diff --git a/.github/workflows/ca-admin-user-test.yml b/.github/workflows/ca-admin-user-test.yml
index fd6ab2c664b..3b4fcc07a63 100644
--- a/.github/workflows/ca-admin-user-test.yml
+++ b/.github/workflows/ca-admin-user-test.yml
@@ -217,6 +217,9 @@ jobs:
         run: |
           docker exec pki pki -n caadmin ca-user-find
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -234,9 +237,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-basic-test.yml b/.github/workflows/ca-basic-test.yml
index c062c2490c1..5a346af28c5 100644
--- a/.github/workflows/ca-basic-test.yml
+++ b/.github/workflows/ca-basic-test.yml
@@ -214,6 +214,9 @@ jobs:
           docker exec pki pki --debug -n caadmin ca-profile-add ${SHARED}/profile.xml
           docker exec pki pki -n caadmin ca-profile-show caCustomUser
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -231,9 +234,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-cmc-shared-token-test.yml b/.github/workflows/ca-cmc-shared-token-test.yml
index d1b08c14350..4b782ab7114 100644
--- a/.github/workflows/ca-cmc-shared-token-test.yml
+++ b/.github/workflows/ca-cmc-shared-token-test.yml
@@ -382,6 +382,9 @@ jobs:
           cat output | wc -l > actual
           diff expected actual
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -399,9 +402,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-ds-connection-test.yml b/.github/workflows/ca-ds-connection-test.yml
index e97c4a7aec1..21042bad6d8 100644
--- a/.github/workflows/ca-ds-connection-test.yml
+++ b/.github/workflows/ca-ds-connection-test.yml
@@ -155,6 +155,9 @@ jobs:
           echo "0" > expected
           diff expected actual
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
diff --git a/.github/workflows/ca-ecc-test.yml b/.github/workflows/ca-ecc-test.yml
index 6add91c2831..b1d9174d0ea 100644
--- a/.github/workflows/ca-ecc-test.yml
+++ b/.github/workflows/ca-ecc-test.yml
@@ -252,6 +252,9 @@ jobs:
           sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
           diff expected actual
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -269,9 +272,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-existing-certs-test.yml b/.github/workflows/ca-existing-certs-test.yml
index 182177901ff..e44a3130fff 100644
--- a/.github/workflows/ca-existing-certs-test.yml
+++ b/.github/workflows/ca-existing-certs-test.yml
@@ -365,6 +365,9 @@ jobs:
           docker exec pki pki ca-cert-find
           docker exec pki pki -n caadmin ca-cert-request-find
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -382,9 +385,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-existing-ds-test.yml b/.github/workflows/ca-existing-ds-test.yml
index f103ee65bb0..f33cfe560d8 100644
--- a/.github/workflows/ca-existing-ds-test.yml
+++ b/.github/workflows/ca-existing-ds-test.yml
@@ -420,6 +420,9 @@ jobs:
           docker exec pki pki securitydomain-show | tee output
           diff expected output
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -437,9 +440,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-existing-hsm-test.yml b/.github/workflows/ca-existing-hsm-test.yml
index 6e3b48c321b..b2d6ee9810e 100644
--- a/.github/workflows/ca-existing-hsm-test.yml
+++ b/.github/workflows/ca-existing-hsm-test.yml
@@ -418,6 +418,13 @@ jobs:
           docker exec pki pki ca-cert-find
           docker exec pki pki -n caadmin ca-cert-request-find
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
+      - name: Remove SoftHSM token
+        run: |
+          docker exec pki runuser -u pkiuser -- softhsm2-util --delete-token --token HSM
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -435,13 +442,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
-      - name: Remove SoftHSM token
-        run: |
-          docker exec pki runuser -u pkiuser -- softhsm2-util --delete-token --token HSM
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-existing-nssdb-test.yml b/.github/workflows/ca-existing-nssdb-test.yml
index 6f89a3ac7cb..57d15994782 100644
--- a/.github/workflows/ca-existing-nssdb-test.yml
+++ b/.github/workflows/ca-existing-nssdb-test.yml
@@ -309,6 +309,9 @@ jobs:
           docker exec pki pki ca-cert-find
           docker exec pki pki -n caadmin ca-cert-request-find
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -326,9 +329,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-hsm-test.yml b/.github/workflows/ca-hsm-test.yml
index 0afeb4cc47c..2e8c31b8f3b 100644
--- a/.github/workflows/ca-hsm-test.yml
+++ b/.github/workflows/ca-hsm-test.yml
@@ -217,6 +217,14 @@ jobs:
               --pkcs12-password Secret.123
           docker exec pki pki -n caadmin ca-user-show caadmin
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
+      - name: Remove SoftHSM token
+        run: |
+          docker exec pki ls -laR /var/lib/softhsm/tokens
+          docker exec pki runuser -u pkiuser -- softhsm2-util --delete-token --token HSM
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -234,14 +242,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
-      - name: Remove SoftHSM token
-        run: |
-          docker exec pki ls -laR /var/lib/softhsm/tokens
-          docker exec pki runuser -u pkiuser -- softhsm2-util --delete-token --token HSM
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-non-default-user-test.yml b/.github/workflows/ca-non-default-user-test.yml
index 4d16cc58f26..567045570b9 100644
--- a/.github/workflows/ca-non-default-user-test.yml
+++ b/.github/workflows/ca-non-default-user-test.yml
@@ -90,6 +90,9 @@ jobs:
               --pkcs12-password Secret.123
           docker exec pki pki -n caadmin ca-user-show caadmin
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -107,9 +110,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-nuxwdog-test.yml b/.github/workflows/ca-nuxwdog-test.yml
index 1c3eac7c78d..9e1ca855d13 100644
--- a/.github/workflows/ca-nuxwdog-test.yml
+++ b/.github/workflows/ca-nuxwdog-test.yml
@@ -149,6 +149,9 @@ jobs:
           docker exec pki pki info
           docker exec pki pki -n caadmin ca-user-show caadmin
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -166,9 +169,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-pruning-test.yml b/.github/workflows/ca-pruning-test.yml
index 76738185ae7..b859f9c02fe 100644
--- a/.github/workflows/ca-pruning-test.yml
+++ b/.github/workflows/ca-pruning-test.yml
@@ -425,6 +425,9 @@ jobs:
           echo "RequestNotFoundException: Request ID $REQUEST_ID not found" > expected
           diff expected stderr
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -442,9 +445,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-rsa-pss-test.yml b/.github/workflows/ca-rsa-pss-test.yml
index 03c086e9be9..9bb01a0db56 100644
--- a/.github/workflows/ca-rsa-pss-test.yml
+++ b/.github/workflows/ca-rsa-pss-test.yml
@@ -261,6 +261,9 @@ jobs:
           sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
           diff expected actual
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -278,9 +281,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-rsa-test.yml b/.github/workflows/ca-rsa-test.yml
index 03012c5efff..997018fe163 100644
--- a/.github/workflows/ca-rsa-test.yml
+++ b/.github/workflows/ca-rsa-test.yml
@@ -260,6 +260,9 @@ jobs:
           sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
           diff expected actual
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -277,9 +280,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-rsnv1-test.yml b/.github/workflows/ca-rsnv1-test.yml
index 7a0b914b431..7bf1adfcd56 100644
--- a/.github/workflows/ca-rsnv1-test.yml
+++ b/.github/workflows/ca-rsnv1-test.yml
@@ -128,6 +128,9 @@ jobs:
         run: |
           docker exec pki pki ca-cert-find
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -145,9 +148,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ca-sequential-test.yml b/.github/workflows/ca-sequential-test.yml
index b7dcf63f3b0..dee4ff7c671 100644
--- a/.github/workflows/ca-sequential-test.yml
+++ b/.github/workflows/ca-sequential-test.yml
@@ -119,6 +119,9 @@ jobs:
         run: |
           docker exec pki pki ca-cert-find
 
+      - name: Remove CA
+        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
+
       - name: Check PKI server systemd journal
         if: always()
         run: |
@@ -136,9 +139,6 @@ jobs:
           tests/bin/pki-artifacts-save.sh pki
         continue-on-error: true
 
-      - name: Remove CA
-        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
-
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v4