diff --git a/.github/workflows/docker-image.yaml b/.github/workflows/docker-image.yaml
index 0907ac09b4..09ac3738dc 100644
--- a/.github/workflows/docker-image.yaml
+++ b/.github/workflows/docker-image.yaml
@@ -3,6 +3,9 @@ name: Docker Image CI
 on:
   workflow_dispatch:
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
 
   build:
diff --git a/test/e2e/apps/imagelistpulljobs.go b/test/e2e/apps/imagelistpulljobs.go
index 20e7d98076..885bf18d27 100644
--- a/test/e2e/apps/imagelistpulljobs.go
+++ b/test/e2e/apps/imagelistpulljobs.go
@@ -181,12 +181,12 @@ var _ = SIGDescribe("PullImages", func() {
 				return job.Status.Desired
 			}, 3*time.Second, time.Second).Should(gomega.Equal(int32(len(job.Spec.Images))))
 
-			ginkgo.By("Wait completed in 180s")
+			ginkgo.By("Wait completed in 360s")
 			gomega.Eventually(func() bool {
 				job, err = testerForImageListPullJob.GetJob(job)
 				gomega.Expect(err).NotTo(gomega.HaveOccurred())
 				return job.Status.CompletionTime != nil
-			}, 180*time.Second, 3*time.Second).Should(gomega.Equal(true))
+			}, 360*time.Second, 10*time.Second).Should(gomega.Equal(true))
 			gomega.Expect(job.Status.Succeeded).To(gomega.Equal(int32(len(job.Spec.Images))))
 
 			ginkgo.By("Delete job")
diff --git a/test/e2e/apps/statefulset.go b/test/e2e/apps/statefulset.go
index fe4cf78885..bcf77f7887 100644
--- a/test/e2e/apps/statefulset.go
+++ b/test/e2e/apps/statefulset.go
@@ -663,7 +663,7 @@ var _ = SIGDescribe("StatefulSet", func() {
 			gomega.Expect(err).NotTo(gomega.HaveOccurred())
 
 			ginkgo.By("InPlace update Pods at the new revision")
-			sst.WaitForPodNotReady(ss, pods.Items[0].Name)
+			sst.WaitForPodUpdatedAndRunning(ss, pods.Items[0].Name, currentRevision)
 			sst.WaitForRunningAndReady(3, ss)
 			ss = sst.GetStatefulSet(ss.Namespace, ss.Name)
 			pods = sst.GetPodList(ss)
@@ -761,8 +761,9 @@ var _ = SIGDescribe("StatefulSet", func() {
 			gomega.Expect(err).NotTo(gomega.HaveOccurred())
 
 			ginkgo.By("InPlace update Pods at the new revision")
-			sst.WaitForPodNotReady(ss, pods.Items[0].Name)
+			sst.WaitForPodUpdatedAndRunning(ss, pods.Items[0].Name, currentRevision)
 			sst.WaitForRunningAndReady(3, ss)
+
 			ss = sst.GetStatefulSet(ss.Namespace, ss.Name)
 			pods = sst.GetPodList(ss)
 			for i := range pods.Items {
diff --git a/test/e2e/framework/statefulset_utils.go b/test/e2e/framework/statefulset_utils.go
index 0f7efc807f..ad691c1097 100644
--- a/test/e2e/framework/statefulset_utils.go
+++ b/test/e2e/framework/statefulset_utils.go
@@ -397,6 +397,28 @@ func (s *StatefulSetTester) WaitForPodNotReady(set *appsv1beta1.StatefulSet, pod
 
 }
 
+// WaitForPodNotReady waist for the Pod named podName in set to exist and to not have a Ready condition.
+func (s *StatefulSetTester) WaitForPodUpdatedAndRunning(set *appsv1beta1.StatefulSet, podName string, currentRevision string) (*appsv1beta1.StatefulSet, *v1.PodList) {
+	var pods *v1.PodList
+	s.WaitForState(set, func(set2 *appsv1beta1.StatefulSet, pods2 *v1.PodList) (bool, error) {
+		set = set2
+		pods = pods2
+		for i := range pods.Items {
+			if pods.Items[i].Name != podName {
+				continue
+			}
+
+			if pods.Items[i].Labels[apps.StatefulSetRevisionLabel] != currentRevision &&
+				podutil.IsPodReady(&pods.Items[i]) {
+				return true, nil
+			}
+			return false, nil
+		}
+		return false, nil
+	})
+	return set, pods
+}
+
 // WaitForRollingUpdate waits for all Pods in set to exist and have the correct revision and for the RollingUpdate to
 // complete. set must have a RollingUpdateStatefulSetStrategyType.
 func (s *StatefulSetTester) WaitForRollingUpdate(set *appsv1beta1.StatefulSet) (*appsv1beta1.StatefulSet, *v1.PodList) {