diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml
index 170fb368f..f2753edf1 100644
--- a/.github/workflows/helmsman_esignet.yml
+++ b/.github/workflows/helmsman_esignet.yml
@@ -71,6 +71,8 @@ jobs:
       name: ${{ github.ref_name }}
     steps:
       - name: Validate required variables
+        env:
+          IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }}
         run: |
           errors=()
           PROFILE="${{ github.event.inputs.profile }}"
@@ -94,6 +96,15 @@ jobs:
           if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then
             MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}"
             MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}"
+            if [ -z "$MOSIPID1_DOMAIN" ]; then
+              echo "❌ mosipid1_domain_name is required for standalone profiles"
+              exit 1
+            fi
+            if [ "$IN_ENABLE_MOSIPID2" = "true" ] &&
+               [ -z "$MOSIPID2_DOMAIN" ]; then
+              echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true"
+              exit 1
+            fi
             echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)"
             echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)"
             MOSIPID1_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }}"
@@ -326,7 +337,7 @@ jobs:
           kubectl cluster-info
 
       - name: Check if mosip-dsf label is completed
-        if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(github.event.inputs.profile, 'esignet-standalone') }}
+        if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(env.PROFILE, 'esignet-standalone') }}
         run: |
           STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}' 2>/dev/null || echo "")
           if [[ "$STATUS" != "completed" ]]; then
diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml
index 8a2c5395b..1b19de8ff 100644
--- a/.github/workflows/helmsman_testrigs.yml
+++ b/.github/workflows/helmsman_testrigs.yml
@@ -73,6 +73,12 @@ jobs:
       name: ${{ github.ref_name }}
     steps:
       - name: Validate required variables
+        env:
+          IN_MOSIPID1_DOMAIN: ${{ github.event.inputs.mosipid1_domain_name }}
+          IN_MOSIPID2_DOMAIN: ${{ github.event.inputs.mosipid2_domain_name }}
+          VAR_MOSIPID1_DOMAIN: ${{ vars.MOSIPID1_DOMAIN_NAME }}
+          VAR_MOSIPID2_DOMAIN: ${{ vars.MOSIPID2_DOMAIN_NAME }}
+          IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }}
         run: |
           errors=()
           PROFILE="${{ github.event.inputs.profile }}"
@@ -100,13 +106,22 @@ jobs:
           # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only.
           # Push events always target the esignet profile (path filter); dispatch uses explicit profile input.
           if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then
-            MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}"
-            MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}"
+            MOSIPID1_DOMAIN="${IN_MOSIPID1_DOMAIN:-$VAR_MOSIPID1_DOMAIN}"
+            MOSIPID2_DOMAIN="${IN_MOSIPID2_DOMAIN:-$VAR_MOSIPID2_DOMAIN}"
+            if [ -z "$MOSIPID1_DOMAIN" ]; then
+              echo "❌ mosipid1_domain_name is required for standalone profiles"
+              exit 1
+            fi
+            if [ "$IN_ENABLE_MOSIPID2" = "true" ] &&
+               [ -z "$MOSIPID2_DOMAIN" ]; then
+              echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true"
+              exit 1
+            fi
             echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)"
             echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)"
           else
-            MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}"
-            MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}"
+            MOSIPID1_PROVIDED="$IN_MOSIPID1_DOMAIN"
+            MOSIPID2_PROVIDED="$IN_MOSIPID2_DOMAIN"
             if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then
               echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE"
             fi
diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml
index 55e650580..0deca2876 100644
--- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml
+++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml
@@ -1,19 +1,19 @@
 # =============================================================================
 # eSignet Profile - eSignet Services DSF (Desired State File)
 # =============================================================================
-# This DSF deploys eSignet v1.7.1 services for the standalone eSignet profile.
+# This DSF deploys eSignet 2.0.0 (Go) services for the standalone eSignet profile.
 #
 # Components (in priority order):
 #   1. Keycloak Init (eSignet-specific clients and roles)
-#   2. eSignet service v1.7.1
-#   3. OIDC UI v1.7.1
+#   2. eSignet service 2.0.0-develop (Go)
+#   3. OIDC UI 2.0.0-develop (Go)
 #   4. Mock Identity System (optional, disabled by default)
 #   5. Mock Relying Party Service (optional)
 #   6. Mock Relying Party UI (optional)
 #   7. Partner Onboarder (eSignet + Resident OIDC)
 #   8. Demo OIDC Partner Onboarder
 #
-# Based on eSignet v1.7.1 deploy scripts:
+# Based on eSignet 2.0.0 deploy scripts:
 #   - install-esignet.sh
 #   - initialise-prereq.sh (keycloak-init)
 # =============================================================================
@@ -103,7 +103,7 @@ apps:
       postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh"
 
   # ---------------------------------------------------------------------------
-  # eSignet v1.7.1
+  # eSignet 
   # ---------------------------------------------------------------------------
   esignet-go-mock:
     namespace: esignet-go-mock
@@ -122,11 +122,11 @@ apps:
       extraEnvVarsCM[0]: "esignet-softhsm-go-share"
       #extraEnvVarsCM[1]: "kafka-config"
       metrics.serviceMonitor.enabled: "false"
-      domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}"
-      domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}"
-      domainConfig.MOSIP_API_HOST: "api.${domain_name}"
-      domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}"
-      domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}"
+      domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go.${domain_name}"
+      domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go.${domain_name}"
+      domainConfig.MOSIP_API_HOST: "https://api.${domain_name}"
+      domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}"
+      domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}"
       domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}"
       domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}"
       domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}"
@@ -155,11 +155,11 @@ apps:
       extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid1-share"
       extraEnvVarsCM[1]: "esignet-global"
       metrics.serviceMonitor.enabled: "false"
-      domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid1.${domain_name}"
-      domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid1.${domain_name}"
-      domainConfig.MOSIP_API_HOST: "api.${domain_name}"
-      domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}"
-      domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}"
+      domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid1.${domain_name}"
+      domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid1.${domain_name}"
+      domainConfig.MOSIP_API_HOST: "https://api.${domain_name}"
+      domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}"
+      domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid1_domain_name}"
       domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}"
       domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}"
       domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}"
@@ -196,11 +196,11 @@ apps:
       extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid2-share"
       extraEnvVarsCM[1]: "esignet-global"
       metrics.serviceMonitor.enabled: "false"
-      domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid2.${domain_name}"
-      domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid2.${domain_name}"
-      domainConfig.MOSIP_API_HOST: "api.${domain_name}"
-      domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}"
-      domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}"
+      domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid2.${domain_name}"
+      domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid2.${domain_name}"
+      domainConfig.MOSIP_API_HOST: "https://api.${domain_name}"
+      domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}"
+      domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid2_domain_name}"
       domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}"
       domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}"
       domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}"
@@ -237,11 +237,11 @@ apps:
       extraEnvVarsCM[0]: "esignet-softhsm-go-sunbird-share"
       #extraEnvVarsCM[1]: "kafka-config"
       metrics.serviceMonitor.enabled: "false"
-      domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-sunbird.${domain_name}"
-      domainConfig.MOSIP_SIGNUP_HOST: "signup-go-sunbird.${domain_name}"
-      domainConfig.MOSIP_API_HOST: "api.${domain_name}"
-      domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}"
-      domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}"
+      domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-sunbird.${domain_name}"
+      domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-sunbird.${domain_name}"
+      domainConfig.MOSIP_API_HOST: "https://api.${domain_name}"
+      domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}"
+      domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}"
       domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}"
       domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}"
       domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}"
@@ -256,12 +256,12 @@ apps:
       preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh"
 
   # ---------------------------------------------------------------------------
-  # OIDC UI v1.7.1
+  # OIDC UI 
   # ---------------------------------------------------------------------------
   oidc-ui-go:
     namespace: esignet-go-mock
     enabled: true
-    version: 0.0.1-develop
+    version: 2.0.0-develop
     chart: mosip/oidc-ui
     set:
       image.repository: "mosipqa/oidc-ui"
@@ -270,6 +270,7 @@ apps:
       oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock"
       oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet"
       oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mock.esignet-go-mock"
+
     timeout: 1200
     priority: -13
     hooks:
@@ -278,7 +279,7 @@ apps:
   oidc-ui-go-mosipid1:
     namespace: esignet-go-mosipid1
     enabled: true
-    version: 0.1.0-develop
+    version: 2.0.0-develop
     chart: mosip/oidc-ui
     set:
       image.repository: "mosipqa/oidc-ui"
@@ -295,7 +296,7 @@ apps:
   oidc-ui-go-mosipid2:
     namespace: esignet-go-mosipid2
     enabled: ${MOSIPID2_ENABLED}
-    version: 0.0.1-develop
+    version: 2.0.0-develop
     chart: mosip/oidc-ui
     set:
       image.repository: "mosipqa/oidc-ui"
@@ -312,7 +313,7 @@ apps:
   oidc-ui-go-sunbird:
     namespace: esignet-go-sunbird
     enabled: true
-    version: 0.0.1-develop
+    version: 2.0.0-develop
     chart: mosip/oidc-ui
     set:
       image.repository: "mosipqa/oidc-ui"
@@ -380,11 +381,15 @@ apps:
     enabled: true
     version: 0.0.1-develop
     chart: mosip/mock-relying-party-service
+    valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml"
     set:
       image.repository: "mosipqa/mock-relying-party-service"
       image.tag: "develop-go"
-      mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet"
-      mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}/v1/esignet/oauth/v2/token"
+      mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go.${domain_name}/v1/esignet"
+      mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}"
+      mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go.${domain_name}/v1/esignet/oauth2/par"
+      mock_relying_party_service.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile"
+      mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go.${domain_name}"
       enable_insecure: "false"
       domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}"
     timeout: 480
@@ -397,11 +402,15 @@ apps:
     enabled: true
     version: 0.0.1-develop
     chart: mosip/mock-relying-party-service
+    valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml"
     set:
       image.repository: "mosipqa/mock-relying-party-service"
       image.tag: "develop-go"    
-      mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet"
-      mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth/v2/token"
+      mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet"
+      mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}"
+      mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth2/par"
+      mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile"
+      mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid1.${domain_name}"
       enable_insecure: "false"
       domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}"
     timeout: 480
@@ -414,11 +423,15 @@ apps:
     enabled: ${MOSIPID2_ENABLED}
     version: 0.0.1-develop
     chart: mosip/mock-relying-party-service
+    valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml"
     set:
       image.repository: "mosipqa/mock-relying-party-service"
-      image.tag: "develop-go"    
-      mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet"
-      mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth/v2/token"
+      image.tag: "develop-go"
+      mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet"
+      mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}"
+      mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth2/par"
+      mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile"
+      mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid2.${domain_name}"
       enable_insecure: "false"
       domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}"
     timeout: 480
@@ -431,11 +444,15 @@ apps:
     enabled: true
     version: 0.0.1-develop
     chart: mosip/mock-relying-party-service
+    valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml"
     set:
       image.repository: "mosipqa/mock-relying-party-service"
       image.tag: "develop-go"    
-      mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet"
-      mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth/v2/token"
+      mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet"
+      mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}"
+      mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth2/par"
+      mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile"
+      mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-sunbird.${domain_name}"
       enable_insecure: "false"
       domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}"
     timeout: 480
@@ -458,6 +475,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge
       istio.hosts[0]: "healthservices-go.${domain_name}"
     wait: true
     timeout: 480
@@ -480,6 +511,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid1.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge      
       istio.hosts[0]: "healthservices-go-mosipid1.${domain_name}"
     wait: true
     timeout: 480
@@ -502,6 +547,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid2.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge      
       istio.hosts[0]: "healthservices-go-mosipid2.${domain_name}"
     wait: true
     timeout: 480
@@ -524,6 +583,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-sunbird.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-sunbird.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge      
       istio.hosts[0]: "healthservices-go-sunbird.${domain_name}"
     wait: true
     timeout: 480
diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml
index f243acad9..b48741524 100644
--- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml
+++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml
@@ -8,12 +8,12 @@ helmRepos:
   mosip: https://mosip.github.io/mosip-helm
 
 # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces):
-#   esignet-apitestrig            → esignet ns
-#   esignet-mosipid1-apitestrig   → esignet-mosipid1 ns
-#   esignet-mosipid2-apitestrig   → esignet-mosipid2 ns
-#   esignet-sunbird-apitestrig    → esignet-sunbird ns
-#   esignet-signup-apitestrig     → signup ns        (disabled — enable if signup deployed)
-#   signup-uitestrig              → signup-uitestrig  (disabled — enable if signup deployed)
+#   esignet-apitestrig-go            → esignet-go-mock ns
+#   esignet-go-mosipid1-apitestrig   → esignet-go-mosipid1 ns
+#   esignet-go-mosipid2-apitestrig   → esignet-go-mosipid2 ns
+#   esignet-go-sunbird-apitestrig    → esignet-go-sunbird ns
+#   esignet-signup-apitestrig-go     → signup-go ns          (disabled — enable if signup deployed)
+#   signup-uitestrig-go              → signup-uitestrig-go   (disabled — enable if signup deployed)
 namespaces:
   esignet-go-mosipid1:
     protected: false
@@ -212,7 +212,7 @@ apps:
     priority: -2
     hooks:
       preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh"
-      # postInstall: "$WORKDIR/hooks/esignet-standalone/trigger-test-jobs-esignet.sh"
+      # postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh"
 
   # ---------------------------------------------------------------------------
   # Signup API Test Rig — disabled by default
diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml
index bdeb831ef..5db2e94be 100644
--- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml
+++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml
@@ -443,6 +443,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge     
       istio.hosts[0]: "healthservices.${domain_name}"
     wait: true
     timeout: 480
@@ -463,6 +477,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge      
       istio.hosts[0]: "healthservices-mosipid1.${domain_name}"
     wait: true
     timeout: 480
@@ -483,6 +511,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge      
       istio.hosts[0]: "healthservices-mosipid2.${domain_name}"
     wait: true
     timeout: 480
@@ -503,6 +545,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge      
       istio.hosts[0]: "healthservices-sunbird.${domain_name}"
     wait: true
     timeout: 480
diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml
index c25538342..f44e721d9 100644
--- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml
+++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml
@@ -512,7 +512,7 @@ apps:
   captcha:
     namespace: captcha
     enabled: true
-    version: 0.1.0-beta.1
+    version: 0.1.1
     chart: mosip/captcha
     set:
       metrics.serviceMonitor.enabled: "false"
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh
index adbdcadfb..14b70b216 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh
@@ -1,19 +1,22 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup
+# eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install Setup
 # =============================================================================
-# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release.
+# Prepares the esignet-mosipid1 namespace for the esignet-go-mosipid1-apitestrig release.
 # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1
-# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql
-# needs to be copied; stale testrig CMs are deleted so the chart recreates them.
+# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied,
+# and the s3-esignet-mosipid1-apitestrig / apitestrig-esignet-mosipid1-apitestrig
+# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create
+# them itself); stale testrig CMs are deleted so the chart recreates them.
 # =============================================================================
 set -euo pipefail
 
 NS=esignet-go-mosipid1
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
+MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}"
 
 echo "================================================"
-echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install"
+echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install"
 echo "================================================"
 
 echo "Deleting stale testrig configmaps in $NS"
@@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3
 kubectl -n "$NS" delete --ignore-not-found=true configmap db
 kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig
 
+echo "Creating s3-esignet-mosipid1-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic s3-esignet-mosipid1-apitestrig \
+  --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+echo "Creating apitestrig-esignet-mosipid1-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid1-apitestrig \
+  --dry-run=client -o yaml | kubectl apply -f -
+
 echo "Copying postgres-postgresql secret to $NS"
 $COPY_UTIL secret postgres-postgresql postgres "$NS"
 
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh
index bb5f2d9e2..072faec92 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh
@@ -1,19 +1,22 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup
+# eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install Setup
 # =============================================================================
-# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release.
+# Prepares the esignet-mosipid2 namespace for the esignet-go-mosipid2-apitestrig release.
 # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2
-# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql
-# needs to be copied; stale testrig CMs are deleted so the chart recreates them.
+# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied,
+# and the s3-esignet-mosipid2-apitestrig / apitestrig-esignet-mosipid2-apitestrig
+# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create
+# them itself); stale testrig CMs are deleted so the chart recreates them.
 # =============================================================================
 set -euo pipefail
 
 NS=esignet-go-mosipid2
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
+MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}"
 
 echo "================================================"
-echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install"
+echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install"
 echo "================================================"
 
 echo "Deleting stale testrig configmaps in $NS"
@@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3
 kubectl -n "$NS" delete --ignore-not-found=true configmap db
 kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig
 
+echo "Creating s3-esignet-mosipid2-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic s3-esignet-mosipid2-apitestrig \
+  --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+echo "Creating apitestrig-esignet-mosipid2-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid2-apitestrig \
+  --dry-run=client -o yaml | kubectl apply -f -
+
 echo "Copying postgres-postgresql secret to $NS"
 $COPY_UTIL secret postgres-postgresql postgres "$NS"
 
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh
index de0fb532e..ebd79e8e9 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh
@@ -1,19 +1,22 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - eSignet API Testrig Pre-install Setup
+# eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install Setup
 # =============================================================================
-# Prepares the esignet-mock namespace for the esignet-apitestrig release.
+# Prepares the esignet-mock namespace for the esignet-apitestrig-go release.
 # keycloak-host and keycloak-client-secrets are already present in esignet-mock ns
-# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql
-# needs to be copied; stale testrig CMs are deleted so the chart recreates them.
+# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied,
+# and the s3-esignet-apitestrig / apitestrig-esignet-apitestrig secrets referenced
+# by extraEnvVarsSecret are created here (chart doesn't create them itself); stale
+# testrig CMs are deleted so the chart recreates them.
 # =============================================================================
 set -euo pipefail
 
 NS=esignet-go-mock
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
+MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}"
 
 echo "================================================"
-echo "eSignet 1.7.1 - eSignet API Testrig Pre-install"
+echo "eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install"
 echo "================================================"
 
 echo "Deleting stale testrig configmaps in $NS"
@@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3
 kubectl -n "$NS" delete --ignore-not-found=true configmap db
 kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig
 
+echo "Creating s3-esignet-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic s3-esignet-apitestrig \
+  --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+echo "Creating apitestrig-esignet-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic apitestrig-esignet-apitestrig \
+  --dry-run=client -o yaml | kubectl apply -f -
+
 echo "Copying postgres-postgresql secret to $NS"
 $COPY_UTIL secret postgres-postgresql postgres "$NS"
 
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh
index 1a58942ea..d7adbcca9 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh
@@ -1,19 +1,22 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install Setup
+# eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install Setup
 # =============================================================================
-# Prepares the esignet-sunbird namespace for the esignet-sunbird-apitestrig release.
+# Prepares the esignet-sunbird namespace for the esignet-go-sunbird-apitestrig release.
 # keycloak-host and keycloak-client-secrets are already present in esignet-sunbird
-# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql
-# needs to be copied; stale testrig CMs are deleted so the chart recreates them.
+# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied,
+# and the s3-esignet-sunbird-apitestrig / apitestrig-esignet-sunbird-apitestrig
+# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create
+# them itself); stale testrig CMs are deleted so the chart recreates them.
 # =============================================================================
 set -euo pipefail
 
 NS=esignet-go-sunbird
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
+MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}"
 
 echo "================================================"
-echo "eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install"
+echo "eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install"
 echo "================================================"
 
 echo "Deleting stale testrig configmaps in $NS"
@@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3
 kubectl -n "$NS" delete --ignore-not-found=true configmap db
 kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig
 
+echo "Creating s3-esignet-sunbird-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic s3-esignet-sunbird-apitestrig \
+  --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+echo "Creating apitestrig-esignet-sunbird-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic apitestrig-esignet-sunbird-apitestrig \
+  --dry-run=client -o yaml | kubectl apply -f -
+
 echo "Copying postgres-postgresql secret to $NS"
 $COPY_UTIL secret postgres-postgresql postgres "$NS"
 
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh
index 938217c8c..60ef72d59 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh
@@ -7,9 +7,9 @@
 # with the secret key environment variable.
 #
 # Environment Variables:
-#   CAPTCHA_SITE_KEY     - reCAPTCHA site key (REQUIRED)
-#   CAPTCHA_SECRET_KEY   - reCAPTCHA secret key (REQUIRED)
-#   ESIGNET_NS           - eSignet namespace (default: esignet)
+#   ESIGNET_CAPTCHA_SITE_KEY     - reCAPTCHA site key (REQUIRED)
+#   ESIGNET_CAPTCHA_SECRET_KEY   - reCAPTCHA secret key (REQUIRED)
+#   ESIGNET_NS                  - eSignet namespace (default: esignet-go-mock)
 # =============================================================================
 set -euo pipefail
 
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh
index bfeb5c619..f26e8ed56 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh
@@ -18,23 +18,22 @@ JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \
   -l app.kubernetes.io/instance=esignet-misp-onboarder-go \
   -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "")
 
-if [ "$JOB_STATUS" = "1" ]; then
-  echo "eSignet MISP partner onboarding completed successfully."
-else
+# Always restore namespace injection before returning from this hook.
+kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite
+echo "Istio injection re-enabled on namespace $ESIGNET_NS."
+
+if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then
   echo "WARNING: onboarding job may not have completed. Check logs:"
   kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-go --tail=30 2>/dev/null || true
+  exit 1
 fi
-
-# Re-enable Istio sidecar injection now that the Job has completed
-kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite
-echo "Istio injection re-enabled on namespace $ESIGNET_NS."
+echo "eSignet MISP partner onboarding completed successfully."
 
 # Restart config-server first so it reloads the MISP key from the secret,
 # then restart esignet so it fetches the updated config from config-server.
 if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-go &>/dev/null; then
   kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-go
-  kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s || \
-    echo "WARNING: esignet-config-server-go rollout did not complete within timeout." >&2
+  kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s
   echo "esignet-config-server-go restarted."
 else
   echo "esignet-config-server-go deployment not found — skipping restart."
@@ -42,8 +41,7 @@ fi
 
 if kubectl -n "$ESIGNET_NS" get deployment esignet-go-mock &>/dev/null; then
   kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-go-mock
-  kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s || \
-    echo "WARNING: esignet rollout did not complete within timeout." >&2
+  kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s
   echo "esignet deployment restarted."
 else
   echo "esignet deployment not found — skipping restart."
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh
index 72baca851..e8dc9d7e8 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh
@@ -26,6 +26,14 @@ kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply
 kubectl label namespace "$ESIGNET_NS" istio-injection=disabled --overwrite
 echo "Istio injection disabled on namespace $ESIGNET_NS."
 
+restore_istio_injection_on_failure() {
+  local status=$?
+  if [ "$status" -ne 0 ]; then
+    kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite || true
+  fi
+}
+trap restore_istio_injection_on_failure EXIT
+
 # Delete stale MISP onboarder artifacts from any previous run
 kubectl -n "$ESIGNET_NS" delete configmap esignet-onboarder-config --ignore-not-found=true
 kubectl -n "$ESIGNET_NS" delete secret esignet-onboarder-secrets --ignore-not-found=true
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh
index e0d5ccbc1..cd5501eaf 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh
@@ -44,6 +44,29 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null;
   echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS"
 fi
 
+# Create esignet-keystore-go-mosipid1 (PKCS12 keystore for KEYMANAGER_KEYSTORE_TYPE: PKCS12) —
+# a throwaway self-signed cert generated once and reused across redeploys. Never regenerate an
+# existing keystore: KEYMANAGER_PKCS12_PASSWORD/mosipid1.pfx must stay stable, or anything
+# encrypted with the old keystore becomes unreadable.
+if ! kubectl -n "$ESIGNET_NS" get secret esignet-keystore-go-mosipid1 &>/dev/null; then
+  echo "Generating dummy PKCS12 keystore for mosipid1"
+  DUMMY_P12_PASSWORD="localtest"
+  TMP_KEY="$(mktemp)"
+  TMP_CERT="$(mktemp)"
+  TMP_P12="$(mktemp)"
+  openssl req -x509 -newkey rsa:2048 -keyout "$TMP_KEY" -out "$TMP_CERT" \
+    -days 3650 -nodes -subj "/CN=esignet-go-mosipid1-dummy" 2>/dev/null
+  openssl pkcs12 -export -out "$TMP_P12" -inkey "$TMP_KEY" -in "$TMP_CERT" \
+    -passout "pass:${DUMMY_P12_PASSWORD}"
+  kubectl -n "$ESIGNET_NS" create secret generic esignet-keystore-go-mosipid1 \
+    --from-literal=KEYMANAGER_PKCS12_PASSWORD="$DUMMY_P12_PASSWORD" \
+    --from-file=mosipid1.pfx="$TMP_P12"
+  rm -f "$TMP_KEY" "$TMP_CERT" "$TMP_P12"
+  echo "esignet-keystore-go-mosipid1 secret created in $ESIGNET_NS"
+else
+  echo "esignet-keystore-go-mosipid1 already exists — reusing existing keystore"
+fi
+
 echo "Creating esignet-captcha-go-mosipid1 secret in $CAPTCHA_NS namespace"
 kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid1 \
   --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh
index 5651ce2b5..b4f4546ab 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh
@@ -20,6 +20,15 @@ API_HOST="${MOSIP_API_HOST:-}"
 API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}"
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
 
+if [ -z "$API_HOST" ]; then
+  echo "ERROR: MOSIP_API_HOST must be set" >&2
+  exit 1
+fi
+if [ -z "$API_INTERNAL_HOST" ]; then
+  echo "ERROR: MOSIP_API_INTERNAL_HOST must be set" >&2
+  exit 1
+fi
+
 echo "================================================"
 echo "eSignet 1.7.1 - Kernel Pre-install"
 echo "================================================"
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh
index 9d22608cd..8f006956d 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh
@@ -1,13 +1,13 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Identity System DB Init Pre-install
+# eSignet Standalone 2.0.0 - Mock Identity System DB Init Pre-install
 # =============================================================================
 # Based on: esignet-mock-services/deploy/postgres/init_db.sh
 # Ensures postgres-postgresql secret is present in the esignet namespace
 # before postgres-init-mock-identity helm chart runs DB initialization.
 #
 # Environment Variables:
-#   ESIGNET_NS - eSignet namespace (default: esignet)
+#   ESIGNET_NS - eSignet namespace (default: esignet-go-mock)
 # =============================================================================
 set -euo pipefail
 
@@ -16,7 +16,7 @@ POSTGRES_NS="postgres"
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
 
 echo "================================================"
-echo "eSignet 1.7.1 - Mock Identity DB Init Pre-install"
+echo "eSignet Standalone 2.0.0 - Mock Identity DB Init Pre-install"
 echo "================================================"
 
 # --- Step 1: Ensure esignet namespace exists with istio ---
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh
index da1b91802..4d51968bf 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Identity System Pre-install
+# eSignet Standalone 2.0.0 - Mock Identity System Pre-install
 # =============================================================================
 # Prepares esignet namespace for mock identity system deployment:
 #   - Copies softhsm-mock-identity-system secret from softhsm ns
@@ -8,8 +8,8 @@
 #   - Verifies softhsm-mock-identity-system-go-share ConfigMap is present
 #
 # Environment Variables:
-#   MOCKID_DB_NAME  - Mock identity DB name (default: mosip_mockidentitysystem)
-#   MOCKID_DB_USER  - Mock identity DB user (default: mockidentityuser)
+#   MOCKID_DB_NAME  - Mock identity DB name (default: mosip_mockidentitysystem_go)
+#   MOCKID_DB_USER  - Mock identity DB user (default: mockidentityuser_go)
 #   MOCKID_DB_PORT  - Postgres port (default: 5432)
 # =============================================================================
 set -euo pipefail
@@ -22,7 +22,7 @@ MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}"
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
 
 echo "================================================"
-echo "eSignet 1.7.1 - Mock Identity System Pre-install"
+echo "eSignet Standalone 2.0.0 - Mock Identity System Pre-install"
 echo "================================================"
 
 kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f -
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh
index 1847d2e5a..78db8d94c 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install
+# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID1 Pre-install
 # =============================================================================
 # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service
 # preinstall (creates private key secrets in the target namespace).
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh
index 069f92439..e6e8f3496 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install
+# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID2 Pre-install
 # =============================================================================
 # Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service
 # preinstall (creates private key secrets in the target namespace).
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh
index 45b51adcd..f2736d682 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Relying Party Service Pre-install
+# eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install
 # =============================================================================
 # Creates K8s secrets for mock relying party private keys from GitHub Actions
 # environment secrets, then verifies the esignet service is running.
@@ -25,7 +25,7 @@ cleanup_temp_files() {
 trap cleanup_temp_files EXIT INT TERM
 
 echo "================================================"
-echo "eSignet 1.7.1 - Mock Relying Party Service Pre-install"
+echo "eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install"
 echo "================================================"
 
 kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f -
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh
index 7cb2fcbb6..74bc76ee2 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Relying Party Service Sunbird Pre-install
+# eSignet Standalone 2.0.0 - Mock Relying Party Service Sunbird Pre-install
 # =============================================================================
 # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base mock-rp-service
 # preinstall (creates private key secrets in the target namespace).
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh
index dd6165071..eccf10272 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install
+# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install
 # =============================================================================
 # Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service
 # is available in the esignet-mosipid1 namespace before UI deployment.
@@ -10,7 +10,7 @@ set -euo pipefail
 ESIGNET_NS="esignet-go-mosipid1"
 
 echo "================================================"
-echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install"
+echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install"
 echo "================================================"
 
 kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f -
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh
index 3734187c8..3c65bbbcc 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install
+# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install
 # =============================================================================
 # Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service
 # is available in the esignet-mosipid2 namespace before UI deployment.
@@ -10,7 +10,7 @@ set -euo pipefail
 ESIGNET_NS="esignet-go-mosipid2"
 
 echo "================================================"
-echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install"
+echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install"
 echo "================================================"
 
 kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f -
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh
index 1340a045f..220b444ae 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh
@@ -1,13 +1,13 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Relying Party UI Pre-install
+# eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install
 # =============================================================================
 # Prepares for mock relying party UI deployment.
 # =============================================================================
 set -euo pipefail
 
 echo "================================================"
-echo "eSignet 1.7.1 - Mock Relying Party UI Pre-install"
+echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install"
 echo "================================================"
 
 # Ensure esignet namespace exists
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh
index e1c066e06..9d37c849f 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install
+# eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install
 # =============================================================================
 # Ensures esignet-sunbird namespace exists and verifies mock-relying-party-service
 # is available in the esignet-sunbird namespace before UI deployment.
@@ -10,7 +10,7 @@ set -euo pipefail
 ESIGNET_NS="esignet-go-sunbird"
 
 echo "================================================"
-echo "eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install"
+echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install"
 echo "================================================"
 
 kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f -
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh
index 8277b1a8f..5bf32602a 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Notifier Post-install
+# eSignet Standalone 2.0.0 - Notifier Post-install
 # =============================================================================
 # Based on: esignet-signup/deploy/kernel/install.sh
 # Patches notifier deployment with SMS number length env vars after install.
@@ -10,7 +10,7 @@ set -euo pipefail
 KERNEL_NS="kernel-go"
 
 echo "================================================"
-echo "eSignet 1.7.1 - Notifier Post-install"
+echo "eSignet Standalone 2.0.0 - Notifier Post-install"
 echo "================================================"
 
 # Source: deploy/kernel/install.sh - kubectl set env deployment/notifier
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh
index fb19d5533..57aa055fa 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install
+# eSignet Standalone 2.0.0 - OIDC UI MOSIPID1 Pre-install
 # =============================================================================
 # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall.
 # =============================================================================
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh
index 84be8071d..1b95fc1e7 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh
@@ -64,7 +64,9 @@ if [[ -z "$ENV_VAR_EXISTS" ]]; then
   kubectl patch deployment -n captcha captcha --type='json' \
     -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-go", "key": "signup-captcha-secret-key"}}}}]'
 else
-  echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO already exists."
+  echo "Restarting captcha to load the updated signup-go secret."
+  kubectl -n captcha rollout restart deployment/captcha
+  kubectl -n captcha rollout status deployment/captcha --timeout=480s
 fi
 
 # --- Step 5: Create signup-keystore secrets ---
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh
index 2d02ce0cd..2818214bc 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh
@@ -25,14 +25,12 @@ echo "Waiting for SoftHSM pod to be ready..."
 kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-go --timeout=480s || \
   { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; }
 
-# --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace ---
-echo "Copying esignet-softhsm-share configmap to $ESIGNET_NS namespace"
-$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \
-  echo "WARNING: esignet-softhsm-share configmap not found in $SOFTHSM_NS"
+# --- Step 2: Copy esignet-softhsm-go-share configmap to esignet namespace ---
+echo "Copying esignet-softhsm-go-share configmap to $ESIGNET_NS namespace"
+$COPY_UTIL configmap esignet-softhsm-go-share "$SOFTHSM_NS" "$ESIGNET_NS"
 
 # --- Step 3: Copy esignet-softhsm secret to esignet namespace ---
 echo "Copying esignet-softhsm-go secret to $ESIGNET_NS namespace"
-$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \
-  echo "WARNING: esignet-softhsm-go secret not found in $SOFTHSM_NS"
+$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS"
 
 echo "SoftHSM eSignet post-install completed."
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh
index 58088c891..99884df6b 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh
@@ -1,11 +1,11 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Trigger Testrig CronJobs
+# eSignet Standalone 2.0.0 - Trigger Testrig CronJobs
 # =============================================================================
 # Immediately triggers testrig CronJobs after deployment:
-#   apitestrig  → esignet-mock ns   (cronjob-apitestrig-esignet-mock)
-#   signup-apitestrig → signup ns  (if deployed)
-#   signup-uitestrig  → signup-uitestrig ns (if deployed)
+#   apitestrig  → esignet-go-mock ns
+#   signup-apitestrig → signup-go ns  (if deployed)
+#   signup-uitestrig  → signup-uitestrig-go ns (if deployed)
 # =============================================================================
 set -euo pipefail
 
@@ -13,12 +13,35 @@ CONTINUE_ON_FAILURE="${CONTINUE_ON_FAILURE:-true}"
 JOB_TIMEOUT="${JOB_TIMEOUT:-5400}"
 OVERALL_SUCCESS=true
 
+# Runs `kubectl "$@"`, printing stdout on success.
+# Returns 0 on success, 2 for a genuine NotFound (caller should treat the
+# resource as absent), or 1 with the error printed to stderr for any other
+# kubectl failure (RBAC, credentials, API errors) so real problems aren't
+# silently swallowed alongside the expected "doesn't exist" case.
+kubectl_get() {
+  local output rc=0
+  output=$(kubectl "$@" 2>&1) || rc=$?
+  if [[ $rc -eq 0 ]]; then
+    printf '%s' "$output"
+    return 0
+  fi
+  if echo "$output" | grep -q '(NotFound)'; then
+    return 2
+  fi
+  echo "✗ kubectl $* failed: $output" >&2
+  return 1
+}
+
 trigger_and_wait() {
   local ns=$1 cronjob=$2
 
-  if ! kubectl get cronjob -n "$ns" "$cronjob" &>/dev/null; then
+  local rc=0
+  kubectl_get get cronjob -n "$ns" "$cronjob" -o name >/dev/null || rc=$?
+  if [[ $rc -eq 2 ]]; then
     echo "⏭  CronJob $cronjob not found in $ns — skipping"
     return 0
+  elif [[ $rc -ne 0 ]]; then
+    return 1
   fi
 
   local job_name="${cronjob}-manual-$(date +%s)"
@@ -27,10 +50,29 @@ trigger_and_wait() {
 
   local elapsed=0
   while [[ $elapsed -lt $JOB_TIMEOUT ]]; do
-    local complete=$(kubectl get job -n "$ns" "$job_name" \
-      -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}' 2>/dev/null || echo "")
-    local failed=$(kubectl get job -n "$ns" "$job_name" \
-      -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}' 2>/dev/null || echo "")
+    local complete failed
+    rc=0
+    complete=$(kubectl_get get job -n "$ns" "$job_name" \
+      -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}') || rc=$?
+    if [[ $rc -eq 2 ]]; then
+      echo "  ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..."
+      sleep 10
+      elapsed=$((elapsed + 10))
+      continue
+    elif [[ $rc -ne 0 ]]; then
+      return 1
+    fi
+    rc=0
+    failed=$(kubectl_get get job -n "$ns" "$job_name" \
+      -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}') || rc=$?
+    if [[ $rc -eq 2 ]]; then
+      echo "  ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..."
+      sleep 10
+      elapsed=$((elapsed + 10))
+      continue
+    elif [[ $rc -ne 0 ]]; then
+      return 1
+    fi
     [[ "$complete" == "True" ]] && { echo "✓ $job_name completed successfully"; return 0; }
     [[ "$failed"   == "True" ]] && {
       echo "✗ $job_name failed" >&2
@@ -48,8 +90,14 @@ trigger_and_wait() {
 
 trigger_all_in_ns() {
   local ns=$1
-  local cronjobs
-  cronjobs=$(kubectl get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "")
+  local cronjobs rc=0
+  cronjobs=$(kubectl_get get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}') || rc=$?
+  if [[ $rc -eq 2 ]]; then
+    echo "⏭  No CronJobs found in $ns — skipping"
+    return 0
+  elif [[ $rc -ne 0 ]]; then
+    return 1
+  fi
   if [[ -z "$cronjobs" ]]; then
     echo "⏭  No CronJobs found in $ns — skipping"
     return 0
@@ -60,7 +108,7 @@ trigger_all_in_ns() {
 }
 
 echo "================================================"
-echo "eSignet 1.7.1 - Trigger Testrig CronJobs"
+echo "eSignet Standalone 2.0.0 - Trigger Testrig CronJobs"
 echo "================================================"
 
 echo "=== eSignet API Testrig (esignet-go-mock ns) ==="
@@ -76,10 +124,10 @@ echo "=== eSignet-Sunbird API Testrig (esignet-go-sunbird ns) ==="
 trigger_all_in_ns esignet-go-sunbird || OVERALL_SUCCESS=false
 
 echo "=== Signup API Testrig (signup-go ns, if deployed) ==="
-trigger_all_in_ns signup-go || true
+trigger_all_in_ns signup-go || OVERALL_SUCCESS=false
 
 echo "=== Signup UI Testrig (signup-uitestrig-go ns, if deployed) ==="
-trigger_all_in_ns signup-uitestrig-go || true
+trigger_all_in_ns signup-uitestrig-go || OVERALL_SUCCESS=false
 
 echo ""
 echo "=== Testrig Execution Summary ==="
diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh
index c4f7ccf45..102ff6a9c 100755
--- a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh
+++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh
@@ -1,8 +1,8 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - Signup UI Testrig Pre-install Setup
+# eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install Setup
 # =============================================================================
-# Prepares the signup-uitestrig namespace.
+# Prepares the signup-uitestrig-go namespace.
 # Copies keycloak resources from keycloak ns, MinIO s3 secret from minio ns,
 # and postgres-postgresql from postgres ns.
 # Stale uitestrig CMs are deleted so the chart recreates them from set: values.
@@ -13,7 +13,7 @@ NS=signup-uitestrig-go
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
 
 echo "================================================"
-echo "eSignet 1.7.1 - Signup UI Testrig Pre-install"
+echo "eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install"
 echo "================================================"
 
 echo "Ensuring $NS namespace exists with Istio injection disabled"
diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml
index efeb38505..7a48edd8f 100644
--- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml
+++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml
@@ -9,8 +9,6 @@ extraEnvVars:
       configMapKeyRef:
         name: keycloak-host
         key: keycloak-external-url
-  - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME
-    value: esignet
   - name: REDIS_HOST
     valueFrom:
       configMapKeyRef:
@@ -63,14 +61,14 @@ extraEnvVars:
         key: mosip_ida_client_secret
   - name: AUTHN_PROVIDER
     value: mosip
-  - name: MOSIP_P12_PATH
-    value: /home/mosip/keys/secret/esignet.pfx
-  - name: MOSIP_P12_PASSWORD
-    value: localtest
+  - name: KEYMANAGER_DB_SCHEMA
+    value: esignet
+  - name: KEYMANAGER_KEYSTORE_TYPE
+    value: PKCS12
+  - name: KEYMANAGER_PKCS12_FILE_PATH
+    value: /home/mosip/keys/secret/mosipid1.pfx
   - name: OIDC_UI_SCHEME
     value: https
-  - name: CRYPTO_ENCRYPTION_KEY
-    value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e
   - name: OIDC_UI_PORT
     value: '443'
   - name: OIDC_UI_LOGIN_PATH
@@ -83,9 +81,18 @@ extraEnvVars:
     value: decl-layout-1
   - name: DEFAULT_AUTH_FLOW_ID
     value: decl-mosip-otp-flow-1
+extraEnvVarsSecret:
+  - esignet-keystore-go-mosipid1
+extraVolumes:
+  - name: esignet-keystore-go-mosipid1
+    secret:
+      secretName: esignet-keystore-go-mosipid1
+extraVolumeMounts:
+  - name: esignet-keystore-go-mosipid1
+    mountPath: /home/mosip/keys/secret
 extraEnvVarsAdditional:
   - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME"
-    value: "esignetmosipid1"
+    value: "esignetgomosipid1"
   - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY"
     valueFrom:
       secretKeyRef:
@@ -128,7 +135,7 @@ extraEnvVarsAdditional:
       'email', 'svg': 'email_icon', 'prefixes': '', 'postfix':
       '@email', 'maxLength': '', 'regex': '' {{ "}}" }}
   - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT
-    value: DEBUG
+    value: INFO
   - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED
     value: "false"
   - name: MOSIP_ESIGNET_CAPTCHA_URL
diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml
index 6f4317522..9e5695a8e 100644
--- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml
+++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml
@@ -61,14 +61,23 @@ extraEnvVars:
         key: mosip_ida_client_secret
   - name: AUTHN_PROVIDER
     value: mosip
-  - name: MOSIP_P12_PATH
-    value: /home/mosip/keys/secret/esignet.pfx
-  - name: MOSIP_P12_PASSWORD
-    value: localtest
+  - name: KEYMANAGER_DB_SCHEMA
+    value: esignet
+  - name: KEYMANAGER_KEYSTORE_TYPE
+    value: PKCS11
+  - name: KEYMANAGER_PKCS11_MODULE_PATH
+    value: /usr/lib/softhsm/libsofthsm2.so
+  - name: KEYMANAGER_PKCS11_TOKEN_LABEL
+    value: esignet
+  - name: KEYMANAGER_PKCS11_SLOT_ID
+    value: "0"
+  - name: KEYMANAGER_PKCS11_PIN
+    valueFrom:
+      secretKeyRef:
+        name: esignet-softhsm-go-mosipid2
+        key: security-pin
   - name: OIDC_UI_SCHEME
     value: https
-  - name: CRYPTO_ENCRYPTION_KEY
-    value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e
   - name: OIDC_UI_PORT
     value: '443'
   - name: OIDC_UI_LOGIN_PATH
@@ -83,7 +92,7 @@ extraEnvVars:
     value: decl-mosip-otp-flow-1
 extraEnvVarsAdditional:
   - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME"
-    value: "esignetmosipid2"
+    value: "esignetgomosipid2"
   - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY"
     valueFrom:
       secretKeyRef:
@@ -126,7 +135,7 @@ extraEnvVarsAdditional:
       'email', 'svg': 'email_icon', 'prefixes': '', 'postfix':
       '@email', 'maxLength': '', 'regex': '' {{ "}}" }}
   - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT
-    value: DEBUG
+    value: INFO
   - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED
     value: ""
   - name: MOSIP_ESIGNET_CAPTCHA_URL
@@ -136,4 +145,3 @@ extraEnvVarsAdditional:
       secretKeyRef:
         name: esignet-misp-onboarder-key
         key: mosip-esignet-misp-key
-
diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml
index 699de0f37..b10407528 100644
--- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml
+++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml
@@ -22,7 +22,7 @@ extraEnvVars:
        name: esignet-captcha-go
        key: esignet-captcha-site-key
  - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME
-   value: esignet
+   value: esignetgo
  - name: REDIS_HOST
    valueFrom:
      configMapKeyRef:
@@ -75,14 +75,23 @@ extraEnvVars:
        key: mosip_ida_client_secret
  - name: AUTHN_PROVIDER
    value: mosip
- - name: MOSIP_P12_PATH
-   value: /home/mosip/keys/secret/esignet.pfx
- - name: MOSIP_P12_PASSWORD
-   value: localtest
+ - name: KEYMANAGER_DB_SCHEMA
+   value: esignet
+ - name: KEYMANAGER_KEYSTORE_TYPE
+   value: PKCS11
+ - name: KEYMANAGER_PKCS11_MODULE_PATH
+   value: /usr/lib/softhsm/libsofthsm2.so
+ - name: KEYMANAGER_PKCS11_TOKEN_LABEL
+   value: esignet
+ - name: KEYMANAGER_PKCS11_SLOT_ID
+   value: "0"
+ - name: KEYMANAGER_PKCS11_PIN
+   valueFrom:
+     secretKeyRef:
+       name: esignet-softhsm-go
+       key: security-pin
  - name: OIDC_UI_SCHEME
    value: https
- - name: CRYPTO_ENCRYPTION_KEY
-   value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e
  - name: OIDC_UI_PORT
    value: '443'
  - name: OIDC_UI_LOGIN_PATH
@@ -108,7 +117,6 @@ extraEnvVars:
 #  prefix: /v1/esignet/
 
 
-
 # extraEnvVarsAdditional is a Helm list — this file REPLACES the base list on merge.
 # All required entries (captcha + plugin-specific) must be present together.
 
diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml
index d579720f6..80ec0bb63 100644
--- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml
+++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml
@@ -10,7 +10,7 @@ extraEnvVars:
         name: keycloak-host
         key: keycloak-external-url
   - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME
-    value: esignet
+    value: esignetgosunbird
   - name: REDIS_HOST
     valueFrom:
       configMapKeyRef:
@@ -63,14 +63,23 @@ extraEnvVars:
         key: mosip_ida_client_secret
   - name: AUTHN_PROVIDER
     value: mosip
-  - name: MOSIP_P12_PATH
-    value: /home/mosip/keys/secret/esignet.pfx
-  - name: MOSIP_P12_PASSWORD
-    value: localtest
+  - name: KEYMANAGER_DB_SCHEMA
+    value: esignet
+  - name: KEYMANAGER_KEYSTORE_TYPE
+    value: PKCS11
+  - name: KEYMANAGER_PKCS11_MODULE_PATH
+    value: /usr/lib/softhsm/libsofthsm2.so
+  - name: KEYMANAGER_PKCS11_TOKEN_LABEL
+    value: esignet
+  - name: KEYMANAGER_PKCS11_SLOT_ID
+    value: "0"
+  - name: KEYMANAGER_PKCS11_PIN
+    valueFrom:
+      secretKeyRef:
+        name: esignet-softhsm-go-sunbird
+        key: security-pin
   - name: OIDC_UI_SCHEME
     value: https
-  - name: CRYPTO_ENCRYPTION_KEY
-    value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e
   - name: OIDC_UI_PORT
     value: '443'
   - name: OIDC_UI_LOGIN_PATH
diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml
new file mode 100644
index 000000000..152594a8b
--- /dev/null
+++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml
@@ -0,0 +1,25 @@
+extraEnvVars:
+  - name: CLIENT_ID
+    value: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM
+  - name: ACRS
+    value: >-
+     mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge
+  - name: DISPLAY
+    value: page
+  - name: GRANT_TYPE
+    value: authorization_code
+  - name: CLAIMS_LOCALES
+    value: en
+  - name: SCOPE_USER_PROFILE
+    value: openid profile
+  - name: CLAIMS_USER_PROFILE
+    value: >-
+       {"userinfo":{"given_name":{"essential":true},"phone_number":{"essential":true},"email":{"essential":true},"picture":{"essential":false},"gender":{"essential":false},"birthdate":{"essential":false},"address":{"essential":false}},"id_token":{}}
+mock_relying_party_service:
+  host: ''
+  mountDir: ""  # path inside docker
+  healthCheckUrl:
+  mock_relying_party_serviceMountDIr: /home/mosip/oidc/
+  puburl:
+  privurl:
+  USERINFO_RESPONSE_TYPE: jwt
diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md
index ee2e06e61..8d8e29d8d 100644
--- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md
+++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md
@@ -52,6 +52,9 @@ This deployment can run up to **4 separate eSignet instances** on the same clust
 | **eSignet MOSIP-ID2** | `esignet-mosipid2` | A second real MOSIP identity system at `MOSIPID2_DOMAIN_NAME` | No |
 | **eSignet Sunbird** | `esignet-sunbird` | A Sunbird RC credential registry | Yes |
 
+> **Deploying `esignet-standalone-2.0.0` instead?** Same 4 instances, `-go`-suffixed namespaces:
+> `esignet-go-mock`, `esignet-go-mosipid1`, `esignet-go-mosipid2`, `esignet-go-sunbird`.
+
 ### When do you need mosipid1?
 
 Use `esignet-mosipid1` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID1_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak.
@@ -74,6 +77,11 @@ If you only have one MOSIP system to connect to, leave mosipid2 disabled. You do
 
 > No DSF file edits needed — `enable_mosipid2` is a workflow input toggle that controls deployment at runtime.
 
+> **`esignet-standalone-2.0.0` note:** `MOSIPID1_DOMAIN_NAME` and `MOSIPID2_DOMAIN_NAME` are the same variables
+> used by both profiles — if you run `esignet-standalone` and `esignet-standalone-2.0.0` side by side, their
+> mosipid1/mosipid2 instances point at the **same** remote MOSIP environment(s). There's no separate `_GO`-suffixed
+> domain variable.
+
 ---
 
 ## 1. Before You Start
@@ -148,6 +156,12 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings
 | `ESIGNET_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the main `esignet-mock` namespace |
 | `ESIGNET_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the main `esignet-mock` namespace |
 
+> **`esignet-standalone-2.0.0` note:** `helmsman_external.yml` has no `esignet-standalone-2.0.0` option in its
+> `profile` dropdown — it only ever deploys as `esignet-standalone`. The 2.0.0 profile has no `external-dsf.yaml`
+> of its own; it reuses this same shared captcha/Postgres/Keycloak/Redis/Kafka/MinIO deployment (see the callout
+> at the top of this guide). Always run Step 1 with `profile: esignet-standalone`, even if you only plan to
+> deploy `esignet-standalone-2.0.0` in Step 2.
+
 **For `helmsman_esignet.yml`:**
 
 | Secret Name | What it is |
@@ -166,6 +180,13 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings
 | `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* |
 
 > ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error.
+>
+> **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0`
+> — there are no separate `_GO`-suffixed GitHub secrets. Internally, the 2.0.0 hooks create differently-named
+> Kubernetes secrets (e.g. `esignet-captcha-go`, `esignet-captcha-go-mosipid1`) and patch differently-named env
+> vars onto the shared `captcha` deployment (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO`) so both
+> profiles can coexist on the same captcha pod — but the underlying reCAPTCHA key **values** you configure here
+> are shared between `esignet-standalone` and `esignet-standalone-2.0.0`.
 
 **For `helmsman_signup.yml` (set now even though signup is not yet active):**
 
@@ -174,6 +195,9 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings
 | `MOSIP_SIGNUP_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the `signup` namespace |
 | `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the `signup` namespace |
 
+> **`esignet-standalone-2.0.0` note:** Same secrets reused here too — signup for the 2.0.0 profile deploys into
+> the `signup-go` namespace (vs `signup` for `esignet-standalone`) but shares these same GitHub secret values.
+
 ---
 
 ### C. Environment Variables
@@ -206,12 +230,17 @@ Step 0 → Provision Infrastructure   (terraform plan / apply)
   ├── 0b  base-infra      ~10 min   ← once per AWS account; skip if already done
   ├── 0c  observ-infra    ~15 min   ← optional monitoring cluster
   └── 0d  infra           ~20 min   profile: esignet-standalone  ← the main cluster
-Step 1 → Deploy External Services   (helmsman_external.yml)   ~20 min
-Step 2 → Deploy eSignet             (helmsman_esignet.yml)    ~25 min
+Step 1 → Deploy External Services   (helmsman_external.yml)   ~20 min   profile: esignet-standalone (always)
+Step 2 → Deploy eSignet             (helmsman_esignet.yml)    ~25 min   profile: esignet-standalone or esignet-standalone-2.0.0
 Step 3 → Deploy Signup              (helmsman_signup.yml)     ⚠️  IN PROGRESS — not ready yet
-Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml)   ~10 min
+Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml)   ~10 min   profile: esignet-standalone or esignet-standalone-2.0.0
 ```
 
+> Steps 2 and 4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy
+> the Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both
+> profiles share the same external infrastructure. Step 3's dropdown also lists `esignet-standalone-2.0.0`,
+> but the step itself isn't usable yet for either profile — see the note below.
+
 ---
 
 ### Step 0 — Provision Infrastructure (Terraform)
@@ -328,9 +357,11 @@ Follow the full instructions in the root README: [Step 3ca: Observation Infrastr
 ![Deploy External Services - Helmsman](_images/helmsman-external-services.png)
 
 **How to know it succeeded:** Click into the running workflow. Wait for all jobs to show a green tick. Then run:
+
 ```bash
 kubectl get pods -n postgres && kubectl get pods -n keycloak && kubectl get pods -n kafka
 ```
+
 All pods should show `Running` or `Completed`.
 
 ---
@@ -349,7 +380,7 @@ All pods should show `Running` or `Completed`.
 
 | Field | Value to enter |
 |---|---|
-| `profile` | `esignet-standalone` |
+| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — see note below |
 | `mode` | `apply` |
 | `skip_mosip_dsf_check` | **tick this** — standalone has no MOSIP deployment to wait for |
 | `delete_existing_jobs` | tick only if re-running after a failure; leave unticked on first deploy |
@@ -366,12 +397,32 @@ All pods should show `Running` or `Completed`.
 
 ![Deploy eSignet - Helmsman](_images/esignet.png)
 
+> **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml`
+> instead — it deploys the same 4 instances (main/mock, mosipid1, mosipid2, sunbird) plus their OIDC UIs and mock
+> relying party service, but into `-go`-suffixed namespaces (`esignet-go-mock`, `esignet-go-mosipid1`,
+> `esignet-go-mosipid2`, `esignet-go-sunbird`) with `-go`-suffixed hostnames (e.g. `esignet-go.sandbox.xyz.net`).
+> All other fields (`domain_name`, `mosipid1_domain_name`, `enable_mosipid2`, etc.) work the same way as for
+> `esignet-standalone`. You can run both profiles side by side in the same cluster — Step 1 only needs to be run
+> once, with `profile: esignet-standalone`.
+
 **How to know it succeeded:**
+
+For `esignet-standalone`:
+
 ```bash
 kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird
 # If enable_mosipid2 was set to true:
 kubectl get pods -n esignet-mosipid2
 ```
+
+For `esignet-standalone-2.0.0`:
+
+```bash
+kubectl get pods -n esignet-go-mock && kubectl get pods -n esignet-go-mosipid1 && kubectl get pods -n esignet-go-sunbird
+# If enable_mosipid2 was set to true:
+kubectl get pods -n esignet-go-mosipid2
+```
+
 All pods should show `Running`.
 
 ---
@@ -385,6 +436,10 @@ All pods should show `Running`.
 > **What you need to do right now:** Nothing — skip this step for now. However, make sure the signup secrets (`MOSIP_SIGNUP_CAPTCHA_SITE_KEY` and `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY`) are already added to the GitHub Environment (see Section 2) so you are ready when signup is enabled.
 >
 > This section will be updated with full instructions once signup deployment is ready.
+>
+> **`esignet-standalone-2.0.0` note:** `helmsman_signup.yml` already lists `esignet-standalone-2.0.0` in its
+> `profile` dropdown (deploys into the `signup-go` namespace instead of `signup`), but it's equally not-yet-ready
+> for either profile.
 
 ---
 
@@ -402,7 +457,7 @@ All pods should show `Running`.
 
 | Field | Value to enter |
 |---|---|
-| `profile` | `esignet-standalone` |
+| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — matches whichever profile you deployed in Step 2 |
 | `mode` | `apply` |
 | `domain_name` | your base domain — e.g. `sandbox.xyz.net` |
 | `mosipid1_domain_name` | MOSIP-ID1 base domain *(if MOSIP-ID1 was deployed in Step 2)* |
@@ -417,11 +472,25 @@ All pods should show `Running`.
 ![Deploy Test Rigs - Helmsman](_images/helmsman-testrigs.png)
 
 **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created:
+
+For `esignet-standalone`:
+
 ```bash
 kubectl get cronjobs -n esignet-mock
 kubectl get cronjobs -n esignet-mosipid1
-kubectl get cronjobs -n esignet-mosipid2
 kubectl get cronjobs -n esignet-sunbird
+# If enable_mosipid2 was set to true:
+kubectl get cronjobs -n esignet-mosipid2
+```
+
+For `esignet-standalone-2.0.0`:
+
+```bash
+kubectl get cronjobs -n esignet-go-mock
+kubectl get cronjobs -n esignet-go-mosipid1
+kubectl get cronjobs -n esignet-go-sunbird
+# If enable_mosipid2 was set to true:
+kubectl get cronjobs -n esignet-go-mosipid2
 ```
 
 ---
@@ -458,16 +527,19 @@ helm list -n keycloak
 kubectl get pods --all-namespaces | grep -v Running | grep -v Completed | grep -v Terminating
 ```
 
+> **Deployed `esignet-standalone-2.0.0`?** Swap in the `-go` namespaces: `esignet-go-mock`, `esignet-go-mosipid1`,
+> `esignet-go-mosipid2`, `esignet-go-sunbird`. `keycloak` is shared, so `helm list -n keycloak` is unchanged.
+
 **Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain):
 
-| Service | URL |
-|---|---|
-| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` |
-| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` |
-| Keycloak | `https://iam.sandbox.xyz.net` |
-| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` |
-| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` |
-| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` |
+| Service | esignet-standalone URL | esignet-standalone-2.0.0 URL |
+|---|---|---|
+| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | `https://esignet-go.sandbox.xyz.net` |
+| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | `https://healthservices-go.sandbox.xyz.net` |
+| Keycloak | `https://iam.sandbox.xyz.net` | *(shared — same URL)* |
+| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | `https://esignet-go-mosipid1.sandbox.xyz.net` |
+| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | `https://esignet-go-mosipid2.sandbox.xyz.net` |
+| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | `https://esignet-go-sunbird.sandbox.xyz.net` |
 
 ---
 
@@ -499,17 +571,30 @@ Reference commit: [mosip/mosip-config@e8961a2](https://github.com/mosip/mosip-co
 The MOSIP Identity Authentication service restricts which domains can call its APIs. Edit `id-authentication-default.properties` in the MOSIP platform's `mosip-config` branch and add your eSignet standalone hostnames to `mosip.ida.allowed.domain.uris`:
 
 **For mosipid1 only:**
+
 ```properties
 mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.<your-domain>
 ```
 
 **For both mosipid1 and mosipid2:**
+
 ```properties
 mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.<your-domain>,https://esignet-mosipid2.<your-domain>
 ```
 
 Replace `<your-domain>` with your eSignet standalone base domain (e.g. `sandbox.xyz.net`).
 
+> **`esignet-standalone-2.0.0` note:** Since `MOSIPID1_DOMAIN_NAME`/`MOSIPID2_DOMAIN_NAME` are shared between both
+> profiles (see [Section 0](#0-understanding-the-esignet-instances)), if you're running `esignet-mosipid1` (v1.7.1)
+> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment (and similarly for
+> MOSIP-ID2), add **both** hostnames for each shared environment to `mosip.ida.allowed.domain.uris`:
+>
+> ```properties
+> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.<your-domain>,https://esignet-go-mosipid1.<your-domain>,https://esignet-mosipid2.<your-domain>,https://esignet-go-mosipid2.<your-domain>
+> ```
+>
+> Otherwise, only add the hostname for whichever profile(s) you actually deployed.
+
 Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c)
 
 After committing these changes, restart the `id-authentication` pods on the MOSIP platform so the config server picks up the new values:
diff --git a/terraform/implementations/aws/infra/backend.tf b/terraform/implementations/aws/infra/backend.tf
deleted file mode 100644
index ff4cc9846..000000000
--- a/terraform/implementations/aws/infra/backend.tf
+++ /dev/null
@@ -1,5 +0,0 @@
-terraform {
-  backend "local" {
-    path = "profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate"
-  }
-}
diff --git a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml
deleted file mode 100644
index 9681f1e26..000000000
--- a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-apiVersion: v1
-clusters:
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-    server: https://172.31.66.49:6443
-  name: esgotest
-contexts:
-- context:
-    cluster: esgotest
-    user: esgotest
-  name: esgotest
-current-context: esgotest
-kind: Config
-preferences: {}
-users:
-- name: esgotest
-  user:
-    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
diff --git a/terraform/implementations/aws/infra/esgotest.yaml b/terraform/implementations/aws/infra/esgotest.yaml
deleted file mode 120000
index 06f0a3f0c..000000000
--- a/terraform/implementations/aws/infra/esgotest.yaml
+++ /dev/null
@@ -1 +0,0 @@
-esgotest-CONTROL-PLANE-NODE-1.yaml
\ No newline at end of file
diff --git a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml
deleted file mode 100644
index 720fc904a..000000000
--- a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-apiVersion: v1
-clusters:
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    server: https://172.31.64.165:6443
-  name: esqa
-contexts:
-- context:
-    cluster: esqa
-    user: esqa
-  name: esqa
-current-context: esqa
-kind: Config
-preferences: {}
-users:
-- name: esqa
-  user:
-    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
diff --git a/terraform/implementations/aws/infra/esqa.yaml b/terraform/implementations/aws/infra/esqa.yaml
deleted file mode 120000
index 1ea779d1d..000000000
--- a/terraform/implementations/aws/infra/esqa.yaml
+++ /dev/null
@@ -1 +0,0 @@
-esqa-CONTROL-PLANE-NODE-1.yaml
\ No newline at end of file
diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg
deleted file mode 100644
index 5be6c905c..000000000
Binary files a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg and /dev/null differ
diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars
index f38f04b72..98b68ff23 100644
--- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars
+++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars
@@ -7,22 +7,22 @@
 # ============================================================
 
 # Environment name (infra component)
-cluster_name = "esqa"
+cluster_name = "<name>"
 
 # eSignet's domain (ex: esignet.xyz.net)
-cluster_env_domain = "esqa.mosip.net"
+cluster_env_domain = "<sandbox.xyz.net>"
 
 # Email-ID will be used by certbot to notify SSL certificate expiry via email
-mosip_email_id = "thisisbn46@gmail.com"
+mosip_email_id = "<mail-id>"
 
 # SSH login key name for AWS node instances (ex: my-ssh-key)
-ssh_key_name = "mosip-aws"
+ssh_key_name = "<ssh-key-name>"
 
 # The AWS region for resource creation
 aws_provider_region = "ap-south-1"
 
 # Specific availability zones for VM deployment (optional)
-specific_availability_zones = ["ap-south-1b"]
+specific_availability_zones = []
 
 # The instance type for Kubernetes nodes (control plane, worker, etcd)
 # Smaller instance type since eSignet standalone needs fewer resources
@@ -32,7 +32,7 @@ k8s_instance_type = "t3a.2xlarge"
 nginx_instance_type = "t3a.2xlarge"
 
 # The Route 53 hosted zone ID
-zone_id = "Z090954828SJIEL6P5406"
+zone_id = "<route53_zone_id>"
 
 ## UBUNTU 24.04
 # The Amazon Machine Image ID for the instances
@@ -63,7 +63,7 @@ k8s_control_plane_node_count = 1
 k8s_etcd_node_count = 1
 
 # Worker
-k8s_worker_node_count = 3
+k8s_worker_node_count = 2
 
 # RKE2 Version Configuration
 rke2_version = "v1.28.9+rke2r1"
@@ -74,7 +74,7 @@ WIREGUARD_CIDR = "172.0.0.0/8" # Use your actual WireGuard VPN CIDR
 
 # Rancher Import Configuration
 enable_rancher_import = true
-rancher_import_url    = "\"kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml\""
+rancher_import_url    = "\"<rancher import url>\""
 
 # DNS Records to map — only eSignet-relevant subdomains
 # Includes hosts for both the esignet-standalone profile and the isolated
@@ -94,10 +94,10 @@ postgresql_port         = "5433"
 # MOSIP Infrastructure Repository Configuration
 mosip_infra_repo_url = "https://github.com/mosip/infra.git"
 
-mosip_infra_branch = "es-go-test"
+mosip_infra_branch = "develop"
 
 # VPC Configuration - Existing VPC to use (discovered by Name tag)
-vpc_name = "default"
+vpc_name = "<vpc name>"
 
 # ── ActiveMQ Configuration ─────────────────────────────────────────────────────
 # Set enable_activemq_setup = true AND nginx_node_ebs_volume_size_3 > 0 to
diff --git a/terraform/implementations/aws/infra/rancher-override.tfvars b/terraform/implementations/aws/infra/rancher-override.tfvars
deleted file mode 100644
index da1b2e2eb..000000000
--- a/terraform/implementations/aws/infra/rancher-override.tfvars
+++ /dev/null
@@ -1,2 +0,0 @@
-enable_rancher_import = true
-rancher_import_url    = "\"kubectl apply -f https://rancher.mosip.net/v3/import/f25prw8zrsc959n2bk25mn79twtwmpq6hpxphf9xt97dhbm797r99n_c-stb2m.yaml\""
diff --git a/terraform/implementations/aws/infra/tf-plan.gpg b/terraform/implementations/aws/infra/tf-plan.gpg
deleted file mode 100644
index 8eb2d1bda..000000000
Binary files a/terraform/implementations/aws/infra/tf-plan.gpg and /dev/null differ
diff --git a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml
deleted file mode 100644
index 9681f1e26..000000000
--- a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-apiVersion: v1
-clusters:
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-    server: https://172.31.66.49:6443
-  name: esgotest
-contexts:
-- context:
-    cluster: esgotest
-    user: esgotest
-  name: esgotest
-current-context: esgotest
-kind: Config
-preferences: {}
-users:
-- name: esgotest
-  user:
-    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
diff --git a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml
deleted file mode 100644
index 720fc904a..000000000
--- a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-apiVersion: v1
-clusters:
-- cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    server: https://172.31.64.165:6443
-  name: esqa
-contexts:
-- context:
-    cluster: esqa
-    user: esqa
-  name: esqa
-current-context: esqa
-kind: Config
-preferences: {}
-users:
-- name: esqa
-  user:
-    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
diff --git a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml b/terraform/modules/aws/rke2-cluster/ansible/inventory.yml
deleted file mode 100755
index a1bbce466..000000000
--- a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml
+++ /dev/null
@@ -1,46 +0,0 @@
----
-all:
-  vars:
-    cluster_name: "esqa"
-    cluster_env_domain: "mosip.local"
-    k8s_infra_repo_url: "https://github.com/mosip/k8s-infra.git"
-    k8s_infra_branch: "release-1.2.1.x"
-    install_rke2_version: "v1.28.9+rke2r1"
-    enable_rancher_import: true
-    rancher_import_url: "kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml"
-    ansible_user: ubuntu
-    ansible_ssh_private_key_file: ./ssh_key
-    ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
-    
-  children:
-    control_plane:
-      hosts:
-        esqa-CONTROL-PLANE-NODE-1:
-          ansible_host: 172.31.64.165
-          node_role: control_plane
-          is_primary: true
-          node_index: 0
-    
-    etcd:
-      hosts:
-        esqa-ETCD-NODE-1:
-          ansible_host: 172.31.73.182
-          node_role: etcd
-    
-    workers:
-      hosts:
-        esqa-WORKER-NODE-1:
-          ansible_host: 172.31.75.46
-          node_role: worker
-        esqa-WORKER-NODE-2:
-          ansible_host: 172.31.72.215
-          node_role: worker
-        esqa-WORKER-NODE-3:
-          ansible_host: 172.31.77.135
-          node_role: worker
-
-    rke2_cluster:
-      children:
-        control_plane:
-        etcd:
-        workers: