diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 6dd8bb362e1..7e879aa132e 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -163,7 +163,6 @@ go_deps.bzl               @dfinity/idx
 /rs/memory_tracker/                                     @dfinity/execution
 /rs/messaging/                                          @dfinity/ic-message-routing-owners
 /rs/monitoring/                                         @dfinity/consensus
-/rs/monitoring/backtrace/                               @dfinity/consensus @dfinity/ic-message-routing-owners
 /rs/monitoring/metrics                                  @dfinity/consensus @dfinity/ic-message-routing-owners
 /rs/monitoring/pprof/                                   @dfinity/consensus @dfinity/ic-message-routing-owners
 /rs/nervous_system/                                     @dfinity/nns-team
diff --git a/.github/actions/bazel-test-all/action.yaml b/.github/actions/bazel-test-all/action.yaml
index b7e3f0d39d0..0f432cbc581 100644
--- a/.github/actions/bazel-test-all/action.yaml
+++ b/.github/actions/bazel-test-all/action.yaml
@@ -33,6 +33,7 @@ runs:
           if [ -z "${SSH_AUTH_SOCK:-}" ]; then
             eval "$(ssh-agent -s)"
             ssh-add - <<< '${{ inputs.SSH_PRIVATE_KEY_BACKUP_POD }}'
+            echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> "$GITHUB_ENV"
           fi
 
           rm -rf ~/.ssh
diff --git a/.github/workflows/update-mainnet-revisions.yaml b/.github/workflows/update-mainnet-revisions.yaml
index 75048ccde07..61686fce43e 100644
--- a/.github/workflows/update-mainnet-revisions.yaml
+++ b/.github/workflows/update-mainnet-revisions.yaml
@@ -28,6 +28,8 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Update IC versions file
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           set -eEuxo pipefail
 
@@ -46,8 +48,8 @@ jobs:
         uses: actions/create-github-app-token@v1
         id: app-token
         with:
-          app-id: ${{ vars.PR_CREATION_BOT_PRIVATE_KEY }}
-          private-key: ${{ secrets.PR_CREATION_BOT_APP_ID }}
+          app-id: ${{ vars.PR_CREATION_BOT_APP_ID }}
+          private-key: ${{ secrets.PR_CREATION_BOT_PRIVATE_KEY }}
 
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -61,6 +63,8 @@ jobs:
           version: 2.53.0
 
       - name: Update Mainnet canisters file
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           set -eEuxo pipefail
 
diff --git a/bazel/conf/.bazelrc.build b/bazel/conf/.bazelrc.build
index 776250fd770..d487c0ff7cd 100644
--- a/bazel/conf/.bazelrc.build
+++ b/bazel/conf/.bazelrc.build
@@ -72,10 +72,6 @@ test:systest --test_output=streamed --test_tag_filters=
 build:testnet --build_tag_filters=
 test:testnet --test_output=streamed --test_tag_filters=
 
-# For sandboxed actions, mount an empty, writable directory at this absolute path
-# (if supported by the sandboxing implementation, ignored otherwise).
-test --sandbox_tmpfs_path=/tmp
-
 # TODO(IDX-2374): enable alltests in CI when we will have actual system tests.
 #test:ci --config=alltests
 
diff --git a/ci/bazel-scripts/main.sh b/ci/bazel-scripts/main.sh
index a91a08b2fa1..a0805cfaf7c 100755
--- a/ci/bazel-scripts/main.sh
+++ b/ci/bazel-scripts/main.sh
@@ -38,6 +38,9 @@ fi
 # if bazel targets is empty we don't need to run any tests
 if [ -z "${BAZEL_TARGETS:-}" ]; then
     echo "No bazel targets to build"
+    # create empty SHA256SUMS for build determinism
+    # (not ideal but temporary until we can improve or get rid of diff.sh)
+    touch SHA256SUMS
     exit 0
 fi
 
diff --git a/mainnet-subnet-revisions.json b/mainnet-subnet-revisions.json
index 3d9d262c86e..7acb154f6f3 100644
--- a/mainnet-subnet-revisions.json
+++ b/mainnet-subnet-revisions.json
@@ -1,6 +1,6 @@
 {
   "subnets": {
-    "tdb26-jop6k-aogll-7ltgs-eruif-6kk7m-qpktf-gdiqx-mxtrf-vb5e6-eqe": "2008d47a169c4984631c87f2efaa88798e6f14dc",
-    "io67a-2jmkw-zup3h-snbwi-g6a5n-rm5dn-b6png-lvdpl-nqnto-yih6l-gqe": "7147f471c7ac27f518e6c0eeb2015952b5e93e1b"
+    "tdb26-jop6k-aogll-7ltgs-eruif-6kk7m-qpktf-gdiqx-mxtrf-vb5e6-eqe": "7147f471c7ac27f518e6c0eeb2015952b5e93e1b",
+    "io67a-2jmkw-zup3h-snbwi-g6a5n-rm5dn-b6png-lvdpl-nqnto-yih6l-gqe": "6e64281a8e0b4faa1d859f115fc138eee6e136f8"
   }
 }
\ No newline at end of file
diff --git a/rs/ledger_suite/icrc1/ledger/src/main.rs b/rs/ledger_suite/icrc1/ledger/src/main.rs
index 31ce5b260a7..bb59f0dfb7a 100644
--- a/rs/ledger_suite/icrc1/ledger/src/main.rs
+++ b/rs/ledger_suite/icrc1/ledger/src/main.rs
@@ -785,6 +785,10 @@ fn supported_standards() -> Vec<StandardRecord> {
             name: "ICRC-3".to_string(),
             url: "https://github.com/dfinity/ICRC-1/tree/main/standards/ICRC-3".to_string(),
         },
+        StandardRecord {
+            name: "ICRC-10".to_string(),
+            url: "https://github.com/dfinity/ICRC/blob/main/ICRCs/ICRC-10/ICRC-10.md".to_string(),
+        },
         StandardRecord {
             name: "ICRC-21".to_string(),
             url: "https://github.com/dfinity/wg-identity-authentication/blob/main/topics/ICRC-21/icrc_21_consent_msg.md".to_string(),
diff --git a/rs/ledger_suite/tests/sm-tests/src/lib.rs b/rs/ledger_suite/tests/sm-tests/src/lib.rs
index 77e4647deac..4d1203c4c50 100644
--- a/rs/ledger_suite/tests/sm-tests/src/lib.rs
+++ b/rs/ledger_suite/tests/sm-tests/src/lib.rs
@@ -1084,7 +1084,10 @@ where
         standards.push(standard.name);
     }
     standards.sort();
-    assert_eq!(standards, vec!["ICRC-1", "ICRC-2", "ICRC-21", "ICRC-3"]);
+    assert_eq!(
+        standards,
+        vec!["ICRC-1", "ICRC-10", "ICRC-2", "ICRC-21", "ICRC-3"]
+    );
 }
 
 pub fn test_total_supply<T>(ledger_wasm: Vec<u8>, encode_init_args: fn(InitArgs) -> T)