diff --git a/.github/workflows/run_test_cases.yaml b/.github/workflows/run_test_cases.yaml
index aeb83b3a4..72fe741e2 100644
--- a/.github/workflows/run_test_cases.yaml
+++ b/.github/workflows/run_test_cases.yaml
@@ -5,6 +5,8 @@ on:
     tags:
       - v*
       - e*
+    branches:
+      - 'main-v4.?'
   pull_request:
 
 jobs:
@@ -26,6 +28,7 @@ jobs:
     run_common_test:
         runs-on: ${{ matrix.runs-on }}
         strategy:
+          fail-fast: false
           matrix:
             runs-on:
               - aws-amd64
@@ -110,6 +113,7 @@ jobs:
         - name: run cover
           run: |
             printenv > .env
+            docker exec -i erlang bash -c "git config --global --add safe.directory /emqx"
             docker exec -i erlang bash -c "make cover"
             docker exec --env-file .env -i erlang bash -c "make coveralls"
         - name: cat rebar.crashdump
diff --git a/CHANGES-4.3.md b/CHANGES-4.3.md
index 8ef71ba7f..eff05f283 100644
--- a/CHANGES-4.3.md
+++ b/CHANGES-4.3.md
@@ -9,6 +9,12 @@ File format:
 - Use weight-2 heading for releases
 - One list item per change topic
   Change log ends with a list of GitHub PRs
+## v4.3.21
+
+### Enhancements
+
+- TLS listener memory usage optimization
+  new option 'hibernate_after' to hibernate TLS process after idling
 
 ## v4.3.20
 
diff --git a/etc/emqx.conf b/etc/emqx.conf
index 850d85723..dceee5321 100644
--- a/etc/emqx.conf
+++ b/etc/emqx.conf
@@ -1656,6 +1656,12 @@ listener.ssl.external.reuseaddr = true
 ## Value: true | false
 ## listener.ssl.external.gc_after_handshake = false
 
+## hibernate the SSL process after idling for amount of time
+## Default: undefined (off)
+##
+## Value: Duration
+## listener.ssl.external.hibernate_after = 5s
+
 ##--------------------------------------------------------------------
 ## External WebSocket listener for MQTT protocol
 
diff --git a/priv/emqx.schema b/priv/emqx.schema
index d2daf3c6b..865dc7bec 100644
--- a/priv/emqx.schema
+++ b/priv/emqx.schema
@@ -1646,6 +1646,11 @@ end}.
   {datatype, {enum, [true, false]}}
 ]}.
 
+{mapping, "listener.ssl.$name.hibernate_after", "emqx.listeners", [
+  {default, undefined},
+  {datatype, {duration, ms}}
+]}.
+
 %%--------------------------------------------------------------------
 %% MQTT/WebSocket Listeners
 
@@ -2269,7 +2274,8 @@ end}.
                           {reuse_sessions, cuttlefish:conf_get(Prefix ++ ".reuse_sessions", Conf, undefined)},
                           {honor_cipher_order, cuttlefish:conf_get(Prefix ++ ".honor_cipher_order", Conf, undefined)},
                           {log_level, cuttlefish:conf_get(Prefix ++ ".log_level", Conf, undefined)},
-                          {gc_after_handshake, cuttlefish:conf_get(Prefix ++ ".gc_after_handshake", Conf, undefined)}
+                          {gc_after_handshake, cuttlefish:conf_get(Prefix ++ ".gc_after_handshake", Conf, undefined)},
+                          {hibernate_after, cuttlefish:conf_get(Prefix ++ ".hibernate_after", Conf, undefined)}
                          ])
               end,
 
diff --git a/rebar.config.erl b/rebar.config.erl
index b0f52b03c..d1e5494eb 100644
--- a/rebar.config.erl
+++ b/rebar.config.erl
@@ -103,7 +103,7 @@ plugins(HasElixir) ->
 
 test_plugins() ->
     [ rebar3_proper,
-      {coveralls, {git, "https://github.com/emqx/coveralls-erl", {branch, "fix-git-info"}}}
+      {coveralls, {git, "https://github.com/emqx/coveralls-erl", {tag, "v2.2.0-emqx-1"}}}
     ].
 
 test_deps() ->