diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 5cdbf075bd..321b5d5220 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -24,6 +24,7 @@ jobs:
         SCALA_VERSION: [2.13, 3]
         JDK: [17, 21, 25]
         PEKKO_VERSION: ['main']
+        TLS_ENGINE_CONFIG: ['legacy-actor', 'graph-stage']
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -55,8 +56,12 @@ jobs:
       - name: Compile everything
         run: sbt -Dpekko.build.pekko.version=${{ matrix.PEKKO_VERSION }} "++ ${{ matrix.SCALA_VERSION }}" Test/compile
 
-      - name: Run all tests JDK ${{ matrix.JDK }}, Scala ${{ matrix.SCALA_VERSION }}, Pekko ${{ matrix.PEKKO_VERSION }}
-        run: sbt -Dpekko.http.parallelExecution=false -Dpekko.test.timefactor=2 -Dpekko.build.pekko.version=${{ matrix.PEKKO_VERSION }} "++ ${{ matrix.SCALA_VERSION }}" mimaReportBinaryIssues test
+      - name: Run all tests JDK ${{ matrix.JDK }}, Scala ${{ matrix.SCALA_VERSION }}, Pekko ${{ matrix.PEKKO_VERSION }}, TLS Engine ${{ matrix.TLS_ENGINE_CONFIG }}
+        run: |
+          sbt -Dpekko.http.parallelExecution=false -Dpekko.test.timefactor=2 
+            -Dpekko.build.pekko.version=${{ matrix.PEKKO_VERSION }}
+            -DTLS_ENGINE_CONFIG=${{ matrix.TLS_ENGINE_CONFIG }}
+            "++ ${{ matrix.SCALA_VERSION }}" mimaReportBinaryIssues test
 
       - name: Upload test results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/docs/src/test/resources/application.conf b/docs/src/test/resources/application.conf
index 129c365666..25565a78d1 100644
--- a/docs/src/test/resources/application.conf
+++ b/docs/src/test/resources/application.conf
@@ -3,4 +3,9 @@
 pekko {
   # needed because we add pekko-actor-typed here but don't include an slf4j implementation
   use-slf4j = off
+  # TLS engine to use for tests, default is "legacy-actor" but can be overridden by setting
+  # the system property or environment variable TLS_ENGINE_CONFIG to "graph-stage"
+  # see https://github.com/apache/pekko/pull/2878
+  stream.materializer.tls.engine = "legacy-actor"
+  stream.materializer.tls.engine = ${?TLS_ENGINE_CONFIG}
 }
diff --git a/http-tests/src/test/resources/application.conf b/http-tests/src/test/resources/application.conf
index e8b0eb68a0..6138c0c64f 100644
--- a/http-tests/src/test/resources/application.conf
+++ b/http-tests/src/test/resources/application.conf
@@ -8,6 +8,11 @@ pekko {
     default-dispatcher.throughput = 1
   }
   stream.materializer.debug.fuzzing-mode = on
+  # TLS engine to use for tests, default is "legacy-actor" but can be overridden by setting
+  # the system property or environment variable TLS_ENGINE_CONFIG to "graph-stage"
+  # see https://github.com/apache/pekko/pull/2878
+  stream.materializer.tls.engine = "legacy-actor"
+  stream.materializer.tls.engine = ${?TLS_ENGINE_CONFIG}
 
   # silence some annoying warnings
   stream.secret-test-fuzzing-warning-disable = 42