeper.result == 'success' &&
+      (needs.beekeeper-autotls.result == 'success' || needs.beekeeper-autotls.result == 'skipped')
     runs-on: ubuntu-latest
     steps:
       - name: "Download Artifact"