diff --git a/.zuul.yaml b/.zuul.yaml
index d44f208..8eaf6af 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,6 +1,7 @@
 - job:
     name: keystone-protection-functional
     parent: keystone-dsvm-py3-functional
+    voting: false
     vars:
       tempest_test_regex: 'keystone_tempest_plugin.tests.rbac'
       devstack_localrc:
@@ -41,20 +42,26 @@
     check:
       jobs:
         - keystone-dsvm-py3-functional
-        - keystone-dsvm-py3-functional-federation-ubuntu-focal:
+        - keystone-dsvm-py3-functional-federation-ubuntu-jammy:
             voting: false
-        - keystone-dsvm-py3-functional-federation-ubuntu-focal-k2k
+        - keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k
+        - keystone-dsvm-py3-functional-2024-1
         - keystone-dsvm-py3-functional-2023-2
         - keystone-dsvm-py3-functional-2023-1
-        - keystone-dsvm-py3-functional-zed
         - keystone-protection-functional
     gate:
       jobs:
         - keystone-dsvm-py3-functional
-        - keystone-dsvm-py3-functional-federation-ubuntu-focal-k2k
+        - keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k
         - keystone-protection-functional
 
 - job:
+    name: keystone-dsvm-py3-functional-2024-1
+    parent: keystone-dsvm-py3-functional
+    nodeset: openstack-single-node-jammy
+    override-checkout: stable/2024.1
+
+- job:
     name: keystone-dsvm-py3-functional-2023-2
     parent: keystone-dsvm-py3-functional
     nodeset: openstack-single-node-jammy
@@ -65,9 +72,3 @@
     parent: keystone-dsvm-py3-functional
     nodeset: openstack-single-node-jammy
     override-checkout: stable/2023.1
-
-- job:
-    name: keystone-dsvm-py3-functional-zed
-    parent: keystone-dsvm-py3-functional
-    nodeset: openstack-single-node-focal
-    override-checkout: stable/zed
diff --git a/keystone_tempest_plugin/tests/rbac/v3/test_credential.py b/keystone_tempest_plugin/tests/rbac/v3/test_credential.py
index ca7d355..0c70589 100644
--- a/keystone_tempest_plugin/tests/rbac/v3/test_credential.py
+++ b/keystone_tempest_plugin/tests/rbac/v3/test_credential.py
@@ -339,109 +339,15 @@
     credentials = ['system_reader', 'system_admin']
 
 
-class DomainAdminTests(IdentityV3RbacCredentialTest, base.BaseIdentityTest):
+class DomainAdminTests(SystemAdminTests):
 
     credentials = ['domain_admin', 'system_admin']
 
-    def test_identity_create_credential(self):
-        # domain admins cannot create credentials
-        user_id = self.persona.credentials.user_id
-        for u in [user_id, self.test_user_1, self.test_user_2]:
-            self.do_request(
-                'create_credential',
-                expected_status=exceptions.Forbidden,
-                **self.credential(user_id=u))
 
-    def test_identity_get_credential(self):
-        # domain admins cannot get credentials
-        user_id = self.persona.credentials.user_id
-        for u in [user_id, self.test_user_1, self.test_user_2]:
-            cred = self.admin_credentials_client.create_credential(
-                **self.credential(user_id=u))['credential']
-            self.addCleanup(
-                self.admin_credentials_client.delete_credential, cred['id'])
-            self.do_request(
-                'show_credential',
-                expected_status=exceptions.Forbidden,
-                credential_id=cred['id'])
-        # non-existent credential is Forbidden
-        self.do_request(
-            'show_credential',
-            expected_status=exceptions.Forbidden,
-            credential_id=data_utils.rand_uuid_hex())
-
-    def test_identity_list_credentials(self):
-        # domain admins cannot list credentials
-        user_id = self.persona.credentials.user_id
-        for u in [user_id, self.test_user_1, self.test_user_2]:
-            cred = self.admin_credentials_client.create_credential(
-                **self.credential(user_id=u))['credential']
-            self.addCleanup(
-                self.admin_credentials_client.delete_credential, cred['id'])
-            self.do_request(
-                'list_credentials',
-                expected_status=exceptions.Forbidden)
-
-    def test_identity_update_credential(self):
-        # domain admins cannot update credentials
-        user_id = self.persona.credentials.user_id
-        for u in [user_id, self.test_user_1, self.test_user_2]:
-            cred = self.credential(user_id=u)
-            resp = self.admin_credentials_client.create_credential(
-                **cred)['credential']
-            self.addCleanup(
-                self.admin_credentials_client.delete_credential, resp['id'])
-            cred['blob'] = data_utils.rand_uuid_hex()
-            self.do_request(
-                'update_credential',
-                expected_status=exceptions.Forbidden,
-                credential_id=resp['id'], **cred)
-        # non-existent credential is Forbidden
-        self.do_request(
-            'update_credential',
-            expected_status=exceptions.Forbidden,
-            credential_id=data_utils.rand_uuid_hex(),
-            **self.credential(user_id=user_id))
-
-    def test_identity_delete_credential(self):
-        # domain admins cannot delete credentials
-        user_id = self.persona.credentials.user_id
-        for u in [user_id, self.test_user_1, self.test_user_2]:
-            cred = self.credential(user_id=u)
-            resp = self.admin_credentials_client.create_credential(
-                **cred)['credential']
-            self.addCleanup(
-                self.admin_credentials_client.delete_credential, resp['id'])
-            self.do_request(
-                'delete_credential',
-                expected_status=exceptions.Forbidden,
-                credential_id=resp['id'])
-        # non-existent credential is Forbidden
-        self.do_request(
-            'delete_credential',
-            expected_status=exceptions.Forbidden,
-            credential_id=data_utils.rand_uuid_hex())
-
-
-class DomainMemberTests(DomainAdminTests):
+class DomainMemberTests(SystemReaderTests):
 
     credentials = ['domain_member', 'system_admin']
 
-
-class DomainReaderTests(DomainAdminTests):
-
-    credentials = ['domain_reader', 'system_admin']
-
-
-class ProjectAdminTests(SystemAdminTests):
-
-    credentials = ['project_admin', 'system_admin']
-
-
-class ProjectMemberTests(SystemReaderTests):
-
-    credentials = ['project_member', 'system_admin']
-
     def test_identity_get_credential(self):
         # user can get their own credential
         user_id = self.persona.credentials.user_id
@@ -485,6 +391,21 @@
             self.assertNotIn(cred['id'], [c['id'] for c in resp])
 
 
+class DomainReaderTests(DomainMemberTests):
+
+    credentials = ['domain_reader', 'system_admin']
+
+
+class ProjectAdminTests(SystemAdminTests):
+
+    credentials = ['project_admin', 'system_admin']
+
+
+class ProjectMemberTests(DomainReaderTests):
+
+    credentials = ['project_member', 'system_admin']
+
+
 class ProjectReaderTests(ProjectMemberTests):
 
     credentials = ['project_reader', 'system_admin']
diff --git a/keystone_tempest_plugin/tests/rbac/v3/test_role.py b/keystone_tempest_plugin/tests/rbac/v3/test_role.py
index 997731c..32fa424 100644
--- a/keystone_tempest_plugin/tests/rbac/v3/test_role.py
+++ b/keystone_tempest_plugin/tests/rbac/v3/test_role.py
@@ -323,26 +323,10 @@
 
     credentials = ['domain_admin', 'system_admin']
 
-    def test_identity_get_role(self):
-        # user cannot get role
-        role = self.admin_roles_client.create_role(
-            **self.role())['role']
-        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
-        self.do_request('show_role', expected_status=exceptions.Forbidden,
-                        role_id=role['id'])
-        # user gets a 404 for nonexistent role
-        self.do_request('show_role', expected_status=exceptions.NotFound,
-                        role_id=data_utils.rand_uuid_hex())
-
-    def test_identity_list_roles(self):
-        # user cannot list roles
-        role = self.admin_roles_client.create_role(**self.role())['role']
-        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
-        self.do_request('list_roles', expected_status=exceptions.Forbidden)
-
     def test_identity_get_domain_role(self):
         # user cannot get domain role in own domain
-        role = self.admin_roles_client.create_role(**self.role())['role']
+        role = self.admin_roles_client.create_role(
+            **self.role(domain_id=self.own_domain))['role']
         self.addCleanup(self.admin_roles_client.delete_role, role['id'])
         self.do_request('show_role', expected_status=exceptions.Forbidden,
                         role_id=role['id'])
@@ -369,6 +353,23 @@
 
     credentials = ['domain_member', 'system_admin']
 
+    def test_identity_get_role(self):
+        # user cannot get role
+        role = self.admin_roles_client.create_role(
+            **self.role())['role']
+        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
+        self.do_request('show_role', expected_status=exceptions.Forbidden,
+                        role_id=role['id'])
+        # user gets a 404 for nonexistent role
+        self.do_request('show_role', expected_status=exceptions.NotFound,
+                        role_id=data_utils.rand_uuid_hex())
+
+    def test_identity_list_roles(self):
+        # user cannot list roles
+        role = self.admin_roles_client.create_role(**self.role())['role']
+        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
+        self.do_request('list_roles', expected_status=exceptions.Forbidden)
+
 
 class DomainReaderTests(DomainMemberTests):
 
@@ -380,7 +381,7 @@
     credentials = ['project_admin', 'system_admin']
 
 
-class ProjectMemberTests(DomainReaderTests):
+class ProjectMemberTests(DomainMemberTests):
 
     credentials = ['project_member', 'system_admin']