diff --git a/.github/actions/integration-tests/action.yml b/.github/actions/integration-tests/action.yml
index 2e311d8ad..482c5632e 100644
--- a/.github/actions/integration-tests/action.yml
+++ b/.github/actions/integration-tests/action.yml
@@ -8,6 +8,10 @@ inputs:
   maven-version:
     description: The Maven version the build shall run with.
     required: true
+  malware-scan-timeout:
+    description: Timeout for waiting on async malware scan completion (ISO-8601 duration, e.g. PT120S).
+    required: false
+    default: PT1M
 
 runs:
   using: composite
@@ -29,7 +33,18 @@ runs:
       shell: bash
 
     - name: Generic Integration Tests
-      run: mvn clean verify -ntp -B -f integration-tests/pom.xml -pl :cds-feature-attachments-integration-tests-parent,:cds-feature-attachments-integration-tests-db,:cds-feature-attachments-integration-tests-generic -Dcds.install-node.skip
+      env:
+        MALWARE_SCAN_TIMEOUT: ${{ inputs.malware-scan-timeout }}
+        # Tests relying on the malware scan service are flaky.
+        # Therefore, we retry failed tests as a mitigation.
+        RERUN_FAILING_TESTS_COUNT: "2"
+      run: |
+        mvn clean verify -ntp -B \
+          -f integration-tests/pom.xml \
+          -pl :cds-feature-attachments-integration-tests-parent,:cds-feature-attachments-integration-tests-db,:cds-feature-attachments-integration-tests-generic \
+          -Dcds.install-node.skip \
+          -Dtest.malware-scan.timeout="${MALWARE_SCAN_TIMEOUT}" \
+          -Dsurefire.rerunFailingTestsCount="${RERUN_FAILING_TESTS_COUNT}"
       shell: bash
 
     - name: MTX-Local Integration Tests
diff --git a/integration-tests/generic/src/test/java/com/sap/cds/feature/attachments/integrationtests/draftservice/DraftOdataRequestValidationBase.java b/integration-tests/generic/src/test/java/com/sap/cds/feature/attachments/integrationtests/draftservice/DraftOdataRequestValidationBase.java
index fbba60321..4512f3bb4 100644
--- a/integration-tests/generic/src/test/java/com/sap/cds/feature/attachments/integrationtests/draftservice/DraftOdataRequestValidationBase.java
+++ b/integration-tests/generic/src/test/java/com/sap/cds/feature/attachments/integrationtests/draftservice/DraftOdataRequestValidationBase.java
@@ -25,6 +25,7 @@
 import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
 import java.nio.charset.StandardCharsets;
+import java.time.Duration;
 import java.util.concurrent.TimeUnit;
 import org.awaitility.Awaitility;
 import org.junit.jupiter.api.AfterEach;
@@ -32,6 +33,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
 import org.springframework.http.HttpStatus;
@@ -55,6 +57,9 @@ abstract class DraftOdataRequestValidationBase {
   @Autowired private TableDataDeleter dataDeleter;
   @Autowired private TestPersistenceHandler testPersistenceHandler;
 
+  @Value("${test.malware-scan.timeout:PT60S}")
+  private Duration malwareScanTimeout;
+
   @AfterEach
   void teardown() {
     dataDeleter.deleteData(
@@ -122,7 +127,7 @@ void contentCanBeReadFromDraft() throws Exception {
             + "/content";
 
     Awaitility.await()
-        .atMost(60, TimeUnit.SECONDS)
+        .atMost(malwareScanTimeout)
         .pollDelay(1, TimeUnit.SECONDS)
         .pollInterval(2, TimeUnit.SECONDS)
         .until(
@@ -796,7 +801,7 @@ protected void readAndValidateActiveContent(
             + "/content";
 
     Awaitility.await()
-        .atMost(60, TimeUnit.SECONDS)
+        .atMost(malwareScanTimeout)
         .pollDelay(1, TimeUnit.SECONDS)
         .pollInterval(2, TimeUnit.SECONDS)
         .until(
@@ -807,11 +812,11 @@ protected void readAndValidateActiveContent(
               var attachmentEntityContentAsString =
                   attachmentEntityResponse.getResponse().getContentAsString();
 
-              var booleanResult =
+              var contentMatchesExpectation =
                   attachmentContentAsString.equals(attachmentContent)
                       && attachmentEntityContentAsString.equals(attachmentEntityContent);
 
-              if (!booleanResult) {
+              if (!contentMatchesExpectation) {
                 logger.info(
                     "Attachment response content: {}, Attachment Test Content: {}, Attachment Entity response content: {}, Attachment Entity Test Content: {}",
                     attachmentContentAsString,
@@ -819,7 +824,7 @@ protected void readAndValidateActiveContent(
                     attachmentEntityContentAsString,
                     attachmentEntityContent);
               }
-              return booleanResult;
+              return contentMatchesExpectation;
             });
     clearServiceHandlerContext();
 
diff --git a/integration-tests/generic/src/test/resources/application.yaml b/integration-tests/generic/src/test/resources/application.yaml
index 54849379b..d135e153a 100644
--- a/integration-tests/generic/src/test/resources/application.yaml
+++ b/integration-tests/generic/src/test/resources/application.yaml
@@ -3,6 +3,10 @@ cds:
     csv:
       paths: "../db/src/gen/csv"
 
+test:
+  malware-scan:
+    timeout: PT60S
+
 ---
 spring:
   config: