diff --git a/.gitmodules b/.gitmodules
index e4cb41806e9..132b443afd6 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -39,6 +39,12 @@
 [submodule "contrib/tiflash-proxy-next-gen"]
 	path = contrib/tiflash-proxy-next-gen
 	url = git@github.com:tidbcloud/cloud-storage-engine.git
+# cloud-storage-engine is a private repo. It is added as a submodule in TiFlash to bypass image 
+# release issues for tiflash-columnar-hub. This avoids private repo cloning in the internal CD pipeline.
+[submodule "contrib/cloud-storage-engine"]
+	path = contrib/cloud-storage-engine
+	url = git@github.com:tidbcloud/cloud-storage-engine.git
+	branch = cloud-engine
 [submodule "contrib/prometheus-cpp"]
 	path = contrib/prometheus-cpp
 	url = https://github.com/jupp0r/prometheus-cpp.git
diff --git a/contrib/cloud-storage-engine b/contrib/cloud-storage-engine
new file mode 160000
index 00000000000..a9d93252f2a
--- /dev/null
+++ b/contrib/cloud-storage-engine
@@ -0,0 +1 @@
+Subproject commit a9d93252f2ad0cba95eec51a857cd867cd5e6567
diff --git a/contrib/tiflash-columnar-hub/Cargo.lock b/contrib/tiflash-columnar-hub/Cargo.lock
index 7016b63954f..5efa22564b4 100644
--- a/contrib/tiflash-columnar-hub/Cargo.lock
+++ b/contrib/tiflash-columnar-hub/Cargo.lock
@@ -63,7 +63,6 @@ dependencies = [
 [[package]]
 name = "aliyun"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "async-trait",
  "aws",
@@ -167,7 +166,6 @@ checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 [[package]]
 name = "api_version"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "bitflags 1.3.2",
  "bytes",
@@ -361,7 +359,6 @@ dependencies = [
 [[package]]
 name = "aws"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "async-trait",
  "aws-config",
@@ -1112,7 +1109,6 @@ dependencies = [
 [[package]]
 name = "builtin_dfs"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "api_version",
  "async-trait",
@@ -1183,7 +1179,6 @@ dependencies = [
 [[package]]
 name = "case_macros"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "workspace-hack",
 ]
@@ -1342,11 +1337,28 @@ dependencies = [
  "atty",
  "bitflags 1.3.2",
  "strsim 0.8.0",
- "textwrap",
+ "textwrap 0.11.0",
  "unicode-width",
  "vec_map",
 ]
 
+[[package]]
+name = "clap"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
+dependencies = [
+ "atty",
+ "bitflags 1.3.2",
+ "clap_derive 3.2.25",
+ "clap_lex 0.2.4",
+ "indexmap 1.9.3",
+ "once_cell",
+ "strsim 0.10.0",
+ "termcolor",
+ "textwrap 0.16.2",
+]
+
 [[package]]
 name = "clap"
 version = "4.6.1"
@@ -1354,7 +1366,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
 dependencies = [
  "clap_builder",
- "clap_derive",
+ "clap_derive 4.6.1",
 ]
 
 [[package]]
@@ -1365,10 +1377,23 @@ checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
 dependencies = [
  "anstream",
  "anstyle",
- "clap_lex",
+ "clap_lex 1.1.0",
  "strsim 0.11.1",
 ]
 
+[[package]]
+name = "clap_derive"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae6371b8bdc8b7d3959e9cf7b22d4435ef3e79e138688421ec654acf8c81b008"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "clap_derive"
 version = "4.6.1"
@@ -1381,6 +1406,15 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
 [[package]]
 name = "clap_lex"
 version = "1.1.0"
@@ -1390,7 +1424,6 @@ checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 [[package]]
 name = "clara_fts"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "anyhow",
  "charabia",
@@ -1411,7 +1444,6 @@ dependencies = [
 [[package]]
 name = "cloud"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "async-trait",
  "derive_more",
@@ -1431,7 +1463,6 @@ dependencies = [
 [[package]]
 name = "cloud_encryption"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "aliyun",
  "aws",
@@ -1476,7 +1507,6 @@ dependencies = [
 [[package]]
 name = "codec"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "byteorder",
  "error_code",
@@ -1501,7 +1531,6 @@ dependencies = [
 [[package]]
 name = "collections"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "fxhash",
  "tikv_alloc",
@@ -2097,7 +2126,6 @@ dependencies = [
 [[package]]
 name = "encryption"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "async-trait",
  "byteorder",
@@ -2133,7 +2161,6 @@ dependencies = [
 [[package]]
 name = "engine_traits"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "bytes",
  "case_macros",
@@ -2236,7 +2263,6 @@ dependencies = [
 [[package]]
 name = "error_code"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "grpcio",
  "kvproto",
@@ -2350,7 +2376,6 @@ checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 [[package]]
 name = "file_system"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "collections",
  "crc32fast",
@@ -2417,6 +2442,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
+ "libz-sys",
  "miniz_oxide",
 ]
 
@@ -2879,6 +2905,15 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -3463,7 +3498,6 @@ dependencies = [
 [[package]]
 name = "keys"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "byteorder",
  "kvproto",
@@ -3477,7 +3511,6 @@ dependencies = [
 [[package]]
 name = "kvengine"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "aligned-vec",
  "aliyun",
@@ -3585,7 +3618,6 @@ dependencies = [
 [[package]]
 name = "kvenginepb"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "protobuf 2.8.0",
  "protobuf-codegen-pure",
@@ -3595,7 +3627,7 @@ dependencies = [
 [[package]]
 name = "kvproto"
 version = "0.0.2"
-source = "git+ssh://git@github.com/pingcap/kvproto.git?rev=02dc8a9dc01827367f9d91ff2d88c447d3a838ab#02dc8a9dc01827367f9d91ff2d88c447d3a838ab"
+source = "git+https://github.com/pingcap/kvproto.git#1e6ff1c80df24a9ead2b4408133af23c09273718"
 dependencies = [
  "bytes",
  "futures 0.3.32",
@@ -3610,6 +3642,9 @@ name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin 0.9.8",
+]
 
 [[package]]
 name = "lazycell"
@@ -3884,7 +3919,6 @@ checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 [[package]]
 name = "log_wrappers"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "hex 0.4.3",
  "protobuf 2.8.0",
@@ -4088,6 +4122,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "multimap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5ce46fe64a9d73be07dcbe690a38ce1b293be448fd8ce1e6c1b8062c9f72c6a"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "multimap"
 version = "0.10.1"
@@ -4386,7 +4429,6 @@ checksum = "269bca4c2591a28585d6bf10d9ed0332b7d76900a1b02bec41bdc3a2cdcda107"
 [[package]]
 name = "online_config"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "online_config_derive",
  "serde",
@@ -4396,7 +4438,6 @@ dependencies = [
 [[package]]
 name = "online_config_derive"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4487,6 +4528,12 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "os_str_bytes"
+version = "6.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
+
 [[package]]
 name = "outref"
 version = "0.5.2"
@@ -4593,7 +4640,6 @@ checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 [[package]]
 name = "pd_client"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "async-trait",
  "bstr",
@@ -4779,7 +4825,7 @@ dependencies = [
  "protobuf 3.7.2",
  "protobuf-codegen 3.7.2",
  "smallvec",
- "spin",
+ "spin 0.10.0",
  "symbolic-demangle",
  "tempfile",
  "thiserror 2.0.18",
@@ -4937,6 +4983,16 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "prost"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b82eaa1d779e9a4bc1c3217db8ffbeabaae1dca241bf70183242128d48681cd"
+dependencies = [
+ "bytes",
+ "prost-derive 0.11.9",
+]
+
 [[package]]
 name = "prost"
 version = "0.12.6"
@@ -4976,7 +5032,7 @@ dependencies = [
  "heck 0.5.0",
  "itertools 0.14.0",
  "log",
- "multimap",
+ "multimap 0.10.1",
  "once_cell",
  "petgraph",
  "prettyplease",
@@ -4987,6 +5043,19 @@ dependencies = [
  "tempfile",
 ]
 
+[[package]]
+name = "prost-derive"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d2d8d10f3c6ded6da8b05b5fb3b8a5082514344d56c9f871412d29b4e075b4"
+dependencies = [
+ "anyhow",
+ "itertools 0.10.5",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "prost-derive"
 version = "0.12.6"
@@ -5414,7 +5483,6 @@ dependencies = [
 [[package]]
 name = "recovery"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "dashmap 6.2.1",
  "http 0.2.12",
@@ -5467,7 +5535,7 @@ dependencies = [
  "aho-corasick",
  "memchr",
  "regex-automata 0.4.14",
- "regex-syntax",
+ "regex-syntax 0.8.10",
 ]
 
 [[package]]
@@ -5475,6 +5543,9 @@ name = "regex-automata"
 version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+dependencies = [
+ "regex-syntax 0.6.29",
+]
 
 [[package]]
 name = "regex-automata"
@@ -5484,7 +5555,7 @@ checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax",
+ "regex-syntax 0.8.10",
 ]
 
 [[package]]
@@ -5493,6 +5564,12 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
 
+[[package]]
+name = "regex-syntax"
+version = "0.6.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+
 [[package]]
 name = "regex-syntax"
 version = "0.8.10"
@@ -5915,7 +5992,6 @@ dependencies = [
 [[package]]
 name = "schema"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "api_version",
  "async-trait",
@@ -5964,7 +6040,6 @@ dependencies = [
 [[package]]
 name = "security"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "aliyun",
  "aws",
@@ -6404,6 +6479,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
 [[package]]
 name = "spin"
 version = "0.10.0"
@@ -6437,6 +6518,12 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
 
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -6675,7 +6762,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d60769b80ad7953d8a7b2c70cdfe722bbcdcac6bccc8ac934c40c034d866fc18"
 dependencies = [
  "byteorder",
- "regex-syntax",
+ "regex-syntax 0.8.10",
  "utf8-ranges",
 ]
 
@@ -6743,7 +6830,6 @@ dependencies = [
 [[package]]
 name = "tencentcloud"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "async-trait",
  "aws",
@@ -6790,6 +6876,12 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "textwrap"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c13547615a44dc9c452a8a534638acdf07120d4b6847c8178705da06306a3057"
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -6842,7 +6934,6 @@ dependencies = [
 [[package]]
 name = "tidb_query_common"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "anyhow",
  "api_version",
@@ -6870,7 +6961,6 @@ dependencies = [
 [[package]]
 name = "tidb_query_datatype"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "api_version",
  "base64 0.13.1",
@@ -6983,10 +7073,40 @@ dependencies = [
  "tonic",
 ]
 
+[[package]]
+name = "tikv-jemalloc-ctl"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "661f1f6a57b3a36dc9174a2c10f19513b4866816e13425d3e418b11cc37bc24c"
+dependencies = [
+ "libc",
+ "paste",
+ "tikv-jemalloc-sys",
+]
+
+[[package]]
+name = "tikv-jemalloc-sys"
+version = "0.6.1+5.3.0-1-ge13ca993e8ccb9ba9847cc330696e02839f328f7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd8aa5b2ab86a2cefa406d889139c162cbb230092f7d1d7cbc1716405d852a3b"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "tikv-jemallocator"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0359b4327f954e0567e69fb191cf1436617748813819c94b8cd4a431422d053a"
+dependencies = [
+ "libc",
+ "tikv-jemalloc-sys",
+]
+
 [[package]]
 name = "tikv_alloc"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "fxhash",
  "lazy_static",
@@ -6997,7 +7117,6 @@ dependencies = [
 [[package]]
 name = "tikv_util"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "async-speed-limit",
  "backtrace",
@@ -7122,7 +7241,7 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 [[package]]
 name = "tipb"
 version = "0.0.1"
-source = "git+ssh://git@github.com/pingcap/tipb.git?rev=9fd33ded6f2c94633e601104cde26f2bdb5147d5#9fd33ded6f2c94633e601104cde26f2bdb5147d5"
+source = "git+https://github.com/pingcap/tipb.git#a4d204a193b4f9aa776343ac75281cf8442343ba"
 dependencies = [
  "futures 0.3.32",
  "grpcio",
@@ -7233,6 +7352,7 @@ dependencies = [
  "futures-io",
  "futures-sink",
  "pin-project-lite",
+ "slab",
  "tokio",
  "tracing",
 ]
@@ -7312,7 +7432,6 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 [[package]]
 name = "trace_event"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "arc-swap 1.9.1",
  "bitflags 1.3.2",
@@ -7331,6 +7450,7 @@ version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -7402,7 +7522,6 @@ dependencies = [
 [[package]]
 name = "tracker"
 version = "0.0.1"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "collections",
  "crossbeam-utils",
@@ -7426,7 +7545,6 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 [[package]]
 name = "txn_types"
 version = "0.1.0"
-source = "git+https://github.com/tidbcloud/cloud-storage-engine.git?branch=cloud-engine#a9d93252f2ad0cba95eec51a857cd867cd5e6567"
 dependencies = [
  "bitflags 1.3.2",
  "byteorder",
@@ -8256,6 +8374,90 @@ dependencies = [
 [[package]]
 name = "workspace-hack"
 version = "0.1.0"
+dependencies = [
+ "ahash",
+ "aho-corasick",
+ "base64 0.21.7",
+ "bytes",
+ "cc",
+ "chrono",
+ "clap 2.34.0",
+ "clap 3.2.25",
+ "crossbeam-queue",
+ "crossbeam-utils",
+ "data-encoding",
+ "deranged",
+ "digest 0.10.7",
+ "either",
+ "flate2",
+ "futures 0.3.32",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+ "grpcio",
+ "grpcio-sys",
+ "hashbrown 0.14.5",
+ "hashbrown 0.15.5",
+ "heck 0.4.1",
+ "indexmap 1.9.3",
+ "indexmap 2.14.0",
+ "instant",
+ "itertools 0.10.5",
+ "lazy_static",
+ "libc",
+ "lindera-dictionary",
+ "log",
+ "memchr",
+ "multimap 0.8.3",
+ "nom 7.1.3",
+ "num 0.4.3",
+ "num-integer",
+ "num-iter",
+ "num-rational 0.4.2",
+ "num-traits",
+ "once_cell",
+ "openssl",
+ "phf_shared",
+ "proc-macro2",
+ "prost 0.11.9",
+ "protobuf 2.8.0",
+ "protobuf-build",
+ "rand 0.8.6",
+ "rand_core 0.6.4",
+ "regex",
+ "regex-automata 0.1.10",
+ "regex-automata 0.4.14",
+ "regex-syntax 0.8.10",
+ "reqwest 0.11.27",
+ "rustls",
+ "serde",
+ "serde_json",
+ "slog",
+ "smallvec",
+ "strum 0.27.2",
+ "syn 1.0.109",
+ "syn 2.0.117",
+ "tikv-jemalloc-ctl",
+ "tikv-jemalloc-sys",
+ "tikv-jemallocator",
+ "time 0.3.41",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tokio-util",
+ "tower",
+ "tracing",
+ "tracing-core",
+ "unicode-bidi",
+ "unicode-normalization",
+ "url",
+ "uuid 1.23.1",
+ "zstd-sys",
+]
 
 [[package]]
 name = "xattr"
@@ -8378,3 +8580,7 @@ dependencies = [
  "cc",
  "pkg-config",
 ]
+
+[[patch.unused]]
+name = "workspace-hack"
+version = "0.1.0"
diff --git a/contrib/tiflash-columnar-hub/Cargo.toml b/contrib/tiflash-columnar-hub/Cargo.toml
index a39f2b03f17..c3a3f52b48e 100644
--- a/contrib/tiflash-columnar-hub/Cargo.toml
+++ b/contrib/tiflash-columnar-hub/Cargo.toml
@@ -24,23 +24,21 @@ tokio-executor = { git = "https://github.com/tikv/tokio", branch = "tokio-timer-
 lindera = { git = "https://github.com/breezewish/lindera", branch = "v0.43.1-tokio-1.24" }
 tantivy = { git = "https://github.com/breezewish/tikv-tantivy.git", branch = "patch-0.22.1" }
 pprof = { git = "https://github.com/tikv/pprof-rs.git", rev = "01cff82dbe6fe110a707bf2b38d8ebb1d14a18f8" }
+kvproto = { git = "https://github.com/pingcap/kvproto.git" }
+tipb = { git = "https://github.com/pingcap/tipb.git" }
 
-[patch."https://github.com/pingcap/kvproto.git"]
-kvproto = { git = "ssh://git@github.com/pingcap/kvproto.git", rev = "02dc8a9dc01827367f9d91ff2d88c447d3a838ab" }
-
-[patch."https://github.com/pingcap/tipb.git"]
-tipb = { git = "ssh://git@github.com/pingcap/tipb.git", rev = "9fd33ded6f2c94633e601104cde26f2bdb5147d5" }
-
+# cloud-storage-engine now is private. We add it as a submodule to workaround
+# image release issue for building tiflash-columnar-hub in internal CD pipeline.
 [patch."https://github.com/tidbcloud/cloud-storage-engine.git"]
-#api_version = { path = "../../../cloud-storage-engine/components/api_version" }
-#builtin_dfs = { path = "../../../cloud-storage-engine/components/builtin_dfs" }
-#cloud_encryption = { path = "../../../cloud-storage-engine/components/cloud_encryption" }
-#keys = { path = "../../../cloud-storage-engine/components/keys" }
-#kvengine = { path = "../../../cloud-storage-engine/components/kvengine" }
-#kvenginepb = { path = "../../../cloud-storage-engine/components/kvenginepb" }
-#pd_client = { path = "../../../cloud-storage-engine/components/pd_client" }
-#security = { path = "../../../cloud-storage-engine/components/security" }
-#tikv_util = { path = "../../../cloud-storage-engine/components/tikv_util" }
+api_version = { path = "../cloud-storage-engine/components/api_version" }
+builtin_dfs = { path = "../cloud-storage-engine/components/builtin_dfs" }
+cloud_encryption = { path = "../cloud-storage-engine/components/cloud_encryption" }
+keys = { path = "../cloud-storage-engine/components/keys" }
+kvengine = { path = "../cloud-storage-engine/components/kvengine" }
+kvenginepb = { path = "../cloud-storage-engine/components/kvenginepb" }
+pd_client = { path = "../cloud-storage-engine/components/pd_client" }
+security = { path = "../cloud-storage-engine/components/security" }
+tikv_util = { path = "../cloud-storage-engine/components/tikv_util" }
 
 # cloud-storage-engine's generated workspace-hack currently forces
 # tikv-jemalloc-* into every consumer. That is fine for standalone
diff --git a/contrib/tiflash-columnar-hub/hub-runtime/Cargo.toml b/contrib/tiflash-columnar-hub/hub-runtime/Cargo.toml
index 4ab6344f085..3a569c4777f 100644
--- a/contrib/tiflash-columnar-hub/hub-runtime/Cargo.toml
+++ b/contrib/tiflash-columnar-hub/hub-runtime/Cargo.toml
@@ -29,7 +29,7 @@ hyper = { version = "0.14.26", features = ["full", "runtime"] }
 keys = { workspace = true }
 kvengine = { workspace = true }
 kvenginepb = { workspace = true }
-kvproto = { git = "ssh://git@github.com/pingcap/kvproto.git", rev = "02dc8a9dc01827367f9d91ff2d88c447d3a838ab" }
+kvproto = { git = "https://github.com/pingcap/kvproto.git" }
 lazy_static = "1.5.0"
 num_cpus = "1"
 pd_client = { workspace = true }
@@ -47,7 +47,7 @@ slog-global = { git = "https://github.com/breeswish/slog-global.git", rev = "d59
 tempfile = "3"
 thiserror = "1.0.44"
 tikv_util = { workspace = true }
-tipb = { git = "ssh://git@github.com/pingcap/tipb.git", rev = "9fd33ded6f2c94633e601104cde26f2bdb5147d5" }
+tipb = { git = "https://github.com/pingcap/tipb.git" }
 tokio = { version = "=1.26.0", features = ["fs", "full", "macros", "net", "process", "rt", "rt-multi-thread", "sync", "time"], default-features = true }
 # Keep tokio-executor aligned with the tokio-timer hotfix used by tikv_util.
 tokio-executor = "=0.1.9"
diff --git a/contrib/tiflash-columnar-hub/hub-runtime/src/profile.rs b/contrib/tiflash-columnar-hub/hub-runtime/src/profile.rs
index 82a3fff68fb..80087d444ec 100644
--- a/contrib/tiflash-columnar-hub/hub-runtime/src/profile.rs
+++ b/contrib/tiflash-columnar-hub/hub-runtime/src/profile.rs
@@ -12,11 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use std::pin::Pin;
+#[cfg(feature = "external-jemalloc")]
 use std::{
     ffi::{c_char, c_int, c_void, CString},
     fs::File,
     io::BufReader,
-    pin::Pin,
 };
 
 use futures::{
diff --git a/release-linux-llvm/scripts/build-tiflash-release.sh b/release-linux-llvm/scripts/build-tiflash-release.sh
index 65dd2b6d4e1..0e23095b225 100755
--- a/release-linux-llvm/scripts/build-tiflash-release.sh
+++ b/release-linux-llvm/scripts/build-tiflash-release.sh
@@ -60,55 +60,13 @@ SRCPATH=$(
 NPROC=${NPROC:-$(nproc || grep -c ^processor /proc/cpuinfo)}
 ENABLE_THINLTO=${ENABLE_THINLTO:-ON}
 ENABLE_PCH=${ENABLE_PCH:-ON}
-
-INSTALL_DIR="${SRCPATH}/release-linux-llvm/tiflash"
-rm -rf ${INSTALL_DIR} && mkdir -p ${INSTALL_DIR}
-
 if [ $CMAKE_BUILD_TYPE == "RELWITHDEBINFO" ]; then
-  BUILD_DIR="${SRCPATH}/release-linux-llvm/build-release"
   ENABLE_FAILPOINTS="OFF"
   JEMALLOC_NARENAS="-1"
 else
-  BUILD_DIR="${SRCPATH}/release-linux-llvm/build-debug"
   ENABLE_FAILPOINTS="ON"
   JEMALLOC_NARENAS="40"
 fi
-rm -rf ${BUILD_DIR} && mkdir -p ${BUILD_DIR}
-cd ${BUILD_DIR}
-
-cmake -S "${SRCPATH}" \
-  ${DEFINE_CMAKE_PREFIX_PATH} \
-  -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE} \
-  -DENABLE_TESTING=OFF \
-  -DENABLE_TESTS=${ENABLE_TESTS} \
-  -DENABLE_FAILPOINTS=${ENABLE_FAILPOINTS} \
-  -DENABLE_NEXT_GEN=${CMAKE_ENABLE_NEXT_GEN} \
-  -DJEMALLOC_NARENAS=${JEMALLOC_NARENAS} \
-  -Wno-dev \
-  -DUSE_CCACHE=OFF \
-  -DUSE_INTERNAL_SSL_LIBRARY=ON \
-  -DRUN_HAVE_STD_REGEX=0 \
-  -DENABLE_THINLTO=${ENABLE_THINLTO} \
-  -DTHINLTO_JOBS=${NPROC} \
-  -DENABLE_PCH=${ENABLE_PCH} \
-  -GNinja
-
-if [ $CMAKE_BUILD_TYPE == "TSAN" ] || [ $CMAKE_BUILD_TYPE == "ASAN" ]; then
-  cmake --build . --target gtests_dbms gtests_libcommon --parallel ${NPROC}
-  cmake --build . --target tiflash --parallel ${NPROC}
-  cmake --install . --component=tiflash-release --prefix="${INSTALL_DIR}"
-else
-  cmake --build . --target tiflash --parallel ${NPROC}
-  cmake --install . --component=tiflash-release --prefix="${INSTALL_DIR}"
-  
-  # unset LD_LIBRARY_PATH before test
-  unset LD_LIBRARY_PATH
-  readelf -d "${INSTALL_DIR}/tiflash"
-  ldd "${INSTALL_DIR}/tiflash"
-  
-  # show version
-  ${INSTALL_DIR}/tiflash version
-fi
 
 # If CMAKE_ENABLE_NEXT_GEN is enabled, build another binary with next-gen columnar features enabled and install to a different directory to avoid conflict with the non-columnar binary.
 if [ "${CMAKE_ENABLE_NEXT_GEN}" = "ON" ]; then
@@ -117,7 +75,6 @@ if [ "${CMAKE_ENABLE_NEXT_GEN}" = "ON" ]; then
 
   # workaround compile issue of cloud-storage-engine dependency
   export CARGO_NET_GIT_FETCH_WITH_CLI=true
-  git config --global url."git@github.com:".insteadOf "https://github.com/"
 
   # prepare build dir and install dir for columnar
   if [ $CMAKE_BUILD_TYPE == "RELWITHDEBINFO" ]; then
@@ -161,3 +118,48 @@ if [ "${CMAKE_ENABLE_NEXT_GEN}" = "ON" ]; then
   # show version
   ${INSTALL_DIR}/tiflash version
 fi
+
+INSTALL_DIR="${SRCPATH}/release-linux-llvm/tiflash"
+rm -rf ${INSTALL_DIR} && mkdir -p ${INSTALL_DIR}
+# prepare build_dir
+if [ $CMAKE_BUILD_TYPE == "RELWITHDEBINFO" ]; then
+  BUILD_DIR="${SRCPATH}/release-linux-llvm/build-release"
+else
+  BUILD_DIR="${SRCPATH}/release-linux-llvm/build-debug"
+fi
+rm -rf ${BUILD_DIR} && mkdir -p ${BUILD_DIR}
+cd ${BUILD_DIR}
+
+cmake -S "${SRCPATH}" \
+  ${DEFINE_CMAKE_PREFIX_PATH} \
+  -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE} \
+  -DENABLE_TESTING=OFF \
+  -DENABLE_TESTS=${ENABLE_TESTS} \
+  -DENABLE_FAILPOINTS=${ENABLE_FAILPOINTS} \
+  -DENABLE_NEXT_GEN=${CMAKE_ENABLE_NEXT_GEN} \
+  -DJEMALLOC_NARENAS=${JEMALLOC_NARENAS} \
+  -Wno-dev \
+  -DUSE_CCACHE=OFF \
+  -DUSE_INTERNAL_SSL_LIBRARY=ON \
+  -DRUN_HAVE_STD_REGEX=0 \
+  -DENABLE_THINLTO=${ENABLE_THINLTO} \
+  -DTHINLTO_JOBS=${NPROC} \
+  -DENABLE_PCH=${ENABLE_PCH} \
+  -GNinja
+
+if [ $CMAKE_BUILD_TYPE == "TSAN" ] || [ $CMAKE_BUILD_TYPE == "ASAN" ]; then
+  cmake --build . --target gtests_dbms gtests_libcommon --parallel ${NPROC}
+  cmake --build . --target tiflash --parallel ${NPROC}
+  cmake --install . --component=tiflash-release --prefix="${INSTALL_DIR}"
+else
+  cmake --build . --target tiflash --parallel ${NPROC}
+  cmake --install . --component=tiflash-release --prefix="${INSTALL_DIR}"
+  
+  # unset LD_LIBRARY_PATH before test
+  unset LD_LIBRARY_PATH
+  readelf -d "${INSTALL_DIR}/tiflash"
+  ldd "${INSTALL_DIR}/tiflash"
+  
+  # show version
+  ${INSTALL_DIR}/tiflash version
+fi