diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2034cdd3bdcc9c1b7177871ab120ad0f77466015..d7487c712698c1866d8e86ff3a97f135a87c0935 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,7 +1,14 @@
-image: $CI_REGISTRY/knot/knot-resolver/ci/debian-buster:knot-3.0
 variables:
   LC_ALL: C.UTF-8
 
+  # IMAGE_TAG is a Git branch/tag name from https://gitlab.nic.cz/knot/knot-resolver-ci
+  # In general, keep it pointing to a tag - use a branch only for development.
+  # More info in the knot-resolver-ci repository.
+  IMAGE_TAG: 'v20240606'
+  IMAGE_PREFIX: '$CI_REGISTRY/knot/knot-resolver-ci'
+
+image: $IMAGE_PREFIX/debian12-knot_3_3:$IMAGE_TAG
+
 stages:
   - test
 
@@ -64,7 +71,7 @@ test:comparative:kresd:
     - git clone --recurse-submodules -j8 --depth=1 https://gitlab.nic.cz/knot/knot-resolver.git /tmp/kresd-local-build
     - pushd /tmp/kresd-local-build
     - git log -1
-    - meson build_local --default-library=static --prefix=/tmp/.local
+    - meson build_local --default-library=static -Dmalloc=disabled --prefix=/tmp/.local
     - ninja -C build_local install
     - popd
     # compare results from latest Deckard with results from merge base
@@ -88,7 +95,7 @@ test:latest:kresd:
     - git clone --recurse-submodules -j8 --depth=1 https://gitlab.nic.cz/knot/knot-resolver.git kresd-local-build
     - pushd kresd-local-build
     - git log -1
-    - meson build_local --default-library=static --prefix="$PWD/../.local"
+    - meson build_local --default-library=static -Dmalloc=disabled --prefix="$PWD/../.local"
     - ninja -C build_local install
     - popd
     - TMPDIR=$(pwd) PATH=$(pwd)/.local/sbin:$PATH ./kresd_run.sh -n $(nproc)
diff --git a/ci/compare-rplint.sh b/ci/compare-rplint.sh
index 0146dc91f82345db84f98cb8cb1a587eb59bb7b9..cb4dad0d6d0f102ea09c460b7eb0b41402327525 100755
--- a/ci/compare-rplint.sh
+++ b/ci/compare-rplint.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o nounset -o xtrace -o errexit
 source "$(dirname "$(readlink -f "$0")")/common.sh"
 
diff --git a/ci/compare-tests.sh b/ci/compare-tests.sh
index 63d8c6766e170d12b42462f29a2b758323e40d76..460f7f13c889a28c8d9dbd00e79796477503ce56 100755
--- a/ci/compare-tests.sh
+++ b/ci/compare-tests.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o nounset -o xtrace -o errexit
 source "$(dirname "$0")/common.sh"
 TESTRUNNER="$1"
diff --git a/ci/junit-compare.py b/ci/junit-compare.py
index 23409bb002911ce213741920efd77c7066213b75..c939449421e1c3843613e53a1bf8962eecf1b7a1 100755
--- a/ci/junit-compare.py
+++ b/ci/junit-compare.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 
 import sys
 
diff --git a/ci/pylint-run.sh b/ci/pylint-run.sh
index 107c674f4beeed63055677417c92350308c19df0..788a4f5a41a2a51dda6161c61480e4e75f977224 100755
--- a/ci/pylint-run.sh
+++ b/ci/pylint-run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o nounset -o errexit
 source "$(dirname "$0")/common.sh"
 
diff --git a/ci/raw_id.py b/ci/raw_id.py
index cc4fe8e16e0abae3ebc792169337fd16ae67fb3b..19c423751a25878a862165ccb691c36600f9a1e0 100755
--- a/ci/raw_id.py
+++ b/ci/raw_id.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 import sys
 
 import dns.message
diff --git a/ci/raw_id_check.sh b/ci/raw_id_check.sh
index 336b37b71663b956b29bad0a13dae0e2005a5235..94c58f102fc3fdeae1e9a5ea0a59b292795b6391 100755
--- a/ci/raw_id_check.sh
+++ b/ci/raw_id_check.sh
@@ -1,7 +1,7 @@
-#!/bin/bash
+#!/usr/bin/env bash
 make depend
 cat env.sh
 source env.sh
 python3 -m pydnstest.testserver --scenario $(pwd)/tests/deckard_raw_id.rpl &
 sleep 1
-python3 -m ci.raw_id
\ No newline at end of file
+python3 -m ci.raw_id
diff --git a/ci/runlocally.sh b/ci/runlocally.sh
index 25bf0c94c1b9c51391ee906f699d20b28bac2621..5829ca251930294353aecf45dbd9a92cd48143ce 100755
--- a/ci/runlocally.sh
+++ b/ci/runlocally.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o nounset -o errexit
 CIDIR="$(dirname "$0")"
 ORIGNAME="$(git symbolic-ref -q --short HEAD || git describe --all --always HEAD)"
diff --git a/getdns_run.sh b/getdns_run.sh
index 2dc73138ab7e27c88f5a8db11fccebe7e0ae7822..707dd1476e232c5400aa8f529b5d42d70b2d8eec 100755
--- a/getdns_run.sh
+++ b/getdns_run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o errexit -o nounset
 
 # Below a summary of tests that failed including a reason for the failure.
diff --git a/knotd_master_run.sh b/knotd_master_run.sh
index 9a61f3c89ff9ebeb15b062c5acffef556f479d60..3d7cb075fbb6b80ad10b3e493fa19ac9afb1ffd4 100755
--- a/knotd_master_run.sh
+++ b/knotd_master_run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o errexit -o nounset
 
 echo 'INFO: Tests require Knot compiled with ./configure --enable-recvmmsg=no'
diff --git a/knotd_slave_run.sh b/knotd_slave_run.sh
index 239cef1f509b30c7a89738a675c412350ad59f59..1b7c11820c524932c6fa6239a39265390ef6581d 100755
--- a/knotd_slave_run.sh
+++ b/knotd_slave_run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o errexit -o nounset
 
 echo 'INFO: Tests require Knot compiled with ./configure --enable-recvmmsg=no'
diff --git a/kresd_run.sh b/kresd_run.sh
index 5fd93e15b5eb1676131a54a76d8de01c9726d25f..b65778ad72bb9740e3aba070e5831ffa9688e07b 100755
--- a/kresd_run.sh
+++ b/kresd_run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o errexit -o nounset
 
 RUNDIR="$(dirname "$0")"
diff --git a/named_run.sh b/named_run.sh
index d8a044bc2d8d63cfe378924d233f0503db7ec059..a7cf2ed7ba946af320dd06a20cb3b5143e822e72 100755
--- a/named_run.sh
+++ b/named_run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o errexit -o nounset
 named -V | grep --quiet -- '--without-jemalloc' || echo 'WARNING: Make sure BIND is compiled without jemalloc library; for 9.17+ use ./configure --without-jemalloc'
 MINOR="$(named -v | cut -d . -f 2)"
diff --git a/pdns_run.sh b/pdns_run.sh
index bb1900ed7026790913e7da4fceba70acc5b1ff29..60094f0ba8dc5d1a810eede967e8f19aa58c279b 100755
--- a/pdns_run.sh
+++ b/pdns_run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o errexit -o nounset
 
 RUNDIR="$(dirname "$0")"
diff --git a/pydnstest/augwrap.py b/pydnstest/augwrap.py
index a0ec190d0fa3a76d51ff01caff65c6e91bda6c45..8f89e0be304b678301e500ae4fdd2611ede5a9fb 100644
--- a/pydnstest/augwrap.py
+++ b/pydnstest/augwrap.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 
 # Copyright (C) 2017
 
diff --git a/rplint.sh b/rplint.sh
index ccdc435b43aa03eed9190fef440fcdb591f2ea0e..9e569f3fe7604f797f18a2c8fb979b7a23df5894 100755
--- a/rplint.sh
+++ b/rplint.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -x
 set -o errexit -o nounset
 MAKEDIR="$(dirname "$0")"
diff --git a/run.sh b/run.sh
index 911fce591056a34e9d9cac3a8e31f1f38ecd5fe6..2ac4c84046100b5a7fed58d8123e60f800b95ee8 100755
--- a/run.sh
+++ b/run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 MAKEDIR="$(dirname "$0")"
 
 # Currently there no tests requiring faking monotonic time in this repository (there are some elsewhere)
diff --git a/tools/divide_tests.sh b/tools/divide_tests.sh
index 1856610ea5658229435e7237e90af60c9f4df8cf..31b5ed26a0318fade89bc281191a6619c88f5dd1 100644
--- a/tools/divide_tests.sh
+++ b/tools/divide_tests.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Sorts .rpl tests into several categories.
 # Takes a diretory with the tests as an argument and moves the test to its subdirectories.
@@ -48,20 +48,20 @@ mkdir -p "$DEST/sorted_tests/invaliddsa"
 for TEST in "$DEST/sorted_tests/"*.rpl
 do
     if ! python3 invalid_dsa.py "$TEST" >/dev/null 2>/dev/null
-    then 
+    then
         echo -e '\t' $(basename "$TEST")
         mv "$TEST" "$DEST/sorted_tests/invaliddsa"
     fi
 done
 
 
-# Working in selected script 
+# Working in selected script
 echo Working in $SCRIPT:
 mkdir -p "$DEST/sorted_tests/working"
 for TEST in "$DEST/sorted_tests/"*.rpl
 do
     if TESTS="$(readlink -m $TEST)" $SCRIPT >/dev/null 2>/dev/null
-    then 
+    then
         echo -e '\t' $(basename "$TEST")
         mv "$TEST" "$DEST/sorted_tests/working"
     fi
diff --git a/unbound_run.sh b/unbound_run.sh
index a5189e027854bed0106f0fa9c36c651c9ccb9048..665adc0c46b4a4be3eb3003a370fb372fd302c59 100755
--- a/unbound_run.sh
+++ b/unbound_run.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o errexit -o nounset
 
 RUNDIR="$(dirname "$0")"