diff --git a/.github/workflows/behat-mariadb.yml b/.github/workflows/behat-mariadb.yml
index 63aa87ec65..788ab2e483 100644
--- a/.github/workflows/behat-mariadb.yml
+++ b/.github/workflows/behat-mariadb.yml
@@ -85,11 +85,7 @@ jobs:
           echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
 
       - name: Install system dependencies
-        run: sudo apt update && sudo apt install poppler-utils
-
-      - name: Install PHP crash diagnostics
-        if: runner.debug == '1'
-        run: sudo apt install -y gdb systemd-coredump
+        run: sudo apt update && sudo apt install poppler-utils gdb systemd-coredump
 
       - name: Checkout server
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -116,7 +112,8 @@ jobs:
           coverage: none
           ini-file: development
           # Required: re-enable pcntl_* functions that may be disabled via disable_functions
-          ini-values: disable_functions=
+          # php -S workers SIGSEGV in zend_objects_store_del under a JIT frame.
+          ini-values: disable_functions=, opcache.jit=disable, opcache.jit_buffer_size=0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -178,19 +175,34 @@ jobs:
       - name: Print logs
         if: always()
         run: |
+          echo "=== php -S diagnostics ==="
+          shopt -s nullglob
+          files=(/tmp/behat-php-server-*)
+          if (( ${#files[@]} )); then
+            ls -la "${files[@]}"
+            for f in "${files[@]}"; do
+              echo "----- $f -----"
+              cat "$f"
+            done
+          else
+            echo "No /tmp/behat-php-server-* files"
+          fi
+          echo "=== nextcloud.log ==="
           cat data/nextcloud.log
 
-      - name: List PHP core dumps
-        if: failure() && runner.debug == '1'
-        run: |
-          sudo coredumpctl --no-pager list || true
+      - name: Backtrace PHP core dumps
+        if: failure()
+        working-directory: apps/${{ env.APP_NAME }}
+        run: tests/integration/bin/ci-dump-php-s-core.sh
 
       - name: Upload PHP server diagnostics
-        if: failure() && runner.debug == '1'
+        if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: behat-mariadb-server-diagnostics-${{ matrix.mariadb-versions }}-php${{ matrix.php-versions }}-nc${{ matrix.server-versions }}
-          path: /tmp/behat-php-server-*
+          name: behat-mariadb-php-s-core-${{ matrix.mariadb-versions }}-php${{ matrix.php-versions }}-nc${{ matrix.server-versions }}
+          path: |
+            /tmp/behat-php-server-*
+            /tmp/php-s-gdb-bt.txt
           if-no-files-found: ignore
 
   summary:
diff --git a/.github/workflows/behat-mysql.yml b/.github/workflows/behat-mysql.yml
index f53fe1236e..ea67afe117 100644
--- a/.github/workflows/behat-mysql.yml
+++ b/.github/workflows/behat-mysql.yml
@@ -89,11 +89,7 @@ jobs:
           echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
 
       - name: Install system dependencies
-        run: sudo apt update && sudo apt install poppler-utils
-
-      - name: Install PHP crash diagnostics
-        if: runner.debug == '1'
-        run: sudo apt install -y gdb systemd-coredump
+        run: sudo apt update && sudo apt install poppler-utils gdb systemd-coredump
 
       - name: Checkout server
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -120,7 +116,8 @@ jobs:
           coverage: none
           ini-file: development
           # Required: re-enable pcntl_* functions that may be disabled via disable_functions
-          ini-values: disable_functions=
+          # php -S workers SIGSEGV in zend_objects_store_del under a JIT frame.
+          ini-values: disable_functions=, opcache.jit=disable, opcache.jit_buffer_size=0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -190,19 +187,34 @@ jobs:
       - name: Print logs
         if: always()
         run: |
+          echo "=== php -S diagnostics ==="
+          shopt -s nullglob
+          files=(/tmp/behat-php-server-*)
+          if (( ${#files[@]} )); then
+            ls -la "${files[@]}"
+            for f in "${files[@]}"; do
+              echo "----- $f -----"
+              cat "$f"
+            done
+          else
+            echo "No /tmp/behat-php-server-* files"
+          fi
+          echo "=== nextcloud.log ==="
           cat data/nextcloud.log
 
-      - name: List PHP core dumps
-        if: failure() && runner.debug == '1'
-        run: |
-          sudo coredumpctl --no-pager list || true
+      - name: Backtrace PHP core dumps
+        if: failure()
+        working-directory: apps/${{ env.APP_NAME }}
+        run: tests/integration/bin/ci-dump-php-s-core.sh
 
       - name: Upload PHP server diagnostics
-        if: failure() && runner.debug == '1'
+        if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: behat-mysql-server-diagnostics-php${{ matrix.php-versions }}-nc${{ matrix.server-versions }}
-          path: /tmp/behat-php-server-*
+          name: behat-mysql-php-s-core-php${{ matrix.php-versions }}-nc${{ matrix.server-versions }}
+          path: |
+            /tmp/behat-php-server-*
+            /tmp/php-s-gdb-bt.txt
           if-no-files-found: ignore
 
   summary:
diff --git a/.github/workflows/behat-pgsql.yml b/.github/workflows/behat-pgsql.yml
index e2f4f643c9..ffe9f86a18 100644
--- a/.github/workflows/behat-pgsql.yml
+++ b/.github/workflows/behat-pgsql.yml
@@ -88,11 +88,7 @@ jobs:
           echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
 
       - name: Install system dependencies
-        run: sudo apt update && sudo apt install poppler-utils
-
-      - name: Install PHP crash diagnostics
-        if: runner.debug == '1'
-        run: sudo apt install -y gdb systemd-coredump
+        run: sudo apt update && sudo apt install poppler-utils gdb systemd-coredump
 
       - name: Checkout server
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -119,7 +115,8 @@ jobs:
           coverage: none
           ini-file: development
           # Required: re-enable pcntl_* functions that may be disabled via disable_functions
-          ini-values: disable_functions=
+          # php -S workers SIGSEGV in zend_objects_store_del under a JIT frame.
+          ini-values: disable_functions=, opcache.jit=disable, opcache.jit_buffer_size=0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -184,19 +181,34 @@ jobs:
       - name: Print logs
         if: always()
         run: |
+          echo "=== php -S diagnostics ==="
+          shopt -s nullglob
+          files=(/tmp/behat-php-server-*)
+          if (( ${#files[@]} )); then
+            ls -la "${files[@]}"
+            for f in "${files[@]}"; do
+              echo "----- $f -----"
+              cat "$f"
+            done
+          else
+            echo "No /tmp/behat-php-server-* files"
+          fi
+          echo "=== nextcloud.log ==="
           cat data/nextcloud.log
 
-      - name: List PHP core dumps
-        if: failure() && runner.debug == '1'
-        run: |
-          sudo coredumpctl --no-pager list || true
+      - name: Backtrace PHP core dumps
+        if: failure()
+        working-directory: apps/${{ env.APP_NAME }}
+        run: tests/integration/bin/ci-dump-php-s-core.sh
 
       - name: Upload PHP server diagnostics
-        if: failure() && runner.debug == '1'
+        if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: behat-pgsql-server-diagnostics-php${{ matrix.php-versions }}-nc${{ matrix.server-versions }}
-          path: /tmp/behat-php-server-*
+          name: behat-pgsql-php-s-core-php${{ matrix.php-versions }}-nc${{ matrix.server-versions }}
+          path: |
+            /tmp/behat-php-server-*
+            /tmp/php-s-gdb-bt.txt
           if-no-files-found: ignore
 
   summary:
diff --git a/.github/workflows/behat-sqlite.yml b/.github/workflows/behat-sqlite.yml
index 9b2e271d77..5707352279 100644
--- a/.github/workflows/behat-sqlite.yml
+++ b/.github/workflows/behat-sqlite.yml
@@ -79,11 +79,7 @@ jobs:
           echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
 
       - name: Install system dependencies
-        run: sudo apt update && sudo apt install poppler-utils
-
-      - name: Install PHP crash diagnostics
-        if: runner.debug == '1'
-        run: sudo apt install -y gdb systemd-coredump
+        run: sudo apt update && sudo apt install poppler-utils gdb systemd-coredump
 
       - name: Checkout server
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -110,7 +106,8 @@ jobs:
           coverage: none
           ini-file: development
           # Required: re-enable pcntl_* functions that may be disabled via disable_functions
-          ini-values: disable_functions=
+          # php -S workers SIGSEGV in zend_objects_store_del under a JIT frame.
+          ini-values: disable_functions=, opcache.jit=disable, opcache.jit_buffer_size=0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -175,19 +172,34 @@ jobs:
       - name: Print logs
         if: always()
         run: |
+          echo "=== php -S diagnostics ==="
+          shopt -s nullglob
+          files=(/tmp/behat-php-server-*)
+          if (( ${#files[@]} )); then
+            ls -la "${files[@]}"
+            for f in "${files[@]}"; do
+              echo "----- $f -----"
+              cat "$f"
+            done
+          else
+            echo "No /tmp/behat-php-server-* files"
+          fi
+          echo "=== nextcloud.log ==="
           cat data/nextcloud.log
 
-      - name: List PHP core dumps
-        if: failure() && runner.debug == '1'
-        run: |
-          sudo coredumpctl --no-pager list || true
+      - name: Backtrace PHP core dumps
+        if: failure()
+        working-directory: apps/${{ env.APP_NAME }}
+        run: tests/integration/bin/ci-dump-php-s-core.sh
 
       - name: Upload PHP server diagnostics
-        if: failure() && runner.debug == '1'
+        if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: behat-sqlite-server-diagnostics-php${{ matrix.php-versions }}-nc${{ matrix.server-versions }}
-          path: /tmp/behat-php-server-*
+          name: behat-sqlite-php-s-core-php${{ matrix.php-versions }}-nc${{ matrix.server-versions }}
+          path: |
+            /tmp/behat-php-server-*
+            /tmp/php-s-gdb-bt.txt
           if-no-files-found: ignore
 
   summary:
diff --git a/tests/integration/bin/ci-dump-php-s-core.sh b/tests/integration/bin/ci-dump-php-s-core.sh
new file mode 100755
index 0000000000..b6ca3a8556
--- /dev/null
+++ b/tests/integration/bin/ci-dump-php-s-core.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Dump a readable PHP stack from a php -S worker core.
+# JIT frames show as n/a in coredumpctl; zbacktrace reads EG(current_execute_data).
+set -u
+
+sudo coredumpctl --no-pager list || true
+
+curl -fsSL -o /tmp/php.gdbinit \
+	https://raw.githubusercontent.com/php/php-src/PHP-8.3/.gdbinit || true
+
+{
+	echo "===== latest php core ====="
+	sudo coredumpctl --no-pager info || true
+	echo "===== gdb zbacktrace + bt full ====="
+	sudo coredumpctl --no-pager debug --debugger=gdb --debugger-arguments="-batch -ex 'set pagination off' -ex 'set debuginfod enabled on' -ex 'source /tmp/php.gdbinit' -ex zbacktrace -ex 'bt full' -ex 'info registers'" || true
+} | tee /tmp/php-s-gdb-bt.txt
diff --git a/tests/integration/config/behat.yml b/tests/integration/config/behat.yml
index 6a0db69dfc..6fb644805f 100644
--- a/tests/integration/config/behat.yml
+++ b/tests/integration/config/behat.yml
@@ -16,9 +16,7 @@ default:
       base_url: http://mailpit:8025
     PhpBuiltin\Server:
       runAs: www-data
-      # Keep two workers while the intermittent PHP built-in server crash is
-      # investigated. Single-process mode did not eliminate the cURL 52 failure.
-      workers: 2
+      workers: 10
     jarnaiz\JUnitFormatter\JUnitFormatterExtension:
       filename: report.xml
       outputDir: '%paths.base%/../output/'