diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 593b25d2..05a666c1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,15 +26,15 @@ updates:
         patterns:
           - "*"
     ignore:
-      # Block newer versions of k8s until go 1.26 is available in RHEL
+      # Block newer versions of k8s until bump of OpenShift CI
       - dependency-name: "k8s.io/api"
-        versions: [">=0.35"]
+        versions: [">=0.36"]
       - dependency-name: "k8s.io/apimachinery"
-        versions: [">=0.35"]
+        versions: [">=0.36"]
       - dependency-name: "sigs.k8s.io/controller-runtime"
-        versions: [">=0.23"]
+        versions: [">=0.24"]
       - dependency-name: "sigs.k8s.io/controller-tools"
-        versions: [">=0.20"]
+        versions: [">=0.21"]
   - package-ecosystem: "cargo"
     directory: "/"
     schedule:
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index f415dabc..86bf9884 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -69,7 +69,7 @@ jobs:
       - name: "Create KinD cluster"
         run: make cluster-up
       - name: "Build and push images"
-        run: make push
+        run: make DELETE_AFTER_PUSH=true push
       - name: "Install KubeVirt"
         run: make install-kubevirt
       - name: "Run integration tests"
diff --git a/AGENTS.md b/AGENTS.md
index 6cc71715..42ef4aac 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -31,7 +31,7 @@ and agents should suggest when they detect
 
 - The operator's crate name is `operator`, test_utils's crate name is `trusted-cluster-operator-test-utils`.
 - Use MCPs when available
-  - Prefer the MCP LSP over `grep`
-  - Prefer the k8s LSP over `kubectl`.
+  - Prefer the LSP MCP over `grep`
+  - Prefer the k8s MCP over `kubectl`.
 - Reuse, and check for other uses of a similar pattern. When functionality can be moved out of a function for reuse, commit the generalization before the new use.
 - Include lint-compatible code style when writing, not as an afterthought.
diff --git a/Makefile b/Makefile
index e29e750b..69e67b1d 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,10 @@
 #
 # SPDX-License-Identifier: CC0-1.0
 
-.PHONY: all build build-tools crds-rs generate manifests cluster-up cluster-down image push install-trustee install clean fmt-check clippy lint test test-release release-tarball
+.PHONY: all build build-tools crds-rs generate manifests cluster-up cluster-down \
+	install-trustee install clean fmt-check clippy lint test test-release release-tarball \
+	operator-image compute-pcrs-image reg-server-image attestation-key-register-image image \
+	push-operator push-compute-pcrs push-reg-server push-attestation-key-register push \
 
 SHELL := /bin/bash
 
@@ -24,6 +27,7 @@ KOPIUM ?= $(LOCALBIN)/kopium-$(KOPIUM_VERSION)
 REGISTRY ?= quay.io/trusted-execution-clusters
 TAG ?= latest
 PUSH_FLAGS ?=
+DELETE_AFTER_PUSH ?= false
 OPERATOR_IMAGE ?= $(REGISTRY)/trusted-cluster-operator:$(TAG)
 COMPUTE_PCRS_IMAGE=$(REGISTRY)/compute-pcrs:$(TAG)
 REG_SERVER_IMAGE=$(REGISTRY)/registration-server:$(TAG)
@@ -111,11 +115,21 @@ attestation-key-register-image:
 
 image: operator-image compute-pcrs-image reg-server-image attestation-key-register-image
 
-push: image
-	$(CONTAINER_CLI) push $(OPERATOR_IMAGE) $(PUSH_FLAGS)
-	$(CONTAINER_CLI) push $(COMPUTE_PCRS_IMAGE) $(PUSH_FLAGS)
-	$(CONTAINER_CLI) push $(REG_SERVER_IMAGE) $(PUSH_FLAGS)
-	$(CONTAINER_CLI) push $(ATTESTATION_KEY_REGISTER_IMAGE) $(PUSH_FLAGS)
+define push-image
+$(CONTAINER_CLI) push $(1) $(PUSH_FLAGS)
+$(if $(filter true,$(DELETE_AFTER_PUSH)),$(CONTAINER_CLI) rmi $(1))
+endef
+
+push-operator: operator-image
+	$(call push-image,$(OPERATOR_IMAGE))
+push-compute-pcrs: compute-pcrs-image
+	$(call push-image,$(COMPUTE_PCRS_IMAGE))
+push-reg-server: reg-server-image
+	$(call push-image,$(REG_SERVER_IMAGE))
+push-attestation-key-register: attestation-key-register-image
+	$(call push-image,$(ATTESTATION_KEY_REGISTER_IMAGE))
+
+push: push-operator push-compute-pcrs push-reg-server push-attestation-key-register
 
 release-tarball: manifests
 	tar -cf trusted-execution-operator-$(TAG).tar config