diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 228fb4e13e004721ed71447a9f294ea40c4e3521..936961a5610354a70b3596dab69210074a6856f3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -5,7 +5,7 @@ stages:
   - qa
 
 default:
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7-golang-1.16-git-2.31
+  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-${RUBY_VERSION}-golang-${GO_VERSION}-git-2.31
   tags:
     - gitlab-org
 
@@ -79,12 +79,13 @@ danger-review:
     policy: pull
   artifacts:
     paths:
-    - ruby/tmp/gitaly-rspec-test.log
+      - ruby/tmp/gitaly-rspec-test.log
+    reports:
+      junit: _build/reports/go-tests-report-go-${GO_VERSION}-git-${GIT_VERSION}.xml
     when: on_failure
     expire_in: 1 week
 
 .postgres_template: &postgres_definition
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-${RUBY_VERSION}-golang-${GO_VERSION}-git-2.31
   services:
     - postgres:${POSTGRES_VERSION}
   variables: &postgres_variables
@@ -133,7 +134,6 @@ proto:
 build:
   <<: *cache_definition
   stage: build
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-${RUBY_VERSION}-golang-${GO_VERSION}-git-2.31
   script:
     - go version
     - make all git
@@ -156,7 +156,6 @@ build:
 binaries:
   <<: *cache_definition
   stage: build
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-${RUBY_VERSION}-golang-${GO_VERSION}-git-2.31
   only:
     - tags
   script:
@@ -177,7 +176,6 @@ binaries:
 test:
   <<: *test_definition
   <<: *postgres_definition
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-${RUBY_VERSION}-golang-${GO_VERSION}-git-2.31
   script:
     - _build/deps/git/install/bin/git version
     # This command will make all directories except of our build directory and Ruby code unwritable.
@@ -185,11 +183,6 @@ test:
     # they should all instead use a temporary directory for runtime data.
     - find . -type d \( -path ./_build -o -path ./ruby \) -prune -o -type d -exec chmod a-w {} \;
     - make ${TARGET}
-  artifacts:
-    paths:
-      - _build/reports/go-tests-report-go-${GO_VERSION}-git-${GIT_VERSION}.xml
-    reports:
-      junit: _build/reports/go-tests-report-go-${GO_VERSION}-git-${GIT_VERSION}.xml
   parallel:
     matrix:
       # These definitions are for the non-default Git versions. We do not want
@@ -207,10 +200,19 @@ test:
       - GO_VERSION: "1.17"
         TARGET: [ test-with-proxies, test-with-praefect, race-go ]
 
+test-quarantine:
+  <<: *test_definition
+  <<: *postgres_definition
+  allow_failure: true
+  variables:
+    <<: *postgres_variables
+    QUARANTINE: 1
+  script:
+    - make test
+
 nightly:git:
   <<: *test_definition
   <<: *postgres_definition
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-${RUBY_VERSION}-golang-${GO_VERSION}-git-2.31
   script:
     - go version
     - make all ${TARGET}
@@ -311,13 +313,6 @@ backwards_compatibility_test:
     - git checkout --no-overlay $CI_COMMIT_SHA -- internal/praefect/datastore/migrations
     - make test-postgres
 
-lint:
-  stage: test
-  retry: 2
-  script:
-    - go version
-    - make lint
-
 objectinfo_fuzz_test:
   extends: .fuzz_base
   stage: test
diff --git a/internal/praefect/datastore/storage_cleanup_test.go b/internal/praefect/datastore/storage_cleanup_test.go
index bb8e66d75bb1c6459320e79b2d3f9459c8f45273..53ebd7b1e9e0d462fad737777b2e21e6b29aa6df 100644
--- a/internal/praefect/datastore/storage_cleanup_test.go
+++ b/internal/praefect/datastore/storage_cleanup_test.go
@@ -146,6 +146,8 @@ func TestStorageCleanup_AcquireNextStorage(t *testing.T) {
 	})
 
 	t.Run("acquired for long time triggers update loop", func(t *testing.T) {
+		testhelper.Quarantine(t, "https://gitlab.com/gitlab-org/gitaly/-/issues/3828")
+
 		db.TruncateAll(t)
 		require.NoError(t, storageCleanup.Populate(ctx, "vs", "g1"))
 		start := time.Now().UTC()
@@ -173,6 +175,12 @@ func TestStorageCleanup_AcquireNextStorage(t *testing.T) {
 		require.Len(t, check3, 1)
 		require.False(t, check3[0].TriggeredAt.Valid)
 	})
+
+	t.Run("fail in quarantine", func(t *testing.T) {
+		testhelper.Quarantine(t, "issue-xyz")
+
+		require.True(t, false, "this is supposed to fail in quarantine only")
+	})
 }
 
 func TestStorageCleanup_Exists(t *testing.T) {
diff --git a/internal/testhelper/testhelper.go b/internal/testhelper/testhelper.go
index 7a52ce3ee6c385bb40cb1166673941946855b000..6029df86b0ef4bdda81ab8c012c56ada5196a588 100644
--- a/internal/testhelper/testhelper.go
+++ b/internal/testhelper/testhelper.go
@@ -314,3 +314,12 @@ func GenerateCerts(t *testing.T) (string, string) {
 
 	return certFile.Name(), keyFile.Name()
 }
+
+// Quarantine skips a test unless environment variable QUARANTINE is set
+func Quarantine(t testing.TB, issueURL string) {
+	_, ok := os.LookupEnv("QUARANTINE")
+	if ok {
+		return
+	}
+	t.Skipf("Skipping quarantined test, issue %s", issueURL)
+}