diff --git a/neutron_tempest_plugin/scenario/base.py b/neutron_tempest_plugin/scenario/base.py
index 4d9165f..eb03c93 100644
--- a/neutron_tempest_plugin/scenario/base.py
+++ b/neutron_tempest_plugin/scenario/base.py
@@ -196,19 +196,18 @@
         Allowing ingress traffic from metadata server, required only for
         stateless security groups.
         """
-        if getattr(cls, 'stateless_sg'):
-            # NOTE(slaweq): in case of stateless security groups, there is no
-            # "related" or "established" traffic matching at all so even if
-            # egress traffic to 169.254.169.254 is allowed by default SG, we
-            # need to explicitly allow ingress traffic from the metadata server
-            # to be able to receive responses in the guest vm
-            cls.create_security_group_rule(
-                security_group_id=secgroup_id,
-                direction=neutron_lib_constants.INGRESS_DIRECTION,
-                protocol=neutron_lib_constants.PROTO_NAME_TCP,
-                remote_ip_prefix='169.254.169.254/32',
-                description='metadata out'
-            )
+        # NOTE(slaweq): in case of stateless security groups, there is no
+        # "related" or "established" traffic matching at all so even if
+        # egress traffic to 169.254.169.254 is allowed by default SG, we
+        # need to explicitly allow ingress traffic from the metadata server
+        # to be able to receive responses in the guest vm
+        cls.create_security_group_rule(
+            security_group_id=secgroup_id,
+            direction=neutron_lib_constants.INGRESS_DIRECTION,
+            protocol=neutron_lib_constants.PROTO_NAME_TCP,
+            remote_ip_prefix='169.254.169.254/32',
+            description='metadata out'
+        )
 
     @classmethod
     def create_pingable_secgroup_rule(cls, secgroup_id=None,
diff --git a/zuul.d/ussuri_jobs.yaml b/zuul.d/ussuri_jobs.yaml
index 9701ec9..5abc741 100644
--- a/zuul.d/ussuri_jobs.yaml
+++ b/zuul.d/ussuri_jobs.yaml
@@ -180,6 +180,10 @@
           (^tempest.api.compute.servers.test_multiple_create)"
       network_api_extensions: *api_extensions
       network_available_features: *available_features
+      # TODO(akatz): remove established tcp session verification test when the
+      # bug https://bugzilla.redhat.com/show_bug.cgi?id=1965036 will be fixed
+      tempest_exclude_regex: "\
+          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_established_tcp_session_after_re_attachinging_sg)"
       devstack_localrc: *localrc_scenarios_common
       devstack_local_conf:
         post-config:
@@ -286,9 +290,11 @@
       - name: openstack/neutron-tempest-plugin
         override-checkout: 1.6.0
       - openstack/tempest
-      - openstack/designate-tempest-plugin
+      - name: openstack/designate-tempest-plugin
+        override-checkout: 0.7.0
     vars:
-      network_api_extensions_common: *api_extensions
+      network_api_extensions: *api_extensions
+      devstack_localrc: *localrc_scenarios_common
 
 - job:
     name: neutron-tempest-plugin-sfc-ussuri