diff --git a/.github/workflows/nfr.yml b/.github/workflows/nfr.yml
index 8c078f5ab..7ad7eff85 100644
--- a/.github/workflows/nfr.yml
+++ b/.github/workflows/nfr.yml
@@ -102,7 +102,6 @@ jobs:
           echo "GKE_SVC_ACCOUNT=${{ secrets.GCP_SERVICE_ACCOUNT }}" >> vars.env
           echo "GKE_NODES_SERVICE_ACCOUNT=${{ secrets.GKE_NODES_SERVICE_ACCOUNT }}" >> vars.env
           echo "NETWORK_TAGS=nfr-tests-${{ github.run_id }}-${{ matrix.type }}" >> vars.env
-          echo "NGF_REPO=nginxinc" >> vars.env
           echo "NGF_BRANCH=${{ github.ref_name }}" >> vars.env
           echo "SOURCE_IP_RANGE=$(curl -sS -4 icanhazip.com)/32" >> vars.env
           echo "ADD_VM_IP_AUTH_NETWORKS=true" >> vars.env
diff --git a/tests/scripts/create-and-setup-gcp-vm.sh b/tests/scripts/create-and-setup-gcp-vm.sh
index 00a9aecec..a783c80f1 100644
--- a/tests/scripts/create-and-setup-gcp-vm.sh
+++ b/tests/scripts/create-and-setup-gcp-vm.sh
@@ -44,5 +44,19 @@ for ((i=1; i<=MAX_RETRIES; i++)); do
 done
 
 gcloud compute scp --zone ${GKE_CLUSTER_ZONE} --project=${GKE_PROJECT} ${SCRIPT_DIR}/vars.env username@${RESOURCE_NAME}:~
+
+if [ -n "${NGF_REPO}" ] && [ "${NGF_REPO}" != "nginxinc" ]; then
+	gcloud compute ssh --zone ${GKE_CLUSTER_ZONE} --project=${GKE_PROJECT} username@${RESOURCE_NAME} \
+		--command="bash -i <<EOF
+rm -rf nginx-gateway-fabric
+git clone https://github.com/${NGF_REPO}/nginx-gateway-fabric.git
+EOF" -- -t
+fi
+
 gcloud compute ssh --zone ${GKE_CLUSTER_ZONE} --project=${GKE_PROJECT} username@${RESOURCE_NAME} \
-	--command="git clone https://github.com/${NGF_REPO}/nginx-gateway-fabric.git && cd nginx-gateway-fabric/tests && git checkout ${NGF_BRANCH} && gcloud container clusters get-credentials ${GKE_CLUSTER_NAME} --zone ${GKE_CLUSTER_ZONE} --project=${GKE_PROJECT} --quiet"
+	--command="bash -i <<EOF
+cd nginx-gateway-fabric/tests
+git fetch -pP --all
+git checkout ${NGF_BRANCH}
+gcloud container clusters get-credentials ${GKE_CLUSTER_NAME} --zone ${GKE_CLUSTER_ZONE} --project=${GKE_PROJECT} --quiet
+EOF" -- -t
diff --git a/tests/scripts/create-gke-cluster.sh b/tests/scripts/create-gke-cluster.sh
index b5a2061f8..55c430914 100644
--- a/tests/scripts/create-gke-cluster.sh
+++ b/tests/scripts/create-gke-cluster.sh
@@ -28,7 +28,8 @@ gcloud container clusters create ${GKE_CLUSTER_NAME} \
     --monitoring=SYSTEM,POD,DEPLOYMENT \
     --logging=SYSTEM,WORKLOAD \
     --machine-type ${GKE_MACHINE_TYPE} \
-    --num-nodes ${GKE_NUM_NODES}
+    --num-nodes ${GKE_NUM_NODES} \
+    --no-enable-insecure-kubelet-readonly-port
 
 # Add current IP to GKE master control node access, if this script is not invoked during a CI run.
 if [ "${IS_CI}" = "false" ]; then
diff --git a/tests/scripts/vars.env-example b/tests/scripts/vars.env-example
index 02f976023..6289b91f8 100644
--- a/tests/scripts/vars.env-example
+++ b/tests/scripts/vars.env-example
@@ -11,7 +11,7 @@ GKE_PROJECT=<GCP project>
 GKE_SVC_ACCOUNT=<service account with k8s admin permissions>
 GKE_NODES_SERVICE_ACCOUNT=<service account for the GKE nodes to assume>
 NETWORK_TAGS=<network tags>
-NGF_REPO=nginxinc
+NGF_REPO=<optional repo, by default nginxinc>
 NGF_BRANCH=main
 GINKGO_LABEL=<optional label to filter the tests, e.g. "performance">
 GINKGO_FLAGS=<optional flags to pass to the go test command>
diff --git a/tests/suite/upgrade_test.go b/tests/suite/upgrade_test.go
index c16248719..6539fffd9 100644
--- a/tests/suite/upgrade_test.go
+++ b/tests/suite/upgrade_test.go
@@ -257,7 +257,7 @@ var _ = Describe("Upgrade testing", Label("nfr", "upgrade"), func() {
 
 			Expect(framework.WriteMetricsResults(resultsFile, res.metrics)).To(Succeed())
 
-			link := fmt.Sprintf("\n\n![%[1]v.png](%[1]v.png)\n", res.scheme)
+			link := fmt.Sprintf("\n\n![%[1]v-oss.png](%[1]v-oss.png)\n", res.scheme)
 			if *plusEnabled {
 				link = fmt.Sprintf("\n\n![%[1]v-plus.png](%[1]v-plus.png)\n", res.scheme)
 			}