diff --git a/.github/actions/test/integration/collect-logs/action.yml b/.github/actions/test/integration/collect-logs/action.yml
index 0974c811..51df119b 100644
--- a/.github/actions/test/integration/collect-logs/action.yml
+++ b/.github/actions/test/integration/collect-logs/action.yml
@@ -34,6 +34,44 @@ runs:
         scp $SSH_OPTS $USER@$HV2_IP:/var/log/QEMU.log "serial-VM-QEMU-HV2.log" || true
         scp $SSH_OPTS $USER@$HV2_IP:/var/log/CHV.log "serial-VM-CHV-HV2.log" || true
 
+    - name: Obtain network diagnostics from hypervisors
+      shell: bash
+      run: |
+        KEY=/opt/ssh_host_ed25519_key
+        SSH_OPTS="-i $KEY -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+        USER="root"
+
+        for HV_NAME in HV1 HV2; do
+          IP="192.168.122.$([[ $HV_NAME == HV1 ]] && echo 2 || echo 3)"
+
+          ssh $SSH_OPTS $USER@$IP "
+            echo '=== ip addr ==='
+            ip addr
+            echo '=== ip route ==='
+            ip route
+            echo '=== bridge link ==='
+            bridge link 2>/dev/null || true
+            echo '=== arp -n ==='
+            arp -n 2>/dev/null || ip neigh || true
+            echo '=== iptables -L -n ==='
+            iptables -L -n 2>/dev/null || true
+            echo '=== iptables -t nat -L -n ==='
+            iptables -t nat -L -n 2>/dev/null || true
+            echo '=== virsh net-list ==='
+            virsh net-list --all 2>/dev/null || true
+            echo '=== virsh net-dumpxml default ==='
+            virsh net-dumpxml default 2>/dev/null || true
+            echo '=== dnsmasq leases ==='
+            cat /var/lib/libvirt/dnsmasq/*.leases 2>/dev/null || true
+            echo '=== systemctl status systemd-networkd ==='
+            systemctl status systemd-networkd --no-pager 2>/dev/null || true
+            echo '=== networkctl status ==='
+            networkctl status --no-pager 2>/dev/null || true
+            echo '=== ssh -V ==='
+            ssh -V 2>&1 || true
+          " > "network-diag-${HV_NAME}.log" 2>&1 || true
+        done
+
     - name: Set permissions
       shell: bash
       run: |
diff --git a/.github/actions/test/integration/test/cloudhypervisor/action.yml b/.github/actions/test/integration/test/cloudhypervisor/action.yml
index f3eeabc8..078de40e 100644
--- a/.github/actions/test/integration/test/cloudhypervisor/action.yml
+++ b/.github/actions/test/integration/test/cloudhypervisor/action.yml
@@ -52,7 +52,14 @@ runs:
             IP=\$(virsh -c ch:///session domifaddr VM-CHV | awk '/ipv4/ {print \$4}' | cut -d'/' -f1)
             if [ -z "\$IP" ]; then
               echo "No IP address found for VM. Retrying..."
-            elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' ; then
+            elif (( i >= MAX_ITER - 2 )); then
+              # Show SSH errors on last 3 attempts for debugging
+              if ssh \$SSH_OPTS "\$USER@\$IP" 'exit'; then
+                echo "VM is up at IP: \$IP"
+                ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
+                break
+              fi
+            elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # create a dummy file for verification later
               ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
@@ -60,6 +67,18 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- virsh -c ch:///session domifaddr VM-CHV ---"
+              virsh -c ch:///session domifaddr VM-CHV || true
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- arp -n ---"
+              arp -n 2>/dev/null || ip neigh || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
@@ -111,7 +130,7 @@ runs:
 
           MAX_ITER=15
           for ((i=1; i<=MAX_ITER; i++)); do
-            if ssh \$SSH_OPTS "\$USER@\$IP" 'exit' ; then
+            if ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # verify the migration by checking the dummy file
               if ssh \$SSH_OPTS "\$USER@\$IP" 'test -f /opt/hello.txt'; then
@@ -124,6 +143,14 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
diff --git a/.github/actions/test/integration/test/qemu/action.yml b/.github/actions/test/integration/test/qemu/action.yml
index 0dab0344..e6887e51 100644
--- a/.github/actions/test/integration/test/qemu/action.yml
+++ b/.github/actions/test/integration/test/qemu/action.yml
@@ -50,6 +50,13 @@ runs:
             IP=\$(virsh domifaddr VM-QEMU | awk '/ipv4/ {print \$4}' | cut -d'/' -f1)
             if [ -z "\$IP" ]; then
               echo "No IP address found for VM. Retrying..."
+            elif (( i >= MAX_ITER - 2 )); then
+              # Show SSH errors on last 3 attempts for debugging
+              if ssh \$SSH_OPTS "\$USER@\$IP" 'exit'; then
+                echo "VM is up at IP: \$IP"
+                ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
+                break
+              fi
             elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # create a dummy file for verification later
@@ -58,6 +65,18 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- virsh domifaddr VM-QEMU ---"
+              virsh domifaddr VM-QEMU || true
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- arp -n ---"
+              arp -n 2>/dev/null || ip neigh || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
@@ -122,6 +141,14 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 901b387d..cf4bfe18 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index c90de876..c7b5ae6e 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 542b73d1..73d2e37b 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index 11e46b58..e9406d31 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2150.6.0
+2150.7.0
diff --git a/features/_scicommon/pkg.include b/features/_scicommon/pkg.include
index a8ef4049..af58852c 100644
--- a/features/_scicommon/pkg.include
+++ b/features/_scicommon/pkg.include
@@ -1 +1,2 @@
 gnupg
+openssh-client
diff --git a/gardenlinux b/gardenlinux
index 7b7c0db8..5e66e8da 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 7b7c0db856bfe4b7e976215c03d87652c277bf0e
+Subproject commit 5e66e8da34e90e9c257662f4a80142ebe11ca346