diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4db2daaeba..0d7ad2da1f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -385,6 +385,9 @@ stages:
       $EXTRA_CONFIGURE
       || (test -s config.log && cat config.log; exit 1)
 
+.git-clone-bind9-qa: &git_clone_bind9-qa
+  - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+
 # change directory to the workspace before including this
 .find_python: &find_python
   - PYTHON="$(cat bin/tests/system/isctest/vars/.ac_vars/PYTHON)"
@@ -437,21 +440,6 @@ stages:
         fi
       fi
 
-.check_for_junit_xml: &check_for_junit_xml
-    # test if junit.xml file exists and is longer 40 bytes
-    # (i.e., contains more than `<testsuites><testsuite /></testsuites>`)
-    - if [ -f "$CI_PROJECT_DIR"/junit.xml ]; then
-        if [ $(wc -c < "$CI_PROJECT_DIR"/junit.xml) -gt 40 ]; then
-          echo "junit.xml file exists and is longer than 40 bytes.";
-        else
-          echo "junit.xml file exists but is too short.";
-          exit 1;
-        fi
-      else
-        echo "junit.xml file does not exist.";
-        exit 1;
-      fi
-
 .build: &build_job
   <<: *default_triggering_rules
   stage: build
@@ -567,7 +555,9 @@ stages:
     - if pytest --version | grep -F "pytest 9.0" >/dev/null; then echo "filterwarnings = ignore::pytest.PytestRemovedIn9Warning" >> pytest.ini; fi
     - >
       ("$PYTEST" --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "$TEST_PARALLEL_JOBS" | tee pytest.out.txt) || RET=1
-    - *check_for_junit_xml
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - >
+      "$PYTHON" bind9-qa/ci/postprocess_junit_files.py "$CI_PROJECT_DIR"/junit.xml --output "$CI_PROJECT_DIR"/junit.xml
     - (exit $RET)
     - '( ! grep -F "grep: warning:" pytest.out.txt )'
     - test "$CLEAN_BUILD_ARTIFACTS_ON_SUCCESS" -eq 0 || ( cd ../../.. && make clean >/dev/null 2>&1 )
@@ -602,7 +592,9 @@ stages:
     - *find_python
     - >
       "$PYTHON" bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
-    - *check_for_junit_xml
+    - *git_clone_bind9-qa
+    - >
+      "$PYTHON" bind9-qa/ci/postprocess_junit_files.py "$CI_PROJECT_DIR"/junit.xml --output "$CI_PROJECT_DIR"/junit.xml
     - (exit $RET)
   after_script:
     - cat bin/tests/system/test-suite.log || true
@@ -629,9 +621,11 @@ stages:
     - RET=0
     - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1 || RET=$?
     - *find_python
+    - *git_clone_bind9-qa
     - >
       "$PYTHON" "$CI_PROJECT_DIR"/bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
-    - *check_for_junit_xml
+    - >
+      "$PYTHON" bind9-qa/ci/postprocess_junit_files.py "$CI_PROJECT_DIR"/junit.xml --output "$CI_PROJECT_DIR"/junit.xml
     - (exit $RET)
     - test "$CLEAN_BUILD_ARTIFACTS_ON_SUCCESS" -eq 0 || make clean >/dev/null 2>&1
   artifacts:
@@ -662,7 +656,7 @@ stages:
     - *configure
     - make -j${BUILD_PARALLEL_JOBS:-1} V=1
     - *setup_interfaces
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - *git_clone_bind9-qa
     - cd bind9-qa/respdiff
   needs: []
   artifacts:
@@ -737,7 +731,7 @@ ci-variables:
 ci-orphaned-anchors:
   <<: *precheck_job
   script:
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - *git_clone_bind9-qa
     - bind9-qa/ci-orphaned-anchors/check-orphaned-anchors-ci.py .gitlab-ci.yml
   needs: []
   rules:
@@ -954,12 +948,13 @@ cross-version-config-tests:
     - *configure
     - *setup_interfaces
     - make -j${BUILD_PARALLEL_JOBS:-1}
+    - *find_python
+    - *find_pytest
     - git clone --branch "${BIND_BASELINE_VERSION}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git "bind-${BIND_BASELINE_VERSION}"
     - cd "bind-${BIND_BASELINE_VERSION}"
     - autoreconf -fi
     - *configure
     - make -j${BUILD_PARALLEL_JOBS:-1}
-    - *find_pytest
     # The cross-version-config-tests job would fail when a system test is
     # removed from the upcoming release. To avoid this, remove the system test
     # also from the $BIND_BASELINE_VERSION.
@@ -973,8 +968,19 @@ cross-version-config-tests:
     # release using the binaries built for the current BIND 9 version.  This
     # intends to detect obvious backward compatibility issues with the latter.
     - sed -i "s|f\"{AC_VARS\['TOP_BUILDDIR'\]}|\"$CI_PROJECT_DIR|g" isctest/vars/basic.py
+    # This script needs to: 1) fail if the tests fail, 2) fail if
+    # the junit.xml file is broken, 3) produce the junit.xml file even if
+    # the  tests fail.  Therefore, $RET is used to "cache" the
+    # result of running pytest as interrupting the script immediately when
+    # system tests fail would make checking the contents of the junit.xml
+    # file impossible (GitLab Runner uses "set -o pipefail").
+    - RET=0
     - >
-      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "${TEST_PARALLEL_JOBS:-1}"
+      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "${TEST_PARALLEL_JOBS:-1}" || RET=1
+    - *git_clone_bind9-qa
+    - >
+      "$PYTHON" bind9-qa/ci/postprocess_junit_files.py "$CI_PROJECT_DIR"/junit.xml --output "$CI_PROJECT_DIR"/junit.xml
+    - (exit $RET)
   needs:
     - job: autoreconf
       artifacts: true
@@ -1951,7 +1957,7 @@ publish:
   <<: *manual_release_job
   <<: *base_image
   before_script:
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - *git_clone_bind9-qa
   needs:
     - job: staging
       artifacts: false
@@ -2069,7 +2075,7 @@ customer-git:branch:
         BRANCH: '$CI_COMMIT_BRANCH'
   before_script:
     - test -n "$CUSTOMER"
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - *git_clone_bind9-qa
   script:
     - git checkout -b "$BRANCH"  # ensure refs/heads/$BRANCH exists; GitLab clones with detached HEAD
     - bind9-qa/releng/push_to_customer_repository.py --branch "$BRANCH" --customer "$CUSTOMER" --force
@@ -2082,7 +2088,7 @@ customer-git:tag:
   rules:
     - *rule_tag
   before_script:
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - *git_clone_bind9-qa
     - git clone --depth 1 "https://token:${ISC_CUSTOMERS_WRITE_TOKEN}@gitlab.isc.org/isc-customers/isc-customer-settings.git"
   script:
     - bind9-qa/releng/push_to_customer_repository.py --tag "$CI_COMMIT_TAG" --entitlements isc-customer-settings/entitlements.yaml --force
@@ -2257,7 +2263,7 @@ generate-stress-test-configs:
   <<: *default_triggering_rules
   stage: precheck
   script:
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - *git_clone_bind9-qa
     - bind9-qa/stress/generate-stress-test-configs.py > stress-test-configs.yml
   artifacts:
     paths:
@@ -2375,7 +2381,7 @@ pairwise:
     - >
       : stop if this is not a merge request in the current project\'s namespace
     - test -n "$MERGE_REQUEST_ID" || exit 0
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - *git_clone_bind9-qa
 
 backports:
   <<: *post_merge