diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index fd79536d..a551af74 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -15,6 +15,9 @@ env:
   TEST_S3_ENDPOINT: http://localhost:9000
   TEST_S3_ACCESS_KEY: accesskey
   TEST_S3_SECRET_KEY: secretkey
+  # Public test-only key (32 bytes of 0x42), never use for real data.
+  # beta.10 requires a local SSE-S3 master key when no KMS is configured.
+  RUSTFS_SSE_S3_MASTER_KEY: "QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI="
   # Self-hosted runner images may still bundle an older Node than current
   # JavaScript actions require.
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
@@ -122,6 +125,7 @@ jobs:
             -e RUSTFS_ROOT_PASSWORD=secretkey \
             -e RUSTFS_ACCESS_KEY=accesskey \
             -e RUSTFS_SECRET_KEY=secretkey \
+            -e RUSTFS_SSE_S3_MASTER_KEY \
             -e RUSTFS_VOLUMES=/data \
             -e RUSTFS_ADDRESS=":9000" \
             -e RUSTFS_CONSOLE_ENABLE="true" \
@@ -168,11 +172,14 @@ jobs:
             "option_behavior_operations::test_head_bytes_returns_prefix_bytes"
             "option_behavior_operations::test_find_print_outputs_full_remote_path"
             "option_behavior_operations::test_find_exec_rejects_json_output"
-            "option_behavior_operations::test_mirror_parallel_zero_returns_usage_error"
+            "option_behavior_operations::test_mirror_concurrency_zero_returns_usage_error"
           )
 
           if [[ "${{ matrix.version }}" == "1.0.0-beta.10" ]]; then
             TESTS+=(
+              "encryption_operations::test_cp_enc_s3_upload"
+              "encryption_operations::test_mv_enc_s3_remote_copy"
+              "encryption_operations::test_pipe_enc_s3_upload"
               "checksum_operations::test_beta10_checksum_put_multipart_and_rejection"
               "atomic_object_lock_operations::test_beta10_atomic_object_lock_put_copy_and_multipart"
               "sse_customer_operations::test_beta10_sse_customer_put_head_get_wrong_key_and_multipart"
@@ -239,6 +246,7 @@ jobs:
             -e RUSTFS_ROOT_PASSWORD=secretkey \
             -e RUSTFS_ACCESS_KEY=accesskey \
             -e RUSTFS_SECRET_KEY=secretkey \
+            -e RUSTFS_SSE_S3_MASTER_KEY \
             -e RUSTFS_VOLUMES=/data \
             -e RUSTFS_ADDRESS=":9000" \
             -e RUSTFS_CONSOLE_ENABLE="true" \
diff --git a/crates/cli/tests/golden.rs b/crates/cli/tests/golden.rs
index 0edcd9e0..bc7bea6d 100644
--- a/crates/cli/tests/golden.rs
+++ b/crates/cli/tests/golden.rs
@@ -1,7 +1,7 @@
 //! Golden tests for verifying JSON output format stability
 //!
 //! These tests ensure that the JSON output format remains stable
-//! and matches the schema defined in `schemas/output_v1.json`.
+//! and matches the applicable versioned output contract in `schemas/`.
 //!
 //! Run with: `cargo test --features golden`
 
@@ -260,8 +260,13 @@ mod s3_tests {
         let json: serde_json::Value =
             serde_json::from_str(&stdout).expect("Output should be valid JSON");
 
-        assert_eq!(json["success"], true);
-        assert!(json["bucket"].as_str().unwrap().contains("test-bucket"));
+        assert_eq!(json["schema_version"], 3);
+        assert_eq!(json["type"], "bucket_operations");
+        assert_eq!(json["status"], "success");
+        assert_eq!(json["data"]["operation"], "create");
+        assert_eq!(json["data"]["bucket"], bucket);
+        assert_eq!(json["data"]["outcome"], "created");
+        assert_eq!(json["data"]["created"], true);
 
         // Cleanup: remove the bucket
         Command::new(rc_binary())
@@ -300,7 +305,15 @@ mod s3_tests {
         let json: serde_json::Value =
             serde_json::from_str(&stdout).expect("Output should be valid JSON");
 
-        assert_eq!(json["success"], true);
+        assert_eq!(json["schema_version"], 3);
+        assert_eq!(json["type"], "bucket_remove");
+        assert_eq!(json["status"], "success");
+        assert_eq!(json["data"]["bucket"], bucket);
+        assert_eq!(json["data"]["outcome"], "success");
+        assert_eq!(
+            json["data"]["completed_stages"],
+            serde_json::json!(["bucket_delete"])
+        );
 
         drop(temp_dir);
     }
@@ -454,8 +467,8 @@ mod s3_tests {
         let json: serde_json::Value =
             serde_json::from_str(&stdout).expect("Output should be valid JSON");
 
-        assert!(json["key"].is_string());
-        assert!(json["size_bytes"].is_number());
+        assert_eq!(json["name"], "stat-test.txt");
+        assert_eq!(json["size_bytes"], b"Test content for stat".len());
 
         // Cleanup
         Command::new(rc_binary())
diff --git a/crates/cli/tests/integration.rs b/crates/cli/tests/integration.rs
index d57124b6..f78e0faf 100644
--- a/crates/cli/tests/integration.rs
+++ b/crates/cli/tests/integration.rs
@@ -4,13 +4,14 @@
 //!
 //! Run with:
 //! ```bash
-//! # Start RustFS container
+//! # Start RustFS container with a public test-only SSE-S3 key (never use for real data).
 //! docker run -d --name rustfs -p 9000:9000 -p 9001:9001 \
 //!     -v rustfs-data:/data \
 //!     -e RUSTFS_ROOT_USER=accesskey \
 //!     -e RUSTFS_ROOT_PASSWORD=secretkey \
 //!     -e RUSTFS_ACCESS_KEY=accesskey \
 //!     -e RUSTFS_SECRET_KEY=secretkey \
+//!     -e RUSTFS_SSE_S3_MASTER_KEY=QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI= \
 //!     rustfs/rustfs:1.0.0-beta.10
 //!
 //! # Run tests
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index dac3dc77..bd9611a5 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -18,6 +18,8 @@ services:
       RUSTFS_ROOT_PASSWORD: secretkey
       RUSTFS_ACCESS_KEY: accesskey
       RUSTFS_SECRET_KEY: secretkey
+      # Public test-only key (32 bytes of 0x42), never use for real data.
+      RUSTFS_SSE_S3_MASTER_KEY: "QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI="
       RUSTFS_VOLUMES: /data
       RUSTFS_ADDRESS: ":9000"
       RUSTFS_CONSOLE_ENABLE: "true"