diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 9037439..9fe1c21 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,5 +1,6 @@
 stages:
   - build
+  - lint
   - test
   - sast
   - tag
@@ -201,7 +202,7 @@ build-migrate:
     SERVICE_NAME: migrate
 
 golangci-lint:
-  stage: test
+  stage: lint
   image: docker.io/golangci/golangci-lint:latest-alpine
   variables:
     GOLANGCI_LINT_CACHE: $CI_PROJECT_DIR/.cache/golangci-lint
@@ -218,64 +219,31 @@ golangci-lint:
     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
     - if: $CI_COMMIT_TAG
 
-# test:
-#   <<: *docker-job
-#   stage: test
-#   tags:
-#     - beta
-#   variables:
-#     COMPOSE_PROFILES: |
-#       --profile migrations
-#       --profile tests
-#       --profile ml
-#   script:
-#     - apk add --no-cache docker-compose
-#     - export PROFILES="$(printf '%s ' $COMPOSE_PROFILES)"
-#     - cp "$TEST_STAGE_FIREBASE_CONF" ./infrastructure/configs/backend/firebase.json
-#     - |
-#       (
-#         while true; do
-#           docker compose -f compose.yaml $PROFILES logs -f 2>&1
-#           sleep 1
-#         done
-#       ) | tee -a compose.log &
-#     - LOGS_PID=$!
-#     - |
-#       REGISTRY_PREFIX=$CI_REGISTRY_IMAGE IMAGE_TAG=$CI_COMMIT_SHA \
-#       docker compose -f compose.yaml -f compose.prod.yaml \
-#       $PROFILES up -d --quiet-pull --quiet-build 2>&1 | tee compose.log
-#     - |
-#       TEST_CONTAINER_ID=$(docker compose -f compose.yaml $PROFILES ps -q tests -a)
-#       timeout 600 docker wait $TEST_CONTAINER_ID
-#       TEST_EXIT_CODE=$(docker inspect --format "{{.State.ExitCode}}" $TEST_CONTAINER_ID)
-
-#       if [ $TEST_EXIT_CODE -eq 0 ]; then
-#         echo "Tests passed."
-#       else
-#         echo "Tests failed with exit code $TEST_EXIT_CODE."
-#         exit 1
-#       fi
-#     - |
-#       docker compose -f compose.yaml $PROFILES down
-#     - cat .cov/coverage.txt
-#   artifacts:
-#     paths:
-#       - ./.cov
-#       - ./compose.log
-#     reports:
-#       coverage_report:
-#         coverage_format: cobertura
-#         path: .cov/coverage.xml
-#     expire_in: 1 week
-#     when: always
-#   coverage: /TOTAL.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/
-#   rules:
-#     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-#     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-#   dependencies:
-#     - build-runtime
-#     - build-tests
-#     - build-migrations
+go-test:
+  stage: test
+  image: docker.io/library/golang:1.24-alpine
+  variables:
+    CGO_ENABLED: "0"
+  cache:
+    key: "${CI_COMMIT_REF_SLUG}-go-mod"
+    paths:
+      - /go/pkg/mod
+      - /root/.cache/go-build
+  script:
+    - apk add --no-cache git
+    - go test ./... -coverprofile=coverage.out
+    - go tool cover -func=coverage.out | tee coverage-func.txt
+    - TOTAL=$(go tool cover -func=coverage.out | awk '/total:/ {print $3}' | sed 's/%//')
+    - |
+      echo "Total coverage: $TOTAL"
+      echo "$TOTAL" | awk -v threshold=30 '{ if ($1+0 < threshold) { print "Coverage below threshold: " $1 "%"; exit 1 } }'
+  artifacts:
+    paths:
+      - coverage.out
+      - coverage-func.txt
+    expire_in: 1 week
+    when: always
+  coverage: '/TOTAL.+ ([0-9]{1,3}%)/'
 
 sast-filesystem:
   <<: *trivy-fs-scan
@@ -288,11 +256,24 @@ sast-image-auth:
   dependencies:
     - build-auth
 
+sast-image-migrate:
+  <<: *trivy-image-scan
+  variables:
+    IMAGE_NAME: $BASE_IMAGE_NAME/migrate
+    IMAGE_TYPE: migrate
+  dependencies:
+    - build-migrate
+
 tag-auth:
   <<: *tag-config
   variables:
     IMAGE_NAME: $BASE_IMAGE_NAME/auth
 
+tag-migrate:
+  <<: *tag-config
+  variables:
+    IMAGE_NAME: $BASE_IMAGE_NAME/migrate
+
 # webhook-backend-deploy:
 #   <<: *webhook-config
 #   stage: deploy