diff --git a/.github/workflows/apisix-e2e-test.yml b/.github/workflows/apisix-e2e-test.yml
index 3002023a..04199024 100644
--- a/.github/workflows/apisix-e2e-test.yml
+++ b/.github/workflows/apisix-e2e-test.yml
@@ -103,12 +103,10 @@ jobs:
         if: ${{ env.ADC_VERSION == 'dev' }}
         run: |
           docker create --name adc-temp ghcr.io/api7/adc:dev
-          # main.cjs lives in the image's WORKDIR, not at the container root,
-          # and docker cp resolves a relative SRC_PATH against the root.
-          docker cp "adc-temp:$(docker inspect -f '{{.Config.WorkingDir}}' adc-temp)/main.cjs" adc.js
+          docker cp adc-temp:/adc adc
           docker rm adc-temp
-          node $(pwd)/adc.js -v
-          echo "ADC_BIN=node $(pwd)/adc.js" >> $GITHUB_ENV
+          ./adc --version
+          echo "ADC_BIN=$(pwd)/adc" >> $GITHUB_ENV
 
       - name: Start OpenLDAP server
         run: make e2e-ldap
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 36821759..2118148c 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -105,12 +105,10 @@ jobs:
         if: ${{ env.ADC_VERSION == 'dev' }}
         run: |
           docker create --name adc-temp ghcr.io/api7/adc:dev
-          # main.cjs lives in the image's WORKDIR, not at the container root,
-          # and docker cp resolves a relative SRC_PATH against the root.
-          docker cp "adc-temp:$(docker inspect -f '{{.Config.WorkingDir}}' adc-temp)/main.cjs" adc.js
+          docker cp adc-temp:/adc adc
           docker rm adc-temp
-          node $(pwd)/adc.js -v
-          echo "ADC_BIN=node $(pwd)/adc.js" >> $GITHUB_ENV
+          ./adc --version
+          echo "ADC_BIN=$(pwd)/adc" >> $GITHUB_ENV
 
       - name: Start OpenLDAP server
         run: make e2e-ldap
diff --git a/Makefile b/Makefile
index d78dfff0..87b51645 100644
--- a/Makefile
+++ b/Makefile
@@ -202,34 +202,47 @@ kind-down:
 		&& kind delete cluster --name $(KIND_NAME) \
 		|| echo "kind cluster does not exist"
 
+# kind imports images with `ctr import --all-platforms`. With Docker's containerd
+# image store, `docker save` exports every platform of a pulled multi-platform image
+# although only one was pulled, so the import fails; save only the node platform.
+define kind-load-image
+	@if docker info -f '{{.DriverStatus}}' | grep -q io.containerd.snapshotter; then \
+		archive=$$(mktemp) && trap 'rm -f "$$archive"' EXIT && \
+		docker save --platform "$$(docker version -f '{{.Server.Os}}/{{.Server.Arch}}')" -o "$$archive" $(1) && \
+		kind load image-archive "$$archive" --name $(KIND_NAME); \
+	else \
+		kind load docker-image $(1) --name $(KIND_NAME); \
+	fi
+endef
+
 .PHONY: kind-load-images
 kind-load-images: pull-infra-images kind-load-ingress-image kind-load-adc-image
-	@kind load docker-image ghcr.io/api7/api7-ee-3-gateway:dev --name $(KIND_NAME)
-	@kind load docker-image ghcr.io/api7/api7-ee-dp-manager:$(DASHBOARD_VERSION)  --name $(KIND_NAME)
-	@kind load docker-image ghcr.io/api7/api7-ee-3-integrated:$(DASHBOARD_VERSION)  --name $(KIND_NAME)
-	@kind load docker-image kennethreitz/httpbin:latest --name $(KIND_NAME)
-	@kind load docker-image jmalloc/echo-server:latest --name $(KIND_NAME)
-	@kind load docker-image apache/apisix:dev --name $(KIND_NAME)
-	@kind load docker-image openresty/openresty:1.27.1.2-4-bullseye-fat --name $(KIND_NAME)
+	$(call kind-load-image,ghcr.io/api7/api7-ee-3-gateway:dev)
+	$(call kind-load-image,ghcr.io/api7/api7-ee-dp-manager:$(DASHBOARD_VERSION))
+	$(call kind-load-image,ghcr.io/api7/api7-ee-3-integrated:$(DASHBOARD_VERSION))
+	$(call kind-load-image,kennethreitz/httpbin:latest)
+	$(call kind-load-image,jmalloc/echo-server:latest)
+	$(call kind-load-image,apache/apisix:dev)
+	$(call kind-load-image,openresty/openresty:1.27.1.2-4-bullseye-fat)
 
 .PHONY: kind-load-gateway-image
 kind-load-gateway-image:
-	@kind load docker-image ghcr.io/api7/api7-ee-3-gateway:dev --name $(KIND_NAME)
+	$(call kind-load-image,ghcr.io/api7/api7-ee-3-gateway:dev)
 
 .PHONY: kind-load-dashboard-images
 kind-load-dashboard-images:
-	@kind load docker-image ghcr.io/api7/api7-ee-dp-manager:$(DASHBOARD_VERSION)  --name $(KIND_NAME)
-	@kind load docker-image ghcr.io/api7/api7-ee-3-integrated:$(DASHBOARD_VERSION)  --name $(KIND_NAME)
+	$(call kind-load-image,ghcr.io/api7/api7-ee-dp-manager:$(DASHBOARD_VERSION))
+	$(call kind-load-image,ghcr.io/api7/api7-ee-3-integrated:$(DASHBOARD_VERSION))
 
 .PHONY: kind-load-ingress-image
 kind-load-ingress-image:
-	@kind load docker-image $(IMG) --name $(KIND_NAME)
+	$(call kind-load-image,$(IMG))
 
 .PHONY: kind-load-adc-image
 kind-load-adc-image:
 	@docker pull ghcr.io/api7/adc:$(ADC_VERSION)
 	@docker tag ghcr.io/api7/adc:$(ADC_VERSION) ghcr.io/api7/adc:dev
-	@kind load docker-image ghcr.io/api7/adc:dev --name $(KIND_NAME)
+	$(call kind-load-image,ghcr.io/api7/adc:dev)
 
 .PHONY: pull-infra-images
 pull-infra-images:
diff --git a/test/e2e/crds/v2/streamroute.go b/test/e2e/crds/v2/streamroute.go
index 10ea85c1..f4ffb1ce 100644
--- a/test/e2e/crds/v2/streamroute.go
+++ b/test/e2e/crds/v2/streamroute.go
@@ -222,6 +222,9 @@ spec:
       containers:
       - name: mosquito
         image: eclipse-mosquitto:1.6
+        # Skip the image's all-comment config file: Ubuntu hosts ship an AppArmor
+        # profile for /usr/sbin/mosquitto that denies reading it inside kind.
+        args: ["/usr/sbin/mosquitto"]
         livenessProbe:
           tcpSocket:
             port: 1883