diff --git a/.github/workflows/encryption-rotation.yml b/.github/workflows/encryption-rotation.yml
index 686d248b9d..1f8682b893 100644
--- a/.github/workflows/encryption-rotation.yml
+++ b/.github/workflows/encryption-rotation.yml
@@ -65,16 +65,13 @@ jobs:
       - name: Download Go modules
         run: go mod download -x
 
-      - name: Build and install
-        run: make install
-
       - name: Launch containers
         env:
           ENV_UP_FLAGS: "--detach"
         run: make env-up
 
       - name: Run tests
-        run: go test ./...
+        run: make test
 
       - name: Run debug commands on failure
         if: ${{ failure() }}
diff --git a/encryption-rotation/Makefile b/encryption-rotation/Makefile
index 895b51d25a..fbcc7ff546 100644
--- a/encryption-rotation/Makefile
+++ b/encryption-rotation/Makefile
@@ -14,3 +14,11 @@ test:                           ## Run tests
 
 test-cover:                     ## Run tests and collect per-package coverage information
 	go test $(PMM_TEST_FLAGS) -p 1 -race -coverprofile=cover.out -covermode=atomic -coverpkg=$(PMM_TEST_FILES) $(PMM_TEST_FILES)
+
+ifeq ($(PROFILES),)
+PROFILES := 'pmm'
+endif
+
+env-up: 							## Start devcontainer
+	COMPOSE_PROFILES=$(PROFILES) \
+	docker compose up -d --wait
diff --git a/encryption-rotation/docker-compose.yml b/encryption-rotation/docker-compose.yml
new file mode 100644
index 0000000000..b590b81315
--- /dev/null
+++ b/encryption-rotation/docker-compose.yml
@@ -0,0 +1,97 @@
+# version: '3.7' // Deprecated: see https://docs.docker.com/compose/compose-file/04-version-and-name/
+services:
+  pmm-server:
+    profiles:
+      - pmm
+    image: ${PMM_CONTAINER:-perconalab/pmm-server-fb:PR-3645-cbac5a6}
+    platform: linux/amd64
+    # build:
+    #   context: .
+    #   args:
+    #     PMM_SERVER_IMAGE: ${PMM_SERVER_IMAGE:-perconalab/pmm-server:3-dev-latest}
+    #   dockerfile: ./.devcontainer/Dockerfile
+    container_name: pmm-server
+    hostname: pmm-server
+    networks:
+      - ${NETWORK:-default}
+    environment:
+      - AWS_ACCESS_KEY=${AWS_ACCESS_KEY}
+      - AWS_SECRET_KEY=${AWS_SECRET_KEY}
+      - REVIEWDOG_GITHUB_API_TOKEN=${REVIEWDOG_GITHUB_API_TOKEN}
+      - PMM_RELEASE_PATH=/root/go/bin
+      - PMM_ENABLE_ACCESS_CONTROL=${PMM_ENABLE_ACCESS_CONTROL:-0}
+      - PMM_DEV_VERSION_SERVICE_URL=${PMM_DEV_VERSION_SERVICE_URL}
+      - PMM_WATCHTOWER_HOST=${PMM_WATCHTOWER_HOST:-http://watchtower:8080}
+      - PMM_WATCHTOWER_TOKEN=${PMM_WATCHTOWER_TOKEN:-INSECURE_TOKEN}
+      - PMM_RELEASE_VERSION=3.0.0-alpha
+      # - PMM_DEV_VERSION_SERVICE_URL=http://localhost:11000
+      # - PMM_DEV_PERCONA_PLATFORM_PUBLIC_KEY=<public key>
+      # - PMM_DEV_TELEMETRY_INTERVAL=10s
+      # - PMM_DEV_TELEMETRY_DISABLE_START_DELAY=1
+      # - PMM_DEV_TELEMETRY_RETRY_BACKOFF=10s
+      # - PMM_CLICKHOUSE_ADDR=127.0.0.1:9000
+      # - PMM_CLICKHOUSE_DATABASE=pmm
+      # - PMM_DEBUG=1
+      # - PMM_DEV_ADVISOR_CHECKS_FILE=/srv/checks/local-checks.yml
+      # - PMM_POSTGRES_ADDR=pg
+      # - PMM_POSTGRES_DBNAME=pmm-managed
+      # - PMM_POSTGRES_USERNAME=pmm-managed
+      # - PMM_POSTGRES_DBPASSWORD=pmm-managed
+      # - PMM_POSTGRES_SSL_MODE=verify-full
+      # - PMM_POSTGRES_SSL_CA_PATH=/tmp/certs/root.crt
+      # - PMM_POSTGRES_SSL_KEY_PATH=/tmp/certs/pmm-managed.key
+      # - PMM_POSTGRES_SSL_CERT_PATH=/tmp/certs/pmm-managed.crt
+      # - PMM_DISABLE_BUILTIN_POSTGRES=1
+      # - GF_DATABASE_SSL_MODE=verify-full
+      # - GF_DATABASE_CA_CERT_PATH=/tmp/certs/root.crt
+      # - GF_DATABASE_CLIENT_KEY_PATH=/tmp/certs/grafana.key
+      # - GF_DATABASE_CLIENT_CERT_PATH=/tmp/certs/grafana.crt
+
+    extra_hosts:
+      - host.docker.internal:host-gateway
+      # - portal.localhost:${PORTAL_HOST:-host-gateway}
+      # - check.localhost:${PORTAL_CHECK_HOST:-host-gateway}
+      # - pmm.localhost:${PORTAL_PMM_HOST:-host-gateway}
+      # - check-dev.percona.com:${PORTAL_PMM_HOST:-host-gateway}
+
+    # for delve
+    cap_add:
+      - SYS_PTRACE
+    security_opt:
+      - seccomp:unconfined
+
+    # see https://github.com/golang/go/wiki/LinuxKernelSignalVectorBug#what-to-do
+    ulimits:
+      memlock: 67108864
+
+    ports:
+      - ${PMM_PORT_HTTP:-80}:8080
+      - ${PMM_PORT_HTTPS:-443}:8443
+      # For headless delve
+      - ${PMM_PORT_DELVE:-2345}:2345
+      # PG
+      - ${PMM_PORT_PG:-15432}:5432
+      # VM
+      - ${PMM_PORT_VM:-9090}:9090
+      # CH
+      - ${PMM_PORT_CH_TCP:-11000}:9000
+      - ${PMM_PORT_CH_HTTP:-11123}:8123
+    volumes:
+      - ./:/root/go/src/github.com/percona/pmm
+      - ./Makefile.devcontainer:/root/go/src/github.com/percona/pmm/Makefile:ro # substitute Makefile in devcontainer
+      # caching
+      - go-modules:/root/go/pkg/mod
+      - root-cache:/root/.cache
+    # command: >
+    #   bash -c "
+    #     rm -rf /tmp/certs
+    #     mkdir /tmp/certs
+    #     cp -R /root/go/src/github.com/percona/pmm/managed/testdata/pg/certs/* /tmp/certs
+    #     chown grafana:grafana /tmp/certs/*
+    #     chmod 600 /tmp/certs/*
+    #     /opt/entrypoint.sh
+    #   "
+
+volumes:
+  go-modules:
+  root-cache:
\ No newline at end of file