diff --git a/manila_tempest_tests/common/barbican_client_mgr.py b/manila_tempest_tests/common/barbican_client_mgr.py
new file mode 100644
index 0000000..ee8b53f
--- /dev/null
+++ b/manila_tempest_tests/common/barbican_client_mgr.py
@@ -0,0 +1,73 @@
+# Copyright 2025 Cloudifcation GmbH.  All rights reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import base64
+import secrets
+
+from oslo_log import log as logging
+from tempest import config
+from tempest.lib.services import clients
+from tempest import test
+
+CONF = config.CONF
+LOG = logging.getLogger(__name__)
+
+
+class BarbicanClientManager(test.BaseTestCase):
+    """Class for interacting with the barbican service.
+
+    This class is an abstraction for interacting with the barbican service.
+    """
+
+    credentials = ['primary',]
+
+    @classmethod
+    def setup_clients(cls, tempest_client_mgr):
+        super(BarbicanClientManager, cls).setup_clients()
+        if CONF.identity.auth_version == 'v3':
+            auth_uri = CONF.identity.uri_v3
+        else:
+            auth_uri = CONF.identity.uri
+        service_clients = clients.ServiceClients(
+            tempest_client_mgr.credentials,
+            auth_uri)
+        cls.secret_client = service_clients.secret_v1.SecretClient(
+            service='key-manager')
+
+    @classmethod
+    def ref_to_uuid(cls, href):
+        return href.split('/')[-1]
+
+    def store_secret(self):
+        """Store a secret in barbican.
+
+        :returns: The barbican secret_ref.
+        """
+
+        key = secrets.token_bytes(32)
+
+        manila_secret = self.secret_client.create_secret(
+            algorithm='AES',
+            bit_length=256,
+            secret_type='symmetric',
+            payload=base64.b64encode(key).decode(),
+            payload_content_type='application/octet-stream',
+            payload_content_encoding='base64',
+            mode='CBC'
+        )
+        LOG.debug('Manila Secret has ref %s', manila_secret.get('secret_ref'))
+        return manila_secret.get('secret_ref')
+
+    def delete_secret(self, secret_ref):
+        self.secret_client.delete_secret(secret_ref)
diff --git a/manila_tempest_tests/config.py b/manila_tempest_tests/config.py
index 4afa4e7..5539bb5 100644
--- a/manila_tempest_tests/config.py
+++ b/manila_tempest_tests/config.py
@@ -40,7 +40,7 @@
                     "This value is only used to validate the versions "
                     "response from Manila."),
     cfg.StrOpt("max_api_microversion",
-               default="2.88",
+               default="2.90",
                help="The maximum api microversion is configured to be the "
                     "value of the latest microversion supported by Manila."),
     cfg.StrOpt("region",
@@ -220,6 +220,11 @@
                       "ss_type:<ldap, kerberos or active_directory>, "
                       "ss_dns_ip:value, ss_user:value, ss_password=value, "
                       "ss_domain:value, ss_server:value"),
+    cfg.ListOpt("capability_encryption_support",
+                default=[],
+                help="Encryption support capability. Possible values are "
+                     "share_server, share etc. "),
+
 
     # Switching ON/OFF test suites filtered by features
     cfg.BoolOpt("run_quota_tests",
@@ -287,6 +292,14 @@
     cfg.BoolOpt("run_mount_snapshot_tests",
                 default=False,
                 help="Enable or disable mountable snapshot tests."),
+    cfg.BoolOpt("run_negative_migration_replica_tests",
+                default=False,
+                help="Enable or disable negative migration with replica "
+                     "tests."),
+    cfg.BoolOpt("run_positive_migration_replica_tests",
+                default=True,
+                help="Enable or disable positive migration with replica tests."
+                ),
     cfg.BoolOpt("run_create_share_from_snapshot_in_another_pool_or_az_tests",
                 default=False,
                 help="Defines whether to run tests that create share from "
@@ -378,4 +391,7 @@
     cfg.DictOpt("driver_assisted_backup_test_driver_options",
                 default={'dummy': True},
                 help="Share backup driver options specified as dict."),
+    cfg.BoolOpt("run_encryption_tests",
+                default=False,
+                help="Enable or disable share encryption tests."),
 ]
diff --git a/manila_tempest_tests/services/share/v2/json/shares_client.py b/manila_tempest_tests/services/share/v2/json/shares_client.py
index 4b35687..7457fff 100644
--- a/manila_tempest_tests/services/share/v2/json/shares_client.py
+++ b/manila_tempest_tests/services/share/v2/json/shares_client.py
@@ -248,7 +248,7 @@
                      share_type_id=None, is_public=False,
                      share_group_id=None, availability_zone=None,
                      version=LATEST_MICROVERSION, experimental=False,
-                     scheduler_hints=None):
+                     scheduler_hints=None, encryption_key_ref=None):
         headers = EXPERIMENTAL if experimental else None
         metadata = metadata or {}
         scheduler_hints = scheduler_hints or {}
@@ -283,6 +283,8 @@
             post_body["share"]["share_group_id"] = share_group_id
         if scheduler_hints:
             post_body["share"]["scheduler_hints"] = scheduler_hints
+        if encryption_key_ref:
+            post_body["share"]["encryption_key_ref"] = encryption_key_ref
 
         body = json.dumps(post_body)
         resp, body = self.post("shares", body, headers=headers,
@@ -1102,7 +1104,7 @@
                       share_networks=None,
                       share_groups=None, share_group_snapshots=None,
                       force=True, share_type=None, share_replicas=None,
-                      replica_gigabytes=None, url=None,
+                      replica_gigabytes=None, encryption_keys=None, url=None,
                       version=LATEST_MICROVERSION):
         if url is None:
             url = self._get_quotas_url(version)
@@ -1130,6 +1132,8 @@
             put_body["share_replicas"] = share_replicas
         if replica_gigabytes is not None:
             put_body["replica_gigabytes"] = replica_gigabytes
+        if encryption_keys is not None:
+            put_body["encryption_keys"] = encryption_keys
         put_body = json.dumps({"quota_set": put_body})
 
         resp, body = self.put(url, put_body, version=version)
diff --git a/manila_tempest_tests/tests/api/admin/test_quotas.py b/manila_tempest_tests/tests/api/admin/test_quotas.py
index e8377e1..74c4622 100644
--- a/manila_tempest_tests/tests/api/admin/test_quotas.py
+++ b/manila_tempest_tests/tests/api/admin/test_quotas.py
@@ -66,6 +66,8 @@
         if utils.share_replica_quotas_are_supported():
             self.assertGreater(int(quotas["share_replicas"]), -2)
             self.assertGreater(int(quotas["replica_gigabytes"]), -2)
+        if utils.encryption_keys_quota_supported():
+            self.assertGreater(int(quotas["encryption_keys"]), -2)
 
     @decorators.idempotent_id('1ff57cfa-cd8d-495f-86eb-9fead307428e')
     @tc.attr(base.TAG_POSITIVE, base.TAG_API)
@@ -82,6 +84,8 @@
         if utils.share_replica_quotas_are_supported():
             self.assertGreater(int(quotas["share_replicas"]), -2)
             self.assertGreater(int(quotas["replica_gigabytes"]), -2)
+        if utils.encryption_keys_quota_supported():
+            self.assertGreater(int(quotas["encryption_keys"]), -2)
 
     @decorators.idempotent_id('9b96dd45-7c0d-41ee-88e4-600185f61358')
     @tc.attr(base.TAG_POSITIVE, base.TAG_API)
@@ -471,6 +475,19 @@
 
         self.assertEqual(new_quota, int(updated["share_networks"]))
 
+    @decorators.idempotent_id('78957d97-afad-4371-a21e-79641fff83f7')
+    @tc.attr(base.TAG_POSITIVE, base.TAG_API)
+    @utils.skip_if_microversion_not_supported("2.90")
+    def test_update_tenant_quota_encryption_keys(self):
+        # get current quotas
+        quotas = self.client.show_quotas(self.tenant_id)['quota_set']
+        new_quota = int(quotas["encryption_keys"]) + 2
+
+        # set new quota for encryption keys
+        updated = self.update_quotas(self.tenant_id, encryption_keys=new_quota)
+
+        self.assertEqual(new_quota, int(updated["encryption_keys"]))
+
     @decorators.idempotent_id('84e24c32-ee78-461e-ac1f-f9e4d99f88e2')
     @tc.attr(base.TAG_POSITIVE, base.TAG_API)
     def test_reset_tenant_quotas(self):
@@ -496,6 +513,8 @@
         if utils.share_replica_quotas_are_supported():
             data["share_replicas"] = int(custom["share_replicas"]) + 2
             data["replica_gigabytes"] = int(custom["replica_gigabytes"]) + 2
+        if utils.encryption_keys_quota_supported():
+            data["encryption_keys"] = int(custom["encryption_keys"]) + 2
 
         # set new quota, turn off cleanup - we'll do it right below
         updated = self.update_quotas(self.tenant_id, cleanup=False, **data)
@@ -518,6 +537,9 @@
                 data["share_replicas"], int(updated["share_replicas"]))
             self.assertEqual(
                 data["replica_gigabytes"], int(updated["replica_gigabytes"]))
+        if utils.encryption_keys_quota_supported():
+            self.assertEqual(
+                data["encryption_keys"], int(updated["encryption_keys"]))
 
         # Reset customized quotas
         self.client.reset_quotas(self.tenant_id)
@@ -545,6 +567,10 @@
             self.assertEqual(
                 int(default["replica_gigabytes"]),
                 int(reseted["replica_gigabytes"]))
+        if utils.encryption_keys_quota_supported():
+            self.assertEqual(
+                int(default["encryption_keys"]),
+                int(reseted["encryption_keys"]))
 
     def _get_new_replica_quota_values(self, default_quotas, value_to_set):
         new_values = {
diff --git a/manila_tempest_tests/tests/api/admin/test_quotas_negative.py b/manila_tempest_tests/tests/api/admin/test_quotas_negative.py
index 5b4ff1d..2534104 100644
--- a/manila_tempest_tests/tests/api/admin/test_quotas_negative.py
+++ b/manila_tempest_tests/tests/api/admin/test_quotas_negative.py
@@ -80,6 +80,7 @@
         {"gigabytes": -2},
         {"snapshot_gigabytes": -2},
         {"share_networks": -2},
+        {"encryption_keys": -2},
     )
     @decorators.idempotent_id('07d3e69a-7cda-4ca7-9fea-c32f6830fdd3')
     @tc.attr(base.TAG_NEGATIVE, base.TAG_API)
diff --git a/manila_tempest_tests/tests/api/admin/test_share_servers_migration.py b/manila_tempest_tests/tests/api/admin/test_share_servers_migration.py
index 3864e57..bc88200 100644
--- a/manila_tempest_tests/tests/api/admin/test_share_servers_migration.py
+++ b/manila_tempest_tests/tests/api/admin/test_share_servers_migration.py
@@ -17,6 +17,7 @@
 from tempest import config
 from tempest.lib import decorators
 from tempest.lib import exceptions
+import testtools
 from testtools import testcase as tc
 
 from manila_tempest_tests.common import constants
@@ -330,11 +331,31 @@
     @ddt.data(
         (False, False),
         (True, False),
+    )
+    @ddt.unpack
+    def test_share_server_migration_complete(
+        self, new_share_network, check_with_replica
+    ):
+        self._test_share_server_migration_complete(
+            new_share_network, check_with_replica)
+
+    @decorators.idempotent_id('ae0e9e6c-3a77-4c4b-907b-8a793f88c734')
+    @testtools.skipUnless(CONF.share.run_positive_migration_replica_tests,
+                          'Share server migration with replica test '
+                          'is disabled.')
+    @tc.attr(base.TAG_POSITIVE, base.TAG_BACKEND)
+    @ddt.data(
         (True, True)
     )
     @ddt.unpack
-    def test_share_server_migration_complete(self, new_share_network,
-                                             check_with_replica):
+    def test_share_server_migration_complete_allow_replica(
+        self, new_share_network, check_with_replica
+    ):
+        self._test_share_server_migration_complete(
+            new_share_network, check_with_replica)
+
+    def _test_share_server_migration_complete(self, new_share_network,
+                                              check_with_replica):
         """Test the share server migration complete."""
         share_network_id = self.provide_share_network(
             self.shares_v2_client, self.networks_client)
diff --git a/manila_tempest_tests/tests/api/admin/test_share_servers_migration_negative.py b/manila_tempest_tests/tests/api/admin/test_share_servers_migration_negative.py
index c6f3549..fc2a8db 100644
--- a/manila_tempest_tests/tests/api/admin/test_share_servers_migration_negative.py
+++ b/manila_tempest_tests/tests/api/admin/test_share_servers_migration_negative.py
@@ -17,6 +17,7 @@
 from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
 from tempest.lib import exceptions as lib_exc
+import testtools
 from testtools import testcase as tc
 
 
@@ -342,6 +343,43 @@
             dest_host
         )
 
+    @decorators.idempotent_id('ebe8da5b-ee9c-48c7-a7e4-9e71839f813f')
+    @tc.attr(base.TAG_NEGATIVE, base.TAG_API_WITH_BACKEND)
+    @testtools.skipUnless(
+        CONF.share.run_negative_migration_replica_tests,
+        'Share server negative migration with replica test is disabled.'
+    )
+    def test_share_server_migration_start_with_share_replica(self):
+        """Try server migration start with share replica."""
+        if not CONF.share.backend_replication_type or (
+                not CONF.share.run_replication_tests):
+            raise self.skipException(
+                'Share replica tests are disabled or unsupported.')
+        extra_specs = {
+            'driver_handles_share_servers': CONF.share.multitenancy_enabled,
+            'replication_type': CONF.share.backend_replication_type
+        }
+        share_type = self.shares_v2_client.create_share_type(
+            name=data_utils.rand_name("tempest-share-type"),
+            extra_specs=extra_specs,
+            cleanup_in_class=False)
+        share = self.create_share(share_type_id=share_type['share_type']['id'],
+                                  share_protocol=self.protocol,
+                                  cleanup_in_class=False)
+        share = self.shares_v2_client.get_share(share['id'])['share']
+        share_server_id = share['share_server_id']
+        dest_host, _ = self._choose_compatible_backend_for_share_server(
+            share_server_id)
+        self.create_share_replica(
+            share['id'],
+            cleanup_in_class=False)
+        self.assertRaises(
+            lib_exc.Conflict,
+            self.shares_v2_client.share_server_migration_start,
+            share_server_id,
+            dest_host
+        )
+
 
 class ShareServerMigrationInvalidParametersCIFS(
     ShareServerMigrationInvalidParametersNFS):
diff --git a/manila_tempest_tests/tests/api/base.py b/manila_tempest_tests/tests/api/base.py
index c23e3be..d811ce0 100644
--- a/manila_tempest_tests/tests/api/base.py
+++ b/manila_tempest_tests/tests/api/base.py
@@ -930,6 +930,25 @@
                             client.delete_security_service(res_id)
                             client.wait_for_resource_deletion(ss_id=res_id)
                         elif res["type"] == "share_type":
+                            # Check if there are still shares using this
+                            # share type before attempting deletion to avoid
+                            # cascading cleanup issues
+                            shares_using_type = []
+                            try:
+                                shares_using_type = client.list_shares(
+                                    params={'share_type_id': res_id}
+                                )['shares']
+                            except Exception:
+                                pass
+                            if shares_using_type:
+                                # Skip deletion if any shares exist
+                                LOG.warning("Skipping share type deletion "
+                                            "for %s , still has %d shares "
+                                            "using it.",
+                                            res_id,
+                                            len(shares_using_type))
+                                res["deleted"] = True
+                                continue
                             client.delete_share_type(res_id)
                             client.wait_for_resource_deletion(st_id=res_id)
                         elif res["type"] == "share_group":
diff --git a/manila_tempest_tests/tests/api/test_replication_negative.py b/manila_tempest_tests/tests/api/test_replication_negative.py
index 9424a08..565b174 100644
--- a/manila_tempest_tests/tests/api/test_replication_negative.py
+++ b/manila_tempest_tests/tests/api/test_replication_negative.py
@@ -261,8 +261,9 @@
         data['neutron_net_id'] = subnet['neutron_net_id']
         data['neutron_subnet_id'] = subnet['neutron_subnet_id']
         data['availability_zone'] = self.share_zone
-        share_net = self.shares_v2_client.create_share_network(
-            **data)['share_network']
+        share_net = self.create_share_network(cleanup_in_class=True,
+                                              client=self.shares_v2_client,
+                                              **data)
         share, instance_id = self._create_share_get_instance(
             share_network_id=share_net['id'])
 
diff --git a/manila_tempest_tests/tests/api/test_share_encryption.py b/manila_tempest_tests/tests/api/test_share_encryption.py
new file mode 100644
index 0000000..e199114
--- /dev/null
+++ b/manila_tempest_tests/tests/api/test_share_encryption.py
@@ -0,0 +1,94 @@
+# Copyright 2025 Cloudifcation GmbH.  All rights reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import ddt
+from oslo_log import log
+from tempest import config
+from tempest.lib import decorators
+from testtools import testcase as tc
+
+from manila_tempest_tests.common import barbican_client_mgr
+from manila_tempest_tests.tests.api import base
+from manila_tempest_tests import utils
+
+CONF = config.CONF
+LOG = log.getLogger(__name__)
+
+
+@ddt.ddt
+class ShareEncryptionNFSTest(base.BaseSharesMixedTest):
+    """Covers share functionality, that is related to NFS share type."""
+    protocol = "nfs"
+
+    @classmethod
+    def skip_checks(cls):
+        super(ShareEncryptionNFSTest, cls).skip_checks()
+        if not CONF.share.run_encryption_tests:
+            raise cls.skipException('Encryption tests are disabled.')
+        utils.check_skip_if_microversion_not_supported("2.90")
+
+        if cls.protocol not in CONF.share.enable_protocols:
+            message = "%s tests are disabled" % cls.protocol
+            raise cls.skipException(message)
+
+        if ('share_server' not in CONF.share.capability_encryption_support and
+                'share' not in CONF.share.capability_encryption_support):
+            message = "Unsupported value of encryption support capability"
+            raise cls.skipException(message)
+
+    @classmethod
+    def resource_setup(cls):
+        super(ShareEncryptionNFSTest, cls).resource_setup()
+
+        extra_specs = {
+            'driver_handles_share_servers': CONF.share.multitenancy_enabled,
+        }
+        if 'share_server' in CONF.share.capability_encryption_support:
+            extra_specs.update({'encryption_support': 'share_server'})
+        elif 'share' in CONF.share.capability_encryption_support:
+            extra_specs.update({'encryption_support': 'share'})
+
+        # create share_type
+        cls.share_type_enc = cls.create_share_type(extra_specs=extra_specs)
+        cls.share_type_enc_id = cls.share_type_enc['id']
+
+        # setup barbican client
+        cls.barbican_mgr = barbican_client_mgr.BarbicanClientManager()
+        cls.barbican_mgr.setup_clients(cls.os_primary)
+
+    @decorators.idempotent_id('21ad41fb-04cf-493c-bc2f-66c80220898c')
+    @tc.attr(base.TAG_POSITIVE, base.TAG_BACKEND)
+    def test_create_share_with_share_server_encryption_key_ref(self):
+
+        secret_href = self.barbican_mgr.store_secret()
+        secret_href_uuid = self.barbican_mgr.ref_to_uuid(secret_href)
+
+        share = self.create_share(
+            share_protocol=self.protocol,
+            share_type_id=self.share_type_enc_id,
+            share_network_id=self.shares_v2_client.share_network_id,
+            size=1,
+            name="encrypted_share",
+            encryption_key_ref=secret_href_uuid,
+            cleanup_in_class=False)
+
+        self.assertEqual(share['encryption_key_ref'], secret_href_uuid)
+
+        # Delete Barbican secret
+        self.barbican_mgr.delete_secret(secret_href_uuid)
+
+
+class ShareEncryptionCIFSTest(ShareEncryptionNFSTest):
+    """Covers share functionality, that is related to CIFS share type."""
+    protocol = "cifs"
diff --git a/manila_tempest_tests/tests/api/test_share_encryption_negative.py b/manila_tempest_tests/tests/api/test_share_encryption_negative.py
new file mode 100644
index 0000000..3d37426
--- /dev/null
+++ b/manila_tempest_tests/tests/api/test_share_encryption_negative.py
@@ -0,0 +1,74 @@
+# Copyright 2025 Cloudifcation GmbH.  All rights reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest import config
+from tempest.lib import decorators
+from tempest.lib import exceptions as lib_exc
+from testtools import testcase as tc
+
+from manila_tempest_tests.tests.api import base
+from manila_tempest_tests import utils
+
+CONF = config.CONF
+
+
+class SharesEncryptionNegativeTest(base.BaseSharesMixedTest):
+
+    @classmethod
+    def skip_checks(cls):
+        super(SharesEncryptionNegativeTest, cls).skip_checks()
+        if not CONF.share.run_encryption_tests:
+            raise cls.skipException('Encryption tests are disabled.')
+        utils.check_skip_if_microversion_not_supported("2.90")
+
+    @classmethod
+    def resource_setup(cls):
+        super(SharesEncryptionNegativeTest, cls).resource_setup()
+        # create share_type
+        cls.no_encryption_type = cls.create_share_type()
+        cls.no_encryption_type_id = cls.no_encryption_type['id']
+        cls.encryption_type = cls.create_share_type(
+            extra_specs={
+                'encryption_support': 'share_server',
+            })
+        cls.encryption_type_id = cls.encryption_type['id']
+
+    @decorators.idempotent_id('b8097d56-067e-4d7c-8401-31bc7021fe81')
+    @tc.attr(base.TAG_NEGATIVE, base.TAG_API)
+    def test_create_share_with_invalid_share_type(self):
+        # should not create share when encryption isn't supported by
+        # share type
+        self.assertRaises(lib_exc.BadRequest,
+                          self.shares_v2_client.create_share,
+                          share_type_id=self.no_encryption_type_id,
+                          encryption_key_ref='fake_ref')
+
+    @decorators.idempotent_id('b8097d56-067e-4d7c-8401-31bc7021fe88')
+    @tc.attr(base.TAG_NEGATIVE, base.TAG_API)
+    def test_create_share_with_invalid_encryption_key_ref(self):
+        # should not create share when key ref is invalid UUID
+        self.assertRaises(lib_exc.BadRequest,
+                          self.shares_v2_client.create_share,
+                          share_type_id=self.encryption_type_id,
+                          encryption_key_ref='fake_ref')
+
+    @decorators.idempotent_id('b8097d56-067e-4d7c-8401-31bc7021fe82')
+    @tc.attr(base.TAG_NEGATIVE, base.TAG_API)
+    def test_create_share_with_encryption_key_ref_absent_in_barbican(self):
+        # should not create share when key ref is not present in barbican
+        self.assertRaises(
+            lib_exc.BadRequest,
+            self.shares_v2_client.create_share,
+            share_type_id=self.encryption_type_id,
+            encryption_key_ref='cfbe8ae1-7932-43f2-bf82-3fd3ddba30c3')
diff --git a/manila_tempest_tests/utils.py b/manila_tempest_tests/utils.py
index d7d86f1..56a28e2 100644
--- a/manila_tempest_tests/utils.py
+++ b/manila_tempest_tests/utils.py
@@ -27,6 +27,7 @@
 CONF = config.CONF
 SHARE_NETWORK_SUBNETS_MICROVERSION = '2.51'
 SHARE_REPLICA_QUOTAS_MICROVERSION = "2.53"
+ENCRYPTION_KEYS_QUOTA_MICROVERSION = "2.90"
 EXPERIMENTAL = {'X-OpenStack-Manila-API-Experimental': 'True'}
 
 
@@ -276,6 +277,10 @@
     return is_microversion_supported(SHARE_REPLICA_QUOTAS_MICROVERSION)
 
 
+def encryption_keys_quota_supported():
+    return is_microversion_supported(ENCRYPTION_KEYS_QUOTA_MICROVERSION)
+
+
 def share_network_get_default_subnet(share_network):
     return next((
         subnet for subnet in share_network.get('share_network_subnets', [])
diff --git a/requirements.txt b/requirements.txt
index ae5ea16..d44cb74 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -3,3 +3,6 @@
 ddt>=1.6.0 # MIT
 oslo.log>=3.36.0 # Apache-2.0
 tempest>=31.1.0 # Apache-2.0
+
+# the encryption tests require it
+barbican-tempest-plugin>=1.6.0 # Apache-2.0
diff --git a/zuul.d/manila-tempest-jobs.yaml b/zuul.d/manila-tempest-jobs.yaml
index 0f4ebc8..699874e 100644
--- a/zuul.d/manila-tempest-jobs.yaml
+++ b/zuul.d/manila-tempest-jobs.yaml
@@ -106,6 +106,9 @@
         MANILA_SHARE_MIGRATION_PERIOD_TASK_INTERVAL: 1
         MANILA_SERVER_MIGRATION_PERIOD_TASK_INTERVAL: 10
         MANILA_REPLICA_STATE_UPDATE_INTERVAL: 10
+        # NOTE(pulluri): Adding below because not all services that utilize
+        # tls-proxy necessarily involve enabling HTTPS endpoints.
+        SERVICE_PROTOCOL: https
       devstack_services:
         tls-proxy: true
         key: true
@@ -247,17 +250,6 @@
         NEUTRON_CREATE_INITIAL_NETWORKS: true
 
 
-# TODO(gmann): As per the 2025.1 testing runtime, we need to run at least
-# one job on jammy. This job can be removed as per the future testing
-# runtime (whenever we start testing Ubuntu 26.04 as default version).
-- job:
-    name: manila-tempest-plugin-lvm-jammy
-    description: This is integrated job testing on Ubuntu jammy(22.04)
-    parent: manila-tempest-plugin-lvm
-    nodeset: openstack-single-node-jammy
-    branches:
-      - stable/2025.1
-
 - job:
     name: manila-tempest-plugin-container
     description: |
@@ -689,7 +681,12 @@
     name: manila-tempest-plugin-dummy-dhss
     description: Test the Dummy driver with DHSS=True
     parent: manila-tempest-plugin-standalone-base
+    required-projects:
+      - openstack/barbican
+      - openstack/barbican-tempest-plugin
     vars:
+      devstack_plugins:
+        barbican: https://opendev.org/openstack/barbican
       devstack_localrc:
         SHARE_DRIVER: manila.tests.share.drivers.dummy.DummyDriver
         MANILA_CONFIGURE_GROUPS: alpha,beta,gamma,membernet,adminnet,netapp_active_iq
@@ -757,6 +754,8 @@
               run_share_server_migration_tests: true
               run_share_server_multiple_subnet_tests: true
               run_network_allocation_update_tests: true
+              run_encryption_tests: true
+              capability_encryption_support: share_server
 
 - job:
     name: manila-tempest-plugin-glusterfs-native
@@ -881,7 +880,6 @@
     check:
       jobs:
         - manila-tempest-plugin-lvm
-        - manila-tempest-plugin-lvm-jammy
         - manila-tempest-plugin-generic-scenario:
             voting: false
         - manila-tempest-plugin-generic:
@@ -895,4 +893,3 @@
     gate:
       jobs:
         - manila-tempest-plugin-lvm
-        - manila-tempest-plugin-lvm-jammy
diff --git a/zuul.d/manila-tempest-stable-jobs.yaml b/zuul.d/manila-tempest-stable-jobs.yaml
index e049003..0128c02 100644
--- a/zuul.d/manila-tempest-stable-jobs.yaml
+++ b/zuul.d/manila-tempest-stable-jobs.yaml
@@ -69,10 +69,10 @@
     vars: *manila_tempest_image_pinned_vars
 
 - job:
-    name: manila-tempest-plugin-lvm-2025.1
+    name: manila-tempest-plugin-lvm-2025.2
     parent: manila-tempest-plugin-lvm-base
-    override-checkout: stable/2025.1
-    vars:
+    override-checkout: stable/2025.2
+    vars: &manila_tempest_plugin_lvm_stable_vars
       # TODO(gouthamr): some tests are disabled due to bugs
       # IPv6 Tests: https://bugs.launchpad.net/manila/+bug/1998489
       # drop these overrides once we address that bug.
@@ -82,30 +82,16 @@
         NEUTRON_CREATE_INITIAL_NETWORKS: true
 
 - job:
+    name: manila-tempest-plugin-lvm-2025.1
+    parent: manila-tempest-plugin-lvm-base
+    override-checkout: stable/2025.1
+    vars: *manila_tempest_plugin_lvm_stable_vars
+
+- job:
     name: manila-tempest-plugin-lvm-2024.2
     parent: manila-tempest-plugin-lvm-base
     override-checkout: stable/2024.2
-    vars:
-      # TODO(gouthamr): some tests are disabled due to bugs
-      # IPv6 Tests: https://bugs.launchpad.net/manila/+bug/1998489
-      # drop these overrides once we address that bug.
-      tempest_exclude_regex: '(^manila_tempest_tests.tests.scenario.*IPv6.*)'
-      devstack_localrc:
-        MANILA_SETUP_IPV6: false
-        NEUTRON_CREATE_INITIAL_NETWORKS: true
-
-- job:
-    name: manila-tempest-plugin-lvm-2024.1
-    parent: manila-tempest-plugin-lvm-base
-    override-checkout: stable/2024.1
-    vars:
-      # TODO(gouthamr): some tests are disabled due to bugs
-      # IPv6 Tests: https://bugs.launchpad.net/manila/+bug/1998489
-      # drop these overrides once we address that bug.
-      tempest_exclude_regex: '(^manila_tempest_tests.tests.scenario.*IPv6.*)'
-      devstack_localrc:
-        MANILA_SETUP_IPV6: false
-        NEUTRON_CREATE_INITIAL_NETWORKS: true
+    vars: *manila_tempest_plugin_lvm_stable_vars
 
 - project-template:
     name: manila-tempest-plugin-jobs-using-service-image-stable
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 3ca5092..361b0fa 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -8,9 +8,9 @@
       jobs:
         - manila-tempest-plugin-dummy-no-dhss
         - manila-tempest-plugin-dummy-dhss
+        - manila-tempest-plugin-lvm-2025.2
         - manila-tempest-plugin-lvm-2025.1
         - manila-tempest-plugin-lvm-2024.2
-        - manila-tempest-plugin-lvm-2024.1
         - manila-tempest-plugin-dummy-no-dhss-rbac
         - manila-tempest-plugin-container:
             voting: false