diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5325488f..dcbdb1f8 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -177,6 +177,13 @@ references:
     LAUNCH_NAME: WEB_K8S_RELEASE
     RETRY_NUMBER: 3
 
+  qa_selfhosted_web_permissions_testpath: &qa_selfhosted_web_permissions_testpath
+    AWS_PROFILE: development
+    TEST_PATH: Suite/SELF-HOSTED/RELEASE/WEB_PERMISSIONS.xml
+    LAUNCH_TAG: CIRCLECI;WEB_PERMISSIONS;SELFHOSTED;RELEASE
+    LAUNCH_NAME: WEB_PERMISSIONS_K8S_RELEASE
+    RETRY_NUMBER: 3
+
   qa_selfhosted_e2e_testpath: &qa_selfhosted_e2e_testpath
     AWS_PROFILE: development
     TEST_PATH: Suite/SELF-HOSTED/RELEASE/E2E.xml
@@ -184,6 +191,13 @@ references:
     LAUNCH_NAME: E2E_K8S_RELEASE
     RETRY_NUMBER: 5
 
+  qa_selfhosted_quarantine_testpath: &qa_selfhosted_quarantine_testpath
+    AWS_PROFILE: development
+    TEST_PATH: Suite/SELF-HOSTED/RELEASE/QUARANTINE.xml
+    LAUNCH_TAG: CIRCLECI;QUARANTINE;SELFHOSTED;RELEASE
+    LAUNCH_NAME: QUARANTINE_K8S_RELEASE
+    RETRY_NUMBER: 3
+
   qa_selfhosted_api_testpath: &qa_selfhosted_api_testpath
     AWS_PROFILE: development
     TEST_PATH: Suite/SELF-HOSTED/RELEASE/API.xml
@@ -439,6 +453,14 @@ jobs:
       <<: *qa_selfhosted_web_testpath
     <<: *qa_job
 
+  test_web_permissions:
+    <<: *qa_automation_image
+    resource_class: large
+    environment:
+      <<: *qa_environment_release
+      <<: *qa_selfhosted_web_permissions_testpath
+    <<: *qa_job
+
   test_e2e:
     <<: *qa_automation_image
     resource_class: large
@@ -447,6 +469,14 @@ jobs:
       <<: *qa_selfhosted_e2e_testpath
     <<: *qa_job
 
+  test_quarantine:
+    <<: *qa_automation_image
+    resource_class: large
+    environment:
+      <<: *qa_environment_release
+      <<: *qa_selfhosted_quarantine_testpath
+    <<: *qa_job
+
   test_api:
     <<: *qa_automation_image
     resource_class: large
@@ -736,31 +766,37 @@ workflows:
           requires:
             - test_check_cookies_expired_releases_k8s
 
+      - test_web_permissions:
+          context: CodacyAWS
+          requires:
+            - test_check_cookies_expired_releases_k8s
+
       - test_e2e:
           context: CodacyAWS
           requires:
             - test_check_cookies_expired_releases_k8s
 
+      - test_quarantine:
+          context: CodacyAWS
+          requires:
+            - test_check_cookies_expired_releases_k8s
+
+      # Intentionally does not depend on the QA test jobs so that a manual
+      # approval path to the deploy remains available even if any of them fail.
       - manual_qa_hold:
           type: approval
           context: CodacyDO
           requires:
-            - test_web
-            - test_e2e
-            - test_api
-            - test_apiv3
             - install_k8s-1.30_helm-3.16.3
             - install_k8s-1.31_helm-3.16.3
             - install_k8s-1.32_helm-3.19.0
             - install_k8s-1.33_helm-3.19.0
+      # Intentionally does not depend on the QA test jobs so that a manual
+      # approval path to the deploy remains available even if any of them fail.
       - manual_solutions_eng_hold:
           type: approval
           context: CodacyDO
           requires:
-            - test_web
-            - test_e2e
-            - test_api
-            - test_apiv3
             - install_k8s-1.30_helm-3.16.3
             - install_k8s-1.31_helm-3.16.3
             - install_k8s-1.32_helm-3.19.0
diff --git a/.do/k8s-cluster/Makefile b/.do/k8s-cluster/Makefile
index 10237ec7..f6c25aa8 100644
--- a/.do/k8s-cluster/Makefile
+++ b/.do/k8s-cluster/Makefile
@@ -7,8 +7,10 @@ WORKSPACE ?= ${DO_TF_WORKSPACE}
 VARS_FILE ?= deploy.tfvars
 NGINX_INGRESS_VERSION ?= 4.11.3
 CERT_MANAGER_VERSION ?= v1.15.3
-K8S_VERSION ?= 1.33
-DO_K8S_SLUG ?= $(shell doctl kubernetes options versions | grep $(K8S_VERSION) | awk '{print $$1}')
+K8S_VERSION ?= 1.34
+# Resolve the newest DO slug for K8S_VERSION. Anchored on the Slug column and
+# limited to a single result, so an unexpected match can't corrupt the tfvars.
+DO_K8S_SLUG ?= $(shell doctl kubernetes options versions | awk 'NR>1 && $$1 ~ /^$(K8S_VERSION)\./ {print $$1; exit}')
 NODE_TYPE ?= s-8vcpu-32gb
 NODES_MIN ?= 1
 NODES_MAX ?= 10
@@ -30,6 +32,12 @@ setup_vars:
 	@echo "docker_password = [REDACTED]"
 	@echo "docker_password = \"$(DOCKER_PASSWORD)\"" >> $(VARS_FILE)
 
+	@test -n "$(DO_K8S_SLUG)" || { \
+		echo "ERROR: could not resolve a DigitalOcean k8s slug for K8S_VERSION=$(K8S_VERSION)."; \
+		echo "DigitalOcean only offers the most recent minor versions. Available:"; \
+		doctl kubernetes options versions; \
+		exit 1; \
+	}
 	@echo "k8s_version = \"$(DO_K8S_SLUG)\"" >> $(VARS_FILE)
 	@echo "node_type = \"$(NODE_TYPE)\"" >> $(VARS_FILE)
 	@echo "nodes_min = $(NODES_MIN)" >> $(VARS_FILE)