diff --git a/metadata.yaml b/metadata.yaml
index ce62189a3..e9c043e6b 100644
--- a/metadata.yaml
+++ b/metadata.yaml
@@ -59,12 +59,19 @@ containers:
     mounts:
       - storage: mongodb
         location: /var/lib/mongodb
+  webhook-mutator:
+    resource: data-platform-k8s-webhook-mutator-image
 resources:
   mongodb-image:
     type: oci-image
     description: OCI image for mongodb
     # TODO: Update sha whenever upstream rock changes
     upstream-source: ghcr.io/canonical/charmed-mongodb@sha256:b4b3edb805b20de471da57802643bfadbf979f112d738bc540ab148d145ddcfe
+  data-platform-k8s-webhook-mutator-image:
+    type: oci-image
+    description: OCI image for mongodb
+    # TODO: Update sha whenever upstream rock changes
+    upstream-source: ghcr.io/canonical/data-platform-k8s-mutator@sha256:42f55732ec151a36c06e056ecb91f2aef12a405c3e34657750a0f8685e6fa37d
 storage:
   mongodb:
     type: filesystem
diff --git a/poetry.lock b/poetry.lock
index 52cfc41d0..6e72556c5 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -52,13 +52,13 @@ pluggy = ">=0.4.0"
 
 [[package]]
 name = "anyio"
-version = "4.6.0"
+version = "4.6.2.post1"
 description = "High level compatibility layer for multiple asynchronous event loop implementations"
 optional = false
 python-versions = ">=3.9"
 files = [
-    {file = "anyio-4.6.0-py3-none-any.whl", hash = "sha256:c7d2e9d63e31599eeb636c8c5c03a7e108d73b345f064f1c19fdc87b79036a9a"},
-    {file = "anyio-4.6.0.tar.gz", hash = "sha256:137b4559cbb034c477165047febb6ff83f390fc3b20bf181c1fc0a728cb8beeb"},
+    {file = "anyio-4.6.2.post1-py3-none-any.whl", hash = "sha256:6d170c36fba3bdd840c73d3868c1e777e33676a69c3a72cf0a0d5d6d8009b61d"},
+    {file = "anyio-4.6.2.post1.tar.gz", hash = "sha256:4c8bc31ccdb51c7f7bd251f51c609e038d63e34219b44aa86e47576389880b4c"},
 ]
 
 [package.dependencies]
@@ -69,7 +69,7 @@ typing-extensions = {version = ">=4.1", markers = "python_version < \"3.11\""}
 
 [package.extras]
 doc = ["Sphinx (>=7.4,<8.0)", "packaging", "sphinx-autodoc-typehints (>=1.2.0)", "sphinx-rtd-theme"]
-test = ["anyio[trio]", "coverage[toml] (>=7)", "exceptiongroup (>=1.2.0)", "hypothesis (>=4.0)", "psutil (>=5.9)", "pytest (>=7.0)", "pytest-mock (>=3.6.1)", "trustme", "uvloop (>=0.21.0b1)"]
+test = ["anyio[trio]", "coverage[toml] (>=7)", "exceptiongroup (>=1.2.0)", "hypothesis (>=4.0)", "psutil (>=5.9)", "pytest (>=7.0)", "pytest-mock (>=3.6.1)", "trustme", "truststore (>=0.9.1)", "uvloop (>=0.21.0b1)"]
 trio = ["trio (>=0.26.1)"]
 
 [[package]]
@@ -471,83 +471,73 @@ typing-extensions = "*"
 
 [[package]]
 name = "coverage"
-version = "7.6.1"
+version = "7.6.3"
 description = "Code coverage measurement for Python"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 files = [
-    {file = "coverage-7.6.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:b06079abebbc0e89e6163b8e8f0e16270124c154dc6e4a47b413dd538859af16"},
-    {file = "coverage-7.6.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:cf4b19715bccd7ee27b6b120e7e9dd56037b9c0681dcc1adc9ba9db3d417fa36"},
-    {file = "coverage-7.6.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e61c0abb4c85b095a784ef23fdd4aede7a2628478e7baba7c5e3deba61070a02"},
-    {file = "coverage-7.6.1-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:fd21f6ae3f08b41004dfb433fa895d858f3f5979e7762d052b12aef444e29afc"},
-    {file = "coverage-7.6.1-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8f59d57baca39b32db42b83b2a7ba6f47ad9c394ec2076b084c3f029b7afca23"},
-    {file = "coverage-7.6.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:a1ac0ae2b8bd743b88ed0502544847c3053d7171a3cff9228af618a068ed9c34"},
-    {file = "coverage-7.6.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e6a08c0be454c3b3beb105c0596ebdc2371fab6bb90c0c0297f4e58fd7e1012c"},
-    {file = "coverage-7.6.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:f5796e664fe802da4f57a168c85359a8fbf3eab5e55cd4e4569fbacecc903959"},
-    {file = "coverage-7.6.1-cp310-cp310-win32.whl", hash = "sha256:7bb65125fcbef8d989fa1dd0e8a060999497629ca5b0efbca209588a73356232"},
-    {file = "coverage-7.6.1-cp310-cp310-win_amd64.whl", hash = "sha256:3115a95daa9bdba70aea750db7b96b37259a81a709223c8448fa97727d546fe0"},
-    {file = "coverage-7.6.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:7dea0889685db8550f839fa202744652e87c60015029ce3f60e006f8c4462c93"},
-    {file = "coverage-7.6.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:ed37bd3c3b063412f7620464a9ac1314d33100329f39799255fb8d3027da50d3"},
-    {file = "coverage-7.6.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d85f5e9a5f8b73e2350097c3756ef7e785f55bd71205defa0bfdaf96c31616ff"},
-    {file = "coverage-7.6.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9bc572be474cafb617672c43fe989d6e48d3c83af02ce8de73fff1c6bb3c198d"},
-    {file = "coverage-7.6.1-cp311-cp311-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0c0420b573964c760df9e9e86d1a9a622d0d27f417e1a949a8a66dd7bcee7bc6"},
-    {file = "coverage-7.6.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1f4aa8219db826ce6be7099d559f8ec311549bfc4046f7f9fe9b5cea5c581c56"},
-    {file = "coverage-7.6.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:fc5a77d0c516700ebad189b587de289a20a78324bc54baee03dd486f0855d234"},
-    {file = "coverage-7.6.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b48f312cca9621272ae49008c7f613337c53fadca647d6384cc129d2996d1133"},
-    {file = "coverage-7.6.1-cp311-cp311-win32.whl", hash = "sha256:1125ca0e5fd475cbbba3bb67ae20bd2c23a98fac4e32412883f9bcbaa81c314c"},
-    {file = "coverage-7.6.1-cp311-cp311-win_amd64.whl", hash = "sha256:8ae539519c4c040c5ffd0632784e21b2f03fc1340752af711f33e5be83a9d6c6"},
-    {file = "coverage-7.6.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:95cae0efeb032af8458fc27d191f85d1717b1d4e49f7cb226cf526ff28179778"},
-    {file = "coverage-7.6.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:5621a9175cf9d0b0c84c2ef2b12e9f5f5071357c4d2ea6ca1cf01814f45d2391"},
-    {file = "coverage-7.6.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:260933720fdcd75340e7dbe9060655aff3af1f0c5d20f46b57f262ab6c86a5e8"},
-    {file = "coverage-7.6.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:07e2ca0ad381b91350c0ed49d52699b625aab2b44b65e1b4e02fa9df0e92ad2d"},
-    {file = "coverage-7.6.1-cp312-cp312-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c44fee9975f04b33331cb8eb272827111efc8930cfd582e0320613263ca849ca"},
-    {file = "coverage-7.6.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:877abb17e6339d96bf08e7a622d05095e72b71f8afd8a9fefc82cf30ed944163"},
-    {file = "coverage-7.6.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:3e0cadcf6733c09154b461f1ca72d5416635e5e4ec4e536192180d34ec160f8a"},
-    {file = "coverage-7.6.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c3c02d12f837d9683e5ab2f3d9844dc57655b92c74e286c262e0fc54213c216d"},
-    {file = "coverage-7.6.1-cp312-cp312-win32.whl", hash = "sha256:e05882b70b87a18d937ca6768ff33cc3f72847cbc4de4491c8e73880766718e5"},
-    {file = "coverage-7.6.1-cp312-cp312-win_amd64.whl", hash = "sha256:b5d7b556859dd85f3a541db6a4e0167b86e7273e1cdc973e5b175166bb634fdb"},
-    {file = "coverage-7.6.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:a4acd025ecc06185ba2b801f2de85546e0b8ac787cf9d3b06e7e2a69f925b106"},
-    {file = "coverage-7.6.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a6d3adcf24b624a7b778533480e32434a39ad8fa30c315208f6d3e5542aeb6e9"},
-    {file = "coverage-7.6.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d0c212c49b6c10e6951362f7c6df3329f04c2b1c28499563d4035d964ab8e08c"},
-    {file = "coverage-7.6.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:6e81d7a3e58882450ec4186ca59a3f20a5d4440f25b1cff6f0902ad890e6748a"},
-    {file = "coverage-7.6.1-cp313-cp313-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:78b260de9790fd81e69401c2dc8b17da47c8038176a79092a89cb2b7d945d060"},
-    {file = "coverage-7.6.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a78d169acd38300060b28d600344a803628c3fd585c912cacc9ea8790fe96862"},
-    {file = "coverage-7.6.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:2c09f4ce52cb99dd7505cd0fc8e0e37c77b87f46bc9c1eb03fe3bc9991085388"},
-    {file = "coverage-7.6.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6878ef48d4227aace338d88c48738a4258213cd7b74fd9a3d4d7582bb1d8a155"},
-    {file = "coverage-7.6.1-cp313-cp313-win32.whl", hash = "sha256:44df346d5215a8c0e360307d46ffaabe0f5d3502c8a1cefd700b34baf31d411a"},
-    {file = "coverage-7.6.1-cp313-cp313-win_amd64.whl", hash = "sha256:8284cf8c0dd272a247bc154eb6c95548722dce90d098c17a883ed36e67cdb129"},
-    {file = "coverage-7.6.1-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:d3296782ca4eab572a1a4eca686d8bfb00226300dcefdf43faa25b5242ab8a3e"},
-    {file = "coverage-7.6.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:502753043567491d3ff6d08629270127e0c31d4184c4c8d98f92c26f65019962"},
-    {file = "coverage-7.6.1-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6a89ecca80709d4076b95f89f308544ec8f7b4727e8a547913a35f16717856cb"},
-    {file = "coverage-7.6.1-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:a318d68e92e80af8b00fa99609796fdbcdfef3629c77c6283566c6f02c6d6704"},
-    {file = "coverage-7.6.1-cp313-cp313t-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:13b0a73a0896988f053e4fbb7de6d93388e6dd292b0d87ee51d106f2c11b465b"},
-    {file = "coverage-7.6.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:4421712dbfc5562150f7554f13dde997a2e932a6b5f352edcce948a815efee6f"},
-    {file = "coverage-7.6.1-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:166811d20dfea725e2e4baa71fffd6c968a958577848d2131f39b60043400223"},
-    {file = "coverage-7.6.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:225667980479a17db1048cb2bf8bfb39b8e5be8f164b8f6628b64f78a72cf9d3"},
-    {file = "coverage-7.6.1-cp313-cp313t-win32.whl", hash = "sha256:170d444ab405852903b7d04ea9ae9b98f98ab6d7e63e1115e82620807519797f"},
-    {file = "coverage-7.6.1-cp313-cp313t-win_amd64.whl", hash = "sha256:b9f222de8cded79c49bf184bdbc06630d4c58eec9459b939b4a690c82ed05657"},
-    {file = "coverage-7.6.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:6db04803b6c7291985a761004e9060b2bca08da6d04f26a7f2294b8623a0c1a0"},
-    {file = "coverage-7.6.1-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:f1adfc8ac319e1a348af294106bc6a8458a0f1633cc62a1446aebc30c5fa186a"},
-    {file = "coverage-7.6.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a95324a9de9650a729239daea117df21f4b9868ce32e63f8b650ebe6cef5595b"},
-    {file = "coverage-7.6.1-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b43c03669dc4618ec25270b06ecd3ee4fa94c7f9b3c14bae6571ca00ef98b0d3"},
-    {file = "coverage-7.6.1-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8929543a7192c13d177b770008bc4e8119f2e1f881d563fc6b6305d2d0ebe9de"},
-    {file = "coverage-7.6.1-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:a09ece4a69cf399510c8ab25e0950d9cf2b42f7b3cb0374f95d2e2ff594478a6"},
-    {file = "coverage-7.6.1-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:9054a0754de38d9dbd01a46621636689124d666bad1936d76c0341f7d71bf569"},
-    {file = "coverage-7.6.1-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:0dbde0f4aa9a16fa4d754356a8f2e36296ff4d83994b2c9d8398aa32f222f989"},
-    {file = "coverage-7.6.1-cp38-cp38-win32.whl", hash = "sha256:da511e6ad4f7323ee5702e6633085fb76c2f893aaf8ce4c51a0ba4fc07580ea7"},
-    {file = "coverage-7.6.1-cp38-cp38-win_amd64.whl", hash = "sha256:3f1156e3e8f2872197af3840d8ad307a9dd18e615dc64d9ee41696f287c57ad8"},
-    {file = "coverage-7.6.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:abd5fd0db5f4dc9289408aaf34908072f805ff7792632250dcb36dc591d24255"},
-    {file = "coverage-7.6.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:547f45fa1a93154bd82050a7f3cddbc1a7a4dd2a9bf5cb7d06f4ae29fe94eaf8"},
-    {file = "coverage-7.6.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:645786266c8f18a931b65bfcefdbf6952dd0dea98feee39bd188607a9d307ed2"},
-    {file = "coverage-7.6.1-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9e0b2df163b8ed01d515807af24f63de04bebcecbd6c3bfeff88385789fdf75a"},
-    {file = "coverage-7.6.1-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:609b06f178fe8e9f89ef676532760ec0b4deea15e9969bf754b37f7c40326dbc"},
-    {file = "coverage-7.6.1-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:702855feff378050ae4f741045e19a32d57d19f3e0676d589df0575008ea5004"},
-    {file = "coverage-7.6.1-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:2bdb062ea438f22d99cba0d7829c2ef0af1d768d1e4a4f528087224c90b132cb"},
-    {file = "coverage-7.6.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:9c56863d44bd1c4fe2abb8a4d6f5371d197f1ac0ebdee542f07f35895fc07f36"},
-    {file = "coverage-7.6.1-cp39-cp39-win32.whl", hash = "sha256:6e2cd258d7d927d09493c8df1ce9174ad01b381d4729a9d8d4e38670ca24774c"},
-    {file = "coverage-7.6.1-cp39-cp39-win_amd64.whl", hash = "sha256:06a737c882bd26d0d6ee7269b20b12f14a8704807a01056c80bb881a4b2ce6ca"},
-    {file = "coverage-7.6.1-pp38.pp39.pp310-none-any.whl", hash = "sha256:e9a6e0eb86070e8ccaedfbd9d38fec54864f3125ab95419970575b42af7541df"},
-    {file = "coverage-7.6.1.tar.gz", hash = "sha256:953510dfb7b12ab69d20135a0662397f077c59b1e6379a768e97c59d852ee51d"},
+    {file = "coverage-7.6.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:6da42bbcec130b188169107ecb6ee7bd7b4c849d24c9370a0c884cf728d8e976"},
+    {file = "coverage-7.6.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:c222958f59b0ae091f4535851cbb24eb57fc0baea07ba675af718fb5302dddb2"},
+    {file = "coverage-7.6.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ab84a8b698ad5a6c365b08061920138e7a7dd9a04b6feb09ba1bfae68346ce6d"},
+    {file = "coverage-7.6.3-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:70a6756ce66cd6fe8486c775b30889f0dc4cb20c157aa8c35b45fd7868255c5c"},
+    {file = "coverage-7.6.3-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3c2e6fa98032fec8282f6b27e3f3986c6e05702828380618776ad794e938f53a"},
+    {file = "coverage-7.6.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:921fbe13492caf6a69528f09d5d7c7d518c8d0e7b9f6701b7719715f29a71e6e"},
+    {file = "coverage-7.6.3-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:6d99198203f0b9cb0b5d1c0393859555bc26b548223a769baf7e321a627ed4fc"},
+    {file = "coverage-7.6.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:87cd2e29067ea397a47e352efb13f976eb1b03e18c999270bb50589323294c6e"},
+    {file = "coverage-7.6.3-cp310-cp310-win32.whl", hash = "sha256:a3328c3e64ea4ab12b85999eb0779e6139295bbf5485f69d42cf794309e3d007"},
+    {file = "coverage-7.6.3-cp310-cp310-win_amd64.whl", hash = "sha256:bca4c8abc50d38f9773c1ec80d43f3768df2e8576807d1656016b9d3eeaa96fd"},
+    {file = "coverage-7.6.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:c51ef82302386d686feea1c44dbeef744585da16fcf97deea2a8d6c1556f519b"},
+    {file = "coverage-7.6.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:0ca37993206402c6c35dc717f90d4c8f53568a8b80f0bf1a1b2b334f4d488fba"},
+    {file = "coverage-7.6.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c77326300b839c44c3e5a8fe26c15b7e87b2f32dfd2fc9fee1d13604347c9b38"},
+    {file = "coverage-7.6.3-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:6e484e479860e00da1f005cd19d1c5d4a813324e5951319ac3f3eefb497cc549"},
+    {file = "coverage-7.6.3-cp311-cp311-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0c6c0f4d53ef603397fc894a895b960ecd7d44c727df42a8d500031716d4e8d2"},
+    {file = "coverage-7.6.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:37be7b5ea3ff5b7c4a9db16074dc94523b5f10dd1f3b362a827af66a55198175"},
+    {file = "coverage-7.6.3-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:43b32a06c47539fe275106b376658638b418c7cfdfff0e0259fbf877e845f14b"},
+    {file = "coverage-7.6.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:ee77c7bef0724165e795b6b7bf9c4c22a9b8468a6bdb9c6b4281293c6b22a90f"},
+    {file = "coverage-7.6.3-cp311-cp311-win32.whl", hash = "sha256:43517e1f6b19f610a93d8227e47790722c8bf7422e46b365e0469fc3d3563d97"},
+    {file = "coverage-7.6.3-cp311-cp311-win_amd64.whl", hash = "sha256:04f2189716e85ec9192df307f7c255f90e78b6e9863a03223c3b998d24a3c6c6"},
+    {file = "coverage-7.6.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:27bd5f18d8f2879e45724b0ce74f61811639a846ff0e5c0395b7818fae87aec6"},
+    {file = "coverage-7.6.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d546cfa78844b8b9c1c0533de1851569a13f87449897bbc95d698d1d3cb2a30f"},
+    {file = "coverage-7.6.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9975442f2e7a5cfcf87299c26b5a45266ab0696348420049b9b94b2ad3d40234"},
+    {file = "coverage-7.6.3-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:583049c63106c0555e3ae3931edab5669668bbef84c15861421b94e121878d3f"},
+    {file = "coverage-7.6.3-cp312-cp312-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2341a78ae3a5ed454d524206a3fcb3cec408c2a0c7c2752cd78b606a2ff15af4"},
+    {file = "coverage-7.6.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a4fb91d5f72b7e06a14ff4ae5be625a81cd7e5f869d7a54578fc271d08d58ae3"},
+    {file = "coverage-7.6.3-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:e279f3db904e3b55f520f11f983cc8dc8a4ce9b65f11692d4718ed021ec58b83"},
+    {file = "coverage-7.6.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:aa23ce39661a3e90eea5f99ec59b763b7d655c2cada10729ed920a38bfc2b167"},
+    {file = "coverage-7.6.3-cp312-cp312-win32.whl", hash = "sha256:52ac29cc72ee7e25ace7807249638f94c9b6a862c56b1df015d2b2e388e51dbd"},
+    {file = "coverage-7.6.3-cp312-cp312-win_amd64.whl", hash = "sha256:40e8b1983080439d4802d80b951f4a93d991ef3261f69e81095a66f86cf3c3c6"},
+    {file = "coverage-7.6.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:9134032f5aa445ae591c2ba6991d10136a1f533b1d2fa8f8c21126468c5025c6"},
+    {file = "coverage-7.6.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:99670790f21a96665a35849990b1df447993880bb6463a0a1d757897f30da929"},
+    {file = "coverage-7.6.3-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2dc7d6b380ca76f5e817ac9eef0c3686e7834c8346bef30b041a4ad286449990"},
+    {file = "coverage-7.6.3-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f7b26757b22faf88fcf232f5f0e62f6e0fd9e22a8a5d0d5016888cdfe1f6c1c4"},
+    {file = "coverage-7.6.3-cp313-cp313-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4c59d6a4a4633fad297f943c03d0d2569867bd5372eb5684befdff8df8522e39"},
+    {file = "coverage-7.6.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f263b18692f8ed52c8de7f40a0751e79015983dbd77b16906e5b310a39d3ca21"},
+    {file = "coverage-7.6.3-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:79644f68a6ff23b251cae1c82b01a0b51bc40c8468ca9585c6c4b1aeee570e0b"},
+    {file = "coverage-7.6.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:71967c35828c9ff94e8c7d405469a1fb68257f686bca7c1ed85ed34e7c2529c4"},
+    {file = "coverage-7.6.3-cp313-cp313-win32.whl", hash = "sha256:e266af4da2c1a4cbc6135a570c64577fd3e6eb204607eaff99d8e9b710003c6f"},
+    {file = "coverage-7.6.3-cp313-cp313-win_amd64.whl", hash = "sha256:ea52bd218d4ba260399a8ae4bb6b577d82adfc4518b93566ce1fddd4a49d1dce"},
+    {file = "coverage-7.6.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:8d4c6ea0f498c7c79111033a290d060c517853a7bcb2f46516f591dab628ddd3"},
+    {file = "coverage-7.6.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:331b200ad03dbaa44151d74daeb7da2cf382db424ab923574f6ecca7d3b30de3"},
+    {file = "coverage-7.6.3-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:54356a76b67cf8a3085818026bb556545ebb8353951923b88292556dfa9f812d"},
+    {file = "coverage-7.6.3-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ebec65f5068e7df2d49466aab9128510c4867e532e07cb6960075b27658dca38"},
+    {file = "coverage-7.6.3-cp313-cp313t-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d33a785ea8354c480515e781554d3be582a86297e41ccbea627a5c632647f2cd"},
+    {file = "coverage-7.6.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:f7ddb920106bbbbcaf2a274d56f46956bf56ecbde210d88061824a95bdd94e92"},
+    {file = "coverage-7.6.3-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:70d24936ca6c15a3bbc91ee9c7fc661132c6f4c9d42a23b31b6686c05073bde5"},
+    {file = "coverage-7.6.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:c30e42ea11badb147f0d2e387115b15e2bd8205a5ad70d6ad79cf37f6ac08c91"},
+    {file = "coverage-7.6.3-cp313-cp313t-win32.whl", hash = "sha256:365defc257c687ce3e7d275f39738dcd230777424117a6c76043459db131dd43"},
+    {file = "coverage-7.6.3-cp313-cp313t-win_amd64.whl", hash = "sha256:23bb63ae3f4c645d2d82fa22697364b0046fbafb6261b258a58587441c5f7bd0"},
+    {file = "coverage-7.6.3-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:da29ceabe3025a1e5a5aeeb331c5b1af686daab4ff0fb4f83df18b1180ea83e2"},
+    {file = "coverage-7.6.3-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:df8c05a0f574d480947cba11b947dc41b1265d721c3777881da2fb8d3a1ddfba"},
+    {file = "coverage-7.6.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ec1e3b40b82236d100d259854840555469fad4db64f669ab817279eb95cd535c"},
+    {file = "coverage-7.6.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b4adeb878a374126f1e5cf03b87f66279f479e01af0e9a654cf6d1509af46c40"},
+    {file = "coverage-7.6.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:43d6a66e33b1455b98fc7312b124296dad97a2e191c80320587234a77b1b736e"},
+    {file = "coverage-7.6.3-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:1990b1f4e2c402beb317840030bb9f1b6a363f86e14e21b4212e618acdfce7f6"},
+    {file = "coverage-7.6.3-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:12f9515d875859faedb4144fd38694a761cd2a61ef9603bf887b13956d0bbfbb"},
+    {file = "coverage-7.6.3-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:99ded130555c021d99729fabd4ddb91a6f4cc0707df4b1daf912c7850c373b13"},
+    {file = "coverage-7.6.3-cp39-cp39-win32.whl", hash = "sha256:c3a79f56dee9136084cf84a6c7c4341427ef36e05ae6415bf7d787c96ff5eaa3"},
+    {file = "coverage-7.6.3-cp39-cp39-win_amd64.whl", hash = "sha256:aac7501ae73d4a02f4b7ac8fcb9dc55342ca98ffb9ed9f2dfb8a25d53eda0e4d"},
+    {file = "coverage-7.6.3-pp39.pp310-none-any.whl", hash = "sha256:b9853509b4bf57ba7b1f99b9d866c422c9c5248799ab20e652bbb8a184a38181"},
+    {file = "coverage-7.6.3.tar.gz", hash = "sha256:bb7d5fe92bd0dc235f63ebe9f8c6e0884f7360f88f3411bfed1350c872ef2054"},
 ]
 
 [package.dependencies]
@@ -1400,13 +1390,13 @@ testing = ["pytest", "pytest-benchmark"]
 
 [[package]]
 name = "poetry-core"
-version = "1.9.0"
+version = "1.9.1"
 description = "Poetry PEP 517 Build Backend"
 optional = false
-python-versions = ">=3.8,<4.0"
+python-versions = "<4.0,>=3.8"
 files = [
-    {file = "poetry_core-1.9.0-py3-none-any.whl", hash = "sha256:4e0c9c6ad8cf89956f03b308736d84ea6ddb44089d16f2adc94050108ec1f5a1"},
-    {file = "poetry_core-1.9.0.tar.gz", hash = "sha256:fa7a4001eae8aa572ee84f35feb510b321bd652e5cf9293249d62853e1f935a2"},
+    {file = "poetry_core-1.9.1-py3-none-any.whl", hash = "sha256:6f45dd3598e0de8d9b0367360253d4c5d4d0110c8f5c71120a14f0e0f116c1a0"},
+    {file = "poetry_core-1.9.1.tar.gz", hash = "sha256:7a2d49214bf58b4f17f99d6891d947a9836c9899a67a5069f52d7b67217f61b8"},
 ]
 
 [[package]]
diff --git a/src/charm.py b/src/charm.py
index 5cd2ee13c..cf061c99c 100755
--- a/src/charm.py
+++ b/src/charm.py
@@ -5,6 +5,7 @@
 import json
 import logging
 import re
+import time
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Set
 
@@ -47,6 +48,12 @@
     CrossAppVersionChecker,
     get_charm_revision,
 )
+from lightkube import Client
+from lightkube.core.exceptions import ApiError
+from lightkube.resources.admissionregistration_v1 import MutatingWebhookConfiguration
+from lightkube.resources.apps_v1 import StatefulSet
+from lightkube.resources.core_v1 import Pod
+from lightkube.types import PatchType
 from ops.charm import (
     ActionEvent,
     CharmBase,
@@ -90,6 +97,8 @@
     NotConfigServerError,
     UnitStillInReplicaSet,
 )
+from gen_cert import gen_certificate
+from service_manager import generate_mutating_webhook, generate_service
 from upgrades import kubernetes_upgrades
 from upgrades.mongodb_upgrades import MongoDBUpgrade
 
@@ -105,6 +114,8 @@
 UNIT_SCOPE = Config.Relations.UNIT_SCOPE
 Scopes = Config.Relations.Scopes
 
+ONE_MINUTE = 60
+ONE_YEAR = Config.WebhookManager.GRACE_PERIOD_SECONDS
 USER_CREATING_MAX_ATTEMPTS = 5
 USER_CREATION_COOLDOWN = 30
 REPLICA_SET_INIT_CHECK_TIMEOUT = 10
@@ -115,7 +126,10 @@ class MongoDBCharm(CharmBase):
 
     def __init__(self, *args):
         super().__init__(*args)
-
+        self.framework.observe(
+            self.on.webhook_mutator_pebble_ready,
+            self._on_webhook_mutator_pebble_ready,
+        )
         self.framework.observe(self.on.mongod_pebble_ready, self._on_mongod_pebble_ready)
         self.framework.observe(self.on.config_changed, self._on_config_changed)
         self.framework.observe(self.on.start, self._on_start)
@@ -178,6 +192,20 @@ def __init__(self, *args):
         )
 
     # BEGIN: properties
+    @property
+    def needs_new_termination_period(self) -> bool:
+        """Returns True the termination period is incorrect."""
+        return self.get_termination_period_for_statefulset() != ONE_YEAR
+
+    @property
+    def mutator_service_name(self):
+        """Property to get the mutator service name for k8s."""
+        return f"{self.app.name}-{self.model.name}-{Config.WebhookManager.SERVICE_NAME}-{Config.WebhookManager.CONTAINER_NAME}"
+
+    @property
+    def _is_removing_last_replica(self) -> bool:
+        """Returns True if the last replica (juju unit) is getting removed."""
+        return self.app.planned_units() == 0 and len(self.peers_units) == 0
 
     @property
     def monitoring_jobs(self) -> list[dict[str, Any]]:
@@ -371,6 +399,28 @@ def _backup_layer(self) -> Layer:
         }
         return Layer(layer_config)
 
+    @property
+    def _webhook_layer(self) -> Layer:
+        """Returns a Pebble configuration layer for wehooks mutator."""
+        config = Config.WebhookManager
+        cmd = f"uvicorn app:app --host 0.0.0.0 --port {config.PORT} --ssl-keyfile={config.KEY_PATH} --ssl-certfile={config.CRT_PATH}"
+        layer_config = {
+            "summary": "Webhook Manager layer",
+            "description": "Pebble layer configuration for webhook mutation",
+            "services": {
+                Config.WebhookManager.SERVICE_NAME: {
+                    "override": "merge",
+                    "summary": "webhook manager daemon",
+                    "command": cmd,
+                    "startup": "enabled",
+                    "environment": {
+                        "GRACE_PERIOD_SECONDS": Config.WebhookManager.GRACE_PERIOD_SECONDS,
+                    },
+                },
+            },
+        }
+        return Layer(layer_config)
+
     @property
     def relation(self) -> Optional[Relation]:
         """Peer relation data object."""
@@ -399,6 +449,23 @@ def db_initialised(self) -> bool:
         """Check if MongoDB is initialised."""
         return json.loads(self.app_peer_data.get("db_initialised", "false"))
 
+    @property
+    def first_time_with_new_termination_period(self) -> bool:
+        """Whether the unit has departed or not."""
+        return json.loads(
+            self.unit_peer_data.get("first_time_with_new_termination_period", "true")
+        )
+
+    @first_time_with_new_termination_period.setter
+    def first_time_with_new_termination_period(self, value: bool) -> None:
+        """Set the unit_departed flag."""
+        if isinstance(value, bool):
+            self.unit_peer_data["first_time_with_new_termination_period"] = json.dumps(value)
+        else:
+            raise ValueError(
+                f"'first_time_with_new_termination_period' must be a boolean value. Provided: {value} is of type {type(value)}"
+            )
+
     def is_role_changed(self) -> bool:
         """Checks if application is running in provided role."""
         return self.role != self.model.config["role"]
@@ -529,11 +596,6 @@ def get_charm_internal_revision(self) -> str:
         with open(Config.CHARM_INTERNAL_VERSION_FILE, "r") as f:
             return f.read().strip()
 
-    @property
-    def _is_removing_last_replica(self) -> bool:
-        """Returns True if the last replica (juju unit) is getting removed."""
-        return self.app.planned_units() == 0 and len(self.peers_units) == 0
-
     # END: properties
 
     # BEGIN: generic helper methods
@@ -593,6 +655,56 @@ def _filesystem_handler(self, container: Container) -> None:
             logger.error("Cannot initialize workload: %r", e)
             raise FailedToUpdateFilesystem
 
+    # BEGIN: charm events
+    def _on_mongod_pebble_ready(self, event) -> None:
+        """Configure MongoDB pebble layer specification."""
+        container = self.unit.get_container(Config.CONTAINER_NAME)
+
+        # Just run the configure layers steps on the container and defer if it fails.
+        try:
+            self._configure_container(container)
+        except ContainerNotReadyError:
+            event.defer()
+            return
+
+        self.upgrade._reconcile_upgrade(event)
+
+    # BEGIN: charm events
+    def _on_webhook_mutator_pebble_ready(self, event) -> None:
+        # still need todo use lightkube register the mutating webhook with
+        # lightkube (maybe in on start)?
+        # Get a reference the container attribute
+        container = self.unit.get_container(Config.WebhookManager.CONTAINER_NAME)
+        if not container.can_connect():
+            logger.debug("%s container is not ready yet.", Config.WebhookManager.CONTAINER_NAME)
+            event.defer()
+            return
+
+        cert = self.get_secret(APP_SCOPE, Config.WebhookManager.CRT_SECRET)
+        private_key = self.get_secret(APP_SCOPE, Config.WebhookManager.KEY_SECRET)
+
+        if not cert or not private_key:
+            logger.debug("Waiting for certificates")
+            event.defer()
+            return
+
+        container.push(Config.WebhookManager.CRT_PATH, cert)
+        container.push(Config.WebhookManager.KEY_PATH, private_key)
+
+        # Add initial Pebble config layer using the Pebble API
+        container.add_layer(Config.WebhookManager.SERVICE_NAME, self._webhook_layer, combine=True)
+        container.replan()
+
+        if not self.unit.is_leader():
+            return
+
+        # Lightkube client
+        client = Client()
+        generate_service(client, self.unit, self.model.name, self.mutator_service_name)
+        generate_mutating_webhook(
+            client, self.unit, self.model.name, cert, self.mutator_service_name
+        )
+
     def _configure_layers(self, container: Container) -> None:
         """Configure the layers of the container."""
         modified = False
@@ -655,6 +767,11 @@ def _on_upgrade(self, event: UpgradeCharmEvent) -> None:
         is compatible, it will end up emitting a post upgrade event that
         verifies the health of the cluster.
         """
+        if self.get_termination_period_for_pod() != ONE_YEAR:
+            return
+        if self.first_time_with_new_termination_period:
+            self.first_time_with_new_termination_period = False
+            return
         if self.unit.is_leader():
             self.version_checker.set_version_across_all_relations()
 
@@ -675,19 +792,6 @@ def _on_upgrade(self, event: UpgradeCharmEvent) -> None:
             # Post upgrade event verifies the success of the upgrade.
             self.upgrade.post_app_upgrade_event.emit()
 
-    def _on_mongod_pebble_ready(self, event) -> None:
-        """Configure MongoDB pebble layer specification."""
-        container = self.unit.get_container(Config.CONTAINER_NAME)
-
-        # Just run the configure layers steps on the container and defer if it fails.
-        try:
-            self._configure_container(container)
-        except ContainerNotReadyError:
-            event.defer()
-            return
-
-        self.upgrade._reconcile_upgrade(event)
-
     def is_db_service_ready(self) -> bool:
         """Checks if the MongoDB service is ready to accept connections."""
         with MongoDBConnection(self.mongodb_config, "localhost", direct=True) as direct_mongo:
@@ -741,7 +845,7 @@ def __can_charm_start(self) -> bool:
 
         return True
 
-    def _on_start(self, event: StartEvent) -> None:
+    def _on_start(self, event: StartEvent) -> None:  # noqa: C901
         """Initialise MongoDB.
 
         Initialisation of replSet should be made once after start.
@@ -759,6 +863,22 @@ def _on_start(self, event: StartEvent) -> None:
         It is needed to install mongodb-clients inside the charm container
         to make this function work correctly.
         """
+        # We must ensure that juju does not overwrite our termination period, so we should update
+        # it as needed. However, updating the termination period can result in an onslaught of
+        # events, including the upgrade event.
+        # To prevent this from messing with upgrades do not update the termination period when an
+        # upgrade is occurring.
+        if (
+            self.unit.is_leader()
+            and self.needs_new_termination_period
+            and not self.upgrade_in_progress
+        ):
+            try:
+                self.update_termination_grace_period_to_one_year()
+            except ApiError:
+                event.defer()
+                return
+
         if not self.__can_charm_start():
             event.defer()
             return
@@ -776,6 +896,9 @@ def _on_start(self, event: StartEvent) -> None:
         self.status.set_and_share_status(ActiveStatus())
         self.upgrade._reconcile_upgrade(event)
 
+        if self.get_termination_period_for_pod() == ONE_YEAR:
+            self.first_time_with_new_termination_period = False
+
         if not self.unit.is_leader():
             return
 
@@ -859,6 +982,44 @@ def _reconcile_mongo_hosts_and_users(self, event: RelationEvent) -> None:
                 logger.info("Deferring reconfigure: error=%r", e)
                 event.defer()
 
+    def get_termination_period_for_statefulset(self) -> int:
+        """Returns the current termination period for the stateful set of this juju application."""
+        client = Client()
+        statefulset = client.get(StatefulSet, name=self.app.name, namespace=self.model.name)
+        return statefulset.spec.template.spec.terminationGracePeriodSeconds
+
+    def get_termination_period_for_pod(self) -> int:
+        """Returns the current termination period for the pod of this unit."""
+        pod_name = self.unit.name.replace("/", "-")
+        client = Client()
+        pod = client.get(Pod, name=pod_name, namespace=self.model.name)
+        termination_grace_period = pod.spec.terminationGracePeriodSeconds
+        return termination_grace_period
+
+    def update_termination_grace_period_to_one_year(self) -> None:
+        """Patch the termination grace period for the stateful set of this juju application."""
+        client = Client()
+
+        # Attempts to rewrite the terminationGracePeriodSeconds can fail if the fastapi service is
+        # not yet running, so we retry to give it some time settle.
+        for attempt in Retrying(stop=stop_after_attempt(30), wait=wait_fixed(1), reraise=True):
+            with attempt:
+                patch_data = {
+                    "spec": {
+                        "template": {
+                            "spec": {"terminationGracePeriodSeconds": ONE_YEAR},
+                            "metadata": {"annotations": {"force-update": str(int(time.time()))}},
+                        }
+                    }
+                }
+                client.patch(
+                    StatefulSet,
+                    name=self.app.name,
+                    namespace=self.model.name,
+                    obj=patch_data,
+                    patch_type=PatchType.MERGE,
+                )
+
     def __handle_partition_on_stop(self) -> None:
         """Raise partition to prevent other units from restarting if an upgrade is in progress.
 
@@ -890,8 +1051,29 @@ def __handle_upgrade_on_stop(self) -> None:
             logger.error("Failed to reelect primary before upgrading unit.")
             return
 
+    def _delete_service(self):
+        """Deletes the mutator."""
+        try:
+            client = Client()
+            client.delete(
+                MutatingWebhookConfiguration,
+                namespace=self.model.name,
+                name=self.mutator_service_name,
+            )
+        except ApiError as err:
+            logger.error(
+                "Mutating webhook configuration failed to delete. Remove it manually please"
+            )
+            logger.error(str(err))
+
     def _on_stop(self, event) -> None:
-        self.__handle_partition_on_stop()
+        if (
+            not self.needs_new_termination_period
+            and not self.first_time_with_new_termination_period
+        ):
+            self.__handle_partition_on_stop()
+        if self._is_removing_last_replica:
+            self._delete_service()
         if not self.upgrade._upgrade:
             logger.debug("Peer relation missing during stop event")
             return
@@ -988,8 +1170,27 @@ def _on_update_status(self, event: UpdateStatusEvent):
 
         self.status.set_and_share_status(self.status.process_statuses())
 
+        self._handle_termination()
+
     # END: charm events
 
+    def _handle_termination(self):
+        """Handles the termination perdiod fiddling.
+
+        We must ensure that juju does not overwrite our termination period, so we should update
+        it as needed. However, updating the termination period can result in an onslaught of
+        events, including the upgrade event. To prevent this from messing with upgrades do not
+        update the termination period when an upgrade is occurring.
+        """
+        if not self.unit.is_leader():
+            return
+        try:
+            if self.needs_new_termination_period and not self.upgrade_in_progress:
+                self.update_termination_grace_period_to_one_year()
+        except ApiError:
+            logger.info("Failed to update termination period.")
+            return
+
     # BEGIN: actions
     def _on_get_password(self, event: ActionEvent) -> None:
         """Returns the password for the user as an action response."""
@@ -1327,6 +1528,17 @@ def _check_or_set_keyfile(self) -> None:
         if not self.get_secret(APP_SCOPE, "keyfile"):
             self._generate_keyfile()
 
+    def _check_or_set_webhook_certs(self) -> None:
+        """Set TLS certs for webhooks."""
+        if not self.unit.is_leader():
+            return
+        if not self.get_secret(APP_SCOPE, Config.WebhookManager.CRT_SECRET) or not self.get_secret(
+            APP_SCOPE, Config.WebhookManager.KEY_SECRET
+        ):
+            cert, key = gen_certificate(self.mutator_service_name, self.model.name)
+            self.set_secret(APP_SCOPE, Config.WebhookManager.CRT_SECRET, cert.decode())
+            self.set_secret(APP_SCOPE, Config.WebhookManager.KEY_SECRET, key.decode())
+
     def _generate_keyfile(self) -> None:
         self.set_secret(APP_SCOPE, "keyfile", generate_keyfile())
 
@@ -1353,8 +1565,8 @@ def _generate_secrets(self) -> None:
         """
         self._check_or_set_user_password(OperatorUser)
         self._check_or_set_user_password(MonitorUser)
-
         self._check_or_set_keyfile()
+        self._check_or_set_webhook_certs()
 
     def _initialise_replica_set(self, event: StartEvent) -> None:
         """Initialise replica set and create users."""
diff --git a/src/config.py b/src/config.py
index 06321ad20..ef9ffe5b6 100644
--- a/src/config.py
+++ b/src/config.py
@@ -153,6 +153,18 @@ class Status:
         )
         WAITING_POST_UPGRADE_STATUS = WaitingStatus("Waiting for post upgrade checks")
 
+    class WebhookManager:
+        """Webhook Manager related constants."""
+
+        CONTAINER_NAME = "webhook-mutator"
+        SERVICE_NAME = "fastapi"
+        GRACE_PERIOD_SECONDS = 31_556_952  # one year
+        PORT = 8000
+        CRT_PATH = "/app/certificate.crt"
+        KEY_PATH = "/app/certificate.key"
+        CRT_SECRET = "webhook-certificate"
+        KEY_SECRET = "webhook-key"
+
     @staticmethod
     def get_license_path(license_name: str) -> str:
         """Return the path to the license file."""
diff --git a/src/gen_cert.py b/src/gen_cert.py
new file mode 100644
index 000000000..490261f63
--- /dev/null
+++ b/src/gen_cert.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""Generates a self signed certificate for the mutating webhook."""
+# Copyright 2024 Canonical Ltd.
+# See LICENSE file for licensing details.
+import datetime
+
+from cryptography import x509
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import NameOID
+
+
+def gen_certificate(app_name: str, ns: str) -> tuple[bytes, bytes]:
+    """Generates a tuple of cert and key for the mutating webhook."""
+    one_day = datetime.timedelta(1, 0, 0)
+    private_key = rsa.generate_private_key(
+        public_exponent=65537, key_size=2048, backend=default_backend()
+    )
+    public_key = private_key.public_key()
+
+    builder = x509.CertificateBuilder()
+    builder = builder.subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, app_name)]))
+    builder = builder.issuer_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, ns)]))
+    builder = builder.not_valid_before(datetime.datetime.today() - one_day)
+    builder = builder.not_valid_after(datetime.datetime.today() + (one_day * 365 * 100))
+    builder = builder.serial_number(x509.random_serial_number())
+    builder = builder.public_key(public_key)
+    builder = builder.add_extension(
+        x509.SubjectAlternativeName(
+            [
+                x509.DNSName(f"{app_name}.{ns}.svc"),
+            ]
+        ),
+        critical=False,
+    )
+    builder = builder.add_extension(
+        x509.BasicConstraints(ca=False, path_length=None), critical=True
+    )
+
+    certificate = builder.sign(
+        private_key=private_key, algorithm=hashes.SHA256(), backend=default_backend()
+    )
+
+    return (
+        certificate.public_bytes(serialization.Encoding.PEM),
+        private_key.private_bytes(
+            serialization.Encoding.PEM,
+            serialization.PrivateFormat.PKCS8,
+            serialization.NoEncryption(),
+        ),
+    )
diff --git a/src/service_manager.py b/src/service_manager.py
new file mode 100644
index 000000000..89aec1edf
--- /dev/null
+++ b/src/service_manager.py
@@ -0,0 +1,159 @@
+#!/usr/bin/env python3
+"""Handles kubernetes services and webhook creation."""
+# Copyright 2024 Canonical Ltd.
+# See LICENSE file for licensing details.
+import base64
+from logging import getLogger
+
+from lightkube import Client
+from lightkube.core.exceptions import ApiError
+from lightkube.models.admissionregistration_v1 import (
+    MatchCondition,
+    MutatingWebhook,
+    RuleWithOperations,
+    ServiceReference,
+    WebhookClientConfig,
+)
+from lightkube.models.core_v1 import ServicePort, ServiceSpec
+from lightkube.models.meta_v1 import ObjectMeta, OwnerReference
+from lightkube.resources.admissionregistration_v1 import MutatingWebhookConfiguration
+from lightkube.resources.apps_v1 import StatefulSet
+from lightkube.resources.core_v1 import Namespace, Service
+from ops.model import Unit
+
+from config import Config
+
+logger = getLogger()
+
+
+def get_sts(client: Client, sts_name: str) -> StatefulSet:
+    """Gets a stateful set from k8s."""
+    try:
+        sts = client.get(res=StatefulSet, name=sts_name)
+    except ApiError:
+        raise
+    return sts
+
+
+def get_namespace(client, ns_name: str) -> Namespace:
+    """Gets a namespace resource from k8s."""
+    try:
+        sts = client.get(res=Namespace, name=ns_name)
+    except ApiError:
+        raise
+    return sts
+
+
+def generate_service(client: Client, unit: Unit, model_name: str, service_name: str):
+    """Generates the k8s service for the mutating webhook."""
+    app_name = unit.name.split("/")[0]
+    sts = get_sts(client, app_name)
+    if not sts.metadata:
+        raise Exception(f"Could not find metadata for {sts}")
+
+    try:
+        service = Service(
+            apiVersion="v1",
+            kind="Service",
+            metadata=ObjectMeta(
+                name=service_name,
+                namespace=model_name,
+                ownerReferences=[
+                    OwnerReference(
+                        apiVersion=sts.apiVersion,
+                        kind=sts.kind,
+                        name=app_name,
+                        uid=sts.metadata.uid,
+                        blockOwnerDeletion=True,
+                    )
+                ],
+                labels={"app.kubernetes.io/name": app_name},
+            ),
+            spec=ServiceSpec(
+                type="ClusterIP",
+                selector={"app.kubernetes.io/name": app_name},
+                ports=[
+                    ServicePort(
+                        protocol="TCP",
+                        port=Config.WebhookManager.PORT,
+                        targetPort=Config.WebhookManager.PORT,
+                        name=f"{service_name}-port",
+                    ),
+                ],
+            ),
+        )
+        client.create(service)
+    except ApiError:
+        logger.info("Not creating a service, already present")
+
+
+def generate_mutating_webhook(
+    client: Client, unit: Unit, model_name: str, cert: str, service_name: str
+):
+    """Generates the mutating webhook for this application."""
+    app_name = unit.name.split("/")[0]
+    namespace = get_namespace(client, model_name)
+    if not namespace.metadata:
+        raise Exception(f"Could not find metadata for {namespace}")
+    try:
+        webhooks = client.get(
+            MutatingWebhookConfiguration,
+            namespace=model_name,
+            name=service_name,
+        )
+        if webhooks:
+            return
+    except ApiError:
+        logger.debug("Mutating Webhook doesn't yet exist.")
+
+    ca_bundle = base64.b64encode(cert.encode()).decode()
+
+    logger.debug("Registering our Mutating Wehook.")
+    webhook_config = MutatingWebhookConfiguration(
+        metadata=ObjectMeta(
+            name=service_name,
+            namespace=model_name,
+            ownerReferences=[
+                OwnerReference(
+                    apiVersion=namespace.apiVersion,
+                    kind=namespace.kind,
+                    name=model_name,
+                    uid=namespace.metadata.uid,
+                    blockOwnerDeletion=True,
+                )
+            ],
+        ),
+        apiVersion="admissionregistration.k8s.io/v1",
+        webhooks=[
+            MutatingWebhook(
+                name=f"{service_name}.juju.is",
+                clientConfig=WebhookClientConfig(
+                    service=ServiceReference(
+                        namespace=model_name,
+                        name=service_name,
+                        port=8000,
+                        path="/mutate",
+                    ),
+                    caBundle=ca_bundle,
+                ),
+                rules=[
+                    RuleWithOperations(
+                        operations=["CREATE", "UPDATE"],
+                        apiGroups=["apps"],
+                        apiVersions=["v1"],
+                        resources=["statefulsets"],
+                    )
+                ],
+                admissionReviewVersions=["v1"],
+                sideEffects="None",
+                timeoutSeconds=5,
+                matchConditions=[
+                    MatchCondition(
+                        name=f"match-sts-{app_name}",
+                        expression=f'object.metadata.name == "{app_name}"',
+                    )
+                ],
+            )
+        ],
+    )
+    client.create(webhook_config)
diff --git a/src/upgrades/mongodb_upgrades.py b/src/upgrades/mongodb_upgrades.py
index a1fbf22e1..7cedc7655 100644
--- a/src/upgrades/mongodb_upgrades.py
+++ b/src/upgrades/mongodb_upgrades.py
@@ -78,6 +78,16 @@ def _observe_events(self, charm: "MongoDBCharm") -> None:
 
     def _reconcile_upgrade(self, _, during_upgrade: bool = False) -> None:
         """Handle upgrade events."""
+        if (
+            self.charm.get_termination_period_for_pod()
+            != Config.WebhookManager.GRACE_PERIOD_SECONDS
+        ) or self.charm.first_time_with_new_termination_period:
+            logger.debug("Pod hasn't reastarted at least once")
+            return
+
+        if self.charm.needs_new_termination_period:
+            logger.debug("Can't upgrade before graceTerminationPeriod is set")
+            return
         if not self._upgrade:
             logger.debug("Peer relation not available")
             return
@@ -233,6 +243,9 @@ def _upgrade(self) -> KubernetesUpgrade | None:
     def run_post_upgrade_checks(self, event, finished_whole_cluster: bool) -> None:
         """Runs post-upgrade checks for after a shard/config-server/replset/cluster upgrade."""
         upgrade_type = "unit" if not finished_whole_cluster else "sharded cluster"
+        if not self.charm.db_initialised:
+            self._upgrade.unit_state = UnitState.HEALTHY
+            return
         try:
             self.wait_for_cluster_healthy()
         except RetryError:
diff --git a/tests/integration/backup_tests/test_backups.py b/tests/integration/backup_tests/test_backups.py
index f0a80c325..517e90a78 100644
--- a/tests/integration/backup_tests/test_backups.py
+++ b/tests/integration/backup_tests/test_backups.py
@@ -6,11 +6,9 @@
 import secrets
 import string
 import time
-from pathlib import Path
 
 import pytest
 import pytest_asyncio
-import yaml
 from pytest_operator.plugin import OpsTest
 from tenacity import (
     RetryError,
@@ -22,6 +20,8 @@
 
 from ..ha_tests import helpers as ha_helpers
 from ..helpers import (
+    METADATA,
+    RESOURCES,
     check_or_scale_app,
     destroy_cluster,
     get_app_name,
@@ -35,7 +35,6 @@
 TIMEOUT = 15 * 60
 ENDPOINT = "s3-credentials"
 NEW_CLUSTER = "new-mongodb"
-METADATA = yaml.safe_load(Path("./metadata.yaml").read_text())
 DATABASE_APP_NAME = METADATA["name"]
 NUM_UNITS = 3
 
@@ -105,13 +104,10 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
     else:
         async with ops_test.fast_forward():
             my_charm = await ops_test.build_charm(".")
-            resources = {
-                "mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]
-            }
             await ops_test.model.deploy(
                 my_charm,
                 num_units=NUM_UNITS,
-                resources=resources,
+                resources=RESOURCES,
                 series="jammy",
                 trust=True,
             )
@@ -120,6 +116,7 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
                 status="active",
                 timeout=2000,
                 raise_on_error=False,
+                idle_period=60,
             )
 
     # deploy the s3 integrator charm
@@ -412,11 +409,10 @@ async def test_restore_new_cluster(
 
     # deploy a new cluster with a different name
     db_charm = await ops_test.build_charm(".")
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
     await ops_test.model.deploy(
         db_charm,
         num_units=3,
-        resources=resources,
+        resources=RESOURCES,
         application_name=new_cluster_app_name,
         trust=True,
     )
diff --git a/tests/integration/backup_tests/test_sharding_backups.py b/tests/integration/backup_tests/test_sharding_backups.py
index 9dd60e6e0..ad29385b8 100644
--- a/tests/integration/backup_tests/test_sharding_backups.py
+++ b/tests/integration/backup_tests/test_sharding_backups.py
@@ -14,8 +14,8 @@
 from ..backup_tests import helpers as backup_helpers
 from ..ha_tests.helpers import deploy_and_scale_application, get_direct_mongo_client
 from ..helpers import (
-    METADATA,
     MONGOS_PORT,
+    RESOURCES,
     get_leader_id,
     get_password,
     mongodb_uri,
@@ -299,7 +299,6 @@ async def deploy_cluster_backup_test(
     ops_test: OpsTest, deploy_s3_integrator=True, new_names=False
 ) -> None:
     """Deploy a cluster for the backup test."""
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
     my_charm = await ops_test.build_charm(".")
 
     config_server_name = CONFIG_SERVER_APP_NAME if not new_names else CONFIG_SERVER_APP_NAME_NEW
@@ -307,7 +306,7 @@ async def deploy_cluster_backup_test(
     shard_two_name = SHARD_TWO_APP_NAME if not new_names else SHARD_TWO_APP_NAME_NEW
     await ops_test.model.deploy(
         my_charm,
-        resources=resources,
+        resources=RESOURCES,
         num_units=2,
         config={"role": "config-server"},
         application_name=config_server_name,
@@ -315,7 +314,7 @@ async def deploy_cluster_backup_test(
     )
     await ops_test.model.deploy(
         my_charm,
-        resources=resources,
+        resources=RESOURCES,
         num_units=2,
         config={"role": "shard"},
         application_name=shard_one_name,
@@ -323,7 +322,7 @@ async def deploy_cluster_backup_test(
     )
     await ops_test.model.deploy(
         my_charm,
-        resources=resources,
+        resources=RESOURCES,
         num_units=1,
         config={"role": "shard"},
         application_name=shard_two_name,
@@ -334,13 +333,14 @@ async def deploy_cluster_backup_test(
     if deploy_s3_integrator:
         await ops_test.model.deploy(S3_APP_NAME, channel="edge")
 
-    await ops_test.model.wait_for_idle(
-        apps=[S3_APP_NAME, config_server_name, shard_one_name, shard_two_name],
-        idle_period=20,
-        raise_on_blocked=False,
-        timeout=TIMEOUT,
-        raise_on_error=False,
-    )
+    async with ops_test.fast_forward("1m"):
+        await ops_test.model.wait_for_idle(
+            apps=[S3_APP_NAME, config_server_name, shard_one_name, shard_two_name],
+            idle_period=30,
+            raise_on_blocked=False,
+            timeout=TIMEOUT,
+            raise_on_error=False,
+        )
 
 
 async def setup_cluster_and_s3(ops_test: OpsTest, new_names=False) -> None:
diff --git a/tests/integration/ha_tests/helpers.py b/tests/integration/ha_tests/helpers.py
index 8b844105a..2a37a4511 100644
--- a/tests/integration/ha_tests/helpers.py
+++ b/tests/integration/ha_tests/helpers.py
@@ -16,7 +16,6 @@
 
 import kubernetes as kubernetes
 import ops
-import yaml
 from juju.unit import Unit
 from pymongo import MongoClient
 from pytest_operator.plugin import OpsTest
@@ -33,6 +32,7 @@
     APP_NAME,
     MONGOD_PORT,
     MONGOS_PORT,
+    RESOURCES,
     get_app_name,
     get_mongo_cmd,
     get_password,
@@ -41,7 +41,6 @@
     primary_host,
 )
 
-METADATA = yaml.safe_load(Path("./metadata.yaml").read_text())
 MONGODB_CONTAINER_NAME = "mongod"
 MONGODB_SERVICE_NAME = "mongod"
 MONGOD_PROCESS_NAME = "mongod"
@@ -175,13 +174,11 @@ async def deploy_and_scale_mongodb(
         # Cache the built charm to avoid rebuilding it between tests
         mongodb_charm = charm
 
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
-
     async with ops_test.fast_forward():
         await ops_test.model.deploy(
             mongodb_charm,
             application_name=mongodb_application_name,
-            resources=resources,
+            resources=RESOURCES,
             num_units=num_units,
             series="jammy",
             trust=True,
diff --git a/tests/integration/helpers.py b/tests/integration/helpers.py
index 723da4975..8a9fc7464 100644
--- a/tests/integration/helpers.py
+++ b/tests/integration/helpers.py
@@ -16,6 +16,8 @@
 
 import yaml
 from dateutil.parser import parse
+from lightkube import Client
+from lightkube.resources.core_v1 import Pod
 from more_itertools import one
 from pytest_operator.plugin import OpsTest
 from tenacity import Retrying, retry, stop_after_attempt, stop_after_delay, wait_fixed
@@ -25,6 +27,12 @@
 UNIT_IDS = [0, 1, 2]
 MONGOS_PORT = 27018
 MONGOD_PORT = 27017
+RESOURCES = {
+    "mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"],
+    "data-platform-k8s-webhook-mutator-image": METADATA["resources"][
+        "data-platform-k8s-webhook-mutator-image"
+    ]["upstream-source"],
+}
 
 TEST_DOCUMENTS = """[
     {
@@ -720,3 +728,10 @@ def get_juju_status(model_name: str, app_name: str) -> str:
     return subprocess.check_output(f"juju status --model {model_name} {app_name}".split()).decode(
         "utf-8"
     )
+
+
+def get_termination_period_for_pod(pod_name: str, namespace: str) -> int:
+    client = Client()
+    pod = client.get(Pod, name=pod_name, namespace=namespace)
+    termination_grace_period = pod.spec.terminationGracePeriodSeconds
+    return termination_grace_period
diff --git a/tests/integration/metrics_tests/test_metrics.py b/tests/integration/metrics_tests/test_metrics.py
index fc2d6a751..f75f29839 100644
--- a/tests/integration/metrics_tests/test_metrics.py
+++ b/tests/integration/metrics_tests/test_metrics.py
@@ -2,17 +2,14 @@
 # Copyright 2024 Canonical Ltd.
 # See LICENSE file for licensing details.
 import time
-from pathlib import Path
 
 import pytest
 import requests
-import yaml
 from pytest_operator.plugin import OpsTest
 
 from ..ha_tests import helpers as ha_helpers
-from ..helpers import check_or_scale_app, get_app_name
+from ..helpers import RESOURCES, check_or_scale_app, get_app_name
 
-METADATA = yaml.safe_load(Path("./metadata.yaml").read_text())
 DATABASE_APP_NAME = "mongodb-k8s"
 MONGODB_EXPORTER_PORT = 9216
 MEDIAN_REELECTION_TIME = 12
@@ -63,17 +60,20 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
 
     async with ops_test.fast_forward():
         my_charm = await ops_test.build_charm(".")
-        resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
         await ops_test.model.deploy(
             my_charm,
             num_units=NUM_UNITS,
-            resources=resources,
+            resources=RESOURCES,
             series="jammy",
             trust=True,
         )
         # TODO: remove raise_on_error when we move to juju 3.5 (DPE-4996)
         await ops_test.model.wait_for_idle(
-            apps=[DATABASE_APP_NAME], status="active", raise_on_error=False, timeout=2000
+            apps=[DATABASE_APP_NAME],
+            status="active",
+            raise_on_error=False,
+            timeout=2000,
+            idle_period=60,
         )
 
 
diff --git a/tests/integration/relation_tests/test_charm_relations.py b/tests/integration/relation_tests/test_charm_relations.py
index 652caf735..3aed77981 100644
--- a/tests/integration/relation_tests/test_charm_relations.py
+++ b/tests/integration/relation_tests/test_charm_relations.py
@@ -4,16 +4,20 @@
 import asyncio
 import logging
 import time
-from pathlib import Path
 
 import pytest
-import yaml
 from pymongo.uri_parser import parse_uri
 from pytest_operator.plugin import OpsTest
 from tenacity import RetryError
 
 from ..ha_tests.helpers import get_replica_set_primary as replica_set_primary
-from ..helpers import check_or_scale_app, get_app_name, is_relation_joined, run_mongo_op
+from ..helpers import (
+    RESOURCES,
+    check_or_scale_app,
+    get_app_name,
+    is_relation_joined,
+    run_mongo_op,
+)
 from .helpers import (
     assert_created_user_can_connect,
     get_application_relation_data,
@@ -25,7 +29,6 @@
 
 MEDIAN_REELECTION_TIME = 12
 APPLICATION_APP_NAME = "application"
-DATABASE_METADATA = yaml.safe_load(Path("./metadata.yaml").read_text())
 PORT = 27017
 DATABASE_APP_NAME = "mongodb-k8s"
 FIRST_DATABASE_RELATION_NAME = "first-database"
@@ -56,10 +59,6 @@ async def test_deploy_charms(ops_test: OpsTest):
             False
         ), f"provided MongoDB application, cannot be named {ANOTHER_DATABASE_APP_NAME}, this name is reserved for this test."
 
-    db_resources = {
-        "mongodb-image": DATABASE_METADATA["resources"]["mongodb-image"]["upstream-source"]
-    }
-
     if app_name:
         await asyncio.gather(check_or_scale_app(ops_test, app_name, REQUIRED_UNITS))
     else:
@@ -67,7 +66,7 @@ async def test_deploy_charms(ops_test: OpsTest):
             ops_test.model.deploy(
                 database_charm,
                 application_name=DATABASE_APP_NAME,
-                resources=db_resources,
+                resources=RESOURCES,
                 num_units=REQUIRED_UNITS,
                 trust=True,
             )
@@ -82,7 +81,7 @@ async def test_deploy_charms(ops_test: OpsTest):
         ops_test.model.deploy(
             database_charm,
             application_name=ANOTHER_DATABASE_APP_NAME,
-            resources=db_resources,
+            resources=RESOURCES,
             num_units=REQUIRED_UNITS,
             trust=True,
         ),
diff --git a/tests/integration/sharding_tests/helpers.py b/tests/integration/sharding_tests/helpers.py
index c8e32a8ac..7f7b60820 100644
--- a/tests/integration/sharding_tests/helpers.py
+++ b/tests/integration/sharding_tests/helpers.py
@@ -1,13 +1,14 @@
 #!/usr/bin/env python3
 # Copyright 2024 Canonical Ltd.
 # See LICENSE file for licensing details.
+import asyncio
 from typing import List, Optional, Tuple
 
 from pymongo import MongoClient
 from pytest_operator.plugin import OpsTest
 from tenacity import retry, stop_after_attempt, wait_fixed
 
-from ..helpers import METADATA, get_application_relation_data, get_secret_content
+from ..helpers import RESOURCES, get_application_relation_data, get_secret_content
 
 SHARD_ONE_APP_NAME = "shard-one"
 SHARD_TWO_APP_NAME = "shard-two"
@@ -57,40 +58,38 @@ async def deploy_cluster_components(
     else:
         my_charm = MONGODB_CHARM_NAME
 
-    resources = (
-        None
-        if channel
-        else {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
-    )
-    await ops_test.model.deploy(
-        my_charm,
-        resources=resources,
-        num_units=num_units_cluster_config[CONFIG_SERVER_APP_NAME],
-        config={"role": "config-server"},
-        application_name=CONFIG_SERVER_APP_NAME,
-        channel=channel,
-        series="jammy",
-        trust=True,
-    )
-    await ops_test.model.deploy(
-        my_charm,
-        resources=resources,
-        num_units=num_units_cluster_config[SHARD_ONE_APP_NAME],
-        config={"role": "shard"},
-        application_name=SHARD_ONE_APP_NAME,
-        channel=channel,
-        series="jammy",
-        trust=True,
-    )
-    await ops_test.model.deploy(
-        my_charm,
-        resources=resources,
-        num_units=num_units_cluster_config[SHARD_TWO_APP_NAME],
-        config={"role": "shard"},
-        application_name=SHARD_TWO_APP_NAME,
-        channel=channel,
-        series="jammy",
-        trust=True,
+    resources = None if channel else RESOURCES
+    await asyncio.gather(
+        ops_test.model.deploy(
+            my_charm,
+            resources=resources,
+            num_units=num_units_cluster_config[CONFIG_SERVER_APP_NAME],
+            config={"role": "config-server"},
+            application_name=CONFIG_SERVER_APP_NAME,
+            channel=channel,
+            series="jammy",
+            trust=True,
+        ),
+        ops_test.model.deploy(
+            my_charm,
+            resources=resources,
+            num_units=num_units_cluster_config[SHARD_ONE_APP_NAME],
+            config={"role": "shard"},
+            application_name=SHARD_ONE_APP_NAME,
+            channel=channel,
+            series="jammy",
+            trust=True,
+        ),
+        ops_test.model.deploy(
+            my_charm,
+            resources=resources,
+            num_units=num_units_cluster_config[SHARD_TWO_APP_NAME],
+            config={"role": "shard"},
+            application_name=SHARD_TWO_APP_NAME,
+            channel=channel,
+            series="jammy",
+            trust=True,
+        ),
     )
 
     await ops_test.model.wait_for_idle(
diff --git a/tests/integration/sharding_tests/test_mongos.py b/tests/integration/sharding_tests/test_mongos.py
index a065b190a..2b44f8d16 100644
--- a/tests/integration/sharding_tests/test_mongos.py
+++ b/tests/integration/sharding_tests/test_mongos.py
@@ -9,7 +9,7 @@
 from pytest_operator.plugin import OpsTest
 
 from ..ha_tests.helpers import get_direct_mongo_client
-from ..helpers import METADATA, is_relation_joined
+from ..helpers import RESOURCES, is_relation_joined
 from .helpers import count_users, get_related_username_password
 
 SHARD_ONE_APP_NAME = "shard-one"
@@ -28,10 +28,9 @@
 async def test_build_and_deploy(ops_test: OpsTest) -> None:
     """Build and deploy a sharded cluster."""
     mongodb_charm = await ops_test.build_charm(".")
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
     await ops_test.model.deploy(
         mongodb_charm,
-        resources=resources,
+        resources=RESOURCES,
         num_units=1,
         config={"role": "config-server"},
         application_name=CONFIG_SERVER_APP_NAME,
@@ -39,7 +38,7 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
     )
     await ops_test.model.deploy(
         mongodb_charm,
-        resources=resources,
+        resources=RESOURCES,
         num_units=1,
         config={"role": "shard"},
         application_name=SHARD_ONE_APP_NAME,
diff --git a/tests/integration/sharding_tests/test_sharding.py b/tests/integration/sharding_tests/test_sharding.py
index 9fa7c4584..7868dc0fc 100644
--- a/tests/integration/sharding_tests/test_sharding.py
+++ b/tests/integration/sharding_tests/test_sharding.py
@@ -1,12 +1,14 @@
 #!/usr/bin/env python3
 # Copyright 2024 Canonical Ltd.
 # See LICENSE file for licensing details.
+import asyncio
+
 import pytest
 from pytest_operator.plugin import OpsTest
 
 from ..ha_tests.helpers import get_direct_mongo_client
 from ..helpers import (
-    METADATA,
+    RESOURCES,
     get_leader_id,
     get_password,
     set_password,
@@ -45,11 +47,10 @@
 async def test_build_and_deploy(ops_test: OpsTest) -> None:
     """Build and deploy a sharded cluster."""
     my_charm = await ops_test.build_charm(".")
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
 
     await ops_test.model.deploy(
         my_charm,
-        resources=resources,
+        resources=RESOURCES,
         num_units=2,
         config={"role": "config-server"},
         application_name=CONFIG_SERVER_APP_NAME,
@@ -57,7 +58,7 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
     )
     await ops_test.model.deploy(
         my_charm,
-        resources=resources,
+        resources=RESOURCES,
         num_units=2,
         config={"role": "shard"},
         application_name=SHARD_ONE_APP_NAME,
@@ -65,7 +66,7 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
     )
     await ops_test.model.deploy(
         my_charm,
-        resources=resources,
+        resources=RESOURCES,
         num_units=2,
         config={"role": "shard"},
         application_name=SHARD_TWO_APP_NAME,
@@ -73,7 +74,7 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
     )
     await ops_test.model.deploy(
         my_charm,
-        resources=resources,
+        resources=RESOURCES,
         num_units=2,
         config={"role": "shard"},
         application_name=SHARD_THREE_APP_NAME,
@@ -94,18 +95,33 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
     )
 
     # verify that Charmed MongoDB is blocked and reports incorrect credentials
-    await wait_for_mongodb_units_blocked(
-        ops_test, CONFIG_SERVER_APP_NAME, status=CONFIG_SERVER_NEEDS_SHARD_STATUS, timeout=300
-    )
-    await wait_for_mongodb_units_blocked(
-        ops_test, SHARD_ONE_APP_NAME, status=SHARD_NEEDS_CONFIG_SERVER_STATUS, timeout=300
-    )
-    await wait_for_mongodb_units_blocked(
-        ops_test, SHARD_TWO_APP_NAME, status=SHARD_NEEDS_CONFIG_SERVER_STATUS, timeout=300
-    )
-    await wait_for_mongodb_units_blocked(
-        ops_test, SHARD_THREE_APP_NAME, status=SHARD_NEEDS_CONFIG_SERVER_STATUS, timeout=300
-    )
+    async with ops_test.fast_forward(fast_interval="1m"):
+        await asyncio.gather(
+            wait_for_mongodb_units_blocked(
+                ops_test,
+                CONFIG_SERVER_APP_NAME,
+                status=CONFIG_SERVER_NEEDS_SHARD_STATUS,
+                timeout=300,
+            ),
+            wait_for_mongodb_units_blocked(
+                ops_test,
+                SHARD_ONE_APP_NAME,
+                status=SHARD_NEEDS_CONFIG_SERVER_STATUS,
+                timeout=300,
+            ),
+            wait_for_mongodb_units_blocked(
+                ops_test,
+                SHARD_TWO_APP_NAME,
+                status=SHARD_NEEDS_CONFIG_SERVER_STATUS,
+                timeout=300,
+            ),
+            wait_for_mongodb_units_blocked(
+                ops_test,
+                SHARD_THREE_APP_NAME,
+                status=SHARD_NEEDS_CONFIG_SERVER_STATUS,
+                timeout=300,
+            ),
+        )
 
 
 @pytest.mark.group(1)
@@ -125,16 +141,17 @@ async def test_cluster_active(ops_test: OpsTest) -> None:
         f"{CONFIG_SERVER_APP_NAME}:{CONFIG_SERVER_REL_NAME}",
     )
 
-    await ops_test.model.wait_for_idle(
-        apps=[
-            CONFIG_SERVER_APP_NAME,
-            SHARD_ONE_APP_NAME,
-            SHARD_TWO_APP_NAME,
-            SHARD_THREE_APP_NAME,
-        ],
-        idle_period=15,
-        status="active",
-    )
+    async with ops_test.fast_forward("30s"):
+        await ops_test.model.wait_for_idle(
+            apps=[
+                CONFIG_SERVER_APP_NAME,
+                SHARD_ONE_APP_NAME,
+                SHARD_TWO_APP_NAME,
+                SHARD_THREE_APP_NAME,
+            ],
+            idle_period=15,
+            status="active",
+        )
     mongos_client = await get_direct_mongo_client(
         ops_test, app_name=CONFIG_SERVER_APP_NAME, mongos=True
     )
@@ -225,7 +242,7 @@ async def test_set_operator_password(ops_test: OpsTest, username):
         apps=CLUSTER_APPS,
         status="active",
         idle_period=30,
-    ),
+    )
     # verify that the password was set across the cluster
     for cluster_app_name in CLUSTER_APPS:
         operator_password = await get_password(
@@ -278,15 +295,16 @@ async def test_shard_removal(ops_test: OpsTest) -> None:
         f"{CONFIG_SERVER_APP_NAME}:{CONFIG_SERVER_REL_NAME}",
     )
 
-    await ops_test.model.wait_for_idle(
-        apps=[
-            CONFIG_SERVER_APP_NAME,
-            SHARD_THREE_APP_NAME,
-            SHARD_THREE_APP_NAME,
-        ],
-        idle_period=15,
-        status="active",
-    )
+    async with ops_test.fast_forward("30s"):
+        await ops_test.model.wait_for_idle(
+            apps=[
+                CONFIG_SERVER_APP_NAME,
+                SHARD_THREE_APP_NAME,
+                SHARD_THREE_APP_NAME,
+            ],
+            idle_period=15,
+            status="active",
+        )
 
     # verify that config server turned back on the balancer
     balancer_state = mongos_client.admin.command("balancerStatus")
@@ -314,29 +332,31 @@ async def test_removal_of_non_primary_shard(ops_test: OpsTest):
         f"{CONFIG_SERVER_APP_NAME}:{CONFIG_SERVER_REL_NAME}",
     )
 
-    await ops_test.model.wait_for_idle(
-        apps=[
-            CONFIG_SERVER_APP_NAME,
-            SHARD_ONE_APP_NAME,
-            SHARD_TWO_APP_NAME,
-            SHARD_THREE_APP_NAME,
-        ],
-        idle_period=15,
-        status="active",
-        raise_on_error=False,
-    )
+    async with ops_test.fast_forward("30s"):
+        await ops_test.model.wait_for_idle(
+            apps=[
+                CONFIG_SERVER_APP_NAME,
+                SHARD_ONE_APP_NAME,
+                SHARD_TWO_APP_NAME,
+                SHARD_THREE_APP_NAME,
+            ],
+            idle_period=15,
+            status="active",
+            raise_on_error=False,
+        )
 
     await ops_test.model.applications[CONFIG_SERVER_APP_NAME].remove_relation(
         f"{SHARD_TWO_APP_NAME}:{SHARD_REL_NAME}",
         f"{CONFIG_SERVER_APP_NAME}:{CONFIG_SERVER_REL_NAME}",
     )
 
-    await ops_test.model.wait_for_idle(
-        apps=[CONFIG_SERVER_APP_NAME, SHARD_ONE_APP_NAME, SHARD_TWO_APP_NAME],
-        idle_period=15,
-        status="active",
-        raise_on_error=False,
-    )
+    async with ops_test.fast_forward("30s"):
+        await ops_test.model.wait_for_idle(
+            apps=[CONFIG_SERVER_APP_NAME, SHARD_ONE_APP_NAME, SHARD_TWO_APP_NAME],
+            idle_period=15,
+            status="active",
+            raise_on_error=False,
+        )
 
     mongos_client = await get_direct_mongo_client(
         ops_test, app_name=CONFIG_SERVER_APP_NAME, mongos=True
@@ -368,29 +388,32 @@ async def test_unconventual_shard_removal(ops_test: OpsTest):
         f"{CONFIG_SERVER_APP_NAME}:{CONFIG_SERVER_REL_NAME}",
     )
 
-    await ops_test.model.wait_for_idle(
-        apps=[SHARD_TWO_APP_NAME],
-        idle_period=15,
-        status="active",
-        raise_on_error=False,
-    )
+    async with ops_test.fast_forward("30s"):
+        await ops_test.model.wait_for_idle(
+            apps=[SHARD_TWO_APP_NAME],
+            idle_period=15,
+            status="active",
+            raise_on_error=False,
+        )
 
     await ops_test.model.applications[SHARD_TWO_APP_NAME].scale(scale_change=-1)
-    await ops_test.model.wait_for_idle(
-        apps=[SHARD_TWO_APP_NAME],
-        idle_period=15,
-        status="active",
-        raise_on_error=False,
-    )
+    async with ops_test.fast_forward("30s"):
+        await ops_test.model.wait_for_idle(
+            apps=[SHARD_TWO_APP_NAME],
+            idle_period=15,
+            status="active",
+            raise_on_error=False,
+        )
 
     await ops_test.model.remove_application(SHARD_TWO_APP_NAME, block_until_done=True)
 
-    await ops_test.model.wait_for_idle(
-        apps=[CONFIG_SERVER_APP_NAME, SHARD_ONE_APP_NAME],
-        idle_period=15,
-        status="active",
-        raise_on_error=False,
-    )
+    async with ops_test.fast_forward("30s"):
+        await ops_test.model.wait_for_idle(
+            apps=[CONFIG_SERVER_APP_NAME, SHARD_ONE_APP_NAME],
+            idle_period=15,
+            status="active",
+            raise_on_error=False,
+        )
 
     mongos_client = await get_direct_mongo_client(
         ops_test, app_name=CONFIG_SERVER_APP_NAME, mongos=True
diff --git a/tests/integration/sharding_tests/test_sharding_relations.py b/tests/integration/sharding_tests/test_sharding_relations.py
index 3bd65e93d..088032e28 100644
--- a/tests/integration/sharding_tests/test_sharding_relations.py
+++ b/tests/integration/sharding_tests/test_sharding_relations.py
@@ -5,7 +5,7 @@
 from juju.errors import JujuAPIError
 from pytest_operator.plugin import OpsTest
 
-from ..helpers import METADATA, wait_for_mongodb_units_blocked
+from ..helpers import RESOURCES, wait_for_mongodb_units_blocked
 
 S3_APP_NAME = "s3-integrator"
 SHARD_ONE_APP_NAME = "shard"
@@ -32,34 +32,33 @@
 async def test_build_and_deploy(ops_test: OpsTest) -> None:
     """Build and deploy a sharded cluster."""
     database_charm = await ops_test.build_charm(".")
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
     application_charm = await ops_test.build_charm(TEST_APP_CHARM_PATH)
 
     await ops_test.model.deploy(application_charm, application_name=APP_CHARM_NAME)
     await ops_test.model.deploy(
         database_charm,
         application_name=REPLICATION_APP_NAME,
-        resources=resources,
+        resources=RESOURCES,
         trust=True,
     )
 
     await ops_test.model.deploy(
         database_charm,
         config={"role": "config-server"},
-        resources=resources,
+        resources=RESOURCES,
         application_name=CONFIG_SERVER_ONE_APP_NAME,
         trust=True,
     )
     await ops_test.model.deploy(
         database_charm,
         config={"role": "config-server"},
-        resources=resources,
+        resources=RESOURCES,
         application_name=CONFIG_SERVER_TWO_APP_NAME,
         trust=True,
     )
     await ops_test.model.deploy(
         database_charm,
-        resources=resources,
+        resources=RESOURCES,
         config={"role": "shard"},
         application_name=SHARD_ONE_APP_NAME,
         trust=True,
diff --git a/tests/integration/test_charm.py b/tests/integration/test_charm.py
index a13562b9a..eecd6ebd9 100644
--- a/tests/integration/test_charm.py
+++ b/tests/integration/test_charm.py
@@ -14,13 +14,15 @@
 from pymongo import MongoClient
 from pytest_operator.plugin import OpsTest
 
+from config import Config
+
 from .ha_tests.helpers import (
     deploy_and_scale_application,
     relate_mongodb_and_application,
 )
 from .helpers import (
     APP_NAME,
-    METADATA,
+    RESOURCES,
     TEST_DOCUMENTS,
     UNIT_IDS,
     audit_log_line_sanity_check,
@@ -34,6 +36,7 @@
     get_password,
     get_secret_content,
     get_secret_id,
+    get_termination_period_for_pod,
     primary_host,
     run_mongo_op,
     secondary_mongo_uris_with_sync_delay,
@@ -41,7 +44,8 @@
 )
 
 LOG_PATH = "/var/log/mongodb/"
-
+TIMEOUT_15M = 15 * 60
+ONE_YEAR = Config.WebhookManager.GRACE_PERIOD_SECONDS
 logger = logging.getLogger(__name__)
 
 
@@ -59,10 +63,9 @@ async def test_build_and_deploy(ops_test: OpsTest):
     app_name = APP_NAME
     # build and deploy charm from local source folder
     charm = await ops_test.build_charm(".")
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
     await ops_test.model.deploy(
         charm,
-        resources=resources,
+        resources=RESOURCES,
         application_name=app_name,
         num_units=len(UNIT_IDS),
         series="jammy",
@@ -74,7 +77,12 @@ async def test_build_and_deploy(ops_test: OpsTest):
 
     # TODO: remove raise_on_error when we move to juju 3.5 (DPE-4996)
     await ops_test.model.wait_for_idle(
-        apps=[app_name], status="active", raise_on_blocked=True, timeout=1000, raise_on_error=False
+        apps=[app_name],
+        status="active",
+        raise_on_blocked=True,
+        timeout=1000,
+        raise_on_error=False,
+        idle_period=60,
     )
     assert ops_test.model.applications[app_name].units[0].workload_status == "active"
 
@@ -82,6 +90,49 @@ async def test_build_and_deploy(ops_test: OpsTest):
     await ops_test.model.set_config({"update-status-hook-interval": "60m"})
 
 
+@pytest.mark.group(1)
+async def test_termination_period(ops_test: OpsTest) -> None:
+    """Verify termination period of 1 year for shards, persists after deployment.
+
+    Shards, unlike other deployments of MongoDB should have a larger termination period, to handle
+    cases where the user performs incorrect operations leading to data loss.
+
+    This test verifies:
+    1. on deployment the shar has a termination period of 1 year
+    2. if the termination period is changed, the charm resets it to 1 year
+    """
+    app_name = await get_app_name(ops_test)
+    for replica in ops_test.model.applications[app_name].units:
+        pod_name = replica.name.replace("/", "-")
+        termination_period_for_replica = get_termination_period_for_pod(
+            pod_name, ops_test.model.name
+        )
+        assert (
+            termination_period_for_replica == ONE_YEAR
+        ), f"replica {pod_name} does not have expected termination period."
+
+    # when scaling up the application, juju attempts resets the termination period, so scale it up
+    await ops_test.model.applications[app_name].scale(scale_change=1)
+
+    await ops_test.model.wait_for_idle(
+        apps=[app_name],
+        status="active",
+        raise_on_blocked=True,
+        timeout=600,
+        raise_on_error=False,
+        idle_period=20,
+    )
+
+    for shard_replica in ops_test.model.applications[app_name].units:
+        pod_name = shard_replica.name.replace("/", "-")
+        termination_period_for_shard = get_termination_period_for_pod(
+            pod_name, ops_test.model.name
+        )
+        assert (
+            termination_period_for_shard == ONE_YEAR
+        ), f"shard replica {pod_name} does not have expected termination period."
+
+
 @pytest.mark.group(1)
 @pytest.mark.abort_on_fail
 @pytest.mark.parametrize("unit_id", UNIT_IDS)
@@ -368,11 +419,11 @@ async def test_scale_up(ops_test: OpsTest):
         apps=[app_name],
         status="active",
         timeout=1000,
-        wait_for_exact_units=5,
+        wait_for_exact_units=6,
         raise_on_error=False,
     )
     num_units = len(ops_test.model.applications[app_name].units)
-    assert num_units == 5
+    assert num_units == 6
 
     # grab juju hosts
     juju_hosts = [
@@ -411,11 +462,11 @@ async def test_scale_down(ops_test: OpsTest):
         apps=[app_name],
         status="active",
         timeout=1000,
-        wait_for_exact_units=3,
+        wait_for_exact_units=4,
         raise_on_error=False,
     )
     num_units = len(ops_test.model.applications[app_name].units)
-    assert num_units == 3
+    assert num_units == 4
 
     # grab juju hosts
     juju_hosts = [
diff --git a/tests/integration/test_teardown.py b/tests/integration/test_teardown.py
index a1047e713..6a961ba76 100644
--- a/tests/integration/test_teardown.py
+++ b/tests/integration/test_teardown.py
@@ -8,7 +8,7 @@
 from pytest_operator.plugin import OpsTest
 
 from .ha_tests.helpers import get_replica_set_primary as replica_set_primary
-from .helpers import METADATA, SERIES, check_or_scale_app, get_app_name
+from .helpers import RESOURCES, SERIES, check_or_scale_app, get_app_name
 
 DATABASE_APP_NAME = "mongodb-k8s"
 MEDIAN_REELECTION_TIME = 12
@@ -30,10 +30,9 @@ async def test_build_and_deploy(ops_test: OpsTest):
     app_name = DATABASE_APP_NAME
     # build and deploy charm from local source folder
     charm = await ops_test.build_charm(".")
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
     await ops_test.model.deploy(
         charm,
-        resources=resources,
+        resources=RESOURCES,
         application_name=app_name,
         num_units=1,
         series=SERIES,
@@ -48,6 +47,7 @@ async def test_build_and_deploy(ops_test: OpsTest):
         status="active",
         raise_on_blocked=True,
         timeout=1000,
+        idle_period=60,
     )
     assert ops_test.model.applications[app_name].units[0].workload_status == "active"
 
diff --git a/tests/integration/tls_tests/test_tls.py b/tests/integration/tls_tests/test_tls.py
index 6bfbe159f..fef3e9feb 100644
--- a/tests/integration/tls_tests/test_tls.py
+++ b/tests/integration/tls_tests/test_tls.py
@@ -7,11 +7,10 @@
 import pytest
 from pytest_operator.plugin import OpsTest
 
-from ..helpers import check_or_scale_app, get_app_name
+from ..helpers import RESOURCES, check_or_scale_app, get_app_name
 from .helpers import (
     EXTERNAL_CERT_PATH,
     INTERNAL_CERT_PATH,
-    METADATA,
     check_certs_correctly_distributed,
     check_tls,
     time_file_created,
@@ -37,11 +36,8 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
         app_name = DATABASE_APP_NAME
         async with ops_test.fast_forward():
             my_charm = await ops_test.build_charm(".")
-            resources = {
-                "mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]
-            }
             await ops_test.model.deploy(
-                my_charm, num_units=3, resources=resources, series="jammy", trust=True
+                my_charm, num_units=3, resources=RESOURCES, series="jammy", trust=True
             )
             # TODO: remove raise_on_error when we move to juju 3.5 (DPE-4996)
             await ops_test.model.wait_for_idle(
diff --git a/tests/integration/upgrades/test_local_sharding_upgrades.py b/tests/integration/upgrades/test_local_sharding_upgrades.py
index 65d2bdeda..4ce77e6f9 100644
--- a/tests/integration/upgrades/test_local_sharding_upgrades.py
+++ b/tests/integration/upgrades/test_local_sharding_upgrades.py
@@ -110,19 +110,21 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
         num_units_cluster_config=num_units_cluster_config,
     )
 
-    await ops_test.model.wait_for_idle(
-        apps=CLUSTER_COMPONENTS,
-        idle_period=20,
-        raise_on_blocked=False,
-        raise_on_error=False,
-    )
+    async with ops_test.fast_forward("30s"):
+        await ops_test.model.wait_for_idle(
+            apps=CLUSTER_COMPONENTS,
+            idle_period=20,
+            raise_on_blocked=False,
+            raise_on_error=False,
+        )
 
     await integrate_cluster(ops_test)
-    await ops_test.model.wait_for_idle(
-        apps=CLUSTER_COMPONENTS,
-        idle_period=20,
-        timeout=TIMEOUT,
-    )
+    async with ops_test.fast_forward("30s"):
+        await ops_test.model.wait_for_idle(
+            apps=CLUSTER_COMPONENTS,
+            idle_period=20,
+            timeout=TIMEOUT,
+        )
     # configure write app to use mongos uri
     mongos_uri = await mongodb_uri(ops_test, app_name=CONFIG_SERVER_APP_NAME, port=MONGOS_PORT)
     await ops_test.model.applications[WRITE_APP].set_config({"mongos-uri": mongos_uri})
diff --git a/tests/integration/upgrades/test_local_upgrades.py b/tests/integration/upgrades/test_local_upgrades.py
index 2634e1db5..b6177444a 100644
--- a/tests/integration/upgrades/test_local_upgrades.py
+++ b/tests/integration/upgrades/test_local_upgrades.py
@@ -12,7 +12,8 @@
 import tenacity
 from pytest_operator.plugin import OpsTest
 
-from ..helpers import APP_NAME, METADATA, get_juju_status, get_leader_id
+from ..backup_tests import helpers as backup_helpers
+from ..helpers import APP_NAME, RESOURCES, get_juju_status, get_leader_id
 from .helpers import get_workload_version
 
 logger = logging.getLogger(__name__)
@@ -46,24 +47,33 @@ def righty_upgrade_charm(local_charm, tmp_path: Path):
 @pytest.mark.abort_on_fail
 async def test_build_and_deploy(ops_test: OpsTest, local_charm: Path):
     """Build and deploy a sharded cluster."""
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
     await ops_test.model.deploy(
         local_charm,
-        resources=resources,
+        resources=RESOURCES,
         application_name=APP_NAME,
         num_units=3,
         series="jammy",
         trust=True,
     )
-    await ops_test.model.wait_for_idle(
-        apps=[APP_NAME], status="active", raise_on_blocked=True, timeout=1000, raise_on_error=False
-    )
+    async with ops_test.fast_forward():
+        await ops_test.model.wait_for_idle(
+            apps=[APP_NAME],
+            status="active",
+            raise_on_blocked=True,
+            timeout=1000,
+            raise_on_error=False,
+            idle_period=120,
+        )
 
 
 @pytest.mark.group(1)
 @pytest.mark.abort_on_fail
 async def test_upgrade(ops_test: OpsTest, righty_upgrade_charm: Path) -> None:
     mongodb_application = ops_test.model.applications[APP_NAME]
+    leader_unit = await backup_helpers.get_leader_unit(ops_test, APP_NAME)
+    action = await leader_unit.run_action("pre-refresh-check")
+    await action.wait()
+    assert action.status == "completed", "pre-refresh-check failed, expected to succeed."
     await mongodb_application.refresh(path=righty_upgrade_charm)
 
     initial_version = Path("workload_version").read_text().strip()
diff --git a/tests/integration/upgrades/test_revision_check.py b/tests/integration/upgrades/test_revision_check.py
index c0f697f6f..1f4e368d5 100644
--- a/tests/integration/upgrades/test_revision_check.py
+++ b/tests/integration/upgrades/test_revision_check.py
@@ -4,7 +4,7 @@
 import pytest
 from pytest_operator.plugin import OpsTest
 
-from ..helpers import METADATA, wait_for_mongodb_units_blocked
+from ..helpers import RESOURCES, wait_for_mongodb_units_blocked
 
 MONGODB_K8S_CHARM = "mongodb-k8s"
 SHARD_REL_NAME = "sharding"
@@ -27,35 +27,38 @@
 @pytest.mark.abort_on_fail
 async def test_build_and_deploy(ops_test: OpsTest) -> None:
     my_charm = await ops_test.build_charm(".")
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
 
     await ops_test.model.deploy(
         MONGODB_K8S_CHARM,
         application_name=REMOTE_SHARD_APP_NAME,
         config={"role": "shard"},
-        channel="edge",
+        channel="6/edge",
+        trust=True,
     )
 
     await ops_test.model.deploy(
         MONGODB_K8S_CHARM,
         application_name=REMOTE_CONFIG_SERVER_APP_NAME,
         config={"role": "config-server"},
-        channel="edge",
+        channel="6/edge",
+        trust=True,
     )
     await ops_test.model.deploy(
         my_charm,
-        resources=resources,
+        resources=RESOURCES,
         config={"role": "config-server"},
         application_name=LOCAL_CONFIG_SERVER_APP_NAME,
+        trust=True,
     )
     await ops_test.model.deploy(
         my_charm,
-        resources=resources,
+        resources=RESOURCES,
         config={"role": "shard"},
         application_name=LOCAL_SHARD_APP_NAME,
+        trust=True,
     )
 
-    await ops_test.model.wait_for_idle(apps=CLUSTER_COMPONENTS, idle_period=20)
+    await ops_test.model.wait_for_idle(apps=CLUSTER_COMPONENTS, idle_period=40)
 
 
 @pytest.mark.group(1)
diff --git a/tests/integration/upgrades/test_rollback.py b/tests/integration/upgrades/test_rollback.py
index 5d12d0c94..3e33fda18 100644
--- a/tests/integration/upgrades/test_rollback.py
+++ b/tests/integration/upgrades/test_rollback.py
@@ -13,7 +13,7 @@
 import tenacity
 from pytest_operator.plugin import OpsTest
 
-from ..helpers import APP_NAME, METADATA, get_juju_status, get_leader_id
+from ..helpers import APP_NAME, RESOURCES, get_juju_status, get_leader_id
 from .helpers import get_workload_version
 
 logger = logging.getLogger(__name__)
@@ -46,10 +46,9 @@ def faulty_upgrade_charm(local_charm, tmp_path: Path):
 @pytest.mark.abort_on_fail
 async def test_build_and_deploy(ops_test: OpsTest, local_charm: Path):
     """Build and deploy a sharded cluster."""
-    resources = {"mongodb-image": METADATA["resources"]["mongodb-image"]["upstream-source"]}
     await ops_test.model.deploy(
         local_charm,
-        resources=resources,
+        resources=RESOURCES,
         application_name=APP_NAME,
         num_units=3,
         series="jammy",
diff --git a/tests/integration/upgrades/test_sharding_upgrades.py b/tests/integration/upgrades/test_sharding_upgrades.py
index 192b5dfb4..d92f0b20a 100644
--- a/tests/integration/upgrades/test_sharding_upgrades.py
+++ b/tests/integration/upgrades/test_sharding_upgrades.py
@@ -80,19 +80,21 @@ async def test_build_and_deploy(ops_test: OpsTest) -> None:
 
     await deploy_cluster_components(ops_test, num_units_cluster_config, channel="6/edge")
 
-    await ops_test.model.wait_for_idle(
-        apps=CLUSTER_COMPONENTS,
-        idle_period=20,
-        raise_on_blocked=False,
-        raise_on_error=False,
-    )
+    async with ops_test.fast_forward(fast_interval="1m"):
+        await ops_test.model.wait_for_idle(
+            apps=CLUSTER_COMPONENTS,
+            idle_period=40,
+            raise_on_blocked=False,
+            raise_on_error=False,
+        )
 
     await integrate_cluster(ops_test)
-    await ops_test.model.wait_for_idle(
-        apps=CLUSTER_COMPONENTS,
-        idle_period=20,
-        timeout=TIMEOUT,
-    )
+    async with ops_test.fast_forward(fast_interval="1m"):
+        await ops_test.model.wait_for_idle(
+            apps=CLUSTER_COMPONENTS,
+            idle_period=40,
+            timeout=TIMEOUT,
+        )
 
     # configure write app to use mongos uri
     mongos_uri = await mongodb_uri(ops_test, app_name=CONFIG_SERVER_APP_NAME, port=MONGOS_PORT)
diff --git a/tests/integration/upgrades/test_upgrades.py b/tests/integration/upgrades/test_upgrades.py
index 1f72fc12e..376d0617a 100644
--- a/tests/integration/upgrades/test_upgrades.py
+++ b/tests/integration/upgrades/test_upgrades.py
@@ -129,8 +129,11 @@ async def test_upgrade_password_change_fail(ops_test: OpsTest):
 
     await ops_test.model.applications[app_name].refresh(path=new_charm)
 
+    leader = await find_unit(ops_test, leader=True, app_name="mongodb-k8s")
+    leader_id = leader.name.split("/")[1]
+
     action = await ops_test.model.units.get(f"{app_name}/{leader_id}").run_action(
-        "set-password", **{"username": "username", "password": "new-password"}
+        "set-password", **{"username": "operator", "password": "new-password"}
     )
     action = await action.wait()
 
diff --git a/tests/unit/test_charm.py b/tests/unit/test_charm.py
index e9dc6afff..f8e9e1f52 100644
--- a/tests/unit/test_charm.py
+++ b/tests/unit/test_charm.py
@@ -2,10 +2,9 @@
 # See LICENSE file for licensing details.
 import json
 import logging
-import re
 import unittest
 from unittest import mock
-from unittest.mock import MagicMock, patch
+from unittest.mock import MagicMock, PropertyMock, patch
 
 import pytest
 from charms.mongodb.v1.helpers import CONF_DIR, DATA_DIR, KEY_FILE
@@ -22,6 +21,7 @@
 from tenacity import stop_after_attempt, wait_fixed, wait_none
 
 from charm import MongoDBCharm, NotReadyError
+from config import Config
 
 from .helpers import patch_network_get
 
@@ -38,11 +38,16 @@
 @pytest.fixture(autouse=True)
 def patch_upgrades(monkeypatch):
     monkeypatch.setattr("charms.mongodb.v0.upgrade_helpers.AbstractUpgrade.in_progress", False)
+    monkeypatch.setattr(
+        "charm.MongoDBCharm.get_termination_period_for_pod",
+        lambda *args, **kwargs: Config.WebhookManager.GRACE_PERIOD_SECONDS,
+    )
     monkeypatch.setattr("charm.kubernetes_upgrades._Partition.get", lambda *args, **kwargs: 0)
     monkeypatch.setattr("charm.kubernetes_upgrades._Partition.set", lambda *args, **kwargs: None)
 
 
 class TestCharm(unittest.TestCase):
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charm.get_charm_revision")
     @patch_network_get(private_address="1.1.1.1")
     def setUp(self, *unused):
@@ -128,6 +133,13 @@ def test_mongod_pebble_ready(self, connect_exporter, fix_data_dir, defer, pull_l
         # Ensure that _connect_mongodb_exporter was called
         connect_exporter.assert_called_once()
 
+    @patch(
+        "charm.MongoDBCharm.needs_new_termination_period",
+        new_callable=PropertyMock(return_value=False),
+    )
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBCharm._push_keyfile_to_workload")
     def test_pebble_ready_cannot_retrieve_container(
@@ -152,6 +164,10 @@ def test_pebble_ready_cannot_retrieve_container(
         mock_container.replan.assert_not_called()
         defer.assert_not_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBCharm._push_keyfile_to_workload")
     def test_pebble_ready_container_cannot_connect(self, push_keyfile_to_workload, defer, *unused):
@@ -174,6 +190,7 @@ def test_pebble_ready_container_cannot_connect(self, push_keyfile_to_workload, d
         mock_container.replan.assert_not_called()
         defer.assert_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBCharm._push_keyfile_to_workload")
     def test_pebble_ready_push_keyfile_to_workload_failure(
@@ -215,6 +232,13 @@ def test_pebble_ready_no_storage_yet(self, defer):
         mock_container.replan.assert_not_called()
         defer.assert_called()
 
+    @patch(
+        "charm.MongoDBCharm.needs_new_termination_period",
+        new_callable=PropertyMock(return_value=False),
+    )
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider")
     @patch("charm.MongoDBCharm._init_operator_user")
@@ -244,6 +268,9 @@ def test_start_cannot_retrieve_container(
         self.assertEqual("db_initialised" in self.harness.charm.app_peer_data, False)
         defer.assert_not_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider")
     @patch("charm.MongoDBCharm._init_operator_user")
@@ -271,6 +298,9 @@ def test_start_container_cannot_connect(self, connection, init_user, provider, d
         self.assertEqual("db_initialised" in self.harness.charm.app_peer_data, False)
         defer.assert_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider")
     @patch("charm.MongoDBCharm._init_operator_user")
@@ -299,6 +329,13 @@ def test_start_container_does_not_exist(self, connection, init_user, provider, d
         self.assertEqual("db_initialised" in self.harness.charm.app_peer_data, False)
         defer.assert_called()
 
+    @patch(
+        "charm.MongoDBCharm.needs_new_termination_period",
+        new_callable=PropertyMock(return_value=False),
+    )
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("charm.MongoDBCharm._configure_container", return_value=None)
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider")
@@ -329,7 +366,14 @@ def test_start_container_exists_fails(self, connection, init_user, provider, def
         self.assertEqual("db_initialised" in self.harness.charm.app_peer_data, False)
         defer.assert_not_called()
 
+    @patch(
+        "charm.MongoDBCharm.needs_new_termination_period",
+        new_callable=PropertyMock(return_value=False),
+    )
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("charm.MongoDBCharm._configure_container", return_value=None)
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider")
     @patch("charm.MongoDBCharm._init_operator_user")
@@ -359,6 +403,9 @@ def test_start_already_initialised(self, connection, init_user, provider, defer,
         provider.return_value.oversee_users.assert_not_called()
         defer.assert_not_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider")
     @patch("charm.MongoDBCharm._init_operator_user")
@@ -390,11 +437,16 @@ def test_start_mongod_not_ready(self, connection, init_user, provider, defer, *u
         self.assertEqual("db_initialised" in self.harness.charm.app_peer_data, False)
         defer.assert_called()
 
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider")
     @patch("charm.MongoDBCharm._initialise_users")
-    @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBConnection")
-    def test_start_mongod_error_initialising_replica_set(self, connection, defer, *unused):
+    def test_start_mongod_error_initalising_replica_set(
+        self, connection, init_users, provider, defer, *unused
+    ):
         """Tests that failure to initialise replica set is properly handled.
 
         Verifies that when there is a failure to initialise replica set the defer is called and
@@ -417,6 +469,9 @@ def test_start_mongod_error_initialising_replica_set(self, connection, defer, *u
             self.assertEqual("replica_set_initialised" in self.harness.charm.app_peer_data, False)
             defer.assert_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider")
     @patch("charm.MongoDBCharm._init_operator_user")
@@ -447,7 +502,10 @@ def test_error_initialising_users(self, connection, init_user, provider, defer,
         # verify app data
         self.assertEqual("db_initialised" in self.harness.charm.app_peer_data, False)
 
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("charm.MongoDBCharm._init_operator_user")
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider")
     @patch("charm.MongoDBConnection")
@@ -487,6 +545,7 @@ def test_start_mongod_error_overseeing_users(
             # verify app data
             self.assertEqual("db_initialised" in self.harness.charm.app_peer_data, False)
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBConnection")
     def test_reconfigure_not_already_initialised(self, connection, defer, *unused):
@@ -527,6 +586,7 @@ def test_reconfigure_not_already_initialised(self, connection, defer, *unused):
 
             defer.assert_not_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charms.mongodb.v0.mongo.MongoClient")
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBConnection")
@@ -564,6 +624,7 @@ def test_reconfigure_get_members_failure(self, connection, defer, *unused):
 
                 defer.assert_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBConnection")
     def test_reconfigure_remove_member_failure(self, connection, defer, *unused):
@@ -598,6 +659,7 @@ def test_reconfigure_remove_member_failure(self, connection, defer, *unused):
             connection.return_value.__enter__.return_value.remove_replset_member.assert_called()
             defer.assert_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charms.mongodb.v0.set_status.get_charm_revision")
     @patch("charm.CrossAppVersionChecker.is_local_charm")
     @patch("ops.framework.EventBase.defer")
@@ -624,6 +686,7 @@ def test_reconfigure_peer_not_ready(self, connection, defer, *unused):
         connection.return_value.__enter__.return_value.add_replset_member.assert_not_called()
         defer.assert_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBConnection")
     def test_reconfigure_add_member_failure(self, connection, defer, *unused):
@@ -654,7 +717,14 @@ def test_reconfigure_add_member_failure(self, connection, defer, *unused):
             connection.return_value.__enter__.return_value.add_replset_member.assert_called()
             defer.assert_called()
 
+    @patch(
+        "charm.MongoDBCharm.needs_new_termination_period",
+        new_callable=PropertyMock(return_value=False),
+    )
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("charm.MongoDBCharm._configure_container", return_value=None)
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("ops.framework.EventBase.defer")
     @patch("charm.MongoDBProvider.oversee_users")
     @patch("charm.MongoDBConnection")
@@ -701,6 +771,7 @@ def test_start_init_operator_user_after_second_call(
 
         defer.assert_not_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     def test_get_password(self, *unused):
         self._setup_secrets()
         assert isinstance(self.harness.charm.get_secret("app", "monitor-password"), str)
@@ -710,6 +781,7 @@ def test_get_password(self, *unused):
         assert isinstance(self.harness.charm.get_secret("unit", "somekey"), str)
         assert self.harness.charm.get_secret("unit", "non-existing-secret") is None
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     def test_set_reset_existing_password_app(self, *unused):
         """NOTE: currently ops.testing seems to allow for non-leader to set secrets too!"""
         self._setup_secrets()
@@ -722,6 +794,7 @@ def test_set_reset_existing_password_app(self, *unused):
         self.harness.charm.set_secret("app", "monitor-password", "blablabla")
         assert self.harness.charm.get_secret("app", "monitor-password") == "blablabla"
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     def test_set_reset_existing_password_app_nonleader(self, *unused):
         self._setup_secrets()
         self.harness.set_leader(False)
@@ -730,28 +803,31 @@ def test_set_reset_existing_password_app_nonleader(self, *unused):
         with self.assertRaises(RuntimeError):
             self.harness.charm.set_secret("app", "monitor-password", "bla")
 
-    @parameterized.expand([("app"), ("unit")])
-    def test_set_secret_returning_secret_id(self, scope):
-        secret_id = self.harness.charm.set_secret(scope, "somekey", "bla")
-        assert re.match(f"mongodb-k8s.{scope}", secret_id)
+    # @patch("charm.gen_certificate", return_value=(b"", b""))
+    # @parameterized.expand([("app"), ("unit")])
+    # def test_set_secret_returning_secret_id(self, scope):
+    #     secret_id = self.harness.charm.set_secret(scope, "somekey", "bla")
+    #     assert re.match(f"mongodb-k8s.{scope}", secret_id)
 
-    @parameterized.expand([("app"), ("unit")])
-    def test_set_reset_new_secret(self, scope, *unused):
-        if scope == "app":
-            self.harness.set_leader(True)
+    # @patch("charm.gen_certificate", return_value=(b"", b""))
+    # @parameterized.expand([("app"), ("unit")])
+    # def test_set_reset_new_secret(self, scope, *unused):
+    #     if scope == "app":
+    #         self.harness.set_leader(True)
 
-        # Getting current password
-        self.harness.charm.set_secret(scope, "new-secret", "bla")
-        assert self.harness.charm.get_secret(scope, "new-secret") == "bla"
+    #     # Getting current password
+    #     self.harness.charm.set_secret(scope, "new-secret", "bla")
+    #     assert self.harness.charm.get_secret(scope, "new-secret") == "bla"
 
-        # Reset new secret
-        self.harness.charm.set_secret(scope, "new-secret", "blablabla")
-        assert self.harness.charm.get_secret(scope, "new-secret") == "blablabla"
+    #     # Reset new secret
+    #     self.harness.charm.set_secret(scope, "new-secret", "blablabla")
+    #     assert self.harness.charm.get_secret(scope, "new-secret") == "blablabla"
 
-        # Set another new secret
-        self.harness.charm.set_secret(scope, "new-secret2", "blablabla")
-        assert self.harness.charm.get_secret(scope, "new-secret2") == "blablabla"
+    #     # Set another new secret
+    #     self.harness.charm.set_secret(scope, "new-secret2", "blablabla")
+    #     assert self.harness.charm.get_secret(scope, "new-secret2") == "blablabla"
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     def test_set_reset_new_secret_non_leader(self, *unused):
         self.harness.set_leader(True)
 
@@ -776,6 +852,7 @@ def test_invalid_secret(self, scope):
         self.harness.charm.set_secret("unit", "somekey", "")
         assert self.harness.charm.get_secret(scope, "somekey") is None
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @pytest.mark.usefixtures("use_caplog")
     def test_delete_password(self, *unused):
         self._setup_secrets()
@@ -814,6 +891,7 @@ def test_delete_password(self, *unused):
                 in self._caplog.text
             )
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     def test_delete_password_non_leader(self, *unused):
         self._setup_secrets()
         self.harness.set_leader(False)
@@ -851,6 +929,7 @@ def test_on_other_secret_changed(self, scope, connect_exporter):
 
         connect_exporter.assert_not_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charm.MongoDBConnection")
     @patch("charm.MongoDBCharm._pull_licenses")
     @patch("charm.MongoDBCharm._connect_mongodb_exporter")
@@ -866,6 +945,7 @@ def test_connect_to_mongo_exporter_on_set_password(self, connect_exporter, *unus
         self.harness.charm._on_set_password(action_event)
         connect_exporter.assert_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charm.MongoDBConnection")
     @patch("charm.MongoDBBackups.get_pbm_status")
     @patch("charm.MongoDBCharm.has_backup_service")
@@ -898,6 +978,7 @@ def test_event_set_password_secrets(
         assert "password" in args_pw
         assert args_pw["password"] == pw
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charm.MongoDBConnection")
     @patch("charm.MongoDBBackups.get_pbm_status")
     @patch("charm.MongoDBCharm.has_backup_service")
@@ -939,6 +1020,7 @@ def test_event_auto_reset_password_secrets_when_no_pw_value_shipped(
         # a new password was created
         assert pw1 != pw2
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charm.MongoDBConnection")
     @patch("charm.MongoDBCharm._connect_mongodb_exporter")
     def test_event_any_unit_can_get_password_secrets(self, *unused):
@@ -1014,11 +1096,19 @@ def test__connect_mongodb_exporter_success(
         expected_uri = uri_template.format(password="mongo123")
         self.assertEqual(expected_uri, new_uri)
 
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
+    @patch(
+        "charm.MongoDBCharm.needs_new_termination_period",
+        new_callable=PropertyMock(return_value=False),
+    )
+    @patch("charm.MongoDBCharm.needs_new_termination_period", return_value=False)
     @patch("tenacity.nap.time.sleep", MagicMock())
     @patch("charm.USER_CREATING_MAX_ATTEMPTS", 1)
     @patch("charm.USER_CREATION_COOLDOWN", 1)
     @patch("charm.REPLICA_SET_INIT_CHECK_TIMEOUT", 1)
     @patch("charm.MongoDBCharm._configure_container", return_value=None)
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charm.MongoDBCharm._init_operator_user")
     @patch("charm.MongoDBCharm._init_monitor_user")
     @patch("charm.MongoDBCharm._connect_mongodb_exporter")
@@ -1038,6 +1128,9 @@ def test_backup_user_created(self, *unused):
         self.harness.charm._initialise_users.retry.wait = wait_none()
         self.assertIsNotNone(password)  # verify the password is set
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
+    @patch("charm.MongoDBCharm.get_termination_period_for_statefulset")
+    @patch("charm.MongoDBCharm.update_termination_grace_period_to_one_year")
     @patch("charm.MongoDBConnection")
     def test_set_password_provided(self, *unused):
         """Tests that a given password is set as the new mongodb password for backup user."""
@@ -1053,6 +1146,7 @@ def test_set_password_provided(self, *unused):
         # verify app data is updated and results are reported to user
         self.assertEqual("canonical123", new_password)
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch_network_get(private_address="1.1.1.1")
     @patch("charm.MongoDBCharm.has_backup_service")
     @patch("charm.MongoDBBackups.get_pbm_status")
diff --git a/tests/unit/test_mongodb_backups.py b/tests/unit/test_mongodb_backups.py
index 6c0e08a49..05a88c438 100644
--- a/tests/unit/test_mongodb_backups.py
+++ b/tests/unit/test_mongodb_backups.py
@@ -25,6 +25,7 @@
 from ops.testing import Harness
 
 from charm import MongoDBCharm
+from config import Config
 
 from .helpers import patch_network_get
 
@@ -33,11 +34,16 @@
 
 @pytest.fixture(autouse=True)
 def patch_upgrades(monkeypatch):
+    monkeypatch.setattr(
+        "charm.MongoDBCharm.get_termination_period_for_pod",
+        lambda *args, **kwargs: Config.WebhookManager.GRACE_PERIOD_SECONDS,
+    )
     monkeypatch.setattr("charm.kubernetes_upgrades._Partition.get", lambda *args, **kwargs: 0)
     monkeypatch.setattr("charm.kubernetes_upgrades._Partition.set", lambda *args, **kwargs: None)
 
 
 class TestMongoBackups(unittest.TestCase):
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charm.get_charm_revision")
     @patch_network_get(private_address="1.1.1.1")
     def setUp(self, *unused):
diff --git a/tests/unit/test_mongodb_provider.py b/tests/unit/test_mongodb_provider.py
index 9585d8c70..a60f065d2 100644
--- a/tests/unit/test_mongodb_provider.py
+++ b/tests/unit/test_mongodb_provider.py
@@ -12,6 +12,7 @@
 from pymongo.errors import ConfigurationError, ConnectionFailure, OperationFailure
 
 from charm import MongoDBCharm
+from config import Config
 
 from .helpers import patch_network_get
 
@@ -28,11 +29,16 @@
 @pytest.fixture(autouse=True)
 def patch_upgrades(monkeypatch):
     monkeypatch.setattr("charms.mongodb.v0.upgrade_helpers.AbstractUpgrade.in_progress", False)
+    monkeypatch.setattr(
+        "charm.MongoDBCharm.get_termination_period_for_pod",
+        lambda *args, **kwargs: Config.WebhookManager.GRACE_PERIOD_SECONDS,
+    )
     monkeypatch.setattr("charm.kubernetes_upgrades._Partition.get", lambda *args, **kwargs: 0)
     monkeypatch.setattr("charm.kubernetes_upgrades._Partition.set", lambda *args, **kwargs: None)
 
 
 class TestMongoProvider(unittest.TestCase):
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charm.get_charm_revision")
     @patch_network_get(private_address="1.1.1.1")
     def setUp(self, *unused):
@@ -47,6 +53,7 @@ def setUp(self, *unused):
         self.charm = self.harness.charm
         self.addCleanup(self.harness.cleanup)
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charms.mongodb.v0.set_status.get_charm_revision")
     @patch("charm.CrossAppVersionChecker.is_local_charm")
     @patch("charm.CrossAppVersionChecker.is_integrated_to_locally_built_charm")
@@ -73,6 +80,7 @@ def test_relation_event_db_not_initialised(self, oversee_users, defer, *unused):
         oversee_users.assert_not_called()
         defer.assert_not_called()
 
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch_network_get(private_address="1.1.1.1")
     @patch("charm.CrossAppVersionChecker.is_local_charm")
     @patch("charms.mongodb.v0.set_status.get_charm_revision")
@@ -99,6 +107,7 @@ def test_relation_event_oversee_users_mongo_failure(self, oversee_users, defer,
             defer.assert_called()
 
     # oversee_users raises AssertionError when unable to attain users from relation
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch_network_get(private_address="1.1.1.1")
     @patch("charm.CrossAppVersionChecker.is_local_charm")
     @patch("charms.mongodb.v0.set_status.get_charm_revision")
diff --git a/tests/unit/test_upgrade.py b/tests/unit/test_upgrade.py
index b972ccbc2..9a18b9a33 100644
--- a/tests/unit/test_upgrade.py
+++ b/tests/unit/test_upgrade.py
@@ -1,5 +1,6 @@
 # Copyright 2024 Canonical Ltd.
 # See LICENSE file for licensing details.
+import json
 import unittest
 from unittest.mock import Mock, PropertyMock, patch
 
@@ -23,11 +24,16 @@
 @pytest.fixture(autouse=True)
 def patch_upgrades(monkeypatch):
     monkeypatch.setattr("charms.mongodb.v0.upgrade_helpers.AbstractUpgrade.in_progress", False)
+    monkeypatch.setattr(
+        "charm.MongoDBCharm.get_termination_period_for_pod",
+        lambda *args, **kwargs: Config.WebhookManager.GRACE_PERIOD_SECONDS,
+    )
     monkeypatch.setattr("charm.kubernetes_upgrades._Partition.get", lambda *args, **kwargs: 0)
     monkeypatch.setattr("charm.kubernetes_upgrades._Partition.set", lambda *args, **kwargs: None)
 
 
 class TestUpgrades(unittest.TestCase):
+    @patch("charm.gen_certificate", return_value=(b"", b""))
     @patch("charm.get_charm_revision")
     @patch_network_get(private_address="1.1.1.1")
     @patch("charm.get_charm_revision")
@@ -151,6 +157,7 @@ def test_run_post_upgrade_checks(
         mock_wait.side_effect = cluster_healthy_return
         mock_is_cluster.return_value = is_cluster_able_to_read_write_return
         self.harness.charm.unit.status = initial_status
+        self.harness.charm.app_peer_data["db_initialised"] = json.dumps(True)
         self.harness.charm.upgrade._upgrade.unit_state = UnitState(initial_unit_state)
 
         self.harness.charm.upgrade.run_post_upgrade_checks(StartEvent, False)