diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 5892fc30..b0445962 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -143,7 +143,8 @@ jobs:
         run: |
           case ${{ matrix.os }} in
           centos7)
-            yum -y update && yum -y install gcc gcc-c++ libstdc++-static
+            sed -i 's|http://vault.centos.org/centos/$releasever/|https://vault.centos.org/7.9.2009/|g' /etc/yum.repos.d/CentOS-Base.repo
+            yum --disablerepo='*' --enablerepo=base,updates,extras -y install gcc gcc-c++ libstdc++-static
             pushd examples
             mkdir build
             cmake \
@@ -156,14 +157,27 @@ jobs:
             popd
             ;;
           *)
+            export LD_LIBRARY_PATH=/usr/local/nebula/lib64:/usr/local/nebula/lib:$LD_LIBRARY_PATH
+            example_env=(env)
+            example_link_flags=()
+            case ${{ matrix.compiler }} in
+            clang-*)
+              asan_dir=$("$TOOLSET_CLANG_DIR/bin/clang++" -print-resource-dir)/lib/linux
+              asan_runtime="$asan_dir/libclang_rt.asan-$(uname -m).so"
+              test -f "$asan_runtime"
+              export LD_LIBRARY_PATH="$asan_dir:$LD_LIBRARY_PATH"
+              example_link_flags=("-DCMAKE_SHARED_LINKER_FLAGS=-Wl,-rpath-link,$asan_dir")
+              example_env+=("LD_PRELOAD=$asan_runtime" "ASAN_OPTIONS=fast_unwind_on_malloc=1")
+              ;;
+            esac
             pushd examples
             mkdir build
-            cmake -B build
+            cmake "${example_link_flags[@]}" -B build
             cmake --build build/ -j $(nproc)
             rm /usr/lib/x86_64-linux-gnu/libstdc++.so.6
             ln -s /opt/vesoft/toolset/clang/10.0.0/lib64/libstdc++.so /usr/lib/x86_64-linux-gnu/libstdc++.so.6
-            LD_LIBRARY_PATH=/usr/local/nebula/lib64:/usr/local/nebula/lib:$LD_LIBRARY_PATH ./build/session_example graphd:9669
-            LD_LIBRARY_PATH=/usr/local/nebula/lib64:/usr/local/nebula/lib:$LD_LIBRARY_PATH ./build/session_pool_example graphd:9669
+            "${example_env[@]}" ./build/session_example graphd:9669
+            "${example_env[@]}" ./build/session_pool_example graphd:9669
             popd
             ;;
           esac
@@ -202,6 +216,23 @@ jobs:
       options: --mount type=tmpfs,destination=/tmp/ccache/nebula-graph,tmpfs-size=1073741824 --cap-add=SYS_PTRACE
     steps:
       - uses: actions/checkout@v4
+      - name: Generate SSL test certificates
+        run: |
+          printf 'vesoft' > certs/test.ca.password
+          openssl genrsa -aes256 -passout file:certs/test.ca.password -out certs/test.ca.key 2048
+          openssl req -x509 -new -sha256 -days 3650 \
+            -key certs/test.ca.key -passin file:certs/test.ca.password \
+            -subj '/CN=Nebula Test CA' -out certs/test.ca.pem
+          openssl genrsa -out certs/test.derive.key 2048
+          openssl req -new -key certs/test.derive.key \
+            -subj '/CN=Nebula Test Server' -out certs/test.derive.csr
+          openssl x509 -req -sha256 -days 3650 -in certs/test.derive.csr \
+            -CA certs/test.ca.pem -CAkey certs/test.ca.key \
+            -passin file:certs/test.ca.password -CAcreateserial \
+            -out certs/test.derive.crt
+          openssl req -x509 -newkey rsa:2048 -nodes -sha256 -days 3650 \
+            -keyout certs/test.2.key -subj '/CN=Nebula Untrusted Test CA' \
+            -out certs/test.2.crt
       - name: CMake
         run: |
           case ${{ matrix.compiler }} in
@@ -324,6 +355,23 @@ jobs:
       options: --mount type=tmpfs,destination=/tmp/ccache/nebula-graph,tmpfs-size=1073741824 --cap-add=SYS_PTRACE
     steps:
       - uses: actions/checkout@v4
+      - name: Generate SSL test certificates
+        run: |
+          printf 'vesoft' > certs/test.ca.password
+          openssl genrsa -aes256 -passout file:certs/test.ca.password -out certs/test.ca.key 2048
+          openssl req -x509 -new -sha256 -days 3650 \
+            -key certs/test.ca.key -passin file:certs/test.ca.password \
+            -subj '/CN=Nebula Test CA' -out certs/test.ca.pem
+          openssl genrsa -out certs/test.derive.key 2048
+          openssl req -new -key certs/test.derive.key \
+            -subj '/CN=Nebula Test Server' -out certs/test.derive.csr
+          openssl x509 -req -sha256 -days 3650 -in certs/test.derive.csr \
+            -CA certs/test.ca.pem -CAkey certs/test.ca.key \
+            -passin file:certs/test.ca.password -CAcreateserial \
+            -out certs/test.derive.crt
+          openssl req -x509 -newkey rsa:2048 -nodes -sha256 -days 3650 \
+            -keyout certs/test.2.key -subj '/CN=Nebula Untrusted Test CA' \
+            -out certs/test.2.crt
       - name: CMake
         run: |
           case ${{ matrix.compiler }} in
diff --git a/cmake/nebula/GeneralCompilerConfig.cmake b/cmake/nebula/GeneralCompilerConfig.cmake
index a914a49a..461f693c 100644
--- a/cmake/nebula/GeneralCompilerConfig.cmake
+++ b/cmake/nebula/GeneralCompilerConfig.cmake
@@ -83,10 +83,10 @@ if("${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang")
     add_compile_options(-Wno-self-move)
     add_compile_options(-Wno-format-pedantic)
     add_compile_options(-Wno-gnu-zero-variadic-macro-arguments)
-    set(libatomic_link_flags "-Wl,-Bstatic -latomic -Wl,-Bdynamic")
-    set(CMAKE_REQUIRED_FLAGS "${libatomic_link_flags}")
-    check_cxx_compiler_flag("${libatomic_link_flags}" has_static_libatomic)
-    if(NOT has_static_libatomic)
-        set(libatomic_link_flags "-latomic")
+    # The toolchain's static libatomic may contain non-PIC code.
+    find_library(NEBULA_LIBATOMIC_LIBRARY NAMES libatomic.so.1)
+    if(NOT NEBULA_LIBATOMIC_LIBRARY)
+        message(FATAL_ERROR "Clang requires shared libatomic (libatomic.so.1)")
     endif()
+    set(libatomic_link_flags "${NEBULA_LIBATOMIC_LIBRARY}")
 endif()
diff --git a/cmake/nebula/SanitizerConfig.cmake b/cmake/nebula/SanitizerConfig.cmake
index 28b5d500..0b4b5d74 100644
--- a/cmake/nebula/SanitizerConfig.cmake
+++ b/cmake/nebula/SanitizerConfig.cmake
@@ -16,6 +16,10 @@ if(ENABLE_ASAN)
     add_compile_options(-g)
     add_compile_options(-fno-omit-frame-pointer)
     set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fsanitize=address")
+    if("${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang")
+        set(CMAKE_SHARED_LINKER_FLAGS
+            "${CMAKE_SHARED_LINKER_FLAGS} -fsanitize=address -shared-libasan")
+    endif()
 endif()
 
 if(ENABLE_TSAN)
diff --git a/examples/SessionPoolExample.cpp b/examples/SessionPoolExample.cpp
index a575687d..7c5d9fd4 100644
--- a/examples/SessionPoolExample.cpp
+++ b/examples/SessionPoolExample.cpp
@@ -25,6 +25,19 @@ int main(int argc, char* argv[]) {
     auto resp = session.execute(
         "CREATE SPACE IF NOT EXISTS session_pool_test(vid_type = FIXED_STRING(16));");
     assert(resp.errorCode == nebula::ErrorCode::SUCCEEDED);
+
+    // Wait for the new space to reach graphd before initializing the session pool.
+    for (int attempt = 0; attempt < 60; ++attempt) {
+      resp = session.execute("USE session_pool_test");
+      if (resp.errorCode == nebula::ErrorCode::SUCCEEDED) {
+        break;
+      }
+      std::this_thread::sleep_for(std::chrono::seconds(1));
+    }
+    if (resp.errorCode != nebula::ErrorCode::SUCCEEDED) {
+      std::cerr << "Space session_pool_test is not ready: " << *resp.errorMsg << std::endl;
+      return 1;
+    }
   }
 
   nebula::SessionPoolConfig config;
diff --git a/include/nebula/client/Session.h b/include/nebula/client/Session.h
index ad190534..b483b9d5 100644
--- a/include/nebula/client/Session.h
+++ b/include/nebula/client/Session.h
@@ -94,7 +94,7 @@ class Session {
   void release();
 
   bool valid() const {
-    return sessionId_ > 0;
+    return sessionId_ != -1;
   }
 
   const std::string &timeZoneName() const {
diff --git a/src/client/tests/ConnectionTest.cpp b/src/client/tests/ConnectionTest.cpp
index b243afdd..66d24aa0 100644
--- a/src/client/tests/ConnectionTest.cpp
+++ b/src/client/tests/ConnectionTest.cpp
@@ -155,7 +155,8 @@ TEST_F(ConnectionTest, Timeout) {
       c.execute(*authResp.sessionId,
                 "SHOW QUERIES "
                 "| YIELD $-.SessionID AS sid, $-.ExecutionPlanID AS eid, $-.DurationInUSec AS dur "
-                "WHERE $-.DurationInUSec > 1000000 AND $-.`Query` CONTAINS 'GO' "
+                "WHERE $-.DurationInUSec > 1000000 "
+                "AND $-.`Query` STARTS WITH 'use conn_test;GO 100000 STEPS' "
                 "| ORDER BY $-.dur "
                 "| KILL QUERY(session=$-.sid, plan=$-.eid)");
   ASSERT_EQ(resp.errorCode, nebula::ErrorCode::SUCCEEDED);
diff --git a/src/client/tests/SessionTest.cpp b/src/client/tests/SessionTest.cpp
index 27edb055..e2e3ee3d 100644
--- a/src/client/tests/SessionTest.cpp
+++ b/src/client/tests/SessionTest.cpp
@@ -217,7 +217,8 @@ TEST_F(SessionTest, Timeout) {
   resp = session.execute(
       "SHOW QUERIES "
       "| YIELD $-.SessionID AS sid, $-.ExecutionPlanID AS eid, $-.DurationInUSec AS dur "
-      "WHERE $-.DurationInUSec > 1000000 AND $-.`Query` CONTAINS 'GO' "
+      "WHERE $-.DurationInUSec > 1000000 "
+      "AND $-.`Query` STARTS WITH 'use session_test;GO 100000 STEPS' "
       "| ORDER BY $-.dur "
       "| KILL QUERY(session=$-.sid, plan=$-.eid)");
   ASSERT_EQ(resp.errorCode, nebula::ErrorCode::SUCCEEDED);