diff --git a/tests/integration_tests/_utils/start_tidb_cluster_nextgen b/tests/integration_tests/_utils/start_tidb_cluster_nextgen
index e1c4dd0e3c..aeb9b1bff9 100755
--- a/tests/integration_tests/_utils/start_tidb_cluster_nextgen
+++ b/tests/integration_tests/_utils/start_tidb_cluster_nextgen
@@ -13,8 +13,10 @@ TEST_DATA_DIR="$CASE_DIR/$TEST_OUT_DATA_DIR"
 
 echo "TEST_DATA_DIR: $TEST_DATA_DIR"
 
-# Random generate the sockets config.
-# Make sure we dont use the same sock.
+# Random generate the `socket` config for TiDB.
+# TiDB parses `socket = ...` as a root-level key. Our generated config ends with
+# `[instance]`, so appending `socket = ...` at the end would become `instance.socket`,
+# which is rejected by newer TiDB versions (and makes TiDB fail to start).
 randomGenSocketsConf() {
 	config_file="$1"
 	random_str=$(date '+%s%N')
@@ -22,7 +24,13 @@ randomGenSocketsConf() {
 		random_str=$(cat /dev/random | LC_ALL=C tr -dc "a-zA-Z0-9" | head -c 10)
 	fi
 
-	echo "socket = \"/tmp/tidb-$random_str.sock\"" >>"$config_file"
+	# Prepend the root-level `socket` and drop any existing `socket = ...` lines
+	# (old scripts appended it under `[instance]`, which becomes `instance.socket`).
+	{
+		echo "socket = \"/tmp/tidb-$random_str.sock\""
+		sed '/^[[:space:]]*socket[[:space:]]*=/d' "$config_file"
+	} >"$config_file.tmp"
+	mv "$config_file.tmp" "$config_file"
 }
 
 check_bin() {
@@ -343,6 +351,10 @@ check_port_available "$UP_TIKV_WORKER_HOST" "$UP_TIKV_WORKER_PORT" "Upstream TiK
 check_port_available "$DOWN_TIKV_WORKER_HOST" "$DOWN_TIKV_WORKER_PORT" "Downstream TiKV-Worker is not ready yet"
 
 ####################start TiDB####################
+# NOTE: TiDB config keys are section-sensitive. Keep `socket` and
+# `max-server-connections` at root level, and keep tuning knobs like
+# `run-auto-analyze` / `server-memory-quota` under `[performance]`. Otherwise
+# TiDB will report "invalid configuration options" and silently ignore them.
 touch "$OUT_DIR/upstream-tidb-system.toml"
 if [ -f "$tidb_config" ]; then
 	cat "$tidb_config" >>"$OUT_DIR/upstream-tidb-system.toml"
@@ -352,9 +364,7 @@ cat >>"$OUT_DIR/upstream-tidb-system.toml" <<EOF
 keyspace-name = "SYSTEM"
 enable-telemetry = false
 mem-quota-query = 671088640
-run-auto-analyze = false
-server-memory-quota = 2684354560
-analyze-always-skip-wide-columns = true
+max-server-connections = 0
 tikv-worker-url = "http://$UP_TIKV_WORKER_HOST:$UP_TIKV_WORKER_PORT"
 # temp-dir = "$TEST_DATA_DIR/upstream/tidb-system"
 
@@ -363,13 +373,14 @@ max-backups = 100
 
 [performance]
 tcp-keep-alive = true
+run-auto-analyze = false
+server-memory-quota = 2684354560
 
 [security]
 enable-sem = false
 
 [instance]
 tidb_service_scope = 'dxf_service'
-max-server-connections = 0
 EOF
 
 touch "$OUT_DIR/upstream-tidb-$KEYSPACE_NAME.toml"
@@ -381,9 +392,7 @@ cat >>"$OUT_DIR/upstream-tidb-$KEYSPACE_NAME.toml" <<EOF
 keyspace-name = "$KEYSPACE_NAME"
 enable-telemetry = false
 mem-quota-query = 671088640
-run-auto-analyze = false
-server-memory-quota = 2684354560
-analyze-always-skip-wide-columns = true
+max-server-connections = 0
 # temp-dir = "$TEST_DATA_DIR/upstream/tidb-$KEYSPACE_NAME"
 
 [log.file]
@@ -391,12 +400,12 @@ max-backups = 100
 
 [performance]
 tcp-keep-alive = true
+run-auto-analyze = false
+server-memory-quota = 2684354560
 
 [security]
 enable-sem = false
 
-[instance]
-max-server-connections = 0
 EOF
 
 cp "$OUT_DIR/upstream-tidb-$KEYSPACE_NAME.toml" "$OUT_DIR/upstream-tidb-$KEYSPACE_NAME-other.toml"
@@ -410,9 +419,7 @@ cat >>"$OUT_DIR/downstream-tidb-system.toml" <<EOF
 keyspace-name = "SYSTEM"
 enable-telemetry = false
 mem-quota-query = 671088640
-run-auto-analyze = false
-server-memory-quota = 2684354560
-analyze-always-skip-wide-columns = true
+max-server-connections = 0
 tikv-worker-url = "http://$DOWN_TIKV_WORKER_HOST:$DOWN_TIKV_WORKER_PORT"
 # temp-dir = "$TEST_DATA_DIR/downstream/tidb-system"
 
@@ -421,13 +428,14 @@ max-backups = 100
 
 [performance]
 tcp-keep-alive = true
+run-auto-analyze = false
+server-memory-quota = 2684354560
 
 [security]
 enable-sem = false
 
 [instance]
 tidb_service_scope = 'dxf_service'
-max-server-connections = 0
 EOF
 
 touch "$OUT_DIR/downstream-tidb-$KEYSPACE_NAME.toml"
@@ -439,9 +447,7 @@ cat >>"$OUT_DIR/downstream-tidb-$KEYSPACE_NAME.toml" <<EOF
 keyspace-name = "$KEYSPACE_NAME"
 enable-telemetry = false
 mem-quota-query = 671088640
-run-auto-analyze = false
-server-memory-quota = 2684354560
-analyze-always-skip-wide-columns = true
+max-server-connections = 0
 # temp-dir = "$TEST_DATA_DIR/downstream/tidb-$KEYSPACE_NAME"
 
 [log.file]
@@ -449,12 +455,12 @@ max-backups = 100
 
 [performance]
 tcp-keep-alive = true
+run-auto-analyze = false
+server-memory-quota = 2684354560
 
 [security]
 enable-sem = false
 
-[instance]
-max-server-connections = 0
 EOF
 
 echo "Starting upstream system TiDB"
diff --git a/tests/integration_tests/_utils/start_tls_tidb_cluster_impl_nextgen b/tests/integration_tests/_utils/start_tls_tidb_cluster_impl_nextgen
index bb799e9b51..72e6bd7b16 100755
--- a/tests/integration_tests/_utils/start_tls_tidb_cluster_impl_nextgen
+++ b/tests/integration_tests/_utils/start_tls_tidb_cluster_impl_nextgen
@@ -115,15 +115,17 @@ key-path = "$TLS_DIR/server-key.pem"
 EOF
 
 # system tidb server config file
+# NOTE: TiDB config keys are section-sensitive. Keep `socket` and
+# `max-server-connections` at root level, and keep tuning knobs like
+# `run-auto-analyze` / `server-memory-quota` under `[performance]`. Otherwise
+# TiDB will report "invalid configuration options" and silently ignore them.
 cat - >"$OUT_DIR/tidb-system-config-tls.toml" <<EOF
 socket = "/tmp/tidb-system-tls.sock"
 keyspace-name = "SYSTEM"
 enable-telemetry = false
 mem-quota-query = 671088640
 new_collations_enabled_on_first_bootstrap = true
-run-auto-analyze = false
-server-memory-quota = 2684354560
-analyze-always-skip-wide-columns = true
+max-server-connections = 0
 tikv-worker-url = "http://$UP_TIKV_WORKER_HOST:$UP_TIKV_WORKER_PORT"
 
 [log.file]
@@ -131,10 +133,11 @@ max-backups = 100
 
 [performance]
 tcp-keep-alive = true
+run-auto-analyze = false
+server-memory-quota = 2684354560
 
 [instance]
 tidb_service_scope = 'dxf_service'
-max-server-connections = 0
 
 [security]
 enable-sem = false
@@ -152,18 +155,15 @@ keyspace-name = "$KEYSPACE_NAME"
 enable-telemetry = false
 mem-quota-query = 671088640
 new_collations_enabled_on_first_bootstrap = true
-run-auto-analyze = false
-server-memory-quota = 2684354560
-analyze-always-skip-wide-columns = true
+max-server-connections = 0
 
 [log.file]
 max-backups = 100
 
 [performance]
 tcp-keep-alive = true
-
-[instance]
-max-server-connections = 0
+run-auto-analyze = false
+server-memory-quota = 2684354560
 
 [security]
 enable-sem = false
diff --git a/tests/integration_tests/_utils/stop_tidb_cluster b/tests/integration_tests/_utils/stop_tidb_cluster
index 44663f0db5..4d9d6a4c9f 100755
--- a/tests/integration_tests/_utils/stop_tidb_cluster
+++ b/tests/integration_tests/_utils/stop_tidb_cluster
@@ -2,6 +2,9 @@
 
 # cdc server is ran by binary cdc.test, kill cdc server first to avoid too much
 # noise in cdc logs.
+#
+# Also kill sink consumer binaries started by integration tests to avoid leaking
+# background processes across cases/groups.
 
 PKILL="killall -q -w -s 9 "
 if [ "$(uname)" == "Darwin" ]; then
@@ -11,6 +14,7 @@ fi
 ${PKILL} cdc.test || true
 ${PKILL} cdc || true
 ${PKILL} cdc_kafka_consumer || true
+${PKILL} cdc_pulsar_consumer || true
 ${PKILL} cdc_storage_consumer || true
 ${PKILL} tidb-server || true
 ${PKILL} tikv-server || true