diff --git a/.github/workflows/wolfboot-integration.yml b/.github/workflows/wolfboot-integration.yml
index 8bffe325ad..cececdd652 100644
--- a/.github/workflows/wolfboot-integration.yml
+++ b/.github/workflows/wolfboot-integration.yml
@@ -14,7 +14,7 @@ concurrency:
 env:
   WOLFBOOT_REPO: https://github.com/wolfSSL/wolfBoot.git
   WOLFBOOT_BRANCH: master
-  RENODE_CONTAINER_VERSION: 1.15.3
+  WOLFBOOT_RENODE_IMAGE: ghcr.io/wolfssl/wolfboot-ci-renode:v1.8
 
 jobs:
   keytools:
@@ -108,95 +108,6 @@ jobs:
           ./tools/keytools/keygen --rsa2048 -i public-rsa2048-key.der --ecc256 -g wolfboot_signing_private_key.der --ecc384 -g ecc384-priv-key.der
           make SIGN=ECC256 HASH=SHA256 WOLFBOOT_UNIVERSAL_KEYSTORE=1
 
-  renode_config_selection:
-    name: renode-config-selection
-    if: github.repository_owner == 'wolfssl'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 35
-
-    steps:
-      - name: Checkout wolfSSL
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
-
-      - name: Clone wolfBoot and link tested wolfSSL
-        run: |
-          set -euxo pipefail
-
-          git clone --depth 1 --branch "${WOLFBOOT_BRANCH}" "${WOLFBOOT_REPO}" wolfboot
-          rm -rf wolfboot/lib/wolfssl
-          ln -s "${GITHUB_WORKSPACE}" wolfboot/lib/wolfssl
-          test -L wolfboot/lib/wolfssl
-          test "$(realpath wolfboot/lib/wolfssl)" = "${GITHUB_WORKSPACE}"
-
-      - name: Build Renode docker image once
-        working-directory: wolfboot
-        run: |
-          set -euxo pipefail
-          docker build -t wolfboot-renode-nrf52:${RENODE_CONTAINER_VERSION} -f tools/renode/Dockerfile .
-
-      - name: Run curated wolfBoot Renode configurations
-        working-directory: wolfboot
-        run: |
-          set -euo pipefail
-
-          cp config/examples/nrf52840.config .config
-          make include/target.h
-
-          mkdir -p test_results
-
-          run_case() {
-            local slug="$1"
-            local opts="$2"
-            local result_dir="$PWD/test_results/$slug"
-            mkdir -p "$result_dir"
-
-            echo "=== Running $slug: $opts ==="
-            if docker run \
-              --rm \
-              --log-driver=none -a stdout -a stderr \
-              --volume "$PWD:/workspace" \
-              --volume "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}" \
-              --volume "$result_dir:/tmp/test_results" \
-              --env SCRIPT=/workspace/renode-config.resc \
-              --env RENODE_CHECKOUT=/home/developer/renode \
-              --env TEST_OPTIONS="$opts" \
-              --workdir /workspace \
-              wolfboot-renode-nrf52:${RENODE_CONTAINER_VERSION} \
-              /bin/bash -lc 'tools/scripts/renode-test-update.sh $TEST_OPTIONS > /tmp/test_results/logs.txt 2>&1'
-            then
-              echo "$opts: PASS" | tee -a test_results/summary.txt
-            else
-              echo "$opts: FAIL" | tee -a test_results/summary.txt
-              if [ -f "$result_dir/logs.txt" ]; then
-                cat "$result_dir/logs.txt"
-              fi
-              return 1
-            fi
-          }
-
-          run_case sign-none "SIGN=NONE"
-          run_case ecc256 "SIGN=ECC256"
-          run_case ed25519 "SIGN=ED25519"
-          run_case rsa2048 "SIGN=RSA2048"
-
-          run_case sign-none-smallstack "SIGN=NONE WOLFBOOT_SMALL_STACK=1"
-          run_case ecc256-smallstack "SIGN=ECC256 WOLFBOOT_SMALL_STACK=1"
-          run_case ed25519-smallstack "SIGN=ED25519 WOLFBOOT_SMALL_STACK=1"
-          run_case rsa2048-smallstack "SIGN=RSA2048 WOLFBOOT_SMALL_STACK=1"
-
-          run_case ecc256-noasm "SIGN=ECC256 NO_ASM=1"
-          run_case ed25519-noasm "SIGN=ED25519 NO_ASM=1"
-          run_case rsa2048-noasm "SIGN=RSA2048 NO_ASM=1"
-
-          run_case ecc256-fastmath "SIGN=ECC256 SPMATH=0"
-          run_case rsa2048-fastmath "SIGN=RSA2048 SPMATH=0"
-
-          run_case ecc256-smallstack-noasm "SIGN=ECC256 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
-          run_case rsa2048-smallstack-noasm "SIGN=RSA2048 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
-
-          run_case ecc256-smallstack-fastmath "SIGN=ECC256 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
-          run_case rsa2048-smallstack-fastmath "SIGN=RSA2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
-
   host_smoke:
     name: host-smoke
     if: github.repository_owner == 'wolfssl'
@@ -261,3 +172,315 @@ jobs:
           if ! printf '%s\n' "$output" | grep -F "Failure" >/dev/null; then
             echo "test-lib failed as expected, but did not print the legacy \"Failure\" marker"
           fi
+
+  renode_multimem_smallstack:
+    name: renode-multimem-smallstack
+    if: github.repository_owner == 'wolfssl'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: read
+
+    steps:
+      - name: Checkout wolfSSL
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: Clone wolfBoot and link tested wolfSSL
+        run: |
+          set -euxo pipefail
+
+          git clone --depth 1 --branch "${WOLFBOOT_BRANCH}" "${WOLFBOOT_REPO}" wolfboot
+          rm -rf wolfboot/lib/wolfssl
+          ln -s "${GITHUB_WORKSPACE}" wolfboot/lib/wolfssl
+          test -L wolfboot/lib/wolfssl
+          test "$(realpath wolfboot/lib/wolfssl)" = "${GITHUB_WORKSPACE}"
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Select config
+        working-directory: wolfboot
+        run: |
+          cp config/examples/nrf52840.config .config && make include/target.h
+
+##### SMALL STACK tests (xmalloc path: most regressions land here)
+
+      - name: Renode Tests SIGN=NONE WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=NONE WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests ECC256 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ECC256 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests ECC384 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ECC384 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests ECC521 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ECC521 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests ED25519 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ED25519 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests ED448 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ED448 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests RSA2048 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSA2048 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests RSA3072 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSA3072 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests RSA4096 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSA4096 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests RSAPSS2048 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests RSAPSS3072 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Renode Tests RSAPSS4096 WOLFBOOT_SMALL_STACK=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1"
+
+      - name: Upload Output Dir
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: renode-multimem-smallstack-results
+          path: wolfboot/test_results/
+
+  renode_multimem_smallstack_fastmath:
+    name: renode-multimem-smallstack-fastmath
+    if: github.repository_owner == 'wolfssl'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: read
+
+    steps:
+      - name: Checkout wolfSSL
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: Clone wolfBoot and link tested wolfSSL
+        run: |
+          set -euxo pipefail
+
+          git clone --depth 1 --branch "${WOLFBOOT_BRANCH}" "${WOLFBOOT_REPO}" wolfboot
+          rm -rf wolfboot/lib/wolfssl
+          ln -s "${GITHUB_WORKSPACE}" wolfboot/lib/wolfssl
+          test -L wolfboot/lib/wolfssl
+          test "$(realpath wolfboot/lib/wolfssl)" = "${GITHUB_WORKSPACE}"
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Select config
+        working-directory: wolfboot
+        run: |
+          cp config/examples/nrf52840.config .config && make include/target.h
+
+##### SMALL STACK + FAST MATH tests (TFM-backed xmalloc sizing)
+
+      - name: Renode Tests ECC256 SMALL_STACK SPMATH=0
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ECC256 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
+
+      - name: Renode Tests ECC384 SMALL_STACK SPMATH=0
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ECC384 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
+
+      - name: Renode Tests ECC521 SMALL_STACK SPMATH=0
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ECC521 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
+
+      - name: Renode Tests RSA2048 SMALL_STACK SPMATH=0
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSA2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
+
+      - name: Renode Tests RSA3072 SMALL_STACK SPMATH=0
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSA3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
+
+      - name: Renode Tests RSA4096 SMALL_STACK SPMATH=0
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSA4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
+
+      - name: Renode Tests RSAPSS2048 SMALL_STACK SPMATH=0
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
+
+      - name: Renode Tests RSAPSS3072 SMALL_STACK SPMATH=0
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
+
+      - name: Renode Tests RSAPSS4096 SMALL_STACK SPMATH=0
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0"
+
+      - name: Upload Output Dir
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: renode-multimem-smallstack-fastmath-results
+          path: wolfboot/test_results/
+
+  renode_multimem_smallstack_noasm:
+    name: renode-multimem-smallstack-noasm
+    if: github.repository_owner == 'wolfssl'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: read
+
+    steps:
+      - name: Checkout wolfSSL
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: Clone wolfBoot and link tested wolfSSL
+        run: |
+          set -euxo pipefail
+
+          git clone --depth 1 --branch "${WOLFBOOT_BRANCH}" "${WOLFBOOT_REPO}" wolfboot
+          rm -rf wolfboot/lib/wolfssl
+          ln -s "${GITHUB_WORKSPACE}" wolfboot/lib/wolfssl
+          test -L wolfboot/lib/wolfssl
+          test "$(realpath wolfboot/lib/wolfssl)" = "${GITHUB_WORKSPACE}"
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Select config
+        working-directory: wolfboot
+        run: |
+          cp config/examples/nrf52840.config .config && make include/target.h
+
+##### SMALL STACK + NO_ASM tests (portable C path xmalloc sizing)
+
+      - name: Renode Tests ECC256 SMALL_STACK NO_ASM=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ECC256 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
+
+      - name: Renode Tests ECC384 SMALL_STACK NO_ASM=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ECC384 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
+
+      - name: Renode Tests ECC521 SMALL_STACK NO_ASM=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=ECC521 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
+
+      - name: Renode Tests RSA2048 SMALL_STACK NO_ASM=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSA2048 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
+
+      - name: Renode Tests RSA3072 SMALL_STACK NO_ASM=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSA3072 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
+
+      - name: Renode Tests RSA4096 SMALL_STACK NO_ASM=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSA4096 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
+
+      - name: Renode Tests RSAPSS2048 SMALL_STACK NO_ASM=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
+
+      - name: Renode Tests RSAPSS3072 SMALL_STACK NO_ASM=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
+
+      - name: Renode Tests RSAPSS4096 SMALL_STACK NO_ASM=1
+        working-directory: wolfboot
+        env:
+          DOCKER_IMAGE: ${{ env.WOLFBOOT_RENODE_IMAGE }}
+        run: ./tools/renode/docker-test.sh "SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 NO_ASM=1"
+
+      - name: Upload Output Dir
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: renode-multimem-smallstack-noasm-results
+          path: wolfboot/test_results/