diff --git a/.github/workflows/docker-image.yaml b/.github/workflows/docker-image.yaml
index 0907ac09b4..09ac3738dc 100644
--- a/.github/workflows/docker-image.yaml
+++ b/.github/workflows/docker-image.yaml
@@ -3,6 +3,9 @@ name: Docker Image CI
 on:
   workflow_dispatch:
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
 
   build:
diff --git a/test/e2e/apps/ephemeraljob.go b/test/e2e/apps/ephemeraljob.go
index 9577424c7c..b2fd82087b 100644
--- a/test/e2e/apps/ephemeraljob.go
+++ b/test/e2e/apps/ephemeraljob.go
@@ -288,21 +288,6 @@ var _ = SIGDescribe("EphemeralJob", func() {
 					},
 				}})
 
-			job2 := tester.CreateTestEphemeralJob(randStr+"2", 1, 1, metav1.LabelSelector{
-				MatchLabels: map[string]string{
-					"run": "nginx",
-				}}, []v1.EphemeralContainer{
-				{
-					TargetContainerName: "nginx",
-					EphemeralContainerCommon: v1.EphemeralContainerCommon{
-						Name:                     "debugger",
-						Image:                    BusyboxImage,
-						ImagePullPolicy:          v1.PullIfNotPresent,
-						Command:                  []string{"sleep", "3000"},
-						TerminationMessagePolicy: v1.TerminationMessageReadFile,
-					},
-				}})
-
 			ginkgo.By("Check the status of job")
 
 			gomega.Eventually(func() int {
@@ -320,6 +305,21 @@ var _ = SIGDescribe("EphemeralJob", func() {
 				return len(targetPod.Status.EphemeralContainerStatuses)
 			}, 60*time.Second, 3*time.Second).Should(gomega.Equal(1))
 
+			job2 := tester.CreateTestEphemeralJob(randStr+"2", 1, 1, metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"run": "nginx",
+				}}, []v1.EphemeralContainer{
+				{
+					TargetContainerName: "nginx",
+					EphemeralContainerCommon: v1.EphemeralContainerCommon{
+						Name:                     "debugger",
+						Image:                    BusyboxImage,
+						ImagePullPolicy:          v1.PullIfNotPresent,
+						Command:                  []string{"sleep", "3000"},
+						TerminationMessagePolicy: v1.TerminationMessageReadFile,
+					},
+				}})
+			ginkgo.By("Check whether ephemeral container can updated (not possible yet)")
 			gomega.Eventually(func() int32 {
 				job, _ := tester.GetEphemeralJob(job2.Name)
 				return job.Status.Matches
diff --git a/test/e2e/apps/imagelistpulljobs.go b/test/e2e/apps/imagelistpulljobs.go
index 20e7d98076..885bf18d27 100644
--- a/test/e2e/apps/imagelistpulljobs.go
+++ b/test/e2e/apps/imagelistpulljobs.go
@@ -181,12 +181,12 @@ var _ = SIGDescribe("PullImages", func() {
 				return job.Status.Desired
 			}, 3*time.Second, time.Second).Should(gomega.Equal(int32(len(job.Spec.Images))))
 
-			ginkgo.By("Wait completed in 180s")
+			ginkgo.By("Wait completed in 360s")
 			gomega.Eventually(func() bool {
 				job, err = testerForImageListPullJob.GetJob(job)
 				gomega.Expect(err).NotTo(gomega.HaveOccurred())
 				return job.Status.CompletionTime != nil
-			}, 180*time.Second, 3*time.Second).Should(gomega.Equal(true))
+			}, 360*time.Second, 10*time.Second).Should(gomega.Equal(true))
 			gomega.Expect(job.Status.Succeeded).To(gomega.Equal(int32(len(job.Spec.Images))))
 
 			ginkgo.By("Delete job")
diff --git a/test/e2e/apps/statefulset.go b/test/e2e/apps/statefulset.go
index fe4cf78885..bcf77f7887 100644
--- a/test/e2e/apps/statefulset.go
+++ b/test/e2e/apps/statefulset.go
@@ -663,7 +663,7 @@ var _ = SIGDescribe("StatefulSet", func() {
 			gomega.Expect(err).NotTo(gomega.HaveOccurred())
 
 			ginkgo.By("InPlace update Pods at the new revision")
-			sst.WaitForPodNotReady(ss, pods.Items[0].Name)
+			sst.WaitForPodUpdatedAndRunning(ss, pods.Items[0].Name, currentRevision)
 			sst.WaitForRunningAndReady(3, ss)
 			ss = sst.GetStatefulSet(ss.Namespace, ss.Name)
 			pods = sst.GetPodList(ss)
@@ -761,8 +761,9 @@ var _ = SIGDescribe("StatefulSet", func() {
 			gomega.Expect(err).NotTo(gomega.HaveOccurred())
 
 			ginkgo.By("InPlace update Pods at the new revision")
-			sst.WaitForPodNotReady(ss, pods.Items[0].Name)
+			sst.WaitForPodUpdatedAndRunning(ss, pods.Items[0].Name, currentRevision)
 			sst.WaitForRunningAndReady(3, ss)
+
 			ss = sst.GetStatefulSet(ss.Namespace, ss.Name)
 			pods = sst.GetPodList(ss)
 			for i := range pods.Items {
diff --git a/test/e2e/framework/statefulset_utils.go b/test/e2e/framework/statefulset_utils.go
index 0f7efc807f..ad691c1097 100644
--- a/test/e2e/framework/statefulset_utils.go
+++ b/test/e2e/framework/statefulset_utils.go
@@ -397,6 +397,28 @@ func (s *StatefulSetTester) WaitForPodNotReady(set *appsv1beta1.StatefulSet, pod
 
 }
 
+// WaitForPodNotReady waist for the Pod named podName in set to exist and to not have a Ready condition.
+func (s *StatefulSetTester) WaitForPodUpdatedAndRunning(set *appsv1beta1.StatefulSet, podName string, currentRevision string) (*appsv1beta1.StatefulSet, *v1.PodList) {
+	var pods *v1.PodList
+	s.WaitForState(set, func(set2 *appsv1beta1.StatefulSet, pods2 *v1.PodList) (bool, error) {
+		set = set2
+		pods = pods2
+		for i := range pods.Items {
+			if pods.Items[i].Name != podName {
+				continue
+			}
+
+			if pods.Items[i].Labels[apps.StatefulSetRevisionLabel] != currentRevision &&
+				podutil.IsPodReady(&pods.Items[i]) {
+				return true, nil
+			}
+			return false, nil
+		}
+		return false, nil
+	})
+	return set, pods
+}
+
 // WaitForRollingUpdate waits for all Pods in set to exist and have the correct revision and for the RollingUpdate to
 // complete. set must have a RollingUpdateStatefulSetStrategyType.
 func (s *StatefulSetTester) WaitForRollingUpdate(set *appsv1beta1.StatefulSet) (*appsv1beta1.StatefulSet, *v1.PodList) {