diff --git a/.github/workflows/analyse-pr.yml b/.github/workflows/analyse-pr.yml
index cfcc445370b0..99b97a2cc98b 100644
--- a/.github/workflows/analyse-pr.yml
+++ b/.github/workflows/analyse-pr.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   SONAR_TOKEN: ${{ secrets.DHIS2_BOT_SONARCLOUD_TOKEN }}
 on:
diff --git a/.github/workflows/run-api-analytics-tests-doris.yml b/.github/workflows/run-api-analytics-tests-doris.yml
index 3dfb9bb9e258..73aaac4b21f7 100644
--- a/.github/workflows/run-api-analytics-tests-doris.yml
+++ b/.github/workflows/run-api-analytics-tests-doris.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
 
 on:
   pull_request:
diff --git a/.github/workflows/run-api-analytics-tests.yml b/.github/workflows/run-api-analytics-tests.yml
index 7692ac46533c..357f87178dd7 100644
--- a/.github/workflows/run-api-analytics-tests.yml
+++ b/.github/workflows/run-api-analytics-tests.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
 
 on:
   pull_request:
diff --git a/.github/workflows/run-api-tests.yml b/.github/workflows/run-api-tests.yml
index e1632e9c0608..d1e44729040e 100644
--- a/.github/workflows/run-api-tests.yml
+++ b/.github/workflows/run-api-tests.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Xmx1024m -Xms1024m -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
 
 on:
   push:
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index ab224db0ab68..652bb1fe6e52 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -4,6 +4,8 @@ env:
   MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=125
   # PR → quiet (unless ci-verbose label), push/schedule → info, workflow_dispatch → user choice
   MAVEN_ARGS: ${{ (inputs.maven_log == 'debug' && '-X') || (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci-verbose') && '-q') || (inputs.maven_log == 'quiet' && '-q') || '' }}
+  # Controls log4j2 suppression of expected test errors. ci-verbose label sets to error to show them.
+  TEST_LOG_SUPPRESSED_LEVEL: ${{ (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-verbose') && 'error') || (inputs.maven_log == 'debug' && 'error') || 'off' }}
 on:
   push:
     branches:
diff --git a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
index 9dd20813d726..672012e504ed 100644
--- a/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
+++ b/dhis-2/dhis-support/dhis-support-test/src/main/resources/log4j2-test.xml
@@ -5,6 +5,9 @@
 <Configuration status="warn">
     <Properties>
         <Property name="layout">%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</Property>
+        <!-- CI sets TEST_LOG_SUPPRESSED_LEVEL=error when ci-verbose label is present to show all errors.
+        Defaults to off which disables these loggers entirely. -->
+        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-off}</Property>
     </Properties>
 
     <Appenders>
@@ -17,6 +20,23 @@
     </Appenders>
 
     <Loggers>
+        <!-- Suppress expected errors from tests exercising error paths and from resources
+        not available in test classpaths (e.g. build.properties, apps-bundle.json).
+        These are not real failures - the tests pass, but the application logs at ERROR. -->
+        <Logger name="org.hisp.dhis.scheduling" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.system" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.appmanager" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.fileresource" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.sms" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.route" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.dxf2.gml" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.rules.engine" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.tracker.imports.sms" level="${suppressed.level}"/>
+        <!-- CrudControllerAdvice is the global @ControllerAdvice that catches exceptions from tests
+        deliberately exercising error paths (e.g. SQL injection tests). The broad package suppression
+        was replaced with this targeted class to keep other controller errors visible. -->
+        <Logger name="org.hisp.dhis.webapi.controller.CrudControllerAdvice" level="${suppressed.level}"/>
+
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
             we use due to for example misconfigurations or so. If you want to increase the verbosity of specific
@@ -27,6 +47,10 @@
             <AppenderRef ref="file" level="warn"/>
         </Root>
 
+        <!-- Tests that verify uniqueness constraints intentionally trigger duplicate-key
+             violations; Hibernate logs every such exception at ERROR via SqlExceptionHelper. -->
+        <Logger name="org.hibernate.engine.jdbc.spi.SqlExceptionHelper" level="fatal" additivity="false"/>
+
         <!-- A few examples of loggers that might be useful to debug integration test issues.
         Adding an AppenderRef is necessary to overrule the log level we have set on the Root AppenderRefs.
         Once you add an AppenderRef to a Logger you need to set additivity to false otherwise logs might appear twice
diff --git a/dhis-2/dhis-test-integration/src/test/java/org/hisp/dhis/security/oauth2/authorization/Dhis2OAuth2AuthorizationServiceIntegrationTest.java b/dhis-2/dhis-test-integration/src/test/java/org/hisp/dhis/security/oauth2/authorization/Dhis2OAuth2AuthorizationServiceIntegrationTest.java
index a90b0304d83e..4174242f8a7e 100644
--- a/dhis-2/dhis-test-integration/src/test/java/org/hisp/dhis/security/oauth2/authorization/Dhis2OAuth2AuthorizationServiceIntegrationTest.java
+++ b/dhis-2/dhis-test-integration/src/test/java/org/hisp/dhis/security/oauth2/authorization/Dhis2OAuth2AuthorizationServiceIntegrationTest.java
@@ -34,7 +34,6 @@
 import static org.junit.jupiter.api.Assertions.assertNull;
 
 import java.time.Instant;
-import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
@@ -172,11 +171,6 @@ void testFindByAuthorizationCode() {
     // When
     authorizationService.save(authorization);
 
-    List<Dhis2OAuth2Authorization> all = authorizationService.getAll();
-    for (Dhis2OAuth2Authorization oAuth2Authorization : all) {
-      System.out.println(oAuth2Authorization);
-    }
-
     OAuth2Authorization foundAuthorization =
         authorizationService.findByToken(
             "code-value", new OAuth2TokenType(OAuth2ParameterNames.CODE));
diff --git a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
index a97e9aae339f..756b996b146a 100644
--- a/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-integration/src/test/resources/log4j2-test.xml
@@ -2,6 +2,9 @@
 <Configuration status="warn">
     <Properties>
         <Property name="layout">%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</Property>
+        <!-- CI sets TEST_LOG_SUPPRESSED_LEVEL=error when ci-verbose label is present to show all errors.
+        Defaults to off which disables these loggers entirely. -->
+        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-off}</Property>
     </Properties>
 
     <Appenders>
@@ -14,6 +17,23 @@
     </Appenders>
 
     <Loggers>
+        <!-- Suppress expected errors from tests exercising error paths and from resources
+        not available in test classpaths (e.g. build.properties, apps-bundle.json).
+        These are not real failures - the tests pass, but the application logs at ERROR. -->
+        <Logger name="org.hisp.dhis.scheduling" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.system" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.appmanager" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.fileresource" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.sms" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.route" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.dxf2.gml" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.rules.engine" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.tracker.imports.sms" level="${suppressed.level}"/>
+        <!-- CrudControllerAdvice is the global @ControllerAdvice that catches exceptions from tests
+        deliberately exercising error paths (e.g. SQL injection tests). The broad package suppression
+        was replaced with this targeted class to keep other controller errors visible. -->
+        <Logger name="org.hisp.dhis.webapi.controller.CrudControllerAdvice" level="${suppressed.level}"/>
+
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
             we use due to for example misconfigurations or so. If you want to increase the verbosity of specific
@@ -30,6 +50,10 @@
         as they propagate up from the Logger to its parent which is the Root.
         Check the log4j2 config documentation for more details. Uncomment the various loggers to debug the tests. -->
 
+        <!-- Tests that verify uniqueness constraints intentionally trigger duplicate-key
+             violations; Hibernate logs every such exception at ERROR via SqlExceptionHelper. -->
+        <Logger name="org.hibernate.engine.jdbc.spi.SqlExceptionHelper" level="fatal" additivity="false"/>
+
         <!-- DHIS2 -->
         <!--        
         <Logger name="org.hisp.dhis.migration" level="info" additivity="false">
diff --git a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
index bd964117d76a..12cf879d2e47 100644
--- a/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
+++ b/dhis-2/dhis-test-web-api/src/test/resources/log4j2-test.xml
@@ -2,6 +2,9 @@
 <Configuration status="warn">
     <Properties>
         <Property name="layout">%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</Property>
+        <!-- CI sets TEST_LOG_SUPPRESSED_LEVEL=error when ci-verbose label is present to show all errors.
+        Defaults to off which disables these loggers entirely. -->
+        <Property name="suppressed.level">${env:TEST_LOG_SUPPRESSED_LEVEL:-off}</Property>
     </Properties>
 
     <Appenders>
@@ -18,6 +21,23 @@
     </Appenders>
 
     <Loggers>
+        <!-- Suppress expected errors from tests exercising error paths and from resources
+        not available in test classpaths (e.g. build.properties, apps-bundle.json).
+        These are not real failures - the tests pass, but the application logs at ERROR. -->
+        <Logger name="org.hisp.dhis.scheduling" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.system" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.appmanager" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.fileresource" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.sms" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.route" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.dxf2.gml" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.rules.engine" level="${suppressed.level}"/>
+        <Logger name="org.hisp.dhis.tracker.imports.sms" level="${suppressed.level}"/>
+        <!-- CrudControllerAdvice is the global @ControllerAdvice that catches exceptions from tests
+        deliberately exercising error paths (e.g. SQL injection tests). The broad package suppression
+        was replaced with this targeted class to keep other controller errors visible. -->
+        <Logger name="org.hisp.dhis.webapi.controller.CrudControllerAdvice" level="${suppressed.level}"/>
+
         <Root level="warn">
             <!-- Set to error so CI test runs are quiet, we see failed tests easily but still see errors from libraries
             we use due to for example misconfigurations or so. If you want to increase the verbosity of specific
@@ -30,6 +50,17 @@
 
         <Logger name="org.openapitools.codegen" level="off"/>
 
+        <!-- Analytics tables do not exist in the test database, so any test that drives
+             the analytics engine (e.g. ADEX) produces expected "relation does not exist"
+             SQL errors.  The tests still pass; suppress the noise. -->
+        <Logger name="org.hisp.dhis.analytics.data.JdbcAnalyticsManager" level="fatal" additivity="false"/>
+        <Logger name="org.hisp.dhis.analytics.data.handler.DataHandler" level="fatal" additivity="false"/>
+        <Logger name="org.hisp.dhis.analytics.util.AnalyticsUtils" level="fatal" additivity="false"/>
+
+        <!-- Tests that verify uniqueness constraints intentionally trigger duplicate-key
+             violations; Hibernate logs every such exception at ERROR via SqlExceptionHelper. -->
+        <Logger name="org.hibernate.engine.jdbc.spi.SqlExceptionHelper" level="fatal" additivity="false"/>
+
         <!-- A few examples of loggers that might be useful to debug integration test issues.
         Adding an AppenderRef is necessary to overrule the log level we have set on the Root AppenderRefs.
         Once you add an AppenderRef to a Logger you need to set additivity to false otherwise logs might appear twice