diff --git a/src/core/cm/alerts/alerts.cpp b/src/core/cm/alerts/alerts.cpp
index 994461f0e..2242134a4 100644
--- a/src/core/cm/alerts/alerts.cpp
+++ b/src/core/cm/alerts/alerts.cpp
@@ -44,11 +44,12 @@ class SetTimestamp : public StaticVisitor<void> {
  * Public
  **********************************************************************************************************************/
 
-Error Alerts::Init(
-    const alerts::Config& config, cm::alerts::SenderItf& sender, cloudconnection::CloudConnectionItf& cloudConnection)
+Error Alerts::Init(AllocatorItf& allocator, const alerts::Config& config, cm::alerts::SenderItf& sender,
+    cloudconnection::CloudConnectionItf& cloudConnection)
 {
     LOG_DBG() << "Init alerts" << Log::Field("sendPeriod", config.mSendPeriod);
 
+    mAllocator       = &allocator;
     mConfig          = config;
     mSender          = &sender;
     mCloudConnection = &cloudConnection;
@@ -242,6 +243,9 @@ Error Alerts::SendAlerts()
 
     while (!mAlerts.IsEmpty()) {
         auto package = CreatePackage();
+        if (!package) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         LOG_INF() << "Send alerts" << Log::Field("alertsCount", package->mItems.Size());
 
@@ -257,7 +261,12 @@ Error Alerts::SendAlerts()
 
 bool Alerts::IsDuplicated(const AlertVariant& alert)
 {
-    auto alertCopy = MakeUnique<AlertVariant>(&mAllocator, alert);
+    auto alertCopy = MakeUnique<AlertVariant>(mAllocator, alert);
+    if (!alertCopy) {
+        LOG_ERR() << "Can't allocate alert copy" << Log::Field(ErrorEnum::eNoMemory);
+
+        return false;
+    }
 
     return mAlerts.FindIf([&alertCopy](const AlertVariant& item) {
         alertCopy->ApplyVisitor(SetTimestamp(item.ApplyVisitor(GetTimestamp())));
@@ -268,7 +277,12 @@ bool Alerts::IsDuplicated(const AlertVariant& alert)
 
 UniquePtr<aos::Alerts> Alerts::CreatePackage()
 {
-    auto package = MakeUnique<aos::Alerts>(&mAllocator);
+    auto package = MakeUnique<aos::Alerts>(mAllocator);
+    if (!package) {
+        LOG_ERR() << "Can't allocate alerts package" << Log::Field(ErrorEnum::eNoMemory);
+
+        return package;
+    }
 
     const auto count = Min<size_t>(cAlertItemsCount, mAlerts.Size());
 
diff --git a/src/core/cm/alerts/alerts.hpp b/src/core/cm/alerts/alerts.hpp
index 67c02d33a..177a4dbeb 100644
--- a/src/core/cm/alerts/alerts.hpp
+++ b/src/core/cm/alerts/alerts.hpp
@@ -40,12 +40,13 @@ class Alerts : public ReceiverItf,
     /**
      * Initializes alerts.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config configuration object.
      * @param sender alerts sender object.
      * @param cloudConnection cloud connection.
      * @return Error.
      */
-    Error Init(const alerts::Config& config, cm::alerts::SenderItf& sender,
+    Error Init(AllocatorItf& allocator, const alerts::Config& config, cm::alerts::SenderItf& sender,
         cloudconnection::CloudConnectionItf& cloudConnection);
 
     /**
@@ -96,7 +97,6 @@ class Alerts : public ReceiverItf,
     Error UnsubscribeListener(AlertsListenerItf& listener) override;
 
 private:
-    static constexpr auto cAllocatorSize     = sizeof(AlertVariant) + sizeof(aos::Alerts);
     static constexpr auto cListenersMaxCount = 4;
     static constexpr auto cAlertTagsCount    = static_cast<size_t>(AlertTagEnum::eNumAlertTags);
 
@@ -111,7 +111,7 @@ class Alerts : public ReceiverItf,
     void                   ShrinkCache(size_t count);
     void                   NotifyListeners(const AlertVariant& alert);
 
-    StaticAllocator<cAllocatorSize>                      mAllocator;
+    AllocatorItf*                                        mAllocator {};
     alerts::Config                                       mConfig;
     cm::alerts::SenderItf*                               mSender {};
     cloudconnection::CloudConnectionItf*                 mCloudConnection {};
diff --git a/src/core/cm/alerts/tests/alerts.cpp b/src/core/cm/alerts/tests/alerts.cpp
index d5c42fd12..64a3f3ebe 100644
--- a/src/core/cm/alerts/tests/alerts.cpp
+++ b/src/core/cm/alerts/tests/alerts.cpp
@@ -16,6 +16,7 @@
 #include <core/common/tests/mocks/cloudconnectionmock.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tests/utils/utils.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 #include <core/cm/alerts/alerts.hpp>
 
@@ -125,6 +126,10 @@ class AlertsTest : public Test {
 protected:
     void SetUp() override { tests::utils::InitLog(); }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     alerts::Config                       mConfig {Time::cSeconds * 1};
     SenderStub                           mCommunication;
     cloudconnection::CloudConnectionMock mCloudConnection;
@@ -159,7 +164,7 @@ TEST_F(AlertsTest, DuplicatesAreSkipped)
             return ErrorEnum::eNone;
         }));
 
-    auto err = mAlerts->Init(mConfig, mCommunication, mCloudConnection);
+    auto err = mAlerts->Init(mAllocator, mConfig, mCommunication, mCloudConnection);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mAlerts->Start();
@@ -198,16 +203,16 @@ TEST_F(AlertsTest, AlertIsSkippedIfBufferIsFull)
 
     std::string message;
 
+    auto err = mAlerts->Init(mAllocator, mConfig, mCommunication, mCloudConnection);
+    ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
+
     for (size_t i = 0; i < cAlertsCacheSize; ++i) {
         auto alert = CreateCoreAlert(cTime, "node1", std::to_string(i));
 
-        auto err = mAlerts->OnAlertReceived(*alert);
+        err = mAlerts->OnAlertReceived(*alert);
         EXPECT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
     }
 
-    auto err = mAlerts->Init(mConfig, mCommunication, mCloudConnection);
-    ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
-
     err = mAlerts->OnAlertReceived(*CreateCoreAlert(cTime, "node1", "skipped alert"));
     EXPECT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
@@ -264,7 +269,7 @@ TEST_F(AlertsTest, PackagesAreSent)
 
     mConfig.mSendPeriod = Time::cSeconds * 3;
 
-    auto err = mAlerts->Init(mConfig, mCommunication, mCloudConnection);
+    auto err = mAlerts->Init(mAllocator, mConfig, mCommunication, mCloudConnection);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mAlerts->Start();
@@ -311,7 +316,7 @@ TEST_F(AlertsTest, PackagesAreSentOnReconnect)
 
     std::vector<aos::Alerts> receivedPackages;
 
-    auto err = mAlerts->Init(mConfig, mCommunication, mCloudConnection);
+    auto err = mAlerts->Init(mAllocator, mConfig, mCommunication, mCloudConnection);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mAlerts->Start();
@@ -353,7 +358,7 @@ TEST_F(AlertsTest, ListenersAreNotified)
         AlertTagEnum::eCoreAlert,
     };
 
-    auto err = mAlerts->Init(mConfig, mCommunication, mCloudConnection);
+    auto err = mAlerts->Init(mAllocator, mConfig, mCommunication, mCloudConnection);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mAlerts->SubscribeListener(
diff --git a/src/core/cm/imagemanager/imagemanager.cpp b/src/core/cm/imagemanager/imagemanager.cpp
index 9f2c46bb7..9ec61bdbe 100644
--- a/src/core/cm/imagemanager/imagemanager.cpp
+++ b/src/core/cm/imagemanager/imagemanager.cpp
@@ -14,14 +14,15 @@ namespace aos::cm::imagemanager {
  * Public
  **********************************************************************************************************************/
 
-Error ImageManager::Init(const Config& config, StorageItf& storage, BlobInfoProviderItf& blobInfoProvider,
-    spaceallocator::SpaceAllocatorItf& downloadingSpaceAllocator,
+Error ImageManager::Init(AllocatorItf& allocator, const Config& config, StorageItf& storage,
+    BlobInfoProviderItf& blobInfoProvider, spaceallocator::SpaceAllocatorItf& downloadingSpaceAllocator,
     spaceallocator::SpaceAllocatorItf& installSpaceAllocator, downloader::DownloaderItf& downloader,
     fileserver::FileServerItf& fileserver, crypto::CryptoHelperItf& cryptoHelper,
     fs::FileInfoProviderItf& fileInfoProvider, oci::OCISpecItf& ociSpec)
 {
     LOG_DBG() << "Init image manager";
 
+    mAllocator                 = &allocator;
     mConfig                    = config;
     mStorage                   = &storage;
     mBlobInfoProvider          = &blobInfoProvider;
@@ -33,7 +34,7 @@ Error ImageManager::Init(const Config& config, StorageItf& storage, BlobInfoProv
     mFileInfoProvider          = &fileInfoProvider;
     mOCISpec                   = &ociSpec;
 
-    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(&mAllocator);
+    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(mAllocator);
     if (!items) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -130,7 +131,7 @@ Error ImageManager::DownloadUpdateItems(const Array<UpdateItemInfo>& itemsInfo,
         statuses[i].mError   = ErrorEnum::eNone;
     }
 
-    auto storedItems = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(&mAllocator);
+    auto storedItems = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(mAllocator);
     if (!storedItems) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -220,7 +221,7 @@ Error ImageManager::InstallUpdateItems(const Array<UpdateItemInfo>& itemsInfo, A
         statuses[i].mError   = ErrorEnum::eNone;
     }
 
-    auto storedItems = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(&mAllocator);
+    auto storedItems = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(mAllocator);
     if (!storedItems) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -300,7 +301,7 @@ Error ImageManager::GetUpdateItemsStatuses(Array<UpdateItemStatus>& statuses)
 
     LOG_DBG() << "Get update items statuses";
 
-    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(&mAllocator);
+    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(mAllocator);
     if (!items) {
         return ErrorEnum::eNoMemory;
     }
@@ -358,7 +359,7 @@ Error ImageManager::GetIndexDigest(const String& itemID, const String& version,
 
     LOG_DBG() << "Get index digest" << Log::Field("itemID", itemID) << Log::Field("version", version);
 
-    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumItemVersions>>(&mAllocator);
+    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumItemVersions>>(mAllocator);
     if (!items) {
         return ErrorEnum::eNoMemory;
     }
@@ -429,7 +430,7 @@ Error ImageManager::GetItemCurrentVersion(const String& itemID, String& version)
 
     LOG_DBG() << "Get item current version" << Log::Field("itemID", itemID);
 
-    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumItemVersions>>(&mAllocator);
+    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumItemVersions>>(mAllocator);
     if (!items) {
         return ErrorEnum::eNoMemory;
     }
@@ -458,7 +459,7 @@ RetWithError<size_t> ImageManager::RemoveItem(const String& id, const String& ve
 
     LOG_DBG() << "Remove item" << Log::Field("id", id) << Log::Field("version", version);
 
-    auto storedItems = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(&mAllocator);
+    auto storedItems = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(mAllocator);
     if (!storedItems) {
         return {0, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
     }
@@ -508,7 +509,7 @@ Error ImageManager::RemoveOutdatedItems()
 
     LOG_DBG() << "Remove outdated items";
 
-    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(&mAllocator);
+    auto items = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(mAllocator);
     if (!items) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -586,7 +587,7 @@ Error ImageManager::AllocateSpaceForPartialDownloads()
             auto fileName = fileIterator->mPath;
             auto filePath = fs::JoinPath(algorithmDir, fileName);
 
-            auto [fileSize, sizeErr] = fs::CalculateSize(filePath);
+            auto [fileSize, sizeErr] = fs::CalculateSize(*mAllocator, filePath);
             if (!sizeErr.IsNone()) {
                 LOG_WRN() << "Failed to get size for partial download" << Log::Field("path", filePath)
                           << Log::Field(sizeErr);
@@ -884,7 +885,7 @@ Error ImageManager::DownloadItem(const UpdateItemInfo& itemInfo, const Array<cry
         return AOS_ERROR_WRAP(err);
     }
 
-    auto imageIndex = MakeUnique<oci::ImageIndex>(&mAllocator);
+    auto imageIndex = MakeUnique<oci::ImageIndex>(mAllocator);
     if (!imageIndex) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -898,7 +899,7 @@ Error ImageManager::DownloadItem(const UpdateItemInfo& itemInfo, const Array<cry
     LOG_DBG() << "Processing manifests" << Log::Field("count", imageIndex->mManifests.Size());
 
     for (const auto& manifestDescriptor : imageIndex->mManifests) {
-        auto manifest = MakeUnique<oci::ImageManifest>(&mAllocator);
+        auto manifest = MakeUnique<oci::ImageManifest>(mAllocator);
         if (!manifest) {
             return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
         }
@@ -1080,7 +1081,11 @@ Error ImageManager::EnsureBlob(const String& digest, const String& downloadPath,
 {
     LOG_DBG() << "Ensure blob" << Log::Field("digest", digest);
 
-    auto                                blobInfo = MakeUnique<BlobInfo>(&mAllocator);
+    auto blobInfo = MakeUnique<BlobInfo>(mAllocator);
+    if (!blobInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
     UniquePtr<spaceallocator::SpaceItf> downloadingSpace;
 
     do {
@@ -1132,7 +1137,7 @@ Error ImageManager::GetBlobInfo(const String& digest, BlobInfo& blobInfo)
         return AOS_ERROR_WRAP(err);
     }
 
-    auto blobsInfo = MakeUnique<StaticArray<BlobInfo, 1>>(&mAllocator);
+    auto blobsInfo = MakeUnique<StaticArray<BlobInfo, 1>>(mAllocator);
     if (!blobsInfo) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -1190,7 +1195,7 @@ Error ImageManager::CheckExistingBlob(const String& installPath)
         return AOS_ERROR_WRAP(err);
     }
 
-    auto expectedSHA256 = MakeUnique<StaticArray<uint8_t, crypto::cSHA256Size>>(&mAllocator);
+    auto expectedSHA256 = MakeUnique<StaticArray<uint8_t, crypto::cSHA256Size>>(mAllocator);
     if (!expectedSHA256) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -1223,7 +1228,7 @@ Error ImageManager::PrepareDownloadSpace(const String& downloadPath, const BlobI
     partialDownloadSize = 0;
 
     if (downloadExists) {
-        auto [dirSize, getSizeErr] = fs::CalculateSize(downloadPath);
+        auto [dirSize, getSizeErr] = fs::CalculateSize(*mAllocator, downloadPath);
         if (!getSizeErr.IsNone()) {
             return AOS_ERROR_WRAP(getSizeErr);
         }
@@ -1275,7 +1280,7 @@ Error ImageManager::PerformDownload(const BlobInfo& blobInfo, const String& down
                       << Log::Field("path", downloadPath) << Log::Field(AOS_ERROR_WRAP(err));
 
             if (err = WaitForStop(); !err.IsNone()) {
-                auto [newPartialSize, retrySizeErr] = fs::CalculateSize(downloadPath);
+                auto [newPartialSize, retrySizeErr] = fs::CalculateSize(*mAllocator, downloadPath);
                 if (!retrySizeErr.IsNone()) {
                     LOG_WRN() << "Failed to get partial download size" << Log::Field("path", downloadPath)
                               << Log::Field(retrySizeErr);
@@ -1514,7 +1519,7 @@ Error ImageManager::VerifyBlobChecksum(const String& digest, const fs::FileInfo&
         return AOS_ERROR_WRAP(err);
     }
 
-    auto expectedSHA256 = MakeUnique<StaticArray<uint8_t, crypto::cSHA256Size>>(&mAllocator);
+    auto expectedSHA256 = MakeUnique<StaticArray<uint8_t, crypto::cSHA256Size>>(mAllocator);
     if (!expectedSHA256) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -1543,7 +1548,7 @@ Error ImageManager::VerifyItemBlobs(const String& indexDigest)
         return AOS_ERROR_WRAP(err);
     }
 
-    auto imageIndex = MakeUnique<oci::ImageIndex>(&mAllocator);
+    auto imageIndex = MakeUnique<oci::ImageIndex>(mAllocator);
     if (!imageIndex) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -1562,7 +1567,7 @@ Error ImageManager::VerifyItemBlobs(const String& indexDigest)
             return AOS_ERROR_WRAP(err);
         }
 
-        auto manifest = MakeUnique<oci::ImageManifest>(&mAllocator);
+        auto manifest = MakeUnique<oci::ImageManifest>(mAllocator);
         if (!manifest) {
             return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
         }
@@ -1605,7 +1610,7 @@ bool ImageManager::IsBlobUsedByItems(const String& blobDigest, const Array<ItemI
             continue;
         }
 
-        auto imageIndex = MakeUnique<oci::ImageIndex>(&mAllocator);
+        auto imageIndex = MakeUnique<oci::ImageIndex>(mAllocator);
         if (!imageIndex) {
             continue;
         }
@@ -1625,7 +1630,7 @@ bool ImageManager::IsBlobUsedByItems(const String& blobDigest, const Array<ItemI
                 continue;
             }
 
-            auto manifest = MakeUnique<oci::ImageManifest>(&mAllocator);
+            auto manifest = MakeUnique<oci::ImageManifest>(mAllocator);
             if (!manifest) {
                 continue;
             }
@@ -1659,7 +1664,7 @@ RetWithError<size_t> ImageManager::CleanupOrphanedBlobs()
 
     size_t totalSize = 0;
 
-    auto storedItems = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(&mAllocator);
+    auto storedItems = MakeUnique<StaticArray<ItemInfo, cMaxNumUpdateItems>>(mAllocator);
     if (!storedItems) {
         return {0, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
     }
@@ -1685,7 +1690,7 @@ RetWithError<size_t> ImageManager::CleanupOrphanedBlobs()
             if (!IsBlobUsedByItems(blobDigest, *storedItems)) {
                 auto filePath = fs::JoinPath(algorithmDir, hash);
 
-                auto [blobSize, sizeErr] = fs::CalculateSize(filePath);
+                auto [blobSize, sizeErr] = fs::CalculateSize(*mAllocator, filePath);
                 if (!sizeErr.IsNone()) {
                     LOG_WRN() << "Failed to get blob size" << Log::Field("path", filePath) << Log::Field(sizeErr);
                 } else {
diff --git a/src/core/cm/imagemanager/imagemanager.hpp b/src/core/cm/imagemanager/imagemanager.hpp
index f72698ba6..0f8271f41 100644
--- a/src/core/cm/imagemanager/imagemanager.hpp
+++ b/src/core/cm/imagemanager/imagemanager.hpp
@@ -36,6 +36,7 @@ class ImageManager : public ImageManagerItf, public ItemInfoProviderItf, public
     /**
      * Initializes image manager.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config image manager config.
      * @param storage stores internal persistent data.
      * @param blobInfoProvider retrieves blobs info.
@@ -48,8 +49,8 @@ class ImageManager : public ImageManagerItf, public ItemInfoProviderItf, public
      * @param ociSpec parses OCI spec files.
      * @return Error.
      */
-    Error Init(const Config& config, StorageItf& storage, BlobInfoProviderItf& blobInfoProvider,
-        spaceallocator::SpaceAllocatorItf& downloadingSpaceAllocator,
+    Error Init(AllocatorItf& allocator, const Config& config, StorageItf& storage,
+        BlobInfoProviderItf& blobInfoProvider, spaceallocator::SpaceAllocatorItf& downloadingSpaceAllocator,
         spaceallocator::SpaceAllocatorItf& installSpaceAllocator, downloader::DownloaderItf& downloader,
         fileserver::FileServerItf& fileserver, crypto::CryptoHelperItf& cryptoHelper,
         fs::FileInfoProviderItf& fileInfoProvider, oci::OCISpecItf& ociSpec);
@@ -253,10 +254,8 @@ class ImageManager : public ImageManagerItf, public ItemInfoProviderItf, public
     ConditionalVariable           mCondVar;
     bool                          mCancel {};
     bool                          mInProgress {};
-    mutable StaticAllocator<(sizeof(StaticArray<ItemInfo, cMaxNumUpdateItems>) * 2) + sizeof(oci::ImageIndex)
-        + sizeof(oci::ImageManifest) + sizeof(StaticArray<BlobInfo, 1>)
-        + sizeof(StaticArray<uint8_t, crypto::cSHA256Size>) + sizeof(BlobInfo)>
-        mAllocator;
+
+    AllocatorItf* mAllocator {};
 };
 
 } // namespace aos::cm::imagemanager
diff --git a/src/core/cm/imagemanager/tests/imagemanager.cpp b/src/core/cm/imagemanager/tests/imagemanager.cpp
index 283890ada..95245bab2 100644
--- a/src/core/cm/imagemanager/tests/imagemanager.cpp
+++ b/src/core/cm/imagemanager/tests/imagemanager.cpp
@@ -18,6 +18,7 @@
 #include <core/common/tests/mocks/ocispecmock.hpp>
 #include <core/common/tests/mocks/spaceallocatormock.hpp>
 #include <core/common/tests/utils/log.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 #include "mocks/blobinfoprovidermock.hpp"
 #include "mocks/itemstatuslistenermock.hpp"
@@ -50,7 +51,7 @@ class ImageManagerTest : public testing::Test {
         EXPECT_CALL(mStorageMock, GetAllItemsInfos(_)).WillRepeatedly(Return(ErrorEnum::eNone));
 
         EXPECT_TRUE(mImageManager
-                        .Init(mConfig, mStorageMock, mBlobInfoProviderMock, mDownloadingSpaceAllocatorMock,
+                        .Init(mAllocator, mConfig, mStorageMock, mBlobInfoProviderMock, mDownloadingSpaceAllocatorMock,
                             mInstallSpaceAllocatorMock, mDownloaderMock, mFileServerMock, mCryptoHelperMock,
                             mFileInfoProviderMock, mOCISpecMock)
                         .IsNone());
@@ -62,9 +63,12 @@ class ImageManagerTest : public testing::Test {
         fs::RemoveAll(mConfig.mDownloadPath);
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     Config                                         mConfig;
     ImageManager                                   mImageManager;
-    StaticAllocator<1024 * 5, 20>                  mAllocator;
     StrictMock<StorageMock>                        mStorageMock;
     StrictMock<BlobInfoProviderMock>               mBlobInfoProviderMock;
     StrictMock<spaceallocator::SpaceAllocatorMock> mDownloadingSpaceAllocatorMock;
@@ -213,6 +217,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_Success_NewItem)
     EXPECT_CALL(mDownloadingSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
@@ -222,6 +228,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_Success_NewItem)
     EXPECT_CALL(mInstallSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
@@ -339,6 +347,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_AlreadyInstalled)
     EXPECT_CALL(mDownloadingSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
@@ -348,6 +358,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_AlreadyInstalled)
     EXPECT_CALL(mInstallSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
@@ -522,6 +534,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_MultipleItems_Success)
     EXPECT_CALL(mDownloadingSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
@@ -531,6 +545,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_MultipleItems_Success)
     EXPECT_CALL(mInstallSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
@@ -670,6 +686,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_Cancel_DownloadFailed)
     EXPECT_CALL(mDownloadingSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
             testing::Mock::AllowLeak(space.Get());
@@ -759,6 +777,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_RemovesOldPendingVersion)
     EXPECT_CALL(mDownloadingSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
@@ -768,6 +788,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_RemovesOldPendingVersion)
     EXPECT_CALL(mInstallSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
@@ -876,6 +898,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_RemovesOldFailedVersion)
     EXPECT_CALL(mDownloadingSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
@@ -885,6 +909,8 @@ TEST_F(ImageManagerTest, DownloadUpdateItems_RemovesOldFailedVersion)
     EXPECT_CALL(mInstallSpaceAllocatorMock, AllocateSpace(_))
         .WillRepeatedly(Invoke([this](size_t) -> RetWithError<UniquePtr<spaceallocator::SpaceItf>> {
             auto space = MakeUnique<spaceallocator::SpaceMock>(&mAllocator);
+            EXPECT_TRUE(space);
+
             EXPECT_CALL(*space, Accept()).Times(AtLeast(0));
             EXPECT_CALL(*space, Release()).Times(AtLeast(0));
 
diff --git a/src/core/cm/launcher/balancer.cpp b/src/core/cm/launcher/balancer.cpp
index 6c1d15138..1e5ea27db 100644
--- a/src/core/cm/launcher/balancer.cpp
+++ b/src/core/cm/launcher/balancer.cpp
@@ -14,9 +14,10 @@ namespace aos::cm::launcher {
  * Public
  **********************************************************************************************************************/
 
-void Balancer::Init(InstanceManager& instanceManager, ImageInfoProvider& imageInfoProvider, NodeManager& nodeManager,
-    MonitoringProviderItf& monitorProvider, InstanceRunnerItf& runner)
+void Balancer::Init(AllocatorItf& allocator, InstanceManager& instanceManager, ImageInfoProvider& imageInfoProvider,
+    NodeManager& nodeManager, MonitoringProviderItf& monitorProvider, InstanceRunnerItf& runner)
 {
+    mAllocator         = &allocator;
     mInstanceManager   = &instanceManager;
     mImageInfoProvider = &imageInfoProvider;
     mNodeManager       = &nodeManager;
@@ -91,12 +92,20 @@ Error Balancer::PerformNodeBalancing(Array<SharedPtr<Instance>>& instances)
             continue;
         }
 
-        auto imageIndex = MakeUnique<oci::ImageIndex>(&mAllocator);
+        auto imageIndex = MakeUnique<oci::ImageIndex>(mAllocator);
+        if (!imageIndex) {
+            LOG_ERR() << "Can't allocate image index" << Log::Field("instance", id) << Log::Field(ErrorEnum::eNoMemory);
+
+            mInstanceManager->ScheduleInstance(instance, AOS_ERROR_WRAP(ErrorEnum::eNoMemory));
+
+            continue;
+        }
 
         if (auto err = mImageInfoProvider->GetImageIndex(id.mItemID, info.mVersion, *imageIndex); !err.IsNone()) {
             LOG_ERR() << "Can't get images" << Log::Field("instance", id) << Log::Field(err);
 
             mInstanceManager->ScheduleInstance(instance, AOS_ERROR_WRAP(err));
+
             continue;
         }
 
@@ -106,8 +115,7 @@ Error Balancer::PerformNodeBalancing(Array<SharedPtr<Instance>>& instances)
             LOG_DBG() << "Try to schedule instance" << Log::Field("instance", id)
                       << Log::Field("manifest", manifest.mDigest);
 
-            scheduleErr = ScheduleInstance(instance, manifest);
-            if (scheduleErr.IsNone()) {
+            if (scheduleErr = ScheduleInstance(instance, manifest); scheduleErr.IsNone()) {
                 LOG_DBG() << "Instance scheduled successfully" << Log::Field("nodeID", info.mNodeID);
 
                 break;
@@ -126,7 +134,10 @@ Error Balancer::PerformNodeBalancing(Array<SharedPtr<Instance>>& instances)
 
 Error Balancer::ScheduleInstance(SharedPtr<Instance>& instance, const oci::IndexContentDescriptor& imageDescriptor)
 {
-    auto nodes = MakeUnique<StaticArray<Node*, cMaxNumNodes>>(&mAllocator);
+    auto nodes = MakeUnique<StaticArray<Node*, cMaxNumNodes>>(mAllocator);
+    if (!nodes) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto releaseConfigs = DeferRelease(reinterpret_cast<int*>(1), [&](int*) { instance->ResetConfigs(); });
 
@@ -196,7 +207,10 @@ void Balancer::FilterNodesByResources(Instance& instance, Array<Node*>& nodes)
 
 RetWithError<Pair<Node*, const RuntimeInfo*>> Balancer::SelectRuntime(Instance& instance, const Array<Node*>& nodes)
 {
-    auto nodeRuntimes = MakeUnique<NodeRuntimes>(&mAllocator);
+    auto nodeRuntimes = MakeUnique<NodeRuntimes>(mAllocator);
+    if (!nodeRuntimes) {
+        return {nullptr, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
 
     if (auto err = CreateRuntimes(nodes, *nodeRuntimes); !err.IsNone()) {
         return {nullptr, AOS_ERROR_WRAP(err)};
@@ -384,7 +398,10 @@ void Balancer::FilterTopPriorityNodes(NodeRuntimes& nodes)
 
 Error Balancer::PerformPolicyBalancing(Array<SharedPtr<Instance>>& instances)
 {
-    auto imageIndex = MakeUnique<oci::ImageIndex>(&mAllocator);
+    auto imageIndex = MakeUnique<oci::ImageIndex>(mAllocator);
+    if (!imageIndex) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     for (auto& instance : instances) {
         const auto& info    = instance->GetInfo();
@@ -465,7 +482,10 @@ Error Balancer::UpdateMonitoringData(bool isInitialUpdate)
     for (auto& node : mNodeManager->GetNodes()) {
         const auto& nodeID = node.GetInfo().mNodeID;
 
-        auto nodeMonitoring = MakeUnique<monitoring::NodeMonitoringData>(&mAllocator);
+        auto nodeMonitoring = MakeUnique<monitoring::NodeMonitoringData>(mAllocator);
+        if (!nodeMonitoring) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         // Monitoring data immediately after startup is not availble.
         // Assign zero consumption on start.
diff --git a/src/core/cm/launcher/balancer.hpp b/src/core/cm/launcher/balancer.hpp
index 9d0846b49..bf22bf06e 100644
--- a/src/core/cm/launcher/balancer.hpp
+++ b/src/core/cm/launcher/balancer.hpp
@@ -7,6 +7,8 @@
 #ifndef AOS_CORE_CM_LAUNCHER_BALANCER_HPP_
 #define AOS_CORE_CM_LAUNCHER_BALANCER_HPP_
 
+#include <core/common/tools/memory.hpp>
+
 #include "itf/instancerunner.hpp"
 #include "itf/launcher.hpp"
 #include "itf/monitoringprovider.hpp"
@@ -29,14 +31,15 @@ class Balancer {
     /**
      * Initializes runner with required managers and providers.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param instanceManager instance manager.
      * @param imageInfoProvider image info provider.
      * @param nodeManager node manager.
      * @param monitorProvider monitoring provider.
      * @param runner instance runner interface.
      */
-    void Init(InstanceManager& instanceManager, ImageInfoProvider& imageInfoProvider, NodeManager& nodeManager,
-        MonitoringProviderItf& monitorProvider, InstanceRunnerItf& runner);
+    void Init(AllocatorItf& allocator, InstanceManager& instanceManager, ImageInfoProvider& imageInfoProvider,
+        NodeManager& nodeManager, MonitoringProviderItf& monitorProvider, InstanceRunnerItf& runner);
 
     /**
      * Runs instances.
@@ -57,13 +60,6 @@ class Balancer {
 private:
     using NodeRuntimes = StaticMap<Node*, StaticArray<const RuntimeInfo*, cMaxNumNodeRuntimes>, cMaxNumInstances>;
 
-    static constexpr size_t cScheduleInstanceSize
-        = sizeof(oci::ImageIndex) + sizeof(StaticArray<Node*, cMaxNumNodes>) + sizeof(NodeRuntimes);
-    static constexpr size_t cPolicyBalancingSize = sizeof(oci::ImageIndex);
-    static constexpr size_t cMonitoringSize      = sizeof(monitoring::NodeMonitoringData);
-
-    static constexpr size_t cAllocatorSize = Max(cScheduleInstanceSize, cPolicyBalancingSize, cMonitoringSize);
-
     Error PerformNodeBalancing(Array<SharedPtr<Instance>>& instances);
 
     Error ScheduleInstance(SharedPtr<Instance>& instance, const oci::IndexContentDescriptor& imageDescriptor);
@@ -99,7 +95,7 @@ class Balancer {
     InstanceRunnerItf*     mRunner {};
     SubjectArray           mSubjects;
 
-    StaticAllocator<cAllocatorSize> mAllocator;
+    AllocatorItf* mAllocator {};
 };
 
 /** @}*/
diff --git a/src/core/cm/launcher/imageinfoprovider.cpp b/src/core/cm/launcher/imageinfoprovider.cpp
index 7198363e0..d45b4c355 100644
--- a/src/core/cm/launcher/imageinfoprovider.cpp
+++ b/src/core/cm/launcher/imageinfoprovider.cpp
@@ -11,17 +11,30 @@
 
 namespace aos::cm::launcher {
 
-void ImageInfoProvider::Init(imagemanager::ItemInfoProviderItf& itemInfoProvider, oci::OCISpecItf& ociSpec)
+void ImageInfoProvider::Init(
+    AllocatorItf& allocator, imagemanager::ItemInfoProviderItf& itemInfoProvider, oci::OCISpecItf& ociSpec)
 {
+    mAllocator        = &allocator;
     mItemInfoProvider = &itemInfoProvider;
     mOCISpec          = &ociSpec;
 }
 
 Error ImageInfoProvider::GetImageConfig(const oci::IndexContentDescriptor& imageDescriptor, oci::ImageConfig& config)
 {
-    auto manifestPath = MakeUnique<StaticString<cFilePathLen>>(&mAllocator);
-    auto manifest     = MakeUnique<oci::ImageManifest>(&mAllocator);
-    auto configPath   = MakeUnique<StaticString<cFilePathLen>>(&mAllocator);
+    auto manifestPath = MakeUnique<StaticString<cFilePathLen>>(mAllocator);
+    if (!manifestPath) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto manifest = MakeUnique<oci::ImageManifest>(mAllocator);
+    if (!manifest) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto configPath = MakeUnique<StaticString<cFilePathLen>>(mAllocator);
+    if (!configPath) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mItemInfoProvider->GetBlobPath(imageDescriptor.mDigest, *manifestPath); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -44,9 +57,20 @@ Error ImageInfoProvider::GetImageConfig(const oci::IndexContentDescriptor& image
 
 Error ImageInfoProvider::GetItemConfig(const oci::IndexContentDescriptor& imageDescriptor, oci::ItemConfig& itemConfig)
 {
-    auto manifestPath = MakeUnique<StaticString<cFilePathLen>>(&mAllocator);
-    auto manifest     = MakeUnique<oci::ImageManifest>(&mAllocator);
-    auto servicePath  = MakeUnique<StaticString<cFilePathLen>>(&mAllocator);
+    auto manifestPath = MakeUnique<StaticString<cFilePathLen>>(mAllocator);
+    if (!manifestPath) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto manifest = MakeUnique<oci::ImageManifest>(mAllocator);
+    if (!manifest) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto servicePath = MakeUnique<StaticString<cFilePathLen>>(mAllocator);
+    if (!servicePath) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mItemInfoProvider->GetBlobPath(imageDescriptor.mDigest, *manifestPath); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -73,8 +97,15 @@ Error ImageInfoProvider::GetItemConfig(const oci::IndexContentDescriptor& imageD
 
 Error ImageInfoProvider::GetImageIndex(const String& itemID, const String& version, oci::ImageIndex& imageIndex)
 {
-    auto indexDigest = MakeUnique<StaticString<oci::cDigestLen>>(&mAllocator);
-    auto indexPath   = MakeUnique<StaticString<cFilePathLen>>(&mAllocator);
+    auto indexDigest = MakeUnique<StaticString<oci::cDigestLen>>(mAllocator);
+    if (!indexDigest) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto indexPath = MakeUnique<StaticString<cFilePathLen>>(mAllocator);
+    if (!indexPath) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mItemInfoProvider->GetIndexDigest(itemID, version, *indexDigest); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
diff --git a/src/core/cm/launcher/imageinfoprovider.hpp b/src/core/cm/launcher/imageinfoprovider.hpp
index 0d54417eb..37dbb2878 100644
--- a/src/core/cm/launcher/imageinfoprovider.hpp
+++ b/src/core/cm/launcher/imageinfoprovider.hpp
@@ -12,6 +12,7 @@
 #include <core/common/ocispec/itf/ocispec.hpp>
 #include <core/common/tools/array.hpp>
 #include <core/common/tools/error.hpp>
+#include <core/common/tools/memory.hpp>
 #include <core/common/types/common.hpp>
 #include <core/common/types/desiredstatus.hpp>
 
@@ -25,10 +26,11 @@ class ImageInfoProvider {
     /**
      * @brief Initializes image info provider.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param itemInfoProvider item info provider.
      * @param ociSpec OCI spec.
      */
-    void Init(imagemanager::ItemInfoProviderItf& itemInfoProvider, oci::OCISpecItf& ociSpec);
+    void Init(AllocatorItf& allocator, imagemanager::ItemInfoProviderItf& itemInfoProvider, oci::OCISpecItf& ociSpec);
 
     /**
      * Returns OCI image config for the specified instance/image identifiers.
@@ -59,13 +61,10 @@ class ImageInfoProvider {
     Error GetImageIndex(const String& itemID, const String& version, oci::ImageIndex& imageIndex);
 
 private:
-    static constexpr auto cAllocatorSize = Max(sizeof(oci::ImageManifest) + sizeof(StaticString<cFilePathLen>) * 3,
-        sizeof(StaticString<cFilePathLen>) + sizeof(StaticString<oci::cDigestLen>));
-
     imagemanager::ItemInfoProviderItf* mItemInfoProvider {};
     oci::OCISpecItf*                   mOCISpec {};
 
-    StaticAllocator<cAllocatorSize> mAllocator;
+    AllocatorItf* mAllocator {};
 };
 
 } // namespace aos::cm::launcher
diff --git a/src/core/cm/launcher/instance.cpp b/src/core/cm/launcher/instance.cpp
index 48fbf62a7..a360a65c0 100644
--- a/src/core/cm/launcher/instance.cpp
+++ b/src/core/cm/launcher/instance.cpp
@@ -16,7 +16,7 @@ namespace aos::cm::launcher {
  **********************************************************************************************************************/
 
 Instance::Instance(
-    const InstanceInfo& info, StorageItf& storage, ImageInfoProvider& imageInfoProvider, Allocator& allocator)
+    AllocatorItf& allocator, const InstanceInfo& info, StorageItf& storage, ImageInfoProvider& imageInfoProvider)
     : mInfo(info)
     , mStorage(storage)
     , mImageInfoProvider(imageInfoProvider)
@@ -37,8 +37,15 @@ Instance::Instance(
 
 Error Instance::LoadConfigs(const oci::IndexContentDescriptor& imageDescriptor)
 {
-    mItemConfig  = MakeUnique<oci::ItemConfig>(&mAllocator);
+    mItemConfig = MakeUnique<oci::ItemConfig>(&mAllocator);
+    if (!mItemConfig) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
     mImageConfig = MakeUnique<oci::ImageConfig>(&mAllocator);
+    if (!mImageConfig) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto releaseConfigs = DeferRelease(reinterpret_cast<int*>(1), [&](int*) { ResetConfigs(); });
     if (auto err = mImageInfoProvider.GetItemConfig(imageDescriptor, *mItemConfig); !err.IsNone()) {
@@ -74,6 +81,11 @@ bool Instance::IsImageValid()
     }
 
     auto imageIndex = MakeUnique<oci::ImageIndex>(&mAllocator);
+    if (!imageIndex) {
+        LOG_ERR() << "Can't allocate image index" << Log::Field(ErrorEnum::eNoMemory);
+
+        return false;
+    }
 
     auto err = mImageInfoProvider.GetImageIndex(mInfo.mInstanceIdent.mItemID, mInfo.mVersion, *imageIndex);
     if (!err.IsNone()) {
@@ -196,6 +208,9 @@ bool Instance::AreNodeLabelsOk(const LabelsArray& nodeLabels)
 RetWithError<bool> Instance::OverrideEnvVars(const OverrideEnvVarsRequest& envVars)
 {
     auto newEnvVars = MakeUnique<EnvVarArray>(&mAllocator);
+    if (!newEnvVars) {
+        return {false, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
 
     for (const auto& item : envVars.mItems) {
         if (!item.Match(mInfo.mInstanceIdent)) {
@@ -280,8 +295,8 @@ Error Instance::SetDefaultRuntimes()
  **********************************************************************************************************************/
 
 ComponentInstance::ComponentInstance(
-    const InstanceInfo& info, StorageItf& storage, ImageInfoProvider& imageInfoProvider, Allocator& allocator)
-    : Instance(info, storage, imageInfoProvider, allocator)
+    AllocatorItf& allocator, const InstanceInfo& info, StorageItf& storage, ImageInfoProvider& imageInfoProvider)
+    : Instance(allocator, info, storage, imageInfoProvider)
 {
 }
 
@@ -377,9 +392,9 @@ Error ComponentInstance::LoadSMInfo(NodeItf& node, const String& runtimeID)
  * ServiceInstance implementation
  **********************************************************************************************************************/
 
-ServiceInstance::ServiceInstance(const InstanceInfo& info, UIDPool& uidPool, GIDPool& gidPool, StorageItf& storage,
-    StorageState& storageState, ImageInfoProvider& imageInfoProvider, Allocator& allocator)
-    : Instance(info, storage, imageInfoProvider, allocator)
+ServiceInstance::ServiceInstance(AllocatorItf& allocator, const InstanceInfo& info, UIDPool& uidPool, GIDPool& gidPool,
+    StorageItf& storage, StorageState& storageState, ImageInfoProvider& imageInfoProvider)
+    : Instance(allocator, info, storage, imageInfoProvider)
     , mUIDPool(uidPool)
     , mGIDPool(gidPool)
     , mStorageState(storageState)
diff --git a/src/core/cm/launcher/instance.hpp b/src/core/cm/launcher/instance.hpp
index 156b69724..46893231e 100644
--- a/src/core/cm/launcher/instance.hpp
+++ b/src/core/cm/launcher/instance.hpp
@@ -35,12 +35,13 @@ class Instance {
     /**
      * Constructs instance.
      *
+     * @param allocator instance allocator.
      * @param info instance information.
      * @param storage interface to persistent storage.
      * @param imageInfoProvider interface for retrieving service information from image.
-     * @param allocator instance allocator.
      */
-    Instance(const InstanceInfo& info, StorageItf& storage, ImageInfoProvider& imageInfoProvider, Allocator& allocator);
+    Instance(
+        AllocatorItf& allocator, const InstanceInfo& info, StorageItf& storage, ImageInfoProvider& imageInfoProvider);
 
     /**
      * Destructor.
@@ -236,7 +237,7 @@ class Instance {
 
     StorageItf&        mStorage;
     ImageInfoProvider& mImageInfoProvider;
-    Allocator&         mAllocator;
+    AllocatorItf&      mAllocator;
 
     MonitoringData mMonitoringData;
 
@@ -252,13 +253,13 @@ class ComponentInstance : public Instance {
     /**
      * Constructs component instance.
      *
+     * @param allocator instance allocator.
      * @param info instance information.
      * @param storage interface to persistent storage.
      * @param imageInfoProvider interface for retrieving service information from image.
-     * @param allocator instance allocator.
      */
     ComponentInstance(
-        const InstanceInfo& info, StorageItf& storage, ImageInfoProvider& imageInfoProvider, Allocator& allocator);
+        AllocatorItf& allocator, const InstanceInfo& info, StorageItf& storage, ImageInfoProvider& imageInfoProvider);
 
     /**
      * Initializes component instance.
@@ -343,14 +344,14 @@ class ServiceInstance : public Instance {
     /**
      * Constructs service instance.
      *
+     * @param allocator instance allocator.
      * @param info instance information.
      * @param uidPool pool for managing user identifiers.
      * @param storage interface to persistent storage.
      * @param storageState interface for managing storage and state partitions.
-     * @param allocator instance allocator.
      */
-    ServiceInstance(const InstanceInfo& info, UIDPool& uidPool, GIDPool& gidPool, StorageItf& storage,
-        StorageState& storageState, ImageInfoProvider& imageInfoProvider, Allocator& allocator);
+    ServiceInstance(AllocatorItf& allocator, const InstanceInfo& info, UIDPool& uidPool, GIDPool& gidPool,
+        StorageItf& storage, StorageState& storageState, ImageInfoProvider& imageInfoProvider);
 
     /**
      * Initializes service instance.
diff --git a/src/core/cm/launcher/instancemanager.cpp b/src/core/cm/launcher/instancemanager.cpp
index c4f024be2..b042b89f8 100644
--- a/src/core/cm/launcher/instancemanager.cpp
+++ b/src/core/cm/launcher/instancemanager.cpp
@@ -38,15 +38,17 @@ Error InstanceManager::RemoveInstances(Array<SharedPtr<Instance>>& instances, Pr
  * Public
  **********************************************************************************************************************/
 
-Error InstanceManager::Init(const Config& config, imagemanager::ItemInfoProviderItf& itemInfoProvider,
-    storagestate::StorageStateItf& storageState, oci::OCISpecItf& ociSpec, IdentifierPoolValidator gidValidator,
-    IdentifierPoolValidator uidValidator, StorageItf& storage)
+Error InstanceManager::Init(AllocatorItf& allocator, const Config& config,
+    imagemanager::ItemInfoProviderItf& itemInfoProvider, storagestate::StorageStateItf& storageState,
+    oci::OCISpecItf& ociSpec, IdentifierPoolValidator gidValidator, IdentifierPoolValidator uidValidator,
+    StorageItf& storage)
 {
-    mConfig  = config;
-    mStorage = &storage;
+    mAllocator = &allocator;
+    mConfig    = config;
+    mStorage   = &storage;
 
-    mImageInfoProvider.Init(itemInfoProvider, ociSpec);
-    mStorageState.Init(storageState);
+    mImageInfoProvider.Init(allocator, itemInfoProvider, ociSpec);
+    mStorageState.Init(allocator, storageState);
 
     if (auto err = mUIDPool.Init(uidValidator); !err.IsNone()) {
         return err;
@@ -218,6 +220,9 @@ RetWithError<SharedPtr<Instance>> InstanceManager::CreateInstance(const RunInsta
     }
 
     auto instanceInfo = CreateInfo(id, "", "", request);
+    if (!instanceInfo) {
+        return {nullptr, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
 
     if (auto err = mStorage->AddInstance(*instanceInfo); !err.IsNone()) {
         return {nullptr, AOS_ERROR_WRAP(err)};
@@ -241,6 +246,9 @@ RetWithError<SharedPtr<Instance>> InstanceManager::CreateInstance(const RunInsta
 
     auto id = InstanceIdent {request.mItemID, request.mSubjectInfo.mSubjectID, index, request.mUpdateItemType};
     auto instanceInfo = CreateInfo(id, nodeID, runtimeID, request);
+    if (!instanceInfo) {
+        return {nullptr, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
 
     if (auto err = mStorage->AddInstance(*instanceInfo); !err.IsNone()) {
         return {nullptr, AOS_ERROR_WRAP(err)};
@@ -415,7 +423,11 @@ Error InstanceManager::LoadInstancesFromStorage()
     mActiveInstances.Clear();
     mCachedInstances.Clear();
 
-    auto instances = MakeUnique<StaticArray<InstanceInfo, cMaxNumInstances>>(&mAllocator);
+    auto instances = MakeUnique<StaticArray<InstanceInfo, cMaxNumInstances>>(mAllocator);
+    if (!instances) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
     if (auto err = mStorage->LoadActiveInstances(*instances); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
@@ -549,18 +561,21 @@ RetWithError<SharedPtr<Instance>> InstanceManager::CreateInstance(const Instance
     switch (info.mInstanceIdent.mType.GetValue()) {
     case UpdateItemTypeEnum::eService:
         newInstance = MakeShared<ServiceInstance>(
-            &mAllocator, info, mUIDPool, mGIDPool, *mStorage, mStorageState, mImageInfoProvider, mInstanceAllocator);
+            mAllocator, *mAllocator, info, mUIDPool, mGIDPool, *mStorage, mStorageState, mImageInfoProvider);
         break;
 
     case UpdateItemTypeEnum::eComponent:
-        newInstance
-            = MakeShared<ComponentInstance>(&mAllocator, info, *mStorage, mImageInfoProvider, mInstanceAllocator);
+        newInstance = MakeShared<ComponentInstance>(mAllocator, *mAllocator, info, *mStorage, mImageInfoProvider);
         break;
 
     default:
         return {{}, AOS_ERROR_WRAP(ErrorEnum::eNotSupported)};
     }
 
+    if (!newInstance) {
+        return {nullptr, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
+
     if (auto err = newInstance->Init(); !err.IsNone()) {
         // Do not leave invalid instance in storage.
         if (auto rmErr = newInstance->Remove(); !rmErr.IsNone()) {
@@ -722,7 +737,12 @@ uint64_t InstanceManager::FindIndexForNewInstance(const String& itemID, const St
 UniquePtr<InstanceInfo> InstanceManager::CreateInfo(
     const InstanceIdent& id, const String& nodeID, const String& runtimeID, const RunInstanceRequest& request)
 {
-    auto info = MakeUnique<InstanceInfo>(&mAllocator);
+    auto info = MakeUnique<InstanceInfo>(mAllocator);
+    if (!info) {
+        LOG_ERR() << "Can't allocate instance info" << Log::Field(ErrorEnum::eNoMemory);
+
+        return info;
+    }
 
     info->mInstanceIdent      = id;
     info->mManifestDigest     = "";
diff --git a/src/core/cm/launcher/instancemanager.hpp b/src/core/cm/launcher/instancemanager.hpp
index 29827465c..25187f88e 100644
--- a/src/core/cm/launcher/instancemanager.hpp
+++ b/src/core/cm/launcher/instancemanager.hpp
@@ -34,6 +34,7 @@ class InstanceManager {
     /**
      * Initializes the instance manager with configuration and required interfaces.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config Configuration object.
      * @param imageInfoProvider Interface for retrieving service information from images.
      * @param storageState Interface for managing storage and state partitions.
@@ -42,7 +43,7 @@ class InstanceManager {
      * @param storage Interface to persistent storage.
      * @return Error.
      */
-    Error Init(const Config& config, imagemanager::ItemInfoProviderItf& itemInfoProvider,
+    Error Init(AllocatorItf& allocator, const Config& config, imagemanager::ItemInfoProviderItf& itemInfoProvider,
         storagestate::StorageStateItf& storageState, oci::OCISpecItf& ociSpec, IdentifierPoolValidator gidValidator,
         IdentifierPoolValidator uidValidator, StorageItf& storage);
 
@@ -250,15 +251,6 @@ class InstanceManager {
 
 private:
     static constexpr auto cRemovePeriod = Time::cDay;
-    // LoadInstancesFromStorage: 1 StaticArray<InstanceInfo, cMaxNumInstances> alive throughout loop
-    // + up to cMaxNumInstances instances. CreateInstance(RunInstanceRequest): up to (cMaxNumInstances-1)
-    // existing instances + 1 InstanceInfo (CreateInfo) + 1 new instance. Both paths peak at
-    // cMaxNumInstances+1 simultaneous allocations.
-    static constexpr auto cAllocatorSize = sizeof(StaticArray<InstanceInfo, cMaxNumInstances>)
-        + Max(sizeof(ComponentInstance), sizeof(ServiceInstance)) * cMaxNumInstances * 2;
-    static constexpr auto cMaxNumAllocations     = 2 * cMaxNumInstances + 1;
-    static constexpr auto cInstanceAllocatorSize = sizeof(oci::ImageConfig) + sizeof(oci::ItemConfig)
-        + sizeof(InstanceStatus) + sizeof(oci::ImageIndex) + sizeof(EnvVarArray);
 
     Error SetStatus(const InstanceStatus& status);
     Error SetStatus(Array<InstanceStatus>& statuses, const InstanceStatus& status);
@@ -305,8 +297,7 @@ class InstanceManager {
     Timer mCleanInstancesTimer;
     Timer mInitTimer;
 
-    StaticAllocator<cAllocatorSize, cMaxNumAllocations> mAllocator;
-    StaticAllocator<cInstanceAllocatorSize>             mInstanceAllocator;
+    AllocatorItf* mAllocator {};
 
     StaticArray<SharedPtr<Instance>, cMaxNumInstances> mActiveInstances;
     StaticArray<SharedPtr<Instance>, cMaxNumInstances> mScheduledInstances;
diff --git a/src/core/cm/launcher/launcher.cpp b/src/core/cm/launcher/launcher.cpp
index b2cf1dde6..98f4c9f0b 100644
--- a/src/core/cm/launcher/launcher.cpp
+++ b/src/core/cm/launcher/launcher.cpp
@@ -33,8 +33,9 @@ class ShouldRebalanceVisitor : public StaticVisitor<bool> {
  * Public
  **********************************************************************************************************************/
 
-Error Launcher::Init(const Config& config, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
-    InstanceRunnerItf& runner, imagemanager::ItemInfoProviderItf& itemInfoProvider, oci::OCISpecItf& ociSpec,
+Error Launcher::Init(AllocatorItf& allocator, const Config& config,
+    nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider, InstanceRunnerItf& runner,
+    imagemanager::ItemInfoProviderItf& itemInfoProvider, oci::OCISpecItf& ociSpec,
     unitconfig::NodeConfigProviderItf& nodeConfigProvider, storagestate::StorageStateItf& storageState,
     MonitoringProviderItf& monitorProvider, alerts::AlertsProviderItf& alertsProvider,
     iamclient::IdentProviderItf& identProvider, IdentifierPoolValidator gidValidator,
@@ -42,6 +43,7 @@ Error Launcher::Init(const Config& config, nodeinfoprovider::NodeInfoProviderItf
 {
     LOG_DBG() << "Init Launcher";
 
+    mAllocator          = &allocator;
     mConfig             = config;
     mStorage            = &storage;
     mNodeInfoProvider   = &nodeInfoProvider;
@@ -53,17 +55,17 @@ Error Launcher::Init(const Config& config, nodeinfoprovider::NodeInfoProviderItf
     mIdentProvider      = &identProvider;
     mSender             = &sender;
 
-    auto err
-        = mInstanceManager.Init(config, itemInfoProvider, storageState, ociSpec, gidValidator, uidValidator, storage);
+    auto err = mInstanceManager.Init(
+        allocator, config, itemInfoProvider, storageState, ociSpec, gidValidator, uidValidator, storage);
     if (!err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
 
-    mImageInfoProvider.Init(itemInfoProvider, ociSpec);
+    mImageInfoProvider.Init(allocator, itemInfoProvider, ociSpec);
 
-    mRunRequestsLoader.Init(storage, mInstanceManager, mImageInfoProvider);
-    mNodeManager.Init(*mNodeInfoProvider, *mNodeConfigProvider, *mRunner, mOverrideEnvVarsProcessor);
-    mBalancer.Init(mInstanceManager, mImageInfoProvider, mNodeManager, *mMonitorProvider, *mRunner);
+    mRunRequestsLoader.Init(allocator, storage, mInstanceManager, mImageInfoProvider);
+    mNodeManager.Init(allocator, *mNodeInfoProvider, *mNodeConfigProvider, *mRunner, mOverrideEnvVarsProcessor);
+    mBalancer.Init(allocator, mInstanceManager, mImageInfoProvider, mNodeManager, *mMonitorProvider, *mRunner);
 
     if (err = mOverrideEnvVarsProcessor.Init(config, storage, sender, *this); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -109,7 +111,10 @@ Error Launcher::Start()
     }
 
     // Set initial subjects list.
-    auto subjects = MakeUnique<SubjectArray>(&mAllocator);
+    auto subjects = MakeUnique<SubjectArray>(mAllocator);
+    if (!subjects) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mIdentProvider->GetSubjects(*subjects); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -300,7 +305,13 @@ void Launcher::UpdateInstanceStatuses()
     const auto  totalSize              = activeInstances.Size() + preinstalledComponents.Size();
 
     // Copy old statuses.
-    auto oldInstanceStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(&mAllocator);
+    auto oldInstanceStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(mAllocator);
+    if (!oldInstanceStatuses) {
+        LOG_ERR() << "Failed to allocate old instance statuses" << Log::Field(AOS_ERROR_WRAP(ErrorEnum::eNoMemory));
+
+        return;
+    }
+
     if (auto err = oldInstanceStatuses->Assign(mInstanceStatuses); !err.IsNone()) {
         LOG_ERR() << "Failed to copy old instance statuses" << Log::Field(AOS_ERROR_WRAP(err));
 
@@ -340,7 +351,12 @@ void Launcher::UpdateInstanceStatuses()
     }
 
     // Find new statuses.
-    auto changedStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(&mAllocator);
+    auto changedStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(mAllocator);
+    if (!changedStatuses) {
+        LOG_ERR() << "Failed to allocate changed statuses" << Log::Field(AOS_ERROR_WRAP(ErrorEnum::eNoMemory));
+
+        return;
+    }
 
     for (size_t i = 0; i < mInstanceStatuses.Size(); ++i) {
         auto newStatus = !oldInstanceStatuses->Contains(mInstanceStatuses[i]);
@@ -388,7 +404,11 @@ Error Launcher::BalanceInstances(UniqueLock<Mutex>& lock, bool rebalance)
     LOG_DBG() << "Balance instances" << Log::Field("rebalance", rebalance);
 
     // Create instances from run requests.
-    auto instances = MakeUnique<StaticArray<SharedPtr<Instance>, cMaxNumInstances>>(&mAllocator);
+    auto instances = MakeUnique<StaticArray<SharedPtr<Instance>, cMaxNumInstances>>(mAllocator);
+    if (!instances) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
     mRunRequestsLoader.CreateInstances(mNodeManager.GetNodes(), *instances);
 
     auto runErr = mBalancer.RunInstances(lock, *instances, rebalance);
diff --git a/src/core/cm/launcher/launcher.hpp b/src/core/cm/launcher/launcher.hpp
index f717d5d61..b82383a63 100644
--- a/src/core/cm/launcher/launcher.hpp
+++ b/src/core/cm/launcher/launcher.hpp
@@ -47,6 +47,7 @@ class Launcher : public LauncherItf,
     /**
      * Initializes launcher object instance.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config configuration.
      * @param nodeInfoProvider interface providing information about all unit nodes.
      * @param runner instance runner interface.
@@ -63,8 +64,8 @@ class Launcher : public LauncherItf,
      * @param sender sender interface.
      * @return Error.
      */
-    Error Init(const Config& config, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider, InstanceRunnerItf& runner,
-        imagemanager::ItemInfoProviderItf& itemInfoProvider, oci::OCISpecItf& ociSpec,
+    Error Init(AllocatorItf& allocator, const Config& config, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
+        InstanceRunnerItf& runner, imagemanager::ItemInfoProviderItf& itemInfoProvider, oci::OCISpecItf& ociSpec,
         unitconfig::NodeConfigProviderItf& nodeConfigProvider, storagestate::StorageStateItf& storageState,
         MonitoringProviderItf& monitorProvider, alerts::AlertsProviderItf& alertsProvider,
         iamclient::IdentProviderItf& identProvider, IdentifierPoolValidator gidValidator,
@@ -137,8 +138,6 @@ class Launcher : public LauncherItf,
 
 private:
     static constexpr auto cMaxNumInstanceStatusListeners = 8;
-    static constexpr auto cAllocatorSize                 = 2 * sizeof(StaticArray<InstanceStatus, cMaxNumInstances>)
-        + sizeof(StaticArray<SharedPtr<Instance>, cMaxNumInstances>);
 
     void SendRunStatus();
 
@@ -169,6 +168,7 @@ class Launcher : public LauncherItf,
     void OnOverrideEnvVarsChanged() override;
 
     // External dependencies
+    AllocatorItf*                                                                     mAllocator {};
     Config                                                                            mConfig;
     StorageItf*                                                                       mStorage {};
     nodeinfoprovider::NodeInfoProviderItf*                                            mNodeInfoProvider {};
@@ -208,7 +208,6 @@ class Launcher : public LauncherItf,
     Mutex                                         mBalancingMutex;
     ConditionalVariable                           mAllNodesConnectedCondVar;
     bool                                          mIsRunning {};
-    StaticAllocator<cAllocatorSize>               mAllocator;
 };
 
 /** @}*/
diff --git a/src/core/cm/launcher/node.cpp b/src/core/cm/launcher/node.cpp
index 4eb880a0d..c4be15573 100644
--- a/src/core/cm/launcher/node.cpp
+++ b/src/core/cm/launcher/node.cpp
@@ -31,12 +31,12 @@ auto FilterByNode(const Array<SharedPtr<Instance>>& array, const String& nodeID)
  * Public
  **********************************************************************************************************************/
 
-void Node::Init(const String& id, unitconfig::NodeConfigProviderItf& nodeConfigProvider,
-    InstanceRunnerItf& instanceRunner, Allocator* allocator)
+void Node::Init(AllocatorItf& allocator, const String& id, unitconfig::NodeConfigProviderItf& nodeConfigProvider,
+    InstanceRunnerItf& instanceRunner)
 {
     mNodeConfigProvider = &nodeConfigProvider;
     mInstanceRunner     = &instanceRunner;
-    mAllocator          = allocator;
+    mAllocator          = &allocator;
 
     mInfo.mNodeID = id;
     mInfo.mState  = NodeStateEnum::eUnprovisioned;
@@ -268,8 +268,15 @@ Error Node::ReserveResources(const InstanceIdent& instanceIdent, const String& r
 Error Node::SendScheduledInstances(
     const Array<SharedPtr<Instance>>& scheduledInstances, const Array<InstanceStatus>& runningInstances)
 {
-    auto stopInstances  = MakeUnique<StaticArray<aos::InstanceInfo, cMaxNumInstances>>(mAllocator);
+    auto stopInstances = MakeUnique<StaticArray<aos::InstanceInfo, cMaxNumInstances>>(mAllocator);
+    if (!stopInstances) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
     auto startInstances = MakeUnique<StaticArray<aos::InstanceInfo, cMaxNumInstances>>(mAllocator);
+    if (!startInstances) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     for (const auto& status : FilterActiveNodeInstances(runningInstances, mInfo.mNodeID)) {
         // Check if the instance is scheduled on this node (ident, runtime, node, and service version must match).
@@ -318,8 +325,16 @@ Error Node::SendScheduledInstances(
 RetWithError<bool> Node::ResendInstances(
     const Array<SharedPtr<Instance>>& activeInstances, const Array<InstanceStatus>& runningInstances, bool forceRestart)
 {
-    auto   stopInstances        = MakeUnique<StaticArray<aos::InstanceInfo, cMaxNumInstances>>(mAllocator);
-    auto   startInstances       = MakeUnique<StaticArray<aos::InstanceInfo, cMaxNumInstances>>(mAllocator);
+    auto stopInstances = MakeUnique<StaticArray<aos::InstanceInfo, cMaxNumInstances>>(mAllocator);
+    if (!stopInstances) {
+        return {false, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
+
+    auto startInstances = MakeUnique<StaticArray<aos::InstanceInfo, cMaxNumInstances>>(mAllocator);
+    if (!startInstances) {
+        return {false, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
+
     size_t runningNodeInstances = 0;
 
     for (const auto& status : FilterActiveNodeInstances(runningInstances, mInfo.mNodeID)) {
diff --git a/src/core/cm/launcher/node.hpp b/src/core/cm/launcher/node.hpp
index 9b69e7f2d..aae04776f 100644
--- a/src/core/cm/launcher/node.hpp
+++ b/src/core/cm/launcher/node.hpp
@@ -30,13 +30,13 @@ class Node : public NodeItf {
     /**
      * Initializes node.
      *
+     * @param allocator allocator.
      * @param info node information.
      * @param nodeConfigProvider node config provider.
      * @param instanceRunner instance runner interface.
-     * @param allocator allocator.
      */
-    void Init(const String& id, unitconfig::NodeConfigProviderItf& nodeConfigProvider,
-        InstanceRunnerItf& instanceRunner, Allocator* allocator);
+    void Init(AllocatorItf& allocator, const String& id, unitconfig::NodeConfigProviderItf& nodeConfigProvider,
+        InstanceRunnerItf& instanceRunner);
 
     /**
      * Prepares node for balancing.
@@ -196,7 +196,7 @@ class Node : public NodeItf {
     StaticMap<StaticString<cIDLen>, size_t, cMaxNumNodeRuntimes>            mRuntimeAvailableCPU;
     StaticMap<StaticString<cResourceNameLen>, size_t, cMaxNumNodeResources> mMaxInstances;
 
-    Allocator* mAllocator {};
+    AllocatorItf* mAllocator {};
 };
 
 /** @}*/
diff --git a/src/core/cm/launcher/nodemanager.cpp b/src/core/cm/launcher/nodemanager.cpp
index e35b345fa..a6dfefe07 100644
--- a/src/core/cm/launcher/nodemanager.cpp
+++ b/src/core/cm/launcher/nodemanager.cpp
@@ -23,10 +23,11 @@ auto FilterActiveNodes(Array<Node>& array)
  * Public
  **********************************************************************************************************************/
 
-void NodeManager::Init(nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
+void NodeManager::Init(AllocatorItf& allocator, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
     unitconfig::NodeConfigProviderItf& nodeConfigProvider, InstanceRunnerItf& runner,
     OverrideEnvVarsProcessor& overrideEnvVarsProcessor)
 {
+    mAllocator                = &allocator;
     mNodeInfoProvider         = &nodeInfoProvider;
     mNodeConfigProvider       = &nodeConfigProvider;
     mRunner                   = &runner;
@@ -35,7 +36,10 @@ void NodeManager::Init(nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
 
 Error NodeManager::Start()
 {
-    auto nodes = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumNodes>>(&mAllocator);
+    auto nodes = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumNodes>>(mAllocator);
+    if (!nodes) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mNodeInfoProvider->GetAllNodeIDs(*nodes); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -43,7 +47,10 @@ Error NodeManager::Start()
 
     LOG_DBG() << "Start node manager" << Log::Field("nodes", nodes->Size());
 
-    auto nodeInfo = MakeUnique<UnitNodeInfo>(&mAllocator);
+    auto nodeInfo = MakeUnique<UnitNodeInfo>(mAllocator);
+    if (!nodeInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     for (const auto& nodeID : *nodes) {
         if (auto err = mNodeInfoProvider->GetNodeInfo(nodeID, *nodeInfo); !err.IsNone()) {
@@ -59,7 +66,7 @@ Error NodeManager::Start()
         // Add online provisioned node
         mNodes.EmplaceBack();
 
-        mNodes.Back().Init(nodeInfo->mNodeID, *mNodeConfigProvider, *mRunner, &mNodeAllocator);
+        mNodes.Back().Init(*mAllocator, nodeInfo->mNodeID, *mNodeConfigProvider, *mRunner);
         mNodes.Back().UpdateInfo(*nodeInfo);
     }
 
@@ -105,11 +112,19 @@ Error NodeManager::LoadSMDataForActiveInstances(
         if (node == nullptr) {
             LOG_ERR() << "Can't find node" << Log::Field("instanceID", instanceID) << Log::Field("nodeID", nodeID)
                       << Log::Field(AOS_ERROR_WRAP(ErrorEnum::eNotFound));
+
+            continue;
+        }
+
+        auto imageDescriptor = MakeUnique<oci::IndexContentDescriptor>(mAllocator);
+        if (!imageDescriptor) {
+            LOG_ERR() << "Can't allocate image descriptor" << Log::Field("instanceID", instanceID)
+                      << Log::Field(AOS_ERROR_WRAP(ErrorEnum::eNoMemory));
+
             continue;
         }
 
-        auto imageDescriptor = MakeUnique<oci::IndexContentDescriptor>(&mAllocator);
-        auto findDescErr     = FindImageDescriptor(
+        auto findDescErr = FindImageDescriptor(
             instanceID.mItemID, instance->GetInfo().mVersion, manifestDigest, imageInfoProvider, *imageDescriptor);
         if (!findDescErr.IsNone()) {
             LOG_ERR() << "Can't find image descriptor" << Log::Field("instanceID", instanceID)
@@ -146,7 +161,7 @@ Error NodeManager::NotifyNodeStatusReceived(const String& nodeID)
             return AOS_ERROR_WRAP(err);
         }
 
-        mNodes.Back().Init(nodeID, *mNodeConfigProvider, *mRunner, &mNodeAllocator);
+        mNodes.Back().Init(*mAllocator, nodeID, *mNodeConfigProvider, *mRunner);
 
         node = FindNode(nodeID);
     }
@@ -337,7 +352,7 @@ bool NodeManager::UpdateNodeInfo(const UnitNodeInfo& info)
             return false;
         }
 
-        mNodes.Back().Init(info.mNodeID, *mNodeConfigProvider, *mRunner, &mNodeAllocator);
+        mNodes.Back().Init(*mAllocator, info.mNodeID, *mNodeConfigProvider, *mRunner);
         mNodes.Back().UpdateInfo(info);
 
         return true;
@@ -351,7 +366,10 @@ bool NodeManager::UpdateNodeInfo(const UnitNodeInfo& info)
 Error NodeManager::FindImageDescriptor(const String& itemID, const String& version, const String& manifestDigest,
     ImageInfoProvider& imageInfoProvider, oci::IndexContentDescriptor& imageDescriptor)
 {
-    auto imageIndex = MakeUnique<oci::ImageIndex>(&mAllocator);
+    auto imageIndex = MakeUnique<oci::ImageIndex>(mAllocator);
+    if (!imageIndex) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = imageInfoProvider.GetImageIndex(itemID, version, *imageIndex); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
diff --git a/src/core/cm/launcher/nodemanager.hpp b/src/core/cm/launcher/nodemanager.hpp
index baf7367d5..441fe7384 100644
--- a/src/core/cm/launcher/nodemanager.hpp
+++ b/src/core/cm/launcher/nodemanager.hpp
@@ -9,7 +9,7 @@
 
 #include <core/cm/nodeinfoprovider/itf/nodeinfoprovider.hpp>
 #include <core/cm/storagestate/storagestate.hpp>
-#include <core/common/tools/allocator.hpp>
+#include <core/common/tools/memory.hpp>
 #include <core/common/tools/thread.hpp>
 
 #include "node.hpp"
@@ -29,12 +29,13 @@ class NodeManager {
     /**
      * Initializes node manager.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param nodeInfoProvider node info provider.
      * @param nodeConfigProvider node config provider.
      * @param runner instance runner interface.
      * @param overrideEnvVarsProcessor override env vars processor.
      */
-    void Init(nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
+    void Init(AllocatorItf& allocator, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
         unitconfig::NodeConfigProviderItf& nodeConfigProvider, InstanceRunnerItf& runner,
         OverrideEnvVarsProcessor& overrideEnvVarsProcessor);
 
@@ -144,11 +145,6 @@ class NodeManager {
 private:
     static constexpr auto cStatusUpdateTimeout = Time::cMinutes * 10;
 
-    static constexpr auto cAllocatorSize
-        = sizeof(StaticArray<StaticString<cIDLen>, cMaxNumNodes>) + sizeof(UnitNodeInfo);
-
-    static constexpr auto cNodeAllocatorSize = sizeof(StaticArray<aos::InstanceInfo, cMaxNumInstances>) * 2;
-
     Error FindImageDescriptor(const String& itemID, const String& version, const String& manifestDigest,
         ImageInfoProvider& imageInfoProvider, oci::IndexContentDescriptor& imageDescriptor);
 
@@ -159,8 +155,7 @@ class NodeManager {
     InstanceRunnerItf*                     mRunner {};
     OverrideEnvVarsProcessor*              mOverrideEnvVarsProcessor {};
 
-    StaticAllocator<cAllocatorSize>     mAllocator;
-    StaticAllocator<cNodeAllocatorSize> mNodeAllocator;
+    AllocatorItf* mAllocator {};
 
     StaticArray<Node, cMaxNumNodes> mNodes;
 
diff --git a/src/core/cm/launcher/runrequestsloader.cpp b/src/core/cm/launcher/runrequestsloader.cpp
index cf865001c..49752ac24 100644
--- a/src/core/cm/launcher/runrequestsloader.cpp
+++ b/src/core/cm/launcher/runrequestsloader.cpp
@@ -10,9 +10,10 @@
 
 namespace aos::cm::launcher {
 
-void RunRequestsLoader::Init(
-    StorageItf& storage, InstanceManager& instanceManager, ImageInfoProvider& imageInfoProvider)
+void RunRequestsLoader::Init(AllocatorItf& allocator, StorageItf& storage, InstanceManager& instanceManager,
+    ImageInfoProvider& imageInfoProvider)
 {
+    mAllocator         = &allocator;
     mStorage           = &storage;
     mInstanceManager   = &instanceManager;
     mImageInfoProvider = &imageInfoProvider;
@@ -88,14 +89,24 @@ void RunRequestsLoader::CreateInstances(const Array<Node>& nodes, Array<SharedPt
 Error RunRequestsLoader::GenerateInstances(
     const RunInstanceRequest& request, const Array<Node>& nodes, Array<SharedPtr<Instance>>& instances)
 {
-    auto imageIndex = MakeUnique<oci::ImageIndex>(&mAllocator);
+    auto imageIndex = MakeUnique<oci::ImageIndex>(mAllocator);
+    if (!imageIndex) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mImageInfoProvider->GetImageIndex(request.mItemID, request.mVersion, *imageIndex); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
 
-    auto combinedRuntimes = MakeUnique<CombinedRuntimesArray>(&mAllocator);
-    auto itemConfig       = MakeUnique<oci::ItemConfig>(&mAllocator);
+    auto combinedRuntimes = MakeUnique<CombinedRuntimesArray>(mAllocator);
+    if (!combinedRuntimes) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto itemConfig = MakeUnique<oci::ItemConfig>(mAllocator);
+    if (!itemConfig) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = CombinedRuntimes(*imageIndex, *combinedRuntimes, *itemConfig); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
diff --git a/src/core/cm/launcher/runrequestsloader.hpp b/src/core/cm/launcher/runrequestsloader.hpp
index 5211fe372..56b3cd4b2 100644
--- a/src/core/cm/launcher/runrequestsloader.hpp
+++ b/src/core/cm/launcher/runrequestsloader.hpp
@@ -7,6 +7,8 @@
 #ifndef AOS_CORE_CM_LAUNCHER_RUNREQUESTSLOADER_HPP_
 #define AOS_CORE_CM_LAUNCHER_RUNREQUESTSLOADER_HPP_
 
+#include <core/common/tools/memory.hpp>
+
 #include "instancemanager.hpp"
 #include "itf/storage.hpp"
 #include "node.hpp"
@@ -21,11 +23,13 @@ class RunRequestsLoader {
     /**
      * Initializes the loader.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param storage storage interface.
      * @param instanceManager instance manager.
      * @param imageInfoProvider image info provider.
      */
-    void Init(StorageItf& storage, InstanceManager& instanceManager, ImageInfoProvider& imageInfoProvider);
+    void Init(AllocatorItf& allocator, StorageItf& storage, InstanceManager& instanceManager,
+        ImageInfoProvider& imageInfoProvider);
 
     /**
      * Saves run requests to internal buffer and to storage.
@@ -55,9 +59,6 @@ class RunRequestsLoader {
     using CombinedRuntimesArray
         = StaticArray<StaticString<cRuntimeTypeLen>, oci::cMaxNumManifests * oci::cMaxNumRunners>;
 
-    static constexpr auto cCombinedRuntimesSize = sizeof(CombinedRuntimesArray);
-    static constexpr auto cAllocatorSize = sizeof(oci::ImageIndex) + cCombinedRuntimesSize + sizeof(oci::ItemConfig);
-
     Error GenerateInstances(
         const RunInstanceRequest& request, const Array<Node>& nodes, Array<SharedPtr<Instance>>& instances);
     Error CombinedRuntimes(
@@ -71,7 +72,7 @@ class RunRequestsLoader {
 
     StaticArray<RunInstanceRequest, cMaxNumInstances> mRunRequests;
 
-    StaticAllocator<cAllocatorSize> mAllocator;
+    AllocatorItf* mAllocator {};
 };
 
 } // namespace aos::cm::launcher
diff --git a/src/core/cm/launcher/storagestate.cpp b/src/core/cm/launcher/storagestate.cpp
index a3f1f259f..f19ef0037 100644
--- a/src/core/cm/launcher/storagestate.cpp
+++ b/src/core/cm/launcher/storagestate.cpp
@@ -14,8 +14,9 @@ namespace aos::cm::launcher {
  * Public
  **********************************************************************************************************************/
 
-void StorageState::Init(storagestate::StorageStateItf& storageState)
+void StorageState::Init(AllocatorItf& allocator, storagestate::StorageStateItf& storageState)
 {
+    mAllocator           = &allocator;
     mStorageStateManager = &storageState;
 }
 
@@ -38,10 +39,14 @@ Error StorageState::PrepareForBalancing()
     mAvailableStorage.Reset();
 
     if (mStorageStateManager->IsSamePartition()) {
-        mAvailableState = mAvailableStorage = MakeShared<size_t>(&mAllocator, 0);
+        mAvailableState = mAvailableStorage = MakeShared<size_t>(mAllocator, 0);
     } else {
-        mAvailableState   = MakeShared<size_t>(&mAllocator, 0);
-        mAvailableStorage = MakeShared<size_t>(&mAllocator, 0);
+        mAvailableState   = MakeShared<size_t>(mAllocator, 0);
+        mAvailableStorage = MakeShared<size_t>(mAllocator, 0);
+    }
+
+    if (!mAvailableState || !mAvailableStorage) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
 
     const auto& [stateSize, stateErr] = mStorageStateManager->GetTotalStateSize();
diff --git a/src/core/cm/launcher/storagestate.hpp b/src/core/cm/launcher/storagestate.hpp
index 70556a094..dec07d82c 100644
--- a/src/core/cm/launcher/storagestate.hpp
+++ b/src/core/cm/launcher/storagestate.hpp
@@ -8,7 +8,7 @@
 #define AOS_CORE_CM_LAUNCHER_STORAGESTATE_HPP_
 
 #include <core/cm/storagestate/itf/storagestate.hpp>
-#include <core/common/tools/allocator.hpp>
+#include <core/common/tools/memory.hpp>
 
 namespace aos::cm::launcher {
 
@@ -21,9 +21,10 @@ class StorageState {
     /**
      * Initializes storage state.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param storageState storage state interface.
      */
-    void Init(storagestate::StorageStateItf& storageState);
+    void Init(AllocatorItf& allocator, storagestate::StorageStateItf& storageState);
 
     /**
      * Starts storage state.
@@ -77,13 +78,11 @@ class StorageState {
         size_t requestedStorageSize, size_t requestedStateSize, String& storagePath, String& statePath);
 
 private:
-    static constexpr auto cAllocatorSize = sizeof(size_t) * 2;
-
     storagestate::StorageStateItf* mStorageStateManager {};
 
-    StaticAllocator<cAllocatorSize> mAllocator;
-    SharedPtr<size_t>               mAvailableState;
-    SharedPtr<size_t>               mAvailableStorage;
+    AllocatorItf*     mAllocator {};
+    SharedPtr<size_t> mAvailableState;
+    SharedPtr<size_t> mAvailableStorage;
 };
 
 } // namespace aos::cm::launcher
diff --git a/src/core/cm/launcher/tests/launcher.cpp b/src/core/cm/launcher/tests/launcher.cpp
index 91b073655..6ddefae17 100644
--- a/src/core/cm/launcher/tests/launcher.cpp
+++ b/src/core/cm/launcher/tests/launcher.cpp
@@ -17,6 +17,7 @@
 #include <core/cm/launcher/launcher.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tests/utils/utils.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 #include "stubs/alertsproviderstub.hpp"
 #include "stubs/identproviderstub.hpp"
@@ -143,6 +144,9 @@ class CMLauncherTest : public testing::Test {
         return mImageStore.GetManifestDigest(id.c_str(), imageID.c_str());
     }
 
+    // Allocator must be declared before any object allocated from it to ensure correct destruction order.
+    HeapAllocator mAllocator;
+
     // Stub objects
     alerts::AlertsProviderStub             mAlertsProvider;
     imagemanager::ImageStoreStub           mImageStore;
@@ -607,7 +611,7 @@ TEST_F(CMLauncherTest, InstancesWithInvalidImageAreRemovedOnStart)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -653,7 +657,7 @@ TEST_F(CMLauncherTest, InstancesWithOutdatedTTLRemovedOnStart)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -718,7 +722,7 @@ TEST_F(CMLauncherTest, CacheInstances)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -816,7 +820,7 @@ TEST_F(CMLauncherTest, Components)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -1505,7 +1509,7 @@ TEST_F(CMLauncherTest, Balancing)
 
         // Init launcher
         ASSERT_TRUE(mLauncher
-                        .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                        .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                             mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                             ValidateGID, ValidateUID, mStorage, mSender)
                         .IsNone());
@@ -1610,7 +1614,7 @@ TEST_F(CMLauncherTest, PlatformFiltering)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -1703,7 +1707,7 @@ TEST_F(CMLauncherTest, ResendInstancesOnMismatchedNodeStatus)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -1778,7 +1782,7 @@ TEST_F(CMLauncherTest, SubjectChanged)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -1851,7 +1855,7 @@ TEST_F(CMLauncherTest, TestSentInstanceInfo)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -1937,7 +1941,7 @@ TEST_F(CMLauncherTest, PreinstalledComponents)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -2025,7 +2029,7 @@ TEST_F(CMLauncherTest, SetStatusOnStart)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -2092,7 +2096,7 @@ TEST_F(CMLauncherTest, OverrideEnvVars)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -2215,7 +2219,7 @@ TEST_F(CMLauncherTest, MultiNodeInstance)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -2345,7 +2349,7 @@ TEST_F(CMLauncherTest, RebalancingWithStoredNotScheduledInstances)
 
     // Init launcher.
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -2442,7 +2446,7 @@ TEST_F(CMLauncherTest, CpuAlertRebalancingMovesLowerPriorityService)
 
     // Init launcher.
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -2546,7 +2550,7 @@ TEST_F(CMLauncherTest, ServiceUpdate)
 
     // Init launcher
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
@@ -2646,7 +2650,7 @@ TEST_F(CMLauncherTest, UnlimitedSharedResource)
     mInstanceRunner.Init(mLauncher, true, aos::InstanceStateEnum::eActive);
 
     ASSERT_TRUE(mLauncher
-                    .Init(CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
+                    .Init(mAllocator, CreateConfig(), mNodeInfoProvider, mInstanceRunner, mImageStore, mImageStore,
                         mResourceManager, mStorageState, mMonitoringProvider, mAlertsProvider, mIdentProvider,
                         ValidateGID, ValidateUID, mStorage, mSender)
                     .IsNone());
diff --git a/src/core/cm/nodeinfoprovider/nodeinfoprovider.cpp b/src/core/cm/nodeinfoprovider/nodeinfoprovider.cpp
index e29e2cd6d..4acbda10f 100644
--- a/src/core/cm/nodeinfoprovider/nodeinfoprovider.cpp
+++ b/src/core/cm/nodeinfoprovider/nodeinfoprovider.cpp
@@ -14,10 +14,12 @@ namespace aos::cm::nodeinfoprovider {
  * Public
  **********************************************************************************************************************/
 
-Error NodeInfoProvider::Init(const Config& config, iamclient::NodeInfoProviderItf& nodeInfoProvider)
+Error NodeInfoProvider::Init(
+    AllocatorItf& allocator, const Config& config, iamclient::NodeInfoProviderItf& nodeInfoProvider)
 {
     LOG_DBG() << "Init node info provider";
 
+    mAllocator        = &allocator;
     mNodeInfoProvider = &nodeInfoProvider;
 
     mConfig = config;
@@ -35,14 +37,20 @@ Error NodeInfoProvider::Start()
         return ErrorEnum::eWrongState;
     }
 
-    auto ids = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumNodes>>(&mAllocator);
+    auto ids = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumNodes>>(mAllocator);
+    if (!ids) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mNodeInfoProvider->GetAllNodeIDs(*ids); !err.IsNone()) {
         return err;
     }
 
     for (const auto& id : *ids) {
-        auto nodeInfo = MakeUnique<NodeInfo>(&mAllocator);
+        auto nodeInfo = MakeUnique<NodeInfo>(mAllocator);
+        if (!nodeInfo) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         if (auto err = mNodeInfoProvider->GetNodeInfo(id, *nodeInfo); !err.IsNone()) {
             return AOS_ERROR_WRAP(err);
@@ -249,7 +257,12 @@ NodeInfoCache* NodeInfoProvider::AddOrGetCacheItem(const String& nodeID)
 
 void NodeInfoProvider::NotifyListeners(const NodeInfoCache& info)
 {
-    auto unitNodeInfo = MakeUnique<UnitNodeInfo>(&mAllocator);
+    auto unitNodeInfo = MakeUnique<UnitNodeInfo>(mAllocator);
+    if (!unitNodeInfo) {
+        LOG_ERR() << "Can't allocate unit node info" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
 
     info.GetUnitNodeInfo(*unitNodeInfo);
 
diff --git a/src/core/cm/nodeinfoprovider/nodeinfoprovider.hpp b/src/core/cm/nodeinfoprovider/nodeinfoprovider.hpp
index 4f869b49f..e30ae6347 100644
--- a/src/core/cm/nodeinfoprovider/nodeinfoprovider.hpp
+++ b/src/core/cm/nodeinfoprovider/nodeinfoprovider.hpp
@@ -7,7 +7,6 @@
 #ifndef AOS_CORE_CM_NODEINFOPROVIDER_NODEINFOPROVIDER_HPP_
 #define AOS_CORE_CM_NODEINFOPROVIDER_NODEINFOPROVIDER_HPP_
 
-#include <core/common/tools/allocator.hpp>
 #include <core/common/tools/map.hpp>
 #include <core/common/tools/memory.hpp>
 #include <core/common/tools/thread.hpp>
@@ -34,11 +33,12 @@ class NodeInfoProvider : public NodeInfoProviderItf, public SMInfoReceiverItf, p
     /**
      * Initializes node info provider.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config configuration.
      * @param nodeInfoProvider IAM client node info provider.
      * @return Error.
      */
-    Error Init(const Config& config, iamclient::NodeInfoProviderItf& nodeInfoProvider);
+    Error Init(AllocatorItf& allocator, const Config& config, iamclient::NodeInfoProviderItf& nodeInfoProvider);
 
     /**
      * Starts node info provider.
@@ -112,8 +112,6 @@ class NodeInfoProvider : public NodeInfoProviderItf, public SMInfoReceiverItf, p
 
 private:
     static constexpr auto cListenersSize = 4;
-    static constexpr auto cAllocatorSize
-        = sizeof(UnitNodeInfo) + sizeof(StaticArray<StaticString<cIDLen>, cMaxNumNodes>);
 
     void OnNodeInfoChanged(const NodeInfo& info) override;
 
@@ -124,7 +122,7 @@ class NodeInfoProvider : public NodeInfoProviderItf, public SMInfoReceiverItf, p
     void           Run();
 
     mutable Mutex                                                       mMutex;
-    StaticAllocator<cAllocatorSize>                                     mAllocator;
+    AllocatorItf*                                                       mAllocator {};
     Thread<>                                                            mThread;
     ConditionalVariable                                                 mCondVar;
     bool                                                                mRunning {};
diff --git a/src/core/cm/nodeinfoprovider/tests/nodeinfoprovider.cpp b/src/core/cm/nodeinfoprovider/tests/nodeinfoprovider.cpp
index fb24bb6d8..3582188e5 100644
--- a/src/core/cm/nodeinfoprovider/tests/nodeinfoprovider.cpp
+++ b/src/core/cm/nodeinfoprovider/tests/nodeinfoprovider.cpp
@@ -15,6 +15,7 @@
 #include <core/common/tests/stubs/nodeinfoproviderstub.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tests/utils/utils.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 #include <core/cm/nodeinfoprovider/nodeinfoprovider.hpp>
 
@@ -93,6 +94,10 @@ class CMNodeInfoProviderTest : public Test {
 protected:
     void SetUp() override { tests::utils::InitLog(); }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     iamclient::NodeInfoProviderStub mIAMNodeInfoProvider;
     NodeInfoListenerStub            mListener;
     Config                          mConfig {Time::cMilliseconds * 100};
@@ -116,7 +121,7 @@ TEST_F(CMNodeInfoProviderTest, KnownInstancesAreProcessedOnStart)
         mIAMNodeInfoProvider.SetNodeInfo(*node);
     }
 
-    auto err = mNodeInfoProvider.Init(mConfig, mIAMNodeInfoProvider);
+    auto err = mNodeInfoProvider.Init(mAllocator, mConfig, mIAMNodeInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mNodeInfoProvider.SubscribeListener(mListener);
@@ -155,7 +160,7 @@ TEST_F(CMNodeInfoProviderTest, GetAllNodeIDs)
     mIAMNodeInfoProvider.SetNodeInfo(*CreateNodeInfo("node1", NodeStateEnum::eProvisioned, true));
     mIAMNodeInfoProvider.SetNodeInfo(*CreateNodeInfo("node2", NodeStateEnum::eProvisioned, true));
 
-    err = mNodeInfoProvider.Init(mConfig, mIAMNodeInfoProvider);
+    err = mNodeInfoProvider.Init(mAllocator, mConfig, mIAMNodeInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mNodeInfoProvider.Start();
@@ -177,7 +182,7 @@ TEST_F(CMNodeInfoProviderTest, GetNodeInfo)
     mIAMNodeInfoProvider.SetNodeInfo(*CreateNodeInfo("node1", NodeStateEnum::eProvisioned, true));
     mIAMNodeInfoProvider.SetNodeInfo(*CreateNodeInfo("node2", NodeStateEnum::eProvisioned, true));
 
-    auto err = mNodeInfoProvider.Init(Config {Time::cDay}, mIAMNodeInfoProvider);
+    auto err = mNodeInfoProvider.Init(mAllocator, Config {Time::cDay}, mIAMNodeInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mNodeInfoProvider.Start();
@@ -208,7 +213,7 @@ TEST_F(CMNodeInfoProviderTest, NodeWithoutSMComponent)
 {
     auto nodeInfo = CreateNodeInfo("node1", NodeStateEnum::eProvisioned, true, false);
 
-    auto err = mNodeInfoProvider.Init(mConfig, mIAMNodeInfoProvider);
+    auto err = mNodeInfoProvider.Init(mAllocator, mConfig, mIAMNodeInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mNodeInfoProvider.Start();
@@ -237,7 +242,7 @@ TEST_F(CMNodeInfoProviderTest, NodeWithSMComponent)
         CreateNodeInfo("node2", NodeStateEnum::eError, false),
     };
 
-    auto err = mNodeInfoProvider.Init(mConfig, mIAMNodeInfoProvider);
+    auto err = mNodeInfoProvider.Init(mAllocator, mConfig, mIAMNodeInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mNodeInfoProvider.Start();
@@ -300,7 +305,7 @@ TEST_F(CMNodeInfoProviderTest, NodeSetToOnlineIfBothIAMAndSMAreReceived)
 
     auto cNodeInfo = CreateNodeInfo("node1", NodeStateEnum::eProvisioned, false);
 
-    auto err = mNodeInfoProvider.Init(mConfig, mIAMNodeInfoProvider);
+    auto err = mNodeInfoProvider.Init(mAllocator, mConfig, mIAMNodeInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mNodeInfoProvider.Start();
@@ -340,7 +345,7 @@ TEST_F(CMNodeInfoProviderTest, NodeSetToUnprovisionedIfSMNotConnectedButNodeInfo
 
     auto cNodeInfo = CreateNodeInfo("node1", NodeStateEnum::eUnprovisioned, true);
 
-    auto err = mNodeInfoProvider.Init(mConfig, mIAMNodeInfoProvider);
+    auto err = mNodeInfoProvider.Init(mAllocator, mConfig, mIAMNodeInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mNodeInfoProvider.Start();
@@ -367,7 +372,7 @@ TEST_F(CMNodeInfoProviderTest, NotifySubscribersOnceSMInfoReceived)
 {
     const auto cNodeInfo = CreateNodeInfo("node1", NodeStateEnum::eProvisioned, false);
 
-    auto err = mNodeInfoProvider.Init(mConfig, mIAMNodeInfoProvider);
+    auto err = mNodeInfoProvider.Init(mAllocator, mConfig, mIAMNodeInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mNodeInfoProvider.Start();
diff --git a/src/core/cm/storagestate/storagestate.cpp b/src/core/cm/storagestate/storagestate.cpp
index 4f1bf36e8..f09670780 100644
--- a/src/core/cm/storagestate/storagestate.cpp
+++ b/src/core/cm/storagestate/storagestate.cpp
@@ -44,11 +44,12 @@ Error ToRelativePath(const String& base, const String& full, String& result)
  * Public
  **********************************************************************************************************************/
 
-Error StorageState::Init(const Config& config, StorageItf& storage, SenderItf& sender, fs::FSPlatformItf& fsPlatform,
-    fs::FSWatcherItf& fsWatcher, crypto::HasherItf& hasher)
+Error StorageState::Init(AllocatorItf& allocator, const Config& config, StorageItf& storage, SenderItf& sender,
+    fs::FSPlatformItf& fsPlatform, fs::FSWatcherItf& fsWatcher, crypto::HasherItf& hasher)
 {
     LOG_DBG() << "Init storage state";
 
+    mAllocator     = &allocator;
     mConfig        = config;
     mStorage       = &storage;
     mMessageSender = &sender;
@@ -136,7 +137,10 @@ Error StorageState::UpdateState(const aos::UpdateState& state)
         return AOS_ERROR_WRAP(err);
     }
 
-    auto storageStateInfo = MakeUnique<InstanceInfo>(&mAllocator);
+    auto storageStateInfo = MakeUnique<InstanceInfo>(mAllocator);
+    if (!storageStateInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mStorage->GetStorageStateInfo(state, *storageStateInfo); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -188,7 +192,10 @@ Error StorageState::AcceptState(const StateAcceptance& state)
         return mMessageSender->SendStateRequest(request);
     }
 
-    auto storageStateInfo = MakeUnique<InstanceInfo>(&mAllocator);
+    auto storageStateInfo = MakeUnique<InstanceInfo>(mAllocator);
+    if (!storageStateInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mStorage->GetStorageStateInfo(state, *storageStateInfo); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -212,11 +219,17 @@ Error StorageState::Setup(
 
     LOG_DBG() << "Setup storage and state" << setupParams;
 
-    auto storageData = MakeUnique<InstanceInfo>(&mAllocator);
+    auto storageData = MakeUnique<InstanceInfo>(mAllocator);
+    if (!storageData) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = mStorage->GetStorageStateInfo(instanceIdent, *storageData);
     if (err.Is(ErrorEnum::eNotFound)) {
-        storageData = MakeUnique<InstanceInfo>(&mAllocator);
+        storageData = MakeUnique<InstanceInfo>(mAllocator);
+        if (!storageData) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         storageData->mInstanceIdent = instanceIdent;
 
@@ -352,7 +365,10 @@ Error StorageState::InitStateWatching()
 {
     LOG_DBG() << "Init state watching";
 
-    auto infos = MakeUnique<InstanceInfoArray>(&mAllocator);
+    auto infos = MakeUnique<InstanceInfoArray>(mAllocator);
+    if (!infos) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mStorage->GetAllStorageStateInfo(*infos); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -473,7 +489,10 @@ Error StorageState::CheckChecksumAndSendUpdateRequest(const State& state)
 {
     LOG_DBG() << "Check checksum and send update request" << state;
 
-    auto stateContent = MakeUnique<StaticString<cStateLen>>(&mAllocator);
+    auto stateContent = MakeUnique<StaticString<cStateLen>>(mAllocator);
+    if (!stateContent) {
+        return ErrorEnum::eNoMemory;
+    }
 
     if (auto err = fs::ReadFileToString(state.mFilePath, *stateContent); !err.IsNone()) {
         return err;
@@ -574,7 +593,10 @@ Error StorageState::SetQuotas(const SetupParams& setupParams)
 
 Error StorageState::SendNewStateIfFileChanged(State& state)
 {
-    auto newState = MakeUnique<NewState>(&mAllocator);
+    auto newState = MakeUnique<NewState>(mAllocator);
+    if (!newState) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     static_cast<InstanceIdent&>(*newState) = state.mInstanceIdent;
 
diff --git a/src/core/cm/storagestate/storagestate.hpp b/src/core/cm/storagestate/storagestate.hpp
index 906ae936c..8cb0ed09e 100644
--- a/src/core/cm/storagestate/storagestate.hpp
+++ b/src/core/cm/storagestate/storagestate.hpp
@@ -35,6 +35,7 @@ class StorageState : public StateHandlerItf,
     /**
      * Initializes storage state instance.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config config object.
      * @param storage storage instance.
      * @param sender sender instance.
@@ -43,8 +44,8 @@ class StorageState : public StateHandlerItf,
      * @param cryptoProvider crypto provider instance.
      * @return Error.
      */
-    Error Init(const Config& config, StorageItf& storage, SenderItf& sender, fs::FSPlatformItf& fsPlatform,
-        fs::FSWatcherItf& fsWatcher, crypto::HasherItf& hasher);
+    Error Init(AllocatorItf& allocator, const Config& config, StorageItf& storage, SenderItf& sender,
+        fs::FSPlatformItf& fsPlatform, fs::FSWatcherItf& fsWatcher, crypto::HasherItf& hasher);
 
     /**
      * Starts storage state instance.
@@ -145,7 +146,6 @@ class StorageState : public StateHandlerItf,
     static constexpr auto cHashAlgorithm          = crypto::HashEnum::eSHA3_224;
     static constexpr auto cNumSendNewStateThreads = 1;
     static constexpr auto cInstanceStringLen      = 8;
-    static constexpr auto cAllocatorSize          = sizeof(InstanceInfoArray) + sizeof(NewState);
 
     struct State {
         State(const InstanceIdent& instanceIdent, const String& filePath, size_t quota)
@@ -189,7 +189,7 @@ class StorageState : public StateHandlerItf,
     StaticString<cFilePathLen> GetStoragePath(const InstanceIdent& instanceIdent) const;
     Error                      CalculateChecksum(const String& data, Array<uint8_t>& checksum);
 
-    StaticAllocator<cAllocatorSize>                                         mAllocator;
+    AllocatorItf*                                                           mAllocator {};
     ThreadPool<cNumSendNewStateThreads, cMaxNumInstances, 2 * cFilePathLen> mThreadPool;
     Mutex                                                                   mMutex;
     Config                                                                  mConfig;
diff --git a/src/core/cm/storagestate/tests/storagestate.cpp b/src/core/cm/storagestate/tests/storagestate.cpp
index 051620036..c5c0c0ab4 100644
--- a/src/core/cm/storagestate/tests/storagestate.cpp
+++ b/src/core/cm/storagestate/tests/storagestate.cpp
@@ -17,6 +17,7 @@
 #include <core/common/tests/mocks/fsmock.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tests/utils/utils.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 using namespace testing;
 
@@ -203,7 +204,7 @@ class StorageStateTests : public Test {
 
         tests::utils::InitLog();
 
-        EXPECT_TRUE(mCryptoProvider.Init().IsNone()) << "Failed to initialize crypto provider";
+        EXPECT_TRUE(mCryptoProvider.Init(mAllocator).IsNone()) << "Failed to initialize crypto provider";
 
         EXPECT_CALL(mFSPlatformMock, GetMountPoint)
             .WillRepeatedly(Return(RetWithError<StaticString<cFilePathLen>>(cTestDir.c_str())));
@@ -254,6 +255,10 @@ class StorageStateTests : public Test {
         return ErrorEnum::eNone;
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     crypto::DefaultCryptoProvider mCryptoProvider;
     StorageStub                   mStorageStub;
     StrictMock<FSPlatformMock>    mFSPlatformMock;
@@ -269,7 +274,8 @@ class StorageStateTests : public Test {
 
 TEST_F(StorageStateTests, StartStop)
 {
-    auto err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    auto err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     err = mStorageState.Start();
@@ -291,7 +297,8 @@ TEST_F(StorageStateTests, StorageQuotaNotSet)
 
     EXPECT_CALL(mFSPlatformMock, SetUserQuota(_, setupParams.mUID, setupParams.mStateQuota)).Times(1);
 
-    auto err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    auto err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mSenderMock, SendStateRequest).WillOnce(Return(ErrorEnum::eNone));
@@ -317,7 +324,8 @@ TEST_F(StorageStateTests, StateQuotaNotSet)
 
     StaticString<cFilePathLen> storagePath, statePath;
 
-    auto err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    auto err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     err = mStorageState.Start();
@@ -352,7 +360,8 @@ TEST_F(StorageStateTests, StorageAndStateQuotaNotSet)
 
     StaticString<cFilePathLen> storagePath, statePath;
 
-    auto err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    auto err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mFSPlatformMock, SetUserQuota).Times(0);
@@ -375,7 +384,8 @@ TEST_F(StorageStateTests, SetupOnDifferentPartitions)
         .WillOnce(Return(RetWithError<StaticString<cFilePathLen>>("partition1")))
         .WillOnce(Return(RetWithError<StaticString<cFilePathLen>>("partition2")));
 
-    auto err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    auto err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     err = mStorageState.Start();
@@ -406,7 +416,8 @@ TEST_F(StorageStateTests, SetupFailsOnSetUserQuotaError)
 {
     constexpr auto cSetQuotaError = ErrorEnum::eOutOfRange;
 
-    auto err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    auto err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     err = mStorageState.Start();
@@ -426,7 +437,8 @@ TEST_F(StorageStateTests, SetupFailsOnSetUserQuotaError)
 
 TEST_F(StorageStateTests, SetupSameInstance)
 {
-    auto err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    auto err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     err = mStorageState.Start();
@@ -494,7 +506,8 @@ TEST_F(StorageStateTests, GetInstanceCheckSum)
     auto err = AddInstanceIdent(cInstanceIdent, "getchecksum-content");
     EXPECT_TRUE(err.IsNone()) << "Failed to add instance ident: " << tests::utils::ErrorToStr(err);
 
-    err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mFSWatcherMock, Subscribe).WillOnce(Return(ErrorEnum::eNone));
@@ -521,7 +534,8 @@ TEST_F(StorageStateTests, Cleanup)
 {
     auto err = AddInstanceIdent(cInstanceIdent, "cleanup-content");
 
-    err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mFSWatcherMock, Subscribe).WillOnce(Return(ErrorEnum::eNone));
@@ -553,7 +567,8 @@ TEST_F(StorageStateTests, Remove)
 {
     auto err = AddInstanceIdent(cInstanceIdent, "remove-content");
 
-    err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mFSWatcherMock, Subscribe).WillOnce(Return(ErrorEnum::eNone));
@@ -585,7 +600,8 @@ TEST_F(StorageStateTests, UpdateState)
 
     auto err = AddInstanceIdent(cInstanceIdent, "outdated state content");
 
-    err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mFSWatcherMock, Subscribe).WillOnce(Return(ErrorEnum::eNone));
@@ -624,7 +640,8 @@ TEST_F(StorageStateTests, UpdateState)
 
 TEST_F(StorageStateTests, AcceptStateUnknownInstance)
 {
-    auto err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    auto err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     err = mStorageState.Start();
@@ -647,7 +664,8 @@ TEST_F(StorageStateTests, AcceptStateChecksumMismatch)
 {
     auto err = AddInstanceIdent(cInstanceIdent, "initial state content");
 
-    err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mFSWatcherMock, Subscribe).WillOnce(Return(ErrorEnum::eNone));
@@ -674,7 +692,8 @@ TEST_F(StorageStateTests, AcceptStateChecksumMismatch)
 
 TEST_F(StorageStateTests, AcceptStateWithRejectedStatus)
 {
-    auto err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    auto err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     err = mStorageState.Start();
@@ -733,7 +752,8 @@ TEST_F(StorageStateTests, UpdateAndAcceptStateFlow)
     err = CalculateChecksum(cUpdateStateContent, updateStateContentChecksum);
     EXPECT_TRUE(err.IsNone()) << "Failed to calculate checksum: " << tests::utils::ErrorToStr(err);
 
-    err = mStorageState.Init(mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
+    err = mStorageState.Init(
+        mAllocator, mConfig, mStorageStub, mSenderMock, mFSPlatformMock, mFSWatcherMock, mCryptoProvider);
     EXPECT_TRUE(err.IsNone()) << "Failed to initialize storage state: " << tests::utils::ErrorToStr(err);
 
     err = mStorageState.Start();
diff --git a/src/core/cm/unitconfig/tests/unitconfig.cpp b/src/core/cm/unitconfig/tests/unitconfig.cpp
index 658a5bd34..13d0fab83 100644
--- a/src/core/cm/unitconfig/tests/unitconfig.cpp
+++ b/src/core/cm/unitconfig/tests/unitconfig.cpp
@@ -13,6 +13,7 @@
 #include <core/cm/unitconfig/unitconfig.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tools/fs.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 using namespace testing;
 
@@ -119,6 +120,10 @@ class UnitConfigTest : public Test {
         ASSERT_TRUE(err.IsNone()) << "Failed to create test config file";
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     StrictMock<cm::nodeinfoprovider::NodeInfoProviderMock> mNodeInfoProvider;
     StrictMock<NodeConfigHandlerMock>                      mNodeConfigHandler;
     StrictMock<JSONProviderMock>                           mJSONProvider;
@@ -135,7 +140,7 @@ TEST_F(UnitConfigTest, InitWithValidConfig)
 
     SetupValidUnitConfig();
 
-    auto err = mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider);
+    auto err = mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider);
 
     EXPECT_TRUE(err.IsNone());
 }
@@ -146,14 +151,14 @@ TEST_F(UnitConfigTest, InitWithInvalidConfig)
 
     EXPECT_CALL(mJSONProvider, UnitConfigFromJSON(_, _)).WillOnce(Return(ErrorEnum::eInvalidArgument));
 
-    auto err = mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider);
+    auto err = mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider);
 
     EXPECT_TRUE(err.IsNone());
 }
 
 TEST_F(UnitConfigTest, InitWithMissingConfigFile)
 {
-    auto err = mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider);
+    auto err = mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider);
 
     EXPECT_TRUE(err.IsNone());
 
@@ -171,7 +176,8 @@ TEST_F(UnitConfigTest, GetUnitConfigStatusValid)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     UnitConfigStatus status;
     auto             err = mUnitConfig.GetUnitConfigStatus(status);
@@ -188,7 +194,7 @@ TEST_F(UnitConfigTest, GetUnitConfigStatusWithError)
 
     EXPECT_CALL(mJSONProvider, UnitConfigFromJSON(_, _)).WillOnce(Return(ErrorEnum::eInvalidArgument));
 
-    auto err = mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider);
+    auto err = mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider);
 
     EXPECT_TRUE(err.IsNone());
 
@@ -206,7 +212,8 @@ TEST_F(UnitConfigTest, GetNodeConfigByType)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     NodeConfig nodeConfig;
     auto       err = mUnitConfig.GetNodeConfig("", cTestNodeType, nodeConfig);
@@ -226,7 +233,8 @@ TEST_F(UnitConfigTest, GetNodeConfigByID)
     EXPECT_CALL(mJSONProvider, UnitConfigFromJSON(_, _))
         .WillOnce(DoAll(SetArgReferee<1>(config), Return(ErrorEnum::eNone)));
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     NodeConfig nodeConfig;
     auto       err = mUnitConfig.GetNodeConfig(cTestNodeID, "", nodeConfig);
@@ -243,7 +251,8 @@ TEST_F(UnitConfigTest, GetNodeConfigNotFound)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     NodeConfig nodeConfig;
     auto       err = mUnitConfig.GetNodeConfig("nonexistent", "unknown", nodeConfig);
@@ -263,7 +272,8 @@ TEST_F(UnitConfigTest, CheckUnitConfigValidVersion)
     EXPECT_CALL(mJSONProvider, UnitConfigFromJSON(_, _))
         .WillOnce(DoAll(SetArgReferee<1>(config), Return(ErrorEnum::eNone)));
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     auto newUnitConfig = CreateTestUnitConfigWithNodeID("2.0.0");
 
@@ -293,7 +303,8 @@ TEST_F(UnitConfigTest, CheckUnitConfigSameVersion)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     auto sameVersionConfig = CreateTestUnitConfig("1.0.0");
 
@@ -307,7 +318,8 @@ TEST_F(UnitConfigTest, CheckUnitConfigLowerVersion)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     auto lowerVersionConfig = CreateTestUnitConfig("0.9.0");
 
@@ -321,7 +333,8 @@ TEST_F(UnitConfigTest, UpdateUnitConfigSuccess)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     auto newUnitConfig = CreateTestUnitConfig("2.0.0");
 
@@ -347,7 +360,8 @@ TEST_F(UnitConfigTest, UpdateUnitConfigSameVersion)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     auto sameVersionConfig = CreateTestUnitConfig("1.0.0");
 
@@ -361,7 +375,8 @@ TEST_F(UnitConfigTest, OnNodeInfoChangedUpdatesConfig)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     UnitNodeInfo nodeInfo = CreateTestNodeInfo();
 
@@ -382,7 +397,8 @@ TEST_F(UnitConfigTest, OnNodeInfoChangedSkipsIfVersionMatches)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     UnitNodeInfo nodeInfo = CreateTestNodeInfo();
 
@@ -397,7 +413,8 @@ TEST_F(UnitConfigTest, OnNodeInfoChangedSkipsIfVersionMatches)
 
 TEST_F(UnitConfigTest, OnNodeInfoChangedSkipsWhenUnitConfigAbsent)
 {
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     UnitConfigStatus status;
     ASSERT_TRUE(mUnitConfig.GetUnitConfigStatus(status).IsNone());
@@ -415,7 +432,8 @@ TEST_F(UnitConfigTest, OnNodeInfoChangedWithUnitConfigError)
 
     EXPECT_CALL(mJSONProvider, UnitConfigFromJSON(_, _)).WillOnce(Return(ErrorEnum::eInvalidArgument));
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     UnitNodeInfo nodeInfo = CreateTestNodeInfo();
 
@@ -428,7 +446,8 @@ TEST_F(UnitConfigTest, VersionComparisonPrerelease)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     auto prereleaseVersion = CreateTestUnitConfig("1.0.0-alpha");
     auto err               = mUnitConfig.CheckUnitConfig(prereleaseVersion);
@@ -445,7 +464,8 @@ TEST_F(UnitConfigTest, UpdateUnitConfigSkipsOfflineNodeThenSendsOnConnect)
 
     SetupValidUnitConfig();
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     auto newUnitConfig = CreateTestUnitConfig("2.0.0");
 
@@ -504,7 +524,8 @@ TEST_F(UnitConfigTest, CheckUnitConfigMultipleNodes)
     EXPECT_CALL(mJSONProvider, UnitConfigFromJSON(_, _))
         .WillOnce(DoAll(SetArgReferee<1>(config), Return(ErrorEnum::eNone)));
 
-    ASSERT_TRUE(mUnitConfig.Init({cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
+    ASSERT_TRUE(
+        mUnitConfig.Init(mAllocator, {cTestConfigFile}, mNodeInfoProvider, mNodeConfigHandler, mJSONProvider).IsNone());
 
     aos::UnitConfig newUnitConfig;
     newUnitConfig.mVersion = "2.0.0";
diff --git a/src/core/cm/unitconfig/unitconfig.cpp b/src/core/cm/unitconfig/unitconfig.cpp
index 98aee4419..937179637 100644
--- a/src/core/cm/unitconfig/unitconfig.cpp
+++ b/src/core/cm/unitconfig/unitconfig.cpp
@@ -16,11 +16,13 @@ namespace aos::cm::unitconfig {
  * Public
  **********************************************************************************************************************/
 
-Error UnitConfig::Init(const Config& config, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
-    NodeConfigHandlerItf& nodeConfigHandler, JSONProviderItf& jsonProvider)
+Error UnitConfig::Init(AllocatorItf& allocator, const Config& config,
+    nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider, NodeConfigHandlerItf& nodeConfigHandler,
+    JSONProviderItf& jsonProvider)
 {
     LOG_DBG() << "Init unit config";
 
+    mAllocator         = &allocator;
     mUnitConfigFile    = config.mUnitConfigFile;
     mNodeInfoProvider  = &nodeInfoProvider;
     mNodeConfigHandler = &nodeConfigHandler;
@@ -83,7 +85,10 @@ Error UnitConfig::CheckUnitConfig(const aos::UnitConfig& config)
     }
 
     for (const auto& id : nodeIds) {
-        auto nodeInfo = MakeUnique<UnitNodeInfo>(&mAllocator);
+        auto nodeInfo = MakeUnique<UnitNodeInfo>(mAllocator);
+        if (!nodeInfo) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         if (auto err = mNodeInfoProvider->GetNodeInfo(id, *nodeInfo); !err.IsNone()) {
             return AOS_ERROR_WRAP(err);
@@ -102,7 +107,10 @@ Error UnitConfig::CheckUnitConfig(const aos::UnitConfig& config)
         }
 
         if (nodeConfigStatus.mVersion != config.mVersion || !nodeConfigStatus.mError.IsNone()) {
-            auto nodeConfig = MakeUnique<NodeConfig>(&mAllocator);
+            auto nodeConfig = MakeUnique<NodeConfig>(mAllocator);
+            if (!nodeConfig) {
+                return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+            }
 
             if (auto err = FindNodeConfig(nodeInfo->mNodeID, nodeInfo->mNodeType, config, *nodeConfig); !err.IsNone()) {
                 return err;
@@ -143,7 +151,10 @@ Error UnitConfig::UpdateUnitConfig(const aos::UnitConfig& unitConfig)
 
     mUnitConfig = unitConfig;
 
-    auto unitConfigJSON = MakeUnique<StaticString<cUnitConfigJSONLen>>(&mAllocator);
+    auto unitConfigJSON = MakeUnique<StaticString<cUnitConfigJSONLen>>(mAllocator);
+    if (!unitConfigJSON) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mJSONProvider->UnitConfigToJSON(unitConfig, *unitConfigJSON); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -163,8 +174,15 @@ Error UnitConfig::UpdateUnitConfig(const aos::UnitConfig& unitConfig)
     }
 
     for (const auto& id : nodeIds) {
-        auto nodeConfig = MakeUnique<NodeConfig>(&mAllocator);
-        auto nodeInfo   = MakeUnique<UnitNodeInfo>(&mAllocator);
+        auto nodeConfig = MakeUnique<NodeConfig>(mAllocator);
+        if (!nodeConfig) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
+
+        auto nodeInfo = MakeUnique<UnitNodeInfo>(mAllocator);
+        if (!nodeInfo) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         if (auto err = mNodeInfoProvider->GetNodeInfo(id, *nodeInfo); !err.IsNone()) {
             return AOS_ERROR_WRAP(err);
@@ -227,7 +245,12 @@ void UnitConfig::OnNodeInfoChanged(const UnitNodeInfo& info)
         return;
     }
 
-    auto nodeConfig = MakeUnique<NodeConfig>(&mAllocator);
+    auto nodeConfig = MakeUnique<NodeConfig>(mAllocator);
+    if (!nodeConfig) {
+        LOG_ERR() << "Can't allocate node config" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
 
     if (auto err = FindNodeConfig(info.mNodeID, info.mNodeType, mUnitConfig, *nodeConfig); !err.IsNone()) {
         LOG_ERR() << "Error finding node config" << Log::Field(err);
@@ -250,7 +273,10 @@ Error UnitConfig::LoadConfig()
 {
     LOG_DBG() << "Load config";
 
-    auto unitConfig = MakeUnique<StaticString<cUnitConfigJSONLen>>(&mAllocator);
+    auto unitConfig = MakeUnique<StaticString<cUnitConfigJSONLen>>(mAllocator);
+    if (!unitConfig) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = fs::ReadFileToString(mUnitConfigFile, *unitConfig);
     if (!err.IsNone()) {
diff --git a/src/core/cm/unitconfig/unitconfig.hpp b/src/core/cm/unitconfig/unitconfig.hpp
index 0d1c02622..16ad28965 100644
--- a/src/core/cm/unitconfig/unitconfig.hpp
+++ b/src/core/cm/unitconfig/unitconfig.hpp
@@ -33,13 +33,14 @@ class UnitConfig : public UnitConfigItf, public NodeConfigProviderItf, public no
     /**
      * Initializes unit config.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config configuration.
      * @param nodeInfoProvider node info provider.
      * @param nodeConfigHandler node config handler.
      * @param jsonProvider JSON provider.
      * @return Error.
      */
-    Error Init(const Config& config, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
+    Error Init(AllocatorItf& allocator, const Config& config, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
         NodeConfigHandlerItf& nodeConfigHandler, JSONProviderItf& jsonProvider);
 
     /**
@@ -114,9 +115,7 @@ class UnitConfig : public UnitConfigItf, public NodeConfigProviderItf, public no
     Error           mUnitConfigError;
     UnitConfigState mUnitConfigState {UnitConfigStateEnum::eAbsent};
 
-    StaticAllocator<sizeof(NodeInfo) + sizeof(StaticString<cUnitConfigJSONLen>) + sizeof(NodeConfig)
-        + sizeof(UnitNodeInfo)>
-        mAllocator;
+    AllocatorItf* mAllocator {};
 
     StaticArray<NodeConfigStatus, cMaxNumNodes> mNodeConfigStatuses;
 
diff --git a/src/core/cm/updatemanager/desiredstatushandler.cpp b/src/core/cm/updatemanager/desiredstatushandler.cpp
index 7c8ce5f33..de5feab69 100644
--- a/src/core/cm/updatemanager/desiredstatushandler.cpp
+++ b/src/core/cm/updatemanager/desiredstatushandler.cpp
@@ -14,12 +14,13 @@ namespace aos::cm::updatemanager {
  * Public
  **********************************************************************************************************************/
 
-Error DesiredStatusHandler::Init(iamclient::NodeHandlerItf& nodeHandler, unitconfig::UnitConfigItf& unitConfig,
-    imagemanager::ImageManagerItf& imageManager, launcher::LauncherItf& launcher, UnitStatusHandler& unitStatusHandler,
-    StorageItf& storage)
+Error DesiredStatusHandler::Init(AllocatorItf& allocator, iamclient::NodeHandlerItf& nodeHandler,
+    unitconfig::UnitConfigItf& unitConfig, imagemanager::ImageManagerItf& imageManager, launcher::LauncherItf& launcher,
+    UnitStatusHandler& unitStatusHandler, StorageItf& storage)
 {
     LOG_DBG() << "Init desired status handler";
 
+    mAllocator         = &allocator;
     mNodeHandler       = &nodeHandler;
     mUnitConfig        = &unitConfig;
     mUnitStatusHandler = &unitStatusHandler;
@@ -331,7 +332,10 @@ void DesiredStatusHandler::SetState(UpdateState state)
 
 Error DesiredStatusHandler::DownloadUpdateItems()
 {
-    auto itemsStatuses = MakeUnique<StaticArray<UpdateItemStatus, cMaxNumUpdateItems>>(&mAllocator);
+    auto itemsStatuses = MakeUnique<StaticArray<UpdateItemStatus, cMaxNumUpdateItems>>(mAllocator);
+    if (!itemsStatuses) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     LOG_DBG() << "Download update items" << Log::Field("count", mCurrentDesiredStatus.mUpdateItems.Size());
 
@@ -402,8 +406,15 @@ Error DesiredStatusHandler::InstallDesiredStatus()
 
 Error DesiredStatusHandler::LaunchInstances()
 {
-    auto runRequest        = MakeUnique<StaticArray<launcher::RunInstanceRequest, cMaxNumInstances>>(&mAllocator);
-    auto instancesStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(&mAllocator);
+    auto runRequest = MakeUnique<StaticArray<launcher::RunInstanceRequest, cMaxNumInstances>>(mAllocator);
+    if (!runRequest) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto instancesStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(mAllocator);
+    if (!instancesStatuses) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     LOG_DBG() << "Launch instances" << Log::Field("count", mCurrentDesiredStatus.mInstances.Size());
 
@@ -458,7 +469,10 @@ Error DesiredStatusHandler::LaunchInstances()
 
 Error DesiredStatusHandler::WaitInstancesActive()
 {
-    auto instancesStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(&mAllocator);
+    auto instancesStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(mAllocator);
+    if (!instancesStatuses) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     while (mIsRunning) {
         if (auto err = mLauncher->GetInstancesStatuses(*instancesStatuses); !err.IsNone()) {
@@ -491,7 +505,10 @@ Error DesiredStatusHandler::WaitInstancesActive()
 
 Error DesiredStatusHandler::FinalizeUpdate()
 {
-    auto itemsStatuses = MakeUnique<StaticArray<UpdateItemStatus, cMaxNumUpdateItems>>(&mAllocator);
+    auto itemsStatuses = MakeUnique<StaticArray<UpdateItemStatus, cMaxNumUpdateItems>>(mAllocator);
+    if (!itemsStatuses) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     LOG_DBG() << "Install update items" << Log::Field("count", mCurrentDesiredStatus.mUpdateItems.Size());
 
@@ -534,7 +551,12 @@ bool DesiredStatusHandler::IsUpdateRequired(const DesiredStatus& desiredStatus)
 
 bool DesiredStatusHandler::IsUpdateItemsRequired(const DesiredStatus& desiredStatus) const
 {
-    auto itemsStatuses = MakeUnique<StaticArray<UpdateItemStatus, cMaxNumUpdateItems>>(&mAllocator);
+    auto itemsStatuses = MakeUnique<StaticArray<UpdateItemStatus, cMaxNumUpdateItems>>(mAllocator);
+    if (!itemsStatuses) {
+        LOG_ERR() << "Failed to allocate update items statuses" << Log::Field(ErrorEnum::eNoMemory);
+
+        return true;
+    }
 
     if (auto err = mImageManager->GetUpdateItemsStatuses(*itemsStatuses); !err.IsNone()) {
         LOG_ERR() << "Failed to get update items statuses" << Log::Field(err);
@@ -594,7 +616,12 @@ bool DesiredStatusHandler::IsSameUpdate(const DesiredStatus& desiredStatus) cons
 
 bool DesiredStatusHandler::IsUpdateInstancesRequired(const DesiredStatus& desiredStatus) const
 {
-    auto instancesStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(&mAllocator);
+    auto instancesStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(mAllocator);
+    if (!instancesStatuses) {
+        LOG_ERR() << "Failed to allocate instances statuses" << Log::Field(ErrorEnum::eNoMemory);
+
+        return true;
+    }
 
     if (auto err = mLauncher->GetInstancesStatuses(*instancesStatuses); !err.IsNone()) {
         LOG_ERR() << "Failed to get instances statuses" << Log::Field(err);
diff --git a/src/core/cm/updatemanager/desiredstatushandler.hpp b/src/core/cm/updatemanager/desiredstatushandler.hpp
index 7fbc831de..eaba0dcc4 100644
--- a/src/core/cm/updatemanager/desiredstatushandler.hpp
+++ b/src/core/cm/updatemanager/desiredstatushandler.hpp
@@ -31,6 +31,7 @@ class DesiredStatusHandler : private instancestatusprovider::ListenerItf {
     /**
      * Initializes desired status handler.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param nodeHandler node handler.
      * @param unitConfig unit config interface.
      * @param imageManager image manager.
@@ -39,7 +40,7 @@ class DesiredStatusHandler : private instancestatusprovider::ListenerItf {
      * @param storage storage interface.
      * @return Error.
      */
-    Error Init(iamclient::NodeHandlerItf& nodeHandler, unitconfig::UnitConfigItf& unitConfig,
+    Error Init(AllocatorItf& allocator, iamclient::NodeHandlerItf& nodeHandler, unitconfig::UnitConfigItf& unitConfig,
         imagemanager::ImageManagerItf& imageManager, launcher::LauncherItf& launcher,
         UnitStatusHandler& unitStatusHandler, StorageItf& storage);
 
@@ -67,11 +68,6 @@ class DesiredStatusHandler : private instancestatusprovider::ListenerItf {
 
 private:
     static constexpr auto cWaitActiveTimeout = Time::cMinutes * 10;
-    static constexpr auto cAllocatorSize     = Max(sizeof(StaticArray<UpdateItemStatus, cMaxNumUpdateItems>),
-                                                   sizeof(StaticArray<launcher::RunInstanceRequest, cMaxNumInstances>)
-                                                       + sizeof(StaticArray<InstanceStatus, cMaxNumInstances>))
-        + Max(sizeof(StaticArray<UpdateItemStatus, cMaxNumUpdateItems>),
-            sizeof(StaticArray<launcher::RunInstanceRequest, cMaxNumInstances>));
 
     // instancestatusprovider::ListenerItf implementation
     void OnInstancesStatusesChanged(const Array<InstanceStatus>& statuses) override;
@@ -109,7 +105,7 @@ class DesiredStatusHandler : private instancestatusprovider::ListenerItf {
     bool        mCancelCurrentUpdate {};
     UpdateState mUpdateState {};
 
-    mutable StaticAllocator<cAllocatorSize> mAllocator {};
+    AllocatorItf* mAllocator {};
 };
 
 /** @}*/
diff --git a/src/core/cm/updatemanager/tests/updatemanager.cpp b/src/core/cm/updatemanager/tests/updatemanager.cpp
index b0d38895a..4969ccccb 100644
--- a/src/core/cm/updatemanager/tests/updatemanager.cpp
+++ b/src/core/cm/updatemanager/tests/updatemanager.cpp
@@ -12,6 +12,7 @@
 #include <core/common/tests/mocks/nodehandlermock.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tests/utils/utils.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/common/tools/time.hpp>
 
 #include <core/cm/tests/mocks/nodeinfoprovidermock.hpp>
@@ -343,7 +344,7 @@ class UpdateManagerTest : public Test {
 
         Config config {cUnitStatusSendTimeout};
 
-        auto err = mUpdateManager.Init(config, mIdentProviderMock, mNodeHandlerMock, mUnitConfigMock,
+        auto err = mUpdateManager.Init(mAllocator, config, mIdentProviderMock, mNodeHandlerMock, mUnitConfigMock,
             mNodeInfoProviderMock, mImageManagerMock, mLauncherMock, mCloudConnectionMock, mSenderStub, mStorageStub);
         EXPECT_TRUE(err.IsNone()) << "Failed to initialize update manager: " << tests::utils::ErrorToStr(err);
 
@@ -429,6 +430,10 @@ class UpdateManagerTest : public Test {
         EXPECT_TRUE(err.IsNone()) << "Failed to stop update manager: " << tests::utils::ErrorToStr(err);
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     UpdateManager                                    mUpdateManager;
     NiceMock<iamclient::IdentProviderMock>           mIdentProviderMock;
     NiceMock<iamclient::NodeHandlerMock>             mNodeHandlerMock;
diff --git a/src/core/cm/updatemanager/unitstatushandler.cpp b/src/core/cm/updatemanager/unitstatushandler.cpp
index 14c0a61d0..3bd0f6e65 100644
--- a/src/core/cm/updatemanager/unitstatushandler.cpp
+++ b/src/core/cm/updatemanager/unitstatushandler.cpp
@@ -14,12 +14,13 @@ namespace aos::cm::updatemanager {
  * Public
  **********************************************************************************************************************/
 
-Error UnitStatusHandler::Init(const Config& config, iamclient::IdentProviderItf& identProvider,
+Error UnitStatusHandler::Init(AllocatorItf& allocator, const Config& config, iamclient::IdentProviderItf& identProvider,
     unitconfig::UnitConfigItf& unitConfig, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
     imagemanager::ItemStatusProviderItf& itemStatusProvider,
     instancestatusprovider::ProviderItf& instanceStatusProvider, cloudconnection::CloudConnectionItf& cloudConnection,
     SenderItf& sender)
 {
+    mAllocator              = &allocator;
     mIdentProvider          = &identProvider;
     mUnitConfig             = &unitConfig;
     mNodeInfoProvider       = &nodeInfoProvider;
@@ -443,7 +444,10 @@ Error UnitStatusHandler::SetNodesInfo()
 
 Error UnitStatusHandler::SetUpdateItemsStatus()
 {
-    auto itemsStatuses = MakeUnique<UpdateItemStatusArray>(&mAllocator);
+    auto itemsStatuses = MakeUnique<UpdateItemStatusArray>(mAllocator);
+    if (!itemsStatuses) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     mItemStatusProvider->GetUpdateItemsStatuses(*itemsStatuses);
 
@@ -467,7 +471,10 @@ Error UnitStatusHandler::SetInstancesStatus()
     mUnitStatus.mInstances.EmplaceValue();
     mUnitInstancesStatuses.Clear();
 
-    auto instancesStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(&mAllocator);
+    auto instancesStatuses = MakeUnique<StaticArray<InstanceStatus, cMaxNumInstances>>(mAllocator);
+    if (!instancesStatuses) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mInstanceStatusProvider->GetInstancesStatuses(*instancesStatuses); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
diff --git a/src/core/cm/updatemanager/unitstatushandler.hpp b/src/core/cm/updatemanager/unitstatushandler.hpp
index 7f07d8831..50692f498 100644
--- a/src/core/cm/updatemanager/unitstatushandler.hpp
+++ b/src/core/cm/updatemanager/unitstatushandler.hpp
@@ -14,6 +14,7 @@
 #include <core/common/iamclient/itf/identprovider.hpp>
 #include <core/common/instancestatusprovider/itf/instancestatusprovider.hpp>
 #include <core/common/tools/map.hpp>
+#include <core/common/tools/memory.hpp>
 #include <core/common/tools/optional.hpp>
 #include <core/common/tools/timer.hpp>
 
@@ -38,6 +39,7 @@ class UnitStatusHandler : private nodeinfoprovider::NodeInfoListenerItf,
     /**
      * Initializes unit status handler.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config update manager configuration.
      * @param identProvider identity provider.
      * @param unitConfig unit config interface.
@@ -48,10 +50,10 @@ class UnitStatusHandler : private nodeinfoprovider::NodeInfoListenerItf,
      * @param sender unit status sender.
      * @return Error.
      */
-    Error Init(const Config& config, iamclient::IdentProviderItf& identProvider, unitconfig::UnitConfigItf& unitConfig,
-        nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
-        imagemanager::ItemStatusProviderItf&   itemStatusProvider,
-        instancestatusprovider::ProviderItf&   instanceStatusProvider,
+    Error Init(AllocatorItf& allocator, const Config& config, iamclient::IdentProviderItf& identProvider,
+        unitconfig::UnitConfigItf& unitConfig, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
+        imagemanager::ItemStatusProviderItf& itemStatusProvider,
+        instancestatusprovider::ProviderItf& instanceStatusProvider,
         cloudconnection::CloudConnectionItf& cloudConnection, SenderItf& sender);
 
     /**
@@ -91,9 +93,6 @@ class UnitStatusHandler : private nodeinfoprovider::NodeInfoListenerItf,
     Error SetUpdateNodeStatus(const String& nodeID, const Error& updateErr);
 
 private:
-    static constexpr auto cAllocatorSize
-        = Max(sizeof(StaticArray<InstanceStatus, cMaxNumInstances>), sizeof(UpdateItemStatusArray));
-
     // nodeinfoprovider::NodeInfoListenerItf implementation
     void OnNodeInfoChanged(const UnitNodeInfo& info) override;
 
@@ -134,7 +133,7 @@ class UnitStatusHandler : private nodeinfoprovider::NodeInfoListenerItf,
     Mutex                                             mMutex;
     UnitStatus                                        mUnitStatus;
     StaticArray<UnitInstanceStatus, cMaxNumInstances> mUnitInstancesStatuses;
-    StaticAllocator<cAllocatorSize>                   mAllocator;
+    AllocatorItf*                                     mAllocator {};
     bool                                              mCloudConnected {};
     bool                                              mIsStatusProcessing {};
 
diff --git a/src/core/cm/updatemanager/updatemanager.cpp b/src/core/cm/updatemanager/updatemanager.cpp
index de7b5b95d..00ad0de46 100644
--- a/src/core/cm/updatemanager/updatemanager.cpp
+++ b/src/core/cm/updatemanager/updatemanager.cpp
@@ -14,7 +14,7 @@ namespace aos::cm::updatemanager {
  * Public
  **********************************************************************************************************************/
 
-Error UpdateManager::Init(const Config& config, iamclient::IdentProviderItf& identProvider,
+Error UpdateManager::Init(AllocatorItf& allocator, const Config& config, iamclient::IdentProviderItf& identProvider,
     iamclient::NodeHandlerItf& nodeHandler, unitconfig::UnitConfigItf& unitConfig,
     nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider, imagemanager::ImageManagerItf& imageManager,
     launcher::LauncherItf& launcher, cloudconnection::CloudConnectionItf& cloudConnection, SenderItf& sender,
@@ -22,14 +22,14 @@ Error UpdateManager::Init(const Config& config, iamclient::IdentProviderItf& ide
 {
     LOG_DBG() << "Init update manager";
 
-    if (auto err
-        = mDesiredStatusHandler.Init(nodeHandler, unitConfig, imageManager, launcher, mUnitStatusHandler, storage);
+    if (auto err = mDesiredStatusHandler.Init(
+            allocator, nodeHandler, unitConfig, imageManager, launcher, mUnitStatusHandler, storage);
         !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
 
-    if (auto err = mUnitStatusHandler.Init(
-            config, identProvider, unitConfig, nodeInfoProvider, imageManager, launcher, cloudConnection, sender);
+    if (auto err = mUnitStatusHandler.Init(allocator, config, identProvider, unitConfig, nodeInfoProvider, imageManager,
+            launcher, cloudConnection, sender);
         !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
diff --git a/src/core/cm/updatemanager/updatemanager.hpp b/src/core/cm/updatemanager/updatemanager.hpp
index 5f0a02e29..140efbf09 100644
--- a/src/core/cm/updatemanager/updatemanager.hpp
+++ b/src/core/cm/updatemanager/updatemanager.hpp
@@ -27,6 +27,7 @@ class UpdateManager : public UpdateManagerItf {
     /**
      * Initializes update manager.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config update manager configuration.
      * @param identProvider identity provider.
      * @param nodeHandler node handler.
@@ -39,10 +40,11 @@ class UpdateManager : public UpdateManagerItf {
      * @param storage storage interface.
      * @return Error.
      */
-    Error Init(const Config& config, iamclient::IdentProviderItf& identProvider, iamclient::NodeHandlerItf& nodeHandler,
-        unitconfig::UnitConfigItf& unitConfig, nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider,
-        imagemanager::ImageManagerItf& imageManager, launcher::LauncherItf& launcher,
-        cloudconnection::CloudConnectionItf& cloudConnection, SenderItf& sender, StorageItf& storage);
+    Error Init(AllocatorItf& allocator, const Config& config, iamclient::IdentProviderItf& identProvider,
+        iamclient::NodeHandlerItf& nodeHandler, unitconfig::UnitConfigItf& unitConfig,
+        nodeinfoprovider::NodeInfoProviderItf& nodeInfoProvider, imagemanager::ImageManagerItf& imageManager,
+        launcher::LauncherItf& launcher, cloudconnection::CloudConnectionItf& cloudConnection, SenderItf& sender,
+        StorageItf& storage);
 
     /**
      * Starts update manager.
diff --git a/src/core/common/crypto/certloader.cpp b/src/core/common/crypto/certloader.cpp
index c64e32d37..bcfe966fe 100644
--- a/src/core/common/crypto/certloader.cpp
+++ b/src/core/common/crypto/certloader.cpp
@@ -24,10 +24,11 @@ constexpr auto cSchemeMaxLength = Max(sizeof(cSchemeFile), sizeof(cSchemePKCS11)
  * CertLoader
  **********************************************************************************************************************/
 
-Error CertLoader::Init(x509::ProviderItf& cryptoProvider, pkcs11::PKCS11Manager& pkcs11Manager)
+Error CertLoader::Init(AllocatorItf& allocator, x509::ProviderItf& cryptoProvider, pkcs11::PKCS11Manager& pkcs11Manager)
 {
     LOG_DBG() << "Init cert loader";
 
+    mAllocator      = &allocator;
     mCryptoProvider = &cryptoProvider;
     mPKCS11         = &pkcs11Manager;
 
@@ -73,7 +74,7 @@ RetWithError<SharedPtr<x509::CertificateChain>> CertLoader::LoadCertsChainByURL(
             return {nullptr, err};
         }
 
-        return pkcs11::Utils(session, *mCryptoProvider, mAllocator).FindCertificateChain(id, label);
+        return pkcs11::Utils(*mAllocator, session, *mCryptoProvider).FindCertificateChain(id, label);
     }
 
     return {nullptr, ErrorEnum::eInvalidArgument};
@@ -118,7 +119,7 @@ RetWithError<SharedPtr<PrivateKeyItf>> CertLoader::LoadPrivKeyByURL(const String
             return {nullptr, err};
         }
 
-        auto key = pkcs11::Utils(session, *mCryptoProvider, mAllocator).FindPrivateKey(id, label);
+        auto key = pkcs11::Utils(*mAllocator, session, *mCryptoProvider).FindPrivateKey(id, label);
 
         return {key.mValue.GetPrivKey(), key.mError};
     }
@@ -165,7 +166,11 @@ RetWithError<SharedPtr<pkcs11::SessionContext>> CertLoader::OpenSession(
 RetWithError<pkcs11::SlotID> CertLoader::FindToken(const pkcs11::LibraryContext& library, const String& token)
 {
     StaticArray<pkcs11::SlotID, pkcs11::cSlotListSize> slotList;
-    auto                                               tokenInfo = MakeUnique<pkcs11::TokenInfo>(&mAllocator);
+
+    auto tokenInfo = MakeUnique<pkcs11::TokenInfo>(mAllocator);
+    if (!tokenInfo) {
+        return {0, ErrorEnum::eNoMemory};
+    }
 
     auto err = library.GetSlotList(true, slotList);
     if (!err.IsNone()) {
@@ -190,14 +195,20 @@ RetWithError<SharedPtr<x509::CertificateChain>> CertLoader::LoadCertsFromFile(co
 {
     LOG_DBG() << "Load certs chain from file: fileName=" << fileName;
 
-    auto buff = MakeUnique<PEMCertChainBlob>(&mAllocator);
+    auto buff = MakeUnique<PEMCertChainBlob>(mAllocator);
+    if (!buff) {
+        return {nullptr, ErrorEnum::eNoMemory};
+    }
 
     auto err = fs::ReadFileToString(fileName, *buff);
     if (!err.IsNone()) {
         return {nullptr, err};
     }
 
-    auto certificates = MakeShared<x509::CertificateChain>(&mAllocator);
+    auto certificates = MakeShared<x509::CertificateChain>(mAllocator);
+    if (!certificates) {
+        return {nullptr, ErrorEnum::eNoMemory};
+    }
 
     err = mCryptoProvider->PEMToX509Certs(*buff, *certificates);
 
@@ -208,7 +219,10 @@ RetWithError<SharedPtr<PrivateKeyItf>> CertLoader::LoadPrivKeyFromFile(const Str
 {
     LOG_DBG() << "Load private key from file: fileName=" << fileName;
 
-    auto buff = MakeUnique<StaticString<cPrivKeyPEMLen>>(&mAllocator);
+    auto buff = MakeUnique<StaticString<cPrivKeyPEMLen>>(mAllocator);
+    if (!buff) {
+        return {nullptr, ErrorEnum::eNoMemory};
+    }
 
     auto err = fs::ReadFileToString(fileName, *buff);
     if (!err.IsNone()) {
diff --git a/src/core/common/crypto/certloader.hpp b/src/core/common/crypto/certloader.hpp
index fa63febe6..cd2a58d4a 100644
--- a/src/core/common/crypto/certloader.hpp
+++ b/src/core/common/crypto/certloader.hpp
@@ -24,11 +24,12 @@ class CertLoader : public CertLoaderItf {
     /**
      * Initializes object instance.
      *
+     * @param allocator allocator to use for certificates/keys.
      * @param cryptoProvider crypto provider interface.
      * @param pkcs11Manager PKCS11 library manager.
      * @return Error.
      */
-    Error Init(x509::ProviderItf& cryptoProvider, pkcs11::PKCS11Manager& pkcs11Manager);
+    Error Init(AllocatorItf& allocator, x509::ProviderItf& cryptoProvider, pkcs11::PKCS11Manager& pkcs11Manager);
 
     /**
      * Loads certificate chain by URL.
@@ -49,12 +50,6 @@ class CertLoader : public CertLoaderItf {
 private:
     using PEMCertChainBlob = StaticString<cCertPEMLen * cCertChainSize>;
 
-    static constexpr auto cCertAllocatorSize
-        = cCertChainsCount * cCertChainSize * sizeof(x509::Certificate) + sizeof(PEMCertChainBlob);
-    static constexpr auto cKeyAllocatorSize
-        = AOS_CONFIG_CRYPTO_PRIV_KEYS_COUNT * pkcs11::cPrivateKeyMaxSize + sizeof(cPrivKeyPEMLen);
-    static constexpr auto cNumAllocation = AOS_CONFIG_CRYPTO_NUM_ALLOCATIONS;
-
     static constexpr auto cDefaultPKCS11Library = AOS_CONFIG_CRYPTO_DEFAULT_PKCS11_LIB;
 
     RetWithError<SharedPtr<pkcs11::SessionContext>> OpenSession(
@@ -66,9 +61,7 @@ class CertLoader : public CertLoaderItf {
 
     x509::ProviderItf*     mCryptoProvider = nullptr;
     pkcs11::PKCS11Manager* mPKCS11         = nullptr;
-
-    StaticAllocator<cCertAllocatorSize + cKeyAllocatorSize + pkcs11::Utils::cLocalObjectsMaxSize, cNumAllocation>
-        mAllocator;
+    AllocatorItf*          mAllocator {};
 };
 
 } // namespace aos::crypto
diff --git a/src/core/common/crypto/cryptohelper.cpp b/src/core/common/crypto/cryptohelper.cpp
index 0c1ccccd2..0be0cc313 100644
--- a/src/core/common/crypto/cryptohelper.cpp
+++ b/src/core/common/crypto/cryptohelper.cpp
@@ -21,15 +21,20 @@ CryptoHelper::CryptoHelper()
 {
 }
 
-Error CryptoHelper::Init(iamclient::CertProviderItf& certProvider, CryptoProviderItf& cryptoProvider,
-    CertLoaderItf& certLoader, const String& serviceDiscoveryURL, const String& caCert)
+Error CryptoHelper::Init(AllocatorItf& allocator, iamclient::CertProviderItf& certProvider,
+    CryptoProviderItf& cryptoProvider, CertLoaderItf& certLoader, const String& serviceDiscoveryURL,
+    const String& caCert)
 {
+    mAllocator           = &allocator;
     mCertProvider        = &certProvider;
     mCryptoProvider      = &cryptoProvider;
     mCertLoader          = &certLoader;
     mServiceDiscoveryURL = serviceDiscoveryURL;
 
-    auto caCertsPEM = MakeUnique<StaticString<cCertPEMLen>>(&mAllocator);
+    auto caCertsPEM = MakeUnique<StaticString<cCertPEMLen>>(mAllocator);
+    if (!caCertsPEM) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = fs::ReadFileToString(caCert, *caCertsPEM); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -110,7 +115,10 @@ Error CryptoHelper::ValidateSigns(const String& decryptedPath, const SignInfo& s
 {
     LockGuard lock {mSemaphore};
 
-    auto signCtx = MakeUnique<SignContext>(&mAllocator);
+    auto signCtx = MakeUnique<SignContext>(mAllocator);
+    if (!signCtx) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = AddCertificates(certs, *signCtx); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -131,8 +139,15 @@ Error CryptoHelper::DecryptMetadata(const Array<uint8_t>& input, Array<uint8_t>&
 {
     LockGuard lock {mSemaphore};
 
-    auto contentInfo = MakeUnique<ContentInfo>(&mAllocator);
-    auto symKey      = MakeUnique<StaticArray<uint8_t, cPrivKeyPEMLen>>(&mAllocator);
+    auto contentInfo = MakeUnique<ContentInfo>(mAllocator);
+    if (!contentInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto symKey = MakeUnique<StaticArray<uint8_t, cPrivKeyPEMLen>>(mAllocator);
+    if (!symKey) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = UnmarshalCMS(input, *contentInfo);
     if (!err.IsNone()) {
@@ -164,7 +179,11 @@ Error CryptoHelper::DecryptMetadata(const Array<uint8_t>& input, Array<uint8_t>&
 
 RetWithError<SharedPtr<x509::CertificateChain>> CryptoHelper::GetOnlineCert()
 {
-    auto certInfo = MakeUnique<CertInfo>(&mAllocator);
+    auto certInfo = MakeUnique<CertInfo>(mAllocator);
+    if (!certInfo) {
+        return {{}, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
+
     if (auto err = mCertProvider->GetCert(cOnlineCert, {}, {}, *certInfo); !err.IsNone()) {
         return {{}, AOS_ERROR_WRAP(err)};
     }
@@ -205,7 +224,10 @@ Error CryptoHelper::GetServiceDiscoveryFromExtensions(const x509::Certificate& c
 Error CryptoHelper::GetServiceDiscoveryFromOrganization(
     const x509::Certificate& cert, Array<StaticString<cURLLen>>& urls)
 {
-    auto subject = MakeUnique<StaticString<cCertSubjSize>>(&mAllocator);
+    auto subject = MakeUnique<StaticString<cCertSubjSize>>(mAllocator);
+    if (!subject) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mCryptoProvider->ASN1DecodeDN(cert.mSubject, *subject); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -221,8 +243,15 @@ Error CryptoHelper::GetServiceDiscoveryFromOrganization(
     auto valueStart    = orgPos + orgKey.Size();
     auto [valueEnd, _] = subject->FindSubstr(valueStart, ",");
 
-    auto orgName = MakeUnique<StaticString<cURLLen>>(&mAllocator);
-    auto url     = MakeUnique<StaticString<cURLLen>>(&mAllocator);
+    auto orgName = MakeUnique<StaticString<cURLLen>>(mAllocator);
+    if (!orgName) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto url = MakeUnique<StaticString<cURLLen>>(mAllocator);
+    if (!url) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto assignErr = orgName->Insert(orgName->begin(), subject->begin() + valueStart, subject->begin() + valueEnd);
     if (!assignErr.IsNone()) {
@@ -331,8 +360,15 @@ Error CryptoHelper::CheckSessionKey(
 
 Error CryptoHelper::DecodeFile(const String& encryptedFile, const String& decryptedFile, AESCipherItf& decoder)
 {
-    auto inBlock  = MakeUnique<StaticArray<uint8_t, cFileChunkSize>>(&mAllocator);
-    auto outBlock = MakeUnique<StaticArray<uint8_t, cFileChunkSize>>(&mAllocator);
+    auto inBlock = MakeUnique<StaticArray<uint8_t, cFileChunkSize>>(mAllocator);
+    if (!inBlock) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto outBlock = MakeUnique<StaticArray<uint8_t, cFileChunkSize>>(mAllocator);
+    if (!outBlock) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     fs::File inputFile, outputFile;
 
@@ -410,7 +446,10 @@ Error CryptoHelper::AddCertificates(const Array<CertificateInfo>& certs, SignCon
             continue;
         }
 
-        auto cert = MakeUnique<x509::Certificate>(&mAllocator);
+        auto cert = MakeUnique<x509::Certificate>(mAllocator);
+        if (!cert) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         if (auto err = mCryptoProvider->DERToX509Cert(certInfo.mCertificate, *cert); !err.IsNone()) {
             return AOS_ERROR_WRAP(err);
@@ -475,7 +514,10 @@ Error CryptoHelper::VerifySigns(const String& file, const SignInfo& signs, SignC
     }
 
     // Verify sign
-    auto hashSum = MakeUnique<StaticArray<uint8_t, cMaxHashSize>>(&mAllocator);
+    auto hashSum = MakeUnique<StaticArray<uint8_t, cMaxHashSize>>(mAllocator);
+    if (!hashSum) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = CalculateFileHash(file, hash, *mCryptoProvider, *hashSum); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -500,7 +542,10 @@ Error CryptoHelper::VerifySigns(const String& file, const SignInfo& signs, SignC
     }
 
     // Verify certs
-    auto intermCertPool = MakeUnique<StaticArray<x509::Certificate, cMaxNumCertificates>>(&mAllocator);
+    auto intermCertPool = MakeUnique<StaticArray<x509::Certificate, cMaxNumCertificates>>(mAllocator);
+    if (!intermCertPool) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = CreateIntermCertPool(signCtx, *chain, *intermCertPool); !err.IsNone()) {
         return err;
@@ -856,7 +901,10 @@ Error CryptoHelper::ParseEncryptedContentInfo(const Array<uint8_t>& data, Encryp
 
 Error CryptoHelper::GetKeyForEnvelope(const TransRecipientInfo& info, Array<uint8_t>& symmetricKey)
 {
-    auto certInfo = MakeUnique<CertInfo>(&mAllocator);
+    auto certInfo = MakeUnique<CertInfo>(mAllocator);
+    if (!certInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = mCertProvider->GetCert(cOfflineCert, info.mRID.mIssuer, info.mRID.mSerial, *certInfo);
     if (!err.IsNone()) {
@@ -920,7 +968,10 @@ Error CryptoHelper::DecryptMessage(
 
 Error CryptoHelper::DecodeMessage(AESCipherItf& decoder, const Array<uint8_t>& input, Array<uint8_t>& message)
 {
-    auto outBlock = MakeUnique<StaticArray<uint8_t, cFileChunkSize>>(&mAllocator);
+    auto outBlock = MakeUnique<StaticArray<uint8_t, cFileChunkSize>>(mAllocator);
+    if (!outBlock) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (input.Size() % AESCipherItf::cBlockSize != 0) {
         return AOS_ERROR_WRAP(Error(ErrorEnum::eInvalidArgument, "message should be a multiple of CBC block size"));
diff --git a/src/core/common/crypto/cryptohelper.hpp b/src/core/common/crypto/cryptohelper.hpp
index a569e6f5b..df8e6b4ae 100644
--- a/src/core/common/crypto/cryptohelper.hpp
+++ b/src/core/common/crypto/cryptohelper.hpp
@@ -8,6 +8,7 @@
 #define AOS_AOS_COMMON_CRYPTO_CRYPTOHELPER_HPP_
 
 #include <core/common/iamclient/itf/certprovider.hpp>
+#include <core/common/tools/thread.hpp>
 
 #include "itf/certloader.hpp"
 #include "itf/crypto.hpp"
@@ -97,6 +98,7 @@ class CryptoHelper : public CryptoHelperItf {
     /**
      * Initializes crypto helper.
      *
+     * @param allocator           allocator to use for temporary objects.
      * @param certProvider        certificate provider interface.
      * @param cryptoProvider      cryptographic provider interface.
      * @param certLoader          certificate loader interface.
@@ -104,8 +106,8 @@ class CryptoHelper : public CryptoHelperItf {
      * @param caCert              root certificate path.
      * @return Error.
      */
-    Error Init(iamclient::CertProviderItf& certProvider, CryptoProviderItf& cryptoProvider, CertLoaderItf& certLoader,
-        const String& serviceDiscoveryURL, const String& caCert);
+    Error Init(AllocatorItf& allocator, iamclient::CertProviderItf& certProvider, CryptoProviderItf& cryptoProvider,
+        CertLoaderItf& certLoader, const String& serviceDiscoveryURL, const String& caCert);
 
     /**
      * Retrieves available service discovery URLs.
@@ -157,11 +159,6 @@ class CryptoHelper : public CryptoHelperItf {
     static constexpr auto cRSAEncryptionOid = "1.2.840.113549.1.1.1";
     static constexpr auto cAES256CBCOid     = "2.16.840.1.101.3.4.1.42";
 
-    static constexpr auto cThreadHeapUsage = 2 * sizeof(CertInfo) + sizeof(StaticString<cCertSubjSize>)
-        + sizeof(StaticArray<uint8_t, cCertPEMLen>) + sizeof(SignContext) + sizeof(x509::Certificate)
-        + sizeof(StaticArray<uint8_t, cMaxHashSize>) + sizeof(StaticArray<x509::Certificate, cMaxNumCertificates>)
-        + sizeof(StaticArray<uint8_t, cFileChunkSize>) * 2 + sizeof(StaticString<cURLLen>) * 2;
-
     RetWithError<SharedPtr<x509::CertificateChain>> GetOnlineCert();
     Error                                           SetDefaultServiceDiscoveryURL(Array<StaticString<cURLLen>>& urls);
     Error GetServiceDiscoveryFromExtensions(const x509::Certificate& cert, Array<StaticString<cURLLen>>& urls);
@@ -201,8 +198,8 @@ class CryptoHelper : public CryptoHelperItf {
     StaticString<cURLLen>  mServiceDiscoveryURL;
     x509::CertificateChain mCACerts;
 
-    Semaphore                                                  mSemaphore;
-    StaticAllocator<cMaxNumConcurrentItems * cThreadHeapUsage> mAllocator;
+    Semaphore     mSemaphore;
+    AllocatorItf* mAllocator {};
 };
 
 } // namespace aos::crypto
diff --git a/src/core/common/crypto/cryptoutils.cpp b/src/core/common/crypto/cryptoutils.cpp
index be1ee173b..243f89c31 100644
--- a/src/core/common/crypto/cryptoutils.cpp
+++ b/src/core/common/crypto/cryptoutils.cpp
@@ -6,6 +6,7 @@
 
 #include <core/common/tools/fs.hpp>
 #include <core/common/tools/logger.hpp>
+#include <core/common/tools/thread.hpp>
 
 #include "cryptoutils.hpp"
 
diff --git a/src/core/common/crypto/mbedtls/cryptoprovider.cpp b/src/core/common/crypto/mbedtls/cryptoprovider.cpp
index ec3980795..3bd3e92f3 100644
--- a/src/core/common/crypto/mbedtls/cryptoprovider.cpp
+++ b/src/core/common/crypto/mbedtls/cryptoprovider.cpp
@@ -574,10 +574,12 @@ Error VerifyECDSASignature(const ECDSAPublicKey& pubKey, const Array<uint8_t>& d
  * Public
  **********************************************************************************************************************/
 
-Error MbedTLSCryptoProvider::Init()
+Error MbedTLSCryptoProvider::Init(AllocatorItf& allocator)
 {
     LOG_DBG() << "Init mbedTLS crypto provider";
 
+    mAllocator = &allocator;
+
     auto ret = psa_crypto_init();
 
     return ret != PSA_SUCCESS ? AOS_ERROR_WRAP(ret) : ErrorEnum::eNone;
@@ -827,7 +829,10 @@ RetWithError<SharedPtr<PrivateKeyItf>> MbedTLSCryptoProvider::PEMToX509PrivKey(c
 {
     LOG_ERR() << "Create private key from PEM";
 
-    auto res = MakeShared<MbedTLSRSAPrivKey>(&mAllocator);
+    auto res = MakeShared<MbedTLSRSAPrivKey>(mAllocator);
+    if (!res) {
+        return {{}, ErrorEnum::eNoMemory};
+    }
 
     auto err = res->Init(pemBlob);
     if (!err.IsNone()) {
@@ -941,7 +946,11 @@ RetWithError<UniquePtr<HashItf>> MbedTLSCryptoProvider::CreateHash(Hash algorith
         return {nullptr, ErrorEnum::eNotSupported};
     }
 
-    auto hasher = MakeUnique<MBedTLSHash>(&mAllocator, alg);
+    auto hasher = MakeUnique<MBedTLSHash>(mAllocator, alg);
+    if (!hasher) {
+        return {nullptr, ErrorEnum::eNoMemory};
+    }
+
     if (auto err = hasher->Init(); !err.IsNone()) {
         return {nullptr, AOS_ERROR_WRAP(err)};
     }
@@ -1055,7 +1064,10 @@ RetWithError<UniquePtr<AESCipherItf>> MbedTLSCryptoProvider::CreateAESEncoder(
         return {{}, AOS_ERROR_WRAP(ErrorEnum::eNotSupported)};
     }
 
-    auto cipher = MakeUnique<MbedTLSAESCipher>(&mAllocator);
+    auto cipher = MakeUnique<MbedTLSAESCipher>(mAllocator);
+    if (!cipher) {
+        return {{}, ErrorEnum::eNoMemory};
+    }
 
     auto err = cipher->Init(key, iv, true);
     if (!err.IsNone()) {
@@ -1072,7 +1084,10 @@ RetWithError<UniquePtr<AESCipherItf>> MbedTLSCryptoProvider::CreateAESDecoder(
         return {{}, AOS_ERROR_WRAP(ErrorEnum::eNotSupported)};
     }
 
-    auto cipher = MakeUnique<MbedTLSAESCipher>(&mAllocator);
+    auto cipher = MakeUnique<MbedTLSAESCipher>(mAllocator);
+    if (!cipher) {
+        return {{}, ErrorEnum::eNoMemory};
+    }
 
     auto err = cipher->Init(key, iv, false);
     if (!err.IsNone()) {
diff --git a/src/core/common/crypto/mbedtls/cryptoprovider.hpp b/src/core/common/crypto/mbedtls/cryptoprovider.hpp
index 88ec9d269..7b1f43b61 100644
--- a/src/core/common/crypto/mbedtls/cryptoprovider.hpp
+++ b/src/core/common/crypto/mbedtls/cryptoprovider.hpp
@@ -27,9 +27,10 @@ class MbedTLSCryptoProvider : public CryptoProviderItf {
     /**
      * Initializes the object.
      *
+     * @param allocator allocator to use for temporary and key objects.
      * @result Error.
      */
-    Error Init();
+    Error Init(AllocatorItf& allocator);
 
     /**
      * Creates a new certificate based on a template.
@@ -396,11 +397,6 @@ class MbedTLSCryptoProvider : public CryptoProviderItf {
         mutable mbedtls_pk_context mPrivKey;
     };
 
-    static constexpr auto cAllocatorSize
-        = AOS_CONFIG_CRYPTO_PUB_KEYS_COUNT * Max(sizeof(RSAPublicKey), sizeof(ECDSAPublicKey))
-        + AOS_CONFIG_CRYPTO_HASHER_COUNT * sizeof(MBedTLSHash)
-        + AOS_CONFIG_CRYPTO_PRIV_KEYS_COUNT * sizeof(MbedTLSRSAPrivKey);
-
     static int                             VerifyTime(void* data, mbedtls_x509_crt* crt, int depth, uint32_t* flags);
     static RetWithError<Time>              ConvertTime(const mbedtls_x509_time& src);
     static RetWithError<mbedtls_x509_time> ConvertTime(const Time& src);
@@ -432,7 +428,7 @@ class MbedTLSCryptoProvider : public CryptoProviderItf {
         mbedtls_x509write_cert& cert, const x509::Certificate& templ, const x509::Certificate& parent);
     Error SetCertificateValidityPeriod(mbedtls_x509write_cert& cert, const x509::Certificate& templ);
 
-    StaticAllocator<cAllocatorSize> mAllocator;
+    AllocatorItf* mAllocator {};
 };
 
 } // namespace aos::crypto
diff --git a/src/core/common/crypto/openssl/cryptoprovider.cpp b/src/core/common/crypto/openssl/cryptoprovider.cpp
index 5fa63dd78..b10dfb348 100644
--- a/src/core/common/crypto/openssl/cryptoprovider.cpp
+++ b/src/core/common/crypto/openssl/cryptoprovider.cpp
@@ -1254,10 +1254,12 @@ OpenSSLCryptoProvider::~OpenSSLCryptoProvider()
     OSSL_LIB_CTX_free(mLibCtx);
 }
 
-Error OpenSSLCryptoProvider::Init()
+Error OpenSSLCryptoProvider::Init(AllocatorItf& allocator)
 {
     LOG_DBG() << "Init OpenSSL crypto provider";
 
+    mAllocator = &allocator;
+
     if (mLibCtx = OSSL_LIB_CTX_new(); !mLibCtx) {
         return OPENSSL_ERROR();
     }
@@ -1493,7 +1495,10 @@ RetWithError<SharedPtr<PrivateKeyItf>> OpenSSLCryptoProvider::PEMToX509PrivKey(c
 
     auto type = EVP_PKEY_base_id(pkey.Get());
     if (type == EVP_PKEY_RSA) {
-        auto res = MakeShared<OpenSSLRSAPrivKey>(&mAllocator);
+        auto res = MakeShared<OpenSSLRSAPrivKey>(mAllocator);
+        if (!res) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
 
         auto err = res->Init(pkey.Get());
         if (!err.IsNone()) {
@@ -1768,7 +1773,10 @@ RetWithError<UniquePtr<HashItf>> OpenSSLCryptoProvider::CreateHash(Hash algorith
         return {{}, AOS_ERROR_WRAP(ErrorEnum::eInvalidArgument)};
     }
 
-    auto hasher = MakeUnique<OpenSSLHash>(&mAllocator);
+    auto hasher = MakeUnique<OpenSSLHash>(mAllocator);
+    if (!hasher) {
+        return {{}, ErrorEnum::eNoMemory};
+    }
 
     auto err = hasher->Init(mLibCtx, algorithm.ToString().CStr());
     if (!err.IsNone()) {
@@ -1855,7 +1863,10 @@ RetWithError<UniquePtr<AESCipherItf>> OpenSSLCryptoProvider::CreateAESEncoder(
         return {{}, AOS_ERROR_WRAP(ErrorEnum::eNotSupported)};
     }
 
-    auto cipher = MakeUnique<OpenSSLAESCipher>(&mAllocator);
+    auto cipher = MakeUnique<OpenSSLAESCipher>(mAllocator);
+    if (!cipher) {
+        return {{}, ErrorEnum::eNoMemory};
+    }
 
     auto err = cipher->Init(mLibCtx, key, iv, true);
     if (!err.IsNone()) {
@@ -1872,7 +1883,10 @@ RetWithError<UniquePtr<AESCipherItf>> OpenSSLCryptoProvider::CreateAESDecoder(
         return {{}, AOS_ERROR_WRAP(ErrorEnum::eNotSupported)};
     }
 
-    auto cipher = MakeUnique<OpenSSLAESCipher>(&mAllocator);
+    auto cipher = MakeUnique<OpenSSLAESCipher>(mAllocator);
+    if (!cipher) {
+        return {{}, ErrorEnum::eNoMemory};
+    }
 
     auto err = cipher->Init(mLibCtx, key, iv, false);
     if (!err.IsNone()) {
diff --git a/src/core/common/crypto/openssl/cryptoprovider.hpp b/src/core/common/crypto/openssl/cryptoprovider.hpp
index ea12e598e..7bb19c6f7 100644
--- a/src/core/common/crypto/openssl/cryptoprovider.hpp
+++ b/src/core/common/crypto/openssl/cryptoprovider.hpp
@@ -27,9 +27,10 @@ class OpenSSLCryptoProvider : public CryptoProviderItf {
     /**
      * Initializes the object.
      *
+     * @param allocator allocator to use for temporary and key objects.
      * @result Error.
      */
-    Error Init();
+    Error Init(AllocatorItf& allocator);
 
     /**
      * Creates a new certificate based on a template.
@@ -392,16 +393,10 @@ class OpenSSLCryptoProvider : public CryptoProviderItf {
         struct evp_pkey_st* mPrivKey = nullptr;
     };
 
-    static constexpr auto cAllocatorSize
-        = AOS_CONFIG_CRYPTO_PUB_KEYS_COUNT * Max(sizeof(RSAPublicKey), sizeof(ECDSAPublicKey))
-        + AOS_CONFIG_CRYPTO_HASHER_COUNT * sizeof(OpenSSLHash)
-        + AOS_CONFIG_CRYPTO_AES_CIPHER_COUNT * sizeof(OpenSSLAESCipher)
-        + AOS_CONFIG_CRYPTO_PRIV_KEYS_COUNT * sizeof(OpenSSLRSAPrivKey);
-
     ossl_lib_ctx_st*         mLibCtx = nullptr;
     openssl::OpenSSLProvider mOpenSSLProvider;
 
-    StaticAllocator<cAllocatorSize> mAllocator;
+    AllocatorItf* mAllocator {};
 };
 
 } // namespace aos::crypto
diff --git a/src/core/common/crypto/tests/certloader.cpp b/src/core/common/crypto/tests/certloader.cpp
index 93653aca0..7831b0443 100644
--- a/src/core/common/crypto/tests/certloader.cpp
+++ b/src/core/common/crypto/tests/certloader.cpp
@@ -12,6 +12,7 @@
 #include <core/common/tests/crypto/softhsmenv.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tools/fs.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 namespace aos::crypto {
 
@@ -29,12 +30,13 @@ class CertloaderTest : public Test {
 
         ASSERT_TRUE(fs::WriteStringToFile(mPINSource, mPIN, 0664).IsNone());
 
-        ASSERT_TRUE(mCryptoFactory.Init().IsNone());
+        ASSERT_TRUE(mCryptoFactory.Init(mAllocator).IsNone());
         mCryptoProvider = &mCryptoFactory.GetCryptoProvider();
 
-        ASSERT_TRUE(mSoftHSMEnv.Init(mPIN, mLabel).IsNone());
+        ASSERT_TRUE(mSoftHSMEnv.Init(mAllocator, mPIN, mLabel).IsNone());
 
-        ASSERT_TRUE(mCertLoader.Init(mCryptoFactory.GetCryptoProvider(), mSoftHSMEnv.GetManager()).IsNone());
+        ASSERT_TRUE(
+            mCertLoader.Init(mAllocator, mCryptoFactory.GetCryptoProvider(), mSoftHSMEnv.GetManager()).IsNone());
 
         mLibrary = mSoftHSMEnv.GetLibrary();
         mSlotID  = mSoftHSMEnv.GetSlotID();
@@ -62,8 +64,8 @@ class CertloaderTest : public Test {
 
         // import certificates
         ASSERT_TRUE(
-            pkcs11::Utils(session, *mCryptoProvider, mAllocator).ImportCertificate(caID, mLabel, caCert).IsNone());
-        ASSERT_TRUE(pkcs11::Utils(session, *mCryptoProvider, mAllocator)
+            pkcs11::Utils(mAllocator, session, *mCryptoProvider).ImportCertificate(caID, mLabel, caCert).IsNone());
+        ASSERT_TRUE(pkcs11::Utils(mAllocator, session, *mCryptoProvider)
                         .ImportCertificate(clientID, mLabel, clientCert)
                         .IsNone());
     }
@@ -79,7 +81,7 @@ class CertloaderTest : public Test {
         pkcs11::PrivateKey key;
 
         Tie(key, err)
-            = pkcs11::Utils(session, *mCryptoProvider, mAllocator).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
+            = pkcs11::Utils(mAllocator, session, *mCryptoProvider).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
         ASSERT_TRUE(err.IsNone());
     }
 
@@ -87,6 +89,10 @@ class CertloaderTest : public Test {
     static constexpr auto mPIN       = "admin";
     static constexpr auto mPINSource = "pin.txt";
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     DefaultCryptoFactory mCryptoFactory;
     CryptoProviderItf*   mCryptoProvider = nullptr;
     test::SoftHSMEnv     mSoftHSMEnv;
@@ -94,12 +100,6 @@ class CertloaderTest : public Test {
     pkcs11::SlotID                    mSlotID = 0;
     SharedPtr<pkcs11::LibraryContext> mLibrary;
     CertLoader                        mCertLoader;
-
-    StaticAllocator<Max(2 * sizeof(pkcs11::PKCS11RSAPrivateKey), sizeof(pkcs11::PKCS11ECDSAPrivateKey),
-                        2 * sizeof(x509::Certificate) + sizeof(x509::CertificateChain)
-                            + 2 * sizeof(pkcs11::PKCS11RSAPrivateKey))
-        + sizeof(CertLoader)>
-        mAllocator;
 };
 
 /***********************************************************************************************************************
diff --git a/src/core/common/crypto/tests/cryptohelper.cpp b/src/core/common/crypto/tests/cryptohelper.cpp
index f636271cb..1f6dc9c1f 100644
--- a/src/core/common/crypto/tests/cryptohelper.cpp
+++ b/src/core/common/crypto/tests/cryptohelper.cpp
@@ -14,6 +14,7 @@
 #include <core/common/tests/crypto/softhsmenv.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tools/fs.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/common/tools/utils.hpp>
 
 #include "stubs/certprovider.hpp"
@@ -124,15 +125,16 @@ class CryptoHelperTest : public Test {
     {
         tests::utils::InitLog();
 
-        ASSERT_TRUE(mCryptoFactory.Init().IsNone());
+        ASSERT_TRUE(mCryptoFactory.Init(mAllocator).IsNone());
 
         mCryptoProvider = &mCryptoFactory.GetCryptoProvider();
 
-        ASSERT_TRUE(mSoftHSMEnv.Init(cPIN, cLabel).IsNone());
-        ASSERT_TRUE(mCertLoader.Init(*mCryptoProvider, mSoftHSMEnv.GetManager()).IsNone());
+        ASSERT_TRUE(mSoftHSMEnv.Init(mAllocator, cPIN, cLabel).IsNone());
+        ASSERT_TRUE(mCertLoader.Init(mAllocator, *mCryptoProvider, mSoftHSMEnv.GetManager()).IsNone());
 
         ASSERT_TRUE(
-            mCryptoHelper.Init(mCertProvider, *mCryptoProvider, mCertLoader, cDefaultServiceDiscoveryURL, cCACert)
+            mCryptoHelper
+                .Init(mAllocator, mCertProvider, *mCryptoProvider, mCertLoader, cDefaultServiceDiscoveryURL, cCACert)
                 .IsNone());
     }
 
@@ -143,6 +145,10 @@ class CryptoHelperTest : public Test {
     static constexpr auto cLabel = "iam pkcs11 test slot";
     static constexpr auto cPIN   = "admin";
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     DefaultCryptoFactory mCryptoFactory;
 
     CryptoProviderItf* mCryptoProvider;
diff --git a/src/core/common/crypto/tests/cryptoprovider.cpp b/src/core/common/crypto/tests/cryptoprovider.cpp
index cb8d160e0..b73c60c27 100644
--- a/src/core/common/crypto/tests/cryptoprovider.cpp
+++ b/src/core/common/crypto/tests/cryptoprovider.cpp
@@ -10,6 +10,7 @@
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tests/utils/utils.hpp>
 #include <core/common/tools/fs.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 #if defined(WITH_MBEDTLS)
 #include <core/common/tests/crypto/providers/mbedtlsfactory.hpp>
@@ -35,7 +36,7 @@ class CryptoProviderTest : public TestWithParam<std::shared_ptr<CryptoFactoryItf
 
         mFactory = GetParam();
 
-        ASSERT_TRUE(mFactory->Init().IsNone());
+        ASSERT_TRUE(mFactory->Init(mAllocator).IsNone());
 
         mCryptoProvider = &mFactory->GetCryptoProvider();
         mHashProvider   = &mFactory->GetHashProvider();
@@ -43,6 +44,10 @@ class CryptoProviderTest : public TestWithParam<std::shared_ptr<CryptoFactoryItf
     }
 
 protected:
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     std::shared_ptr<CryptoFactoryItf> mFactory;
     CryptoProviderItf*                mCryptoProvider;
     HasherItf*                        mHashProvider;
diff --git a/src/core/common/crypto/tests/cryptoutils.cpp b/src/core/common/crypto/tests/cryptoutils.cpp
index 42d0f7ca3..8fd3d8800 100644
--- a/src/core/common/crypto/tests/cryptoutils.cpp
+++ b/src/core/common/crypto/tests/cryptoutils.cpp
@@ -13,6 +13,7 @@
 #include <core/common/tests/crypto/providers/cryptofactory.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tests/utils/utils.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 namespace aos::crypto {
 
@@ -28,10 +29,14 @@ class CryptoutilsTest : public Test {
 
     void SetUp() override
     {
-        auto err = mCryptoFactory.Init();
+        auto err = mCryptoFactory.Init(mAllocator);
         ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     DefaultCryptoFactory mCryptoFactory;
 };
 
diff --git a/src/core/common/monitoring/average.cpp b/src/core/common/monitoring/average.cpp
index f5b6d6dc3..f743e34cf 100644
--- a/src/core/common/monitoring/average.cpp
+++ b/src/core/common/monitoring/average.cpp
@@ -47,8 +47,10 @@ void UpdateValue(T& value, T newValue, size_t window, bool isInitialized)
  * Public
  **********************************************************************************************************************/
 
-Error Average::Init(size_t windowCount)
+Error Average::Init(AllocatorItf& allocator, size_t windowCount)
 {
+    mAllocator = &allocator;
+
     mWindowCount = windowCount;
     if (mWindowCount == 0) {
         mWindowCount = 1;
@@ -124,7 +126,10 @@ Error Average::StartInstanceMonitoring(const InstanceIdent& instanceIdent)
         return AOS_ERROR_WRAP(Error(ErrorEnum::eAlreadyExist, "instance monitoring already started"));
     }
 
-    auto averageData = MakeUnique<AverageData>(&mAllocator);
+    auto averageData = MakeUnique<AverageData>(mAllocator);
+    if (!averageData) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mAverageInstancesData.Set(instanceIdent, *averageData); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
diff --git a/src/core/common/monitoring/average.hpp b/src/core/common/monitoring/average.hpp
index 45419e8ef..e68082f96 100644
--- a/src/core/common/monitoring/average.hpp
+++ b/src/core/common/monitoring/average.hpp
@@ -24,10 +24,11 @@ class Average {
     /**
      * Initializes average.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param windowCount window count.
      * @return Error.
      */
-    Error Init(size_t windowCount);
+    Error Init(AllocatorItf& allocator, size_t windowCount);
 
     /**
      * Updates average data.
@@ -69,8 +70,6 @@ class Average {
         PartitionInfoArray   mMonitoredPartitions;
     };
 
-    static constexpr auto cAllocatorSize = sizeof(AverageData);
-
     Error UpdateMonitoringData(MonitoringData& data, const MonitoringData& newData, bool& isInitialized);
     Error GetMonitoringData(MonitoringData& data, const MonitoringData& averageData) const;
 
@@ -78,7 +77,7 @@ class Average {
     AverageData                                             mAverageNodeData {};
     StaticMap<InstanceIdent, AverageData, cMaxNumInstances> mAverageInstancesData {};
 
-    StaticAllocator<cAllocatorSize> mAllocator;
+    AllocatorItf* mAllocator {};
 };
 
 } // namespace aos::monitoring
diff --git a/src/core/common/monitoring/monitoring.cpp b/src/core/common/monitoring/monitoring.cpp
index ad3826d0f..ae16dd5f7 100644
--- a/src/core/common/monitoring/monitoring.cpp
+++ b/src/core/common/monitoring/monitoring.cpp
@@ -106,12 +106,14 @@ void NormalizeMonitoringData(NodeMonitoringData& monitoringData)
  * Public
  **********************************************************************************************************************/
 
-Error Monitoring::Init(const Config& config, nodeconfig::NodeConfigProviderItf& nodeConfigProvider,
+Error Monitoring::Init(AllocatorItf& allocator, const Config& config,
+    nodeconfig::NodeConfigProviderItf&     nodeConfigProvider,
     iamclient::CurrentNodeInfoProviderItf& currentNodeInfoProvider, SenderItf& sender, alerts::SenderItf& alertSender,
     NodeMonitoringProviderItf& nodeMonitoringProvider, InstanceInfoProviderItf* instanceInfoProvider)
 {
     LOG_DBG() << "Init monitoring";
 
+    mAllocator               = &allocator;
     mConfig                  = config;
     mNodeConfigProvider      = &nodeConfigProvider;
     mCurrentNodeInfoProvider = &currentNodeInfoProvider;
@@ -120,7 +122,7 @@ Error Monitoring::Init(const Config& config, nodeconfig::NodeConfigProviderItf&
     mNodeMonitoringProvider  = &nodeMonitoringProvider;
     mInstanceInfoProvider    = instanceInfoProvider;
 
-    if (auto err = mAverage.Init(mConfig.mAverageWindow.Nanoseconds() / mConfig.mPollPeriod.Nanoseconds());
+    if (auto err = mAverage.Init(allocator, mConfig.mAverageWindow.Nanoseconds() / mConfig.mPollPeriod.Nanoseconds());
         !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
@@ -143,7 +145,10 @@ Error Monitoring::Start()
     }
 
     if (mInstanceInfoProvider) {
-        auto statuses = MakeUnique<InstanceStatusArray>(&mAllocator);
+        auto statuses = MakeUnique<InstanceStatusArray>(mAllocator);
+        if (!statuses) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         if (auto err = mInstanceInfoProvider->GetInstancesStatuses(*statuses); !err.IsNone()) {
             return AOS_ERROR_WRAP(err);
@@ -163,7 +168,10 @@ Error Monitoring::Start()
     }
 
     {
-        auto nodeConfig = MakeUnique<NodeConfig>(&mAllocator);
+        auto nodeConfig = MakeUnique<NodeConfig>(mAllocator);
+        if (!nodeConfig) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         if (auto err = mNodeConfigProvider->GetNodeConfig(*nodeConfig); !err.IsNone()) {
             return AOS_ERROR_WRAP(err);
@@ -401,7 +409,13 @@ void Monitoring::ProcessMonitoring()
 {
     UniqueLock lock {mMutex};
 
-    auto nodeMonitoringData                        = MakeUnique<NodeMonitoringData>(&mAllocator);
+    auto nodeMonitoringData = MakeUnique<NodeMonitoringData>(mAllocator);
+    if (!nodeMonitoringData) {
+        LOG_ERR() << "Can't allocate node monitoring data" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
+
     nodeMonitoringData->mMonitoringData.mTimestamp = Time::Now();
 
     GetInstanceMonitoringData(nodeMonitoringData->mInstances);
diff --git a/src/core/common/monitoring/monitoring.hpp b/src/core/common/monitoring/monitoring.hpp
index aef811a21..86a61c5f1 100644
--- a/src/core/common/monitoring/monitoring.hpp
+++ b/src/core/common/monitoring/monitoring.hpp
@@ -11,8 +11,8 @@
 #include <core/common/iamclient/itf/currentnodeinfoprovider.hpp>
 #include <core/common/instancestatusprovider/itf/instancestatusprovider.hpp>
 #include <core/common/nodeconfig/itf/nodeconfigprovider.hpp>
-#include <core/common/tools/allocator.hpp>
 #include <core/common/tools/map.hpp>
+#include <core/common/tools/memory.hpp>
 #include <core/common/tools/thread.hpp>
 #include <core/common/tools/timer.hpp>
 
@@ -37,6 +37,7 @@ class Monitoring : public MonitoringItf,
     /**
      * Initializes monitoring.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config monitoring configuration.
      * @param nodeConfigProvider provides node configuration.
      * @param currentNodeInfoProvider provides current node information.
@@ -46,7 +47,7 @@ class Monitoring : public MonitoringItf,
      * @param instanceInfoProvider provides instance information and monitoring data, optional.
      * @return Error.
      */
-    Error Init(const Config& config, nodeconfig::NodeConfigProviderItf& nodeConfigProvider,
+    Error Init(AllocatorItf& allocator, const Config& config, nodeconfig::NodeConfigProviderItf& nodeConfigProvider,
         iamclient::CurrentNodeInfoProviderItf& currentNodeInfoProvider, SenderItf& sender,
         alerts::SenderItf& alertSender, NodeMonitoringProviderItf& nodeMonitoringProvider,
         InstanceInfoProviderItf* instanceInfoProvider);
@@ -74,8 +75,6 @@ class Monitoring : public MonitoringItf,
     Error GetAverageMonitoringData(NodeMonitoringData& monitoringData) override;
 
 private:
-    static constexpr auto cAllocatorSize = Max(sizeof(NodeMonitoringData), sizeof(InstanceStatusArray));
-
     struct Instance {
         InstanceIdent            mIdent;
         AlertProcessorArray      mAlertProcessors;
@@ -110,7 +109,7 @@ class Monitoring : public MonitoringItf,
     NodeMonitoringProviderItf*             mNodeMonitoringProvider {};
     InstanceInfoProviderItf*               mInstanceInfoProvider {};
 
-    StaticAllocator<cAllocatorSize>         mAllocator;
+    AllocatorItf*                           mAllocator {};
     Mutex                                   mMutex;
     bool                                    mIsRunning {};
     NodeMonitoringData                      mMonitoringData;
diff --git a/src/core/common/monitoring/tests/monitoring.cpp b/src/core/common/monitoring/tests/monitoring.cpp
index 25926e14c..bb215fecd 100644
--- a/src/core/common/monitoring/tests/monitoring.cpp
+++ b/src/core/common/monitoring/tests/monitoring.cpp
@@ -11,6 +11,7 @@
 #include <gtest/gtest.h>
 
 #include <core/common/monitoring/monitoring.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/common/tools/logger.hpp>
 
 #include <core/common/tests/stubs/nodeinfoproviderstub.hpp>
@@ -617,6 +618,10 @@ class MonitoringTest : public Test {
         mInstanceAlertRules.mPartitions.EmplaceBack(cInstanceStorageRule);
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     NodeInfo   mNodeInfo;
     NodeConfig mNodeConfig;
     AlertRules mInstanceAlertRules;
@@ -728,8 +733,8 @@ TEST_F(MonitoringTest, SystemMonitoringAlerts)
             .SetTime(Time::Now().Add(6 * cPollPeriod)),
     };
 
-    auto err = mMonitoring.Init(mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender, mAlertSender,
-        mNodeMonitoringProvider, &mInstanceInfoProvider);
+    auto err = mMonitoring.Init(mAllocator, mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender,
+        mAlertSender, mNodeMonitoringProvider, &mInstanceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mMonitoring.Start();
@@ -797,8 +802,8 @@ TEST_F(MonitoringTest, InstanceMonitoringAlerts)
 
     };
 
-    auto err = mMonitoring.Init(mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender, mAlertSender,
-        mNodeMonitoringProvider, &mInstanceInfoProvider);
+    auto err = mMonitoring.Init(mAllocator, mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender,
+        mAlertSender, mNodeMonitoringProvider, &mInstanceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     std::vector<NodeMonitoringData> avgMonitoring;
@@ -886,8 +891,8 @@ TEST_F(MonitoringTest, SystemMonitoringAccumulatesInstancesMonitoring)
                     .SetTime(Time::Now())),
     };
 
-    auto err = mMonitoring.Init(mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender, mAlertSender,
-        mNodeMonitoringProvider, &mInstanceInfoProvider);
+    auto err = mMonitoring.Init(mAllocator, mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender,
+        mAlertSender, mNodeMonitoringProvider, &mInstanceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     std::vector<NodeMonitoringData> avgMonitoring;
@@ -1000,8 +1005,8 @@ TEST_F(MonitoringTest, GetAverageMonitoringData)
                 InstanceTestData().CPU(400).RAM(600).Download(200).Upload(200).Partition(cStatesPartition, 400)),
     };
 
-    auto err = mMonitoring.Init(mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender, mAlertSender,
-        mNodeMonitoringProvider, &mInstanceInfoProvider);
+    auto err = mMonitoring.Init(mAllocator, mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender,
+        mAlertSender, mNodeMonitoringProvider, &mInstanceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     std::vector<NodeMonitoringData> avgMonitoring;
@@ -1096,8 +1101,8 @@ TEST_F(MonitoringTest, InstanceMonitoringNotSupported)
             SystemTestData().CPU(600).RAM(400).Download(200).Upload(200).Partition(cStatesPartition, 300)),
     };
 
-    auto err = mMonitoring.Init(mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender, mAlertSender,
-        mNodeMonitoringProvider, &instanceInfoProviderNotSupported);
+    auto err = mMonitoring.Init(mAllocator, mConfig, mNodeConfigProvider, mCurrentNodeInfoProvider, mSender,
+        mAlertSender, mNodeMonitoringProvider, &instanceInfoProviderNotSupported);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     std::vector<NodeMonitoringData> avgMonitoring;
diff --git a/src/core/common/pkcs11/pkcs11.cpp b/src/core/common/pkcs11/pkcs11.cpp
index 9b4c7ee51..8e5b96a24 100644
--- a/src/core/common/pkcs11/pkcs11.cpp
+++ b/src/core/common/pkcs11/pkcs11.cpp
@@ -332,10 +332,12 @@ RetWithError<CK_FUNCTION_LIST_PTR> DynamicLibraryContext::Init()
  * LibraryContext
  **********************************************************************************************************************/
 
-Error LibraryContext::Init()
+Error LibraryContext::Init(AllocatorItf& allocator)
 {
     LockGuard lock {mMutex};
 
+    mAllocator = &allocator;
+
     Error err = ErrorEnum::eNone;
 
     Tie(mFunctionList, err) = PKCS11LibraryContext::Init();
@@ -550,7 +552,14 @@ RetWithError<SharedPtr<SessionContext>> LibraryContext::PKCS11OpenSession(SlotID
         return {nullptr, static_cast<int>(rv)};
     }
 
-    auto session = MakeShared<SessionContext>(&mAllocator, handle, mFunctionList);
+    auto session = MakeShared<SessionContext>(mAllocator, handle, mFunctionList);
+    if (!session) {
+        if (rv = mFunctionList->C_CloseSession(handle); rv != CKR_OK) {
+            LOG_ERR() << "Close session failed" << Log::Field("ret", rv);
+        }
+
+        return {nullptr, ErrorEnum::eNoMemory};
+    }
 
     return {session, ErrorEnum::eNone};
 }
@@ -929,6 +938,13 @@ Error SessionContext::FindObjectsFinal() const
  * PKCS11Manager
  **********************************************************************************************************************/
 
+Error PKCS11Manager::Init(AllocatorItf& allocator)
+{
+    mAllocator = &allocator;
+
+    return ErrorEnum::eNone;
+}
+
 SharedPtr<LibraryContext> PKCS11Manager::OpenLibrary(const String& library)
 {
     LockGuard lock {mMutex};
@@ -945,7 +961,7 @@ SharedPtr<LibraryContext> PKCS11Manager::OpenLibrary(const String& library)
         return nullptr;
     }
 
-    auto ctx = MakeShared<LibraryContext>(&mAllocator);
+    auto ctx = MakeShared<LibraryContext>(mAllocator);
     if (!ctx) {
         return nullptr;
     }
@@ -968,7 +984,7 @@ SharedPtr<LibraryContext> PKCS11Manager::OpenLibrary(const String& library)
 
 #endif
 
-    if (!ctx->Init().IsNone()) {
+    if (!ctx->Init(*mAllocator).IsNone()) {
         return nullptr;
     }
 
@@ -981,7 +997,8 @@ SharedPtr<LibraryContext> PKCS11Manager::OpenLibrary(const String& library)
  * Utils
  **********************************************************************************************************************/
 
-Utils::Utils(const SharedPtr<SessionContext>& session, crypto::x509::ProviderItf& cryptoProvider, Allocator& allocator)
+Utils::Utils(
+    AllocatorItf& allocator, const SharedPtr<SessionContext>& session, crypto::x509::ProviderItf& cryptoProvider)
     : mSession(session)
     , mCryptoProvider(cryptoProvider)
     , mAllocator(allocator)
@@ -1266,7 +1283,11 @@ RetWithError<SharedPtr<crypto::x509::CertificateChain>> Utils::FindCertificateCh
     }
 
     SharedPtr<crypto::x509::Certificate> certificate;
-    auto                                 chain = MakeShared<crypto::x509::CertificateChain>(&mAllocator);
+
+    auto chain = MakeShared<crypto::x509::CertificateChain>(&mAllocator);
+    if (!chain) {
+        return {nullptr, ErrorEnum::eNoMemory};
+    }
 
     Tie(certificate, err) = GetCertificate(certHandles[0]);
     if (!err.IsNone()) {
@@ -1331,7 +1352,14 @@ RetWithError<PrivateKey> Utils::ExportPrivateKey(
         attrTypes.PushBack(CKA_PUBLIC_EXPONENT);
 
         auto n = MakeUnique<StaticArray<uint8_t, crypto::cRSAModulusSize>>(&mAllocator);
+        if (!n) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
+
         auto e = MakeUnique<StaticArray<uint8_t, crypto::cRSAPubExponentSize>>(&mAllocator);
+        if (!e) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
 
         attrValues.PushBack(*n);
         attrValues.PushBack(*e);
@@ -1341,8 +1369,15 @@ RetWithError<PrivateKey> Utils::ExportPrivateKey(
             return {{}, err};
         }
 
-        auto pubKey    = MakeUnique<crypto::RSAPublicKey>(&mAllocator, attrValues[0], attrValues[1]);
-        auto cryptoKey = MakeShared<PKCS11RSAPrivateKey>(&mAllocator, mSession, privKeyHandle, *pubKey);
+        auto pubKey = MakeUnique<crypto::RSAPublicKey>(&mAllocator, attrValues[0], attrValues[1]);
+        if (!pubKey) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
+
+        auto cryptoKey = MakeShared<PKCS11RSAPrivateKey>(&mAllocator, mAllocator, mSession, privKeyHandle, *pubKey);
+        if (!cryptoKey) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
 
         PrivateKey pkcsKey = {privKeyHandle, pubKeyHandle, cryptoKey};
 
@@ -1357,7 +1392,14 @@ RetWithError<PrivateKey> Utils::ExportPrivateKey(
         attrTypes.PushBack(CKA_EC_POINT);
 
         auto derEncodedParams = MakeUnique<StaticArray<uint8_t, crypto::cECDSAParamsOIDSize>>(&mAllocator);
-        auto derEncodedPoint  = MakeUnique<StaticArray<uint8_t, crypto::cECDSAPointDERSize>>(&mAllocator);
+        if (!derEncodedParams) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
+
+        auto derEncodedPoint = MakeUnique<StaticArray<uint8_t, crypto::cECDSAPointDERSize>>(&mAllocator);
+        if (!derEncodedPoint) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
 
         attrValues.PushBack(*derEncodedParams);
         attrValues.PushBack(*derEncodedPoint);
@@ -1368,7 +1410,14 @@ RetWithError<PrivateKey> Utils::ExportPrivateKey(
         }
 
         auto params = MakeUnique<StaticArray<uint8_t, crypto::cECDSAParamsOIDSize>>(&mAllocator);
-        auto point  = MakeUnique<StaticArray<uint8_t, crypto::cECDSAPointDERSize>>(&mAllocator);
+        if (!params) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
+
+        auto point = MakeUnique<StaticArray<uint8_t, crypto::cECDSAPointDERSize>>(&mAllocator);
+        if (!point) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
 
         err = mCryptoProvider.ASN1DecodeOID(attrValues[0], *params);
         if (!err.IsNone()) {
@@ -1381,8 +1430,15 @@ RetWithError<PrivateKey> Utils::ExportPrivateKey(
         }
 
         auto pubKey = MakeUnique<crypto::ECDSAPublicKey>(&mAllocator, *params, *point);
+        if (!pubKey) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
+
         auto cryptoKey
             = MakeShared<PKCS11ECDSAPrivateKey>(&mAllocator, mSession, mCryptoProvider, privKeyHandle, *pubKey);
+        if (!cryptoKey) {
+            return {{}, ErrorEnum::eNoMemory};
+        }
 
         PrivateKey pkcsKey = {privKeyHandle, pubKeyHandle, cryptoKey};
 
@@ -1483,6 +1539,10 @@ RetWithError<SharedPtr<crypto::x509::Certificate>> Utils::FindCertificateByKeyID
 RetWithError<SharedPtr<crypto::x509::Certificate>> Utils::GetCertificate(ObjectHandle handle)
 {
     auto certificate = MakeShared<crypto::x509::Certificate>(&mAllocator);
+    if (!certificate) {
+        return {nullptr, ErrorEnum::eNoMemory};
+    }
+
     StaticArray<Array<uint8_t>, cObjectAttributesCount> attrValues;
     StaticArray<AttributeType, cObjectAttributesCount>  attrTypes;
 
diff --git a/src/core/common/pkcs11/pkcs11.hpp b/src/core/common/pkcs11/pkcs11.hpp
index c84ca6bfd..c30bad842 100644
--- a/src/core/common/pkcs11/pkcs11.hpp
+++ b/src/core/common/pkcs11/pkcs11.hpp
@@ -11,6 +11,7 @@
 #include <core/common/crypto/itf/crypto.hpp>
 #include <core/common/tools/log.hpp>
 #include <core/common/tools/memory.hpp>
+#include <core/common/tools/thread.hpp>
 #include <core/common/tools/utils.hpp>
 #include <core/common/tools/uuid.hpp>
 
@@ -544,9 +545,10 @@ class LibraryContext : public PKCS11LibraryContext {
     /**
      * Initializes object instance.
      *
+     * @param allocator allocator to use for session objects.
      * @return Error.
      */
-    virtual Error Init();
+    virtual Error Init(AllocatorItf& allocator);
 
     /**
      * Initializes a token.
@@ -633,8 +635,8 @@ class LibraryContext : public PKCS11LibraryContext {
 
     RetWithError<SharedPtr<SessionContext>> PKCS11OpenSession(SlotID slotID, Flags flags);
 
-    CK_FUNCTION_LIST_PTR                                      mFunctionList = nullptr;
-    StaticAllocator<sizeof(SessionContext) * cSessionsPerLib> mAllocator;
+    CK_FUNCTION_LIST_PTR mFunctionList = nullptr;
+    AllocatorItf*        mAllocator {};
 
     StaticArray<Pair<SessionParams, SharedPtr<SessionContext>>, cSessionsMaxCount> mSessions;
     size_t                                                                         mLRUInd = 0;
@@ -710,11 +712,11 @@ class Utils {
     /**
      * Creates an object instance.
      *
+     * @param allocator allocator for token/session objects.
      * @param session session context.
      * @param cryptoProvider provider to x509 crypto provider.
-     * @param allocator allocator for token/session objects.
      */
-    Utils(const SharedPtr<SessionContext>& session, crypto::x509::ProviderItf& cryptoProvider, Allocator& allocator);
+    Utils(AllocatorItf& allocator, const SharedPtr<SessionContext>& session, crypto::x509::ProviderItf& cryptoProvider);
 
     /**
      * Creates an RSA key pair on the token.
@@ -813,7 +815,7 @@ class Utils {
 
     SharedPtr<SessionContext>  mSession;
     crypto::x509::ProviderItf& mCryptoProvider;
-    Allocator&                 mAllocator;
+    AllocatorItf&              mAllocator;
 };
 
 /**
@@ -821,6 +823,14 @@ class Utils {
  */
 class PKCS11Manager {
 public:
+    /**
+     * Initializes object instance.
+     *
+     * @param allocator allocator to use for library contexts.
+     * @return Error.
+     */
+    Error Init(AllocatorItf& allocator);
+
     /**
      * Opens PKCS11 library.
      *
@@ -832,9 +842,10 @@ class PKCS11Manager {
 private:
     using LibraryInfo = Pair<StaticString<cFilePathLen>, SharedPtr<LibraryContext>>;
 
-    StaticAllocator<sizeof(LibraryContext) * cLibrariesMaxNum> mAllocator;
-    StaticArray<LibraryInfo, cLibrariesMaxNum>                 mLibraries;
-    Mutex                                                      mMutex;
+    AllocatorItf* mAllocator {};
+
+    StaticArray<LibraryInfo, cLibrariesMaxNum> mLibraries;
+    Mutex                                      mMutex;
 };
 
 } // namespace aos::pkcs11
diff --git a/src/core/common/pkcs11/privatekey.cpp b/src/core/common/pkcs11/privatekey.cpp
index 863ae10fb..f76eb139f 100644
--- a/src/core/common/pkcs11/privatekey.cpp
+++ b/src/core/common/pkcs11/privatekey.cpp
@@ -21,9 +21,10 @@ constexpr uint8_t PKCS11RSAPrivateKey::cSHA256Prefix[];
 constexpr uint8_t PKCS11RSAPrivateKey::cSHA384Prefix[];
 constexpr uint8_t PKCS11RSAPrivateKey::cSHA512Prefix[];
 
-PKCS11RSAPrivateKey::PKCS11RSAPrivateKey(
-    const SharedPtr<SessionContext>& session, ObjectHandle privKeyHandle, const crypto::RSAPublicKey& pubKey)
-    : mSession(session)
+PKCS11RSAPrivateKey::PKCS11RSAPrivateKey(AllocatorItf& allocator, const SharedPtr<SessionContext>& session,
+    ObjectHandle privKeyHandle, const crypto::RSAPublicKey& pubKey)
+    : mAllocator(allocator)
+    , mSession(session)
     , mPrivKeyHandle(privKeyHandle)
     , mPublicKey(pubKey)
 {
@@ -39,6 +40,9 @@ Error PKCS11RSAPrivateKey::Sign(
     const Array<uint8_t>& digest, const crypto::SignOptions& options, Array<uint8_t>& signature) const
 {
     auto t = MakeUnique<StaticArray<uint8_t, crypto::cSHA2DigestSize + cMaxPrefixSize>>(&mAllocator);
+    if (!t) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     t->Append(GetPrefix(options.mHash));
     t->Append(digest);
diff --git a/src/core/common/pkcs11/privatekey.hpp b/src/core/common/pkcs11/privatekey.hpp
index ba9f62eac..f9aa15513 100644
--- a/src/core/common/pkcs11/privatekey.hpp
+++ b/src/core/common/pkcs11/privatekey.hpp
@@ -20,12 +20,13 @@ class PKCS11RSAPrivateKey : public crypto::PrivateKeyItf {
     /**
      * Constructs object instance.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param session session context.
      * @param privKeyHandle private key handle.
      * @param pubKey public key.
      */
-    PKCS11RSAPrivateKey(
-        const SharedPtr<SessionContext>& session, ObjectHandle privKeyHandle, const crypto::RSAPublicKey& pubKey);
+    PKCS11RSAPrivateKey(AllocatorItf& allocator, const SharedPtr<SessionContext>& session, ObjectHandle privKeyHandle,
+        const crypto::RSAPublicKey& pubKey);
 
     /**
      * Returns public part of a private key.
@@ -75,7 +76,7 @@ class PKCS11RSAPrivateKey : public crypto::PrivateKeyItf {
 
     Array<uint8_t> GetPrefix(crypto::Hash hash) const;
 
-    mutable StaticAllocator<sizeof(StaticArray<uint8_t, crypto::cSHA2DigestSize + cMaxPrefixSize>)> mAllocator;
+    AllocatorItf& mAllocator;
 
     SharedPtr<SessionContext> mSession;
     ObjectHandle              mPrivKeyHandle;
@@ -168,11 +169,6 @@ class PKCS11ECDSAPrivateKey : public crypto::PrivateKeyItf {
     crypto::ECDSAPublicKey     mPublicKey;
 };
 
-/**
- * Maximum size of pkcs11 PrivateKey in bytes.
- */
-constexpr auto cPrivateKeyMaxSize = Max(sizeof(PKCS11RSAPrivateKey), sizeof(PKCS11ECDSAPrivateKey));
-
 } // namespace aos::pkcs11
 
 #endif
diff --git a/src/core/common/pkcs11/tests/pkcs11.cpp b/src/core/common/pkcs11/tests/pkcs11.cpp
index 6e24d6a24..031e1054e 100644
--- a/src/core/common/pkcs11/tests/pkcs11.cpp
+++ b/src/core/common/pkcs11/tests/pkcs11.cpp
@@ -12,8 +12,8 @@
 #include <core/common/tests/crypto/providers/cryptofactory.hpp>
 #include <core/common/tests/crypto/softhsmenv.hpp>
 #include <core/common/tests/utils/log.hpp>
-#include <core/common/tools/allocator.hpp>
 #include <core/common/tools/fs.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/common/tools/uuid.hpp>
 
 using namespace testing;
@@ -30,11 +30,11 @@ class PKCS11Test : public Test {
     {
         tests::utils::InitLog();
 
-        ASSERT_TRUE(mCryptoFactory.Init().IsNone());
+        ASSERT_TRUE(mCryptoFactory.Init(mAllocator).IsNone());
         mCryptoProvider = &mCryptoFactory.GetCryptoProvider();
         mHashProvider   = &mCryptoFactory.GetHashProvider();
 
-        ASSERT_TRUE(mSoftHSMEnv.Init(mPIN, mLabel).IsNone());
+        ASSERT_TRUE(mSoftHSMEnv.Init(mAllocator, mPIN, mLabel).IsNone());
 
         mLibrary = mSoftHSMEnv.GetLibrary();
         mSlotID  = mSoftHSMEnv.GetSlotID();
@@ -43,6 +43,10 @@ class PKCS11Test : public Test {
     static constexpr auto mLabel = "iam pkcs11 test slot";
     static constexpr auto mPIN   = "admin";
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     crypto::DefaultCryptoFactory mCryptoFactory;
     crypto::CryptoProviderItf*   mCryptoProvider = nullptr;
     crypto::HasherItf*           mHashProvider   = nullptr;
@@ -50,12 +54,6 @@ class PKCS11Test : public Test {
 
     SlotID                    mSlotID = 0;
     SharedPtr<LibraryContext> mLibrary;
-
-    StaticAllocator<Max(2 * sizeof(PKCS11RSAPrivateKey), sizeof(PKCS11ECDSAPrivateKey),
-                        2 * sizeof(crypto::x509::Certificate) + sizeof(crypto::x509::CertificateChain)
-                            + 2 * sizeof(PKCS11RSAPrivateKey))
-        + Utils::cLocalObjectsMaxSize>
-        mAllocator;
 };
 
 /***********************************************************************************************************************
@@ -150,7 +148,7 @@ TEST_F(PKCS11Test, GenerateRSAKeyPairWithLabel)
 
     PrivateKey key;
 
-    Tie(key, err) = Utils(session1, *mCryptoProvider, mAllocator).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
+    Tie(key, err) = Utils(mAllocator, session1, *mCryptoProvider).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
     ASSERT_TRUE(err.IsNone());
 
     // check key exists in a new session
@@ -168,7 +166,7 @@ TEST_F(PKCS11Test, GenerateRSAKeyPairWithLabel)
     ASSERT_THAT(std::vector<ObjectHandle>(objects.begin(), objects.end()), Contains(key.GetPubHandle()));
 
     // remove key
-    err = Utils(session1, *mCryptoProvider, mAllocator).DeletePrivateKey(key);
+    err = Utils(mAllocator, session1, *mCryptoProvider).DeletePrivateKey(key);
     ASSERT_TRUE(err.IsNone());
 
     // check key doesn't exist anymore
@@ -194,7 +192,7 @@ TEST_F(PKCS11Test, GenerateECDSAKeyPairWithLabel)
     PrivateKey key;
 
     Tie(key, err)
-        = Utils(session1, *mCryptoProvider, mAllocator).GenerateECDSAKeyPairWithLabel(id, mLabel, EllipticCurve::eP384);
+        = Utils(mAllocator, session1, *mCryptoProvider).GenerateECDSAKeyPairWithLabel(id, mLabel, EllipticCurve::eP384);
     ASSERT_TRUE(err.IsNone());
 
     // check ECDSA public key params
@@ -219,7 +217,7 @@ TEST_F(PKCS11Test, GenerateECDSAKeyPairWithLabel)
     ASSERT_THAT(std::vector<ObjectHandle>(objects.begin(), objects.end()), Contains(key.GetPubHandle()));
 
     // remove key
-    err = Utils(session1, *mCryptoProvider, mAllocator).DeletePrivateKey(key);
+    err = Utils(mAllocator, session1, *mCryptoProvider).DeletePrivateKey(key);
     ASSERT_TRUE(err.IsNone());
 
     // check key doesn't exist anymore
@@ -244,12 +242,12 @@ TEST_F(PKCS11Test, FindPrivateKey)
 
     PrivateKey key;
 
-    Tie(key, err) = Utils(session, *mCryptoProvider, mAllocator).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
+    Tie(key, err) = Utils(mAllocator, session, *mCryptoProvider).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
     ASSERT_TRUE(err.IsNone());
 
     // find PrivateKey
     PrivateKey foundKey;
-    Tie(foundKey, err) = Utils(session, *mCryptoProvider, mAllocator).FindPrivateKey(id, mLabel);
+    Tie(foundKey, err) = Utils(mAllocator, session, *mCryptoProvider).FindPrivateKey(id, mLabel);
     ASSERT_TRUE(err.IsNone());
 
     ASSERT_EQ(key.GetPrivHandle(), foundKey.GetPrivHandle());
@@ -257,11 +255,11 @@ TEST_F(PKCS11Test, FindPrivateKey)
     ASSERT_TRUE(key.GetPrivKey()->GetPublic().IsEqual(foundKey.GetPrivKey()->GetPublic()));
 
     // remove key
-    err = Utils(session, *mCryptoProvider, mAllocator).DeletePrivateKey(key);
+    err = Utils(mAllocator, session, *mCryptoProvider).DeletePrivateKey(key);
     ASSERT_TRUE(err.IsNone());
 
     // check key doesn't exist anymore
-    Tie(foundKey, err) = Utils(session, *mCryptoProvider, mAllocator).FindPrivateKey(id, mLabel);
+    Tie(foundKey, err) = Utils(mAllocator, session, *mCryptoProvider).FindPrivateKey(id, mLabel);
     ASSERT_EQ(err, ErrorEnum::eNotFound);
 }
 
@@ -285,23 +283,23 @@ TEST_F(PKCS11Test, ImportCertificate)
     ASSERT_TRUE(fs::ReadFile(CERTIFICATES_DIR "/ca.cer.der", derBlob).IsNone());
     ASSERT_TRUE(mCryptoProvider->DERToX509Cert(derBlob, caCert).IsNone());
 
-    ASSERT_TRUE(Utils(session, *mCryptoProvider, mAllocator).ImportCertificate(id, mLabel, caCert).IsNone());
+    ASSERT_TRUE(Utils(mAllocator, session, *mCryptoProvider).ImportCertificate(id, mLabel, caCert).IsNone());
 
     // check certificate exist
     bool hasCertificate = false;
 
     Tie(hasCertificate, err)
-        = Utils(session, *mCryptoProvider, mAllocator).HasCertificate(caCert.mIssuer, caCert.mSerial);
+        = Utils(mAllocator, session, *mCryptoProvider).HasCertificate(caCert.mIssuer, caCert.mSerial);
     ASSERT_TRUE(err.IsNone());
     ASSERT_TRUE(hasCertificate);
 
     // delete certificate
-    err = Utils(session, *mCryptoProvider, mAllocator).DeleteCertificate(id, mLabel);
+    err = Utils(mAllocator, session, *mCryptoProvider).DeleteCertificate(id, mLabel);
     ASSERT_TRUE(err.IsNone());
 
     // check certificate doesn't exist
     Tie(hasCertificate, err)
-        = Utils(session, *mCryptoProvider, mAllocator).HasCertificate(caCert.mIssuer, caCert.mSerial);
+        = Utils(mAllocator, session, *mCryptoProvider).HasCertificate(caCert.mIssuer, caCert.mSerial);
     ASSERT_TRUE(err.IsNone());
     ASSERT_FALSE(hasCertificate);
 }
@@ -359,13 +357,13 @@ TEST_F(PKCS11Test, FindCertificateChain)
     ASSERT_TRUE(mCryptoProvider->DERToX509Cert(derBlob, clientCert).IsNone());
 
     // import certificates
-    ASSERT_TRUE(Utils(session, *mCryptoProvider, mAllocator).ImportCertificate(caId, mLabel, caCert).IsNone());
-    ASSERT_TRUE(Utils(session, *mCryptoProvider, mAllocator).ImportCertificate(clientId, mLabel, clientCert).IsNone());
+    ASSERT_TRUE(Utils(mAllocator, session, *mCryptoProvider).ImportCertificate(caId, mLabel, caCert).IsNone());
+    ASSERT_TRUE(Utils(mAllocator, session, *mCryptoProvider).ImportCertificate(clientId, mLabel, clientCert).IsNone());
 
     // find two certificate chain
     SharedPtr<crypto::x509::CertificateChain> chain;
 
-    Tie(chain, err) = Utils(session, *mCryptoProvider, mAllocator).FindCertificateChain(clientId, mLabel);
+    Tie(chain, err) = Utils(mAllocator, session, *mCryptoProvider).FindCertificateChain(clientId, mLabel);
 
     ASSERT_TRUE(err.IsNone());
     ASSERT_TRUE(chain);
@@ -393,7 +391,7 @@ TEST_F(PKCS11Test, PKCS11RSAPrivateKeySign)
 
     PrivateKey pkcs11key;
 
-    Tie(pkcs11key, err) = Utils(session, *mCryptoProvider, mAllocator).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
+    Tie(pkcs11key, err) = Utils(mAllocator, session, *mCryptoProvider).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
     ASSERT_TRUE(err.IsNone());
 
     // generate signature
@@ -433,7 +431,7 @@ TEST_F(PKCS11Test, PKCS11ECDSAPrivateKeySign)
     PrivateKey pkcs11key;
 
     Tie(pkcs11key, err)
-        = Utils(session, *mCryptoProvider, mAllocator).GenerateECDSAKeyPairWithLabel(id, mLabel, EllipticCurve::eP384);
+        = Utils(mAllocator, session, *mCryptoProvider).GenerateECDSAKeyPairWithLabel(id, mLabel, EllipticCurve::eP384);
     ASSERT_TRUE(err.IsNone());
 
     // generate signature
@@ -470,7 +468,7 @@ TEST_F(PKCS11Test, PKCS11RSAPrivateKeyDecrypt)
 
     PrivateKey pkcs11key;
 
-    Tie(pkcs11key, err) = Utils(session, *mCryptoProvider, mAllocator).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
+    Tie(pkcs11key, err) = Utils(mAllocator, session, *mCryptoProvider).GenerateRSAKeyPairWithLabel(id, mLabel, 2048);
     ASSERT_TRUE(err.IsNone());
 
     // encrypt message
diff --git a/src/core/common/spaceallocator/spaceallocator.hpp b/src/core/common/spaceallocator/spaceallocator.hpp
index f64f00e6a..ed49399c4 100644
--- a/src/core/common/spaceallocator/spaceallocator.hpp
+++ b/src/core/common/spaceallocator/spaceallocator.hpp
@@ -12,6 +12,7 @@
 #include <core/common/tools/function.hpp>
 #include <core/common/tools/map.hpp>
 #include <core/common/tools/memory.hpp>
+#include <core/common/tools/thread.hpp>
 
 #include "itf/spaceallocator.hpp"
 
@@ -25,7 +26,7 @@ struct Partition;
 struct OutdatedItem {
     StaticString<cIDLen>                    mID;
     StaticString<cVersionLen>               mVersion;
-    SpaceAllocatorItf*                      mAllocator {};
+    SpaceAllocatorItf*                      mSpaceAllocator {};
     StaticFunction<cDefaultFunctionMaxSize> mFreeCallback;
     Partition*                              mPartition {};
     ItemRemoverItf*                         mRemover {};
@@ -321,24 +322,24 @@ class SpaceAllocator : public SpaceAllocatorItf, public SpaceAllocatorStorage {
      */
     class Space : public SpaceItf {
     public:
-        Space(size_t size, SpaceAllocator* allocator)
+        Space(size_t size, SpaceAllocator* spaceAllocator)
             : mSize(size)
-            , mAllocator(allocator)
+            , mSpaceAllocator(spaceAllocator)
         {
         }
 
-        Error Accept() override { return mAllocator->AllocateDone(); }
+        Error Accept() override { return mSpaceAllocator->AllocateDone(); }
 
         Error Release() override
         {
-            mAllocator->FreeSpace(mSize);
+            mSpaceAllocator->FreeSpace(mSize);
 
-            return mAllocator->AllocateDone();
+            return mSpaceAllocator->AllocateDone();
         }
 
         Error Resize(size_t size) override
         {
-            if (auto err = mAllocator->ResizeSpace(mSize, size); !err.IsNone()) {
+            if (auto err = mSpaceAllocator->ResizeSpace(mSize, size); !err.IsNone()) {
                 return err;
             }
 
@@ -351,7 +352,7 @@ class SpaceAllocator : public SpaceAllocatorItf, public SpaceAllocatorStorage {
 
     private:
         size_t          mSize;
-        SpaceAllocator* mAllocator;
+        SpaceAllocator* mSpaceAllocator;
     };
 
 public:
@@ -363,16 +364,19 @@ class SpaceAllocator : public SpaceAllocatorItf, public SpaceAllocatorStorage {
     /**
      * Initializes space allocator.
      *
+     * @param allocator allocator to use for space objects.
      * @param path path to allocate space.
      * @param platformFS platform file system.
      * @param limit limit in percents.
      * @param remover item remover.
      * @return Error.
      */
-    Error Init(const String& path, fs::FSPlatformItf& platformFS, size_t limit = 0, ItemRemoverItf* remover = nullptr)
+    Error Init(AllocatorItf& allocator, const String& path, fs::FSPlatformItf& platformFS, size_t limit = 0,
+        ItemRemoverItf* remover = nullptr)
     {
         LockGuard lock {mPartitionsMutex};
 
+        mAllocator  = &allocator;
         mRemover    = remover;
         mPlatformFS = &platformFS;
         mPath       = path;
@@ -461,7 +465,15 @@ class SpaceAllocator : public SpaceAllocatorItf, public SpaceAllocatorStorage {
             return {nullptr, err};
         }
 
-        return UniquePtr<SpaceItf>(MakeUnique<Space>(&mAllocator, size, this));
+        auto space = MakeUnique<Space>(mAllocator, size, this);
+        if (!space) {
+            mPartition->Free(size);
+            Free(size);
+
+            return {nullptr, ErrorEnum::eNoMemory};
+        }
+
+        return UniquePtr<SpaceItf>(Move(space));
     };
 
     /**
@@ -507,12 +519,12 @@ class SpaceAllocator : public SpaceAllocatorItf, public SpaceAllocatorStorage {
 
         OutdatedItem item;
 
-        item.mID        = id;
-        item.mVersion   = version;
-        item.mPartition = mPartition;
-        item.mRemover   = mRemover;
-        item.mTimestamp = timestamp;
-        item.mAllocator = this;
+        item.mID             = id;
+        item.mVersion        = version;
+        item.mPartition      = mPartition;
+        item.mRemover        = mRemover;
+        item.mTimestamp      = timestamp;
+        item.mSpaceAllocator = this;
 
         item.mFreeCallback
             = aos::StaticFunction<> {[this](void* sizePtr) { this->Free(reinterpret_cast<size_t>(sizePtr)); }};
@@ -591,7 +603,7 @@ class SpaceAllocator : public SpaceAllocatorItf, public SpaceAllocatorStorage {
         if (mAllocatedSize + size > mSizeLimit) {
             size_t outdatedCount = 0;
             for (const auto& item : mPartition->mOutdatedItems) {
-                if (item.mAllocator == this) {
+                if (item.mSpaceAllocator == this) {
                     outdatedCount++;
                 }
             }
@@ -631,7 +643,7 @@ class SpaceAllocator : public SpaceAllocatorItf, public SpaceAllocatorStorage {
         size_t i         = 0;
 
         for (auto& item : mPartition->mOutdatedItems) {
-            if (item.mAllocator != this || freedSize >= size) {
+            if (item.mSpaceAllocator != this || freedSize >= size) {
                 mPartition->mOutdatedItems[i] = item;
                 i++;
 
@@ -688,15 +700,15 @@ class SpaceAllocator : public SpaceAllocatorItf, public SpaceAllocatorStorage {
         return ErrorEnum::eNone;
     }
 
-    StaticAllocator<sizeof(Space) * cNumAllocations> mAllocator;
-    size_t                                           mSizeLimit {};
-    size_t                                           mAllocationCount {};
-    size_t                                           mAllocatedSize {};
-    StaticString<cFilePathLen>                       mPath;
-    ItemRemoverItf*                                  mRemover {};
-    fs::FSPlatformItf*                               mPlatformFS {};
-    Partition*                                       mPartition {};
-    Mutex                                            mMutex;
+    AllocatorItf*              mAllocator {};
+    size_t                     mSizeLimit {};
+    size_t                     mAllocationCount {};
+    size_t                     mAllocatedSize {};
+    StaticString<cFilePathLen> mPath;
+    ItemRemoverItf*            mRemover {};
+    fs::FSPlatformItf*         mPlatformFS {};
+    Partition*                 mPartition {};
+    Mutex                      mMutex;
 };
 
 } // namespace aos::spaceallocator
diff --git a/src/core/common/spaceallocator/tests/spaceallocator.cpp b/src/core/common/spaceallocator/tests/spaceallocator.cpp
index ec420d0ed..592929c44 100644
--- a/src/core/common/spaceallocator/tests/spaceallocator.cpp
+++ b/src/core/common/spaceallocator/tests/spaceallocator.cpp
@@ -9,6 +9,7 @@
 #include <core/common/spaceallocator/spaceallocator.hpp>
 #include <core/common/tests/mocks/fsmock.hpp>
 #include <core/common/tests/mocks/spaceallocatormock.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 using namespace testing;
 
@@ -27,6 +28,8 @@ class SpaceallocatorTest : public Test {
         fs::RemoveAll(mPath);
     }
 
+    HeapAllocator mAllocator;
+
     StrictMock<FSPlatformMock>       mPlatformFS;
     StrictMock<ItemRemoverMock>      mRemover;
     const String                     mPath       = "path";
@@ -49,7 +52,7 @@ TEST_F(SpaceallocatorTest, AllocateSuccess)
     EXPECT_CALL(mPlatformFS, GetTotalSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
 
-    ASSERT_TRUE(mSpaceAllocator.Init(mPath, mPlatformFS, mLimit).IsNone());
+    ASSERT_TRUE(mSpaceAllocator.Init(mAllocator, mPath, mPlatformFS, mLimit).IsNone());
 
     EXPECT_CALL(mPlatformFS, GetAvailableSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
@@ -96,9 +99,9 @@ TEST_F(SpaceallocatorTest, MultipleAllocators)
     EXPECT_CALL(mPlatformFS, GetTotalSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
 
-    ASSERT_TRUE(allocator1.Init(mPath, mPlatformFS).IsNone());
-    ASSERT_TRUE(allocator2.Init(mPath, mPlatformFS).IsNone());
-    ASSERT_TRUE(allocator3.Init(mPath, mPlatformFS).IsNone());
+    ASSERT_TRUE(allocator1.Init(mAllocator, mPath, mPlatformFS).IsNone());
+    ASSERT_TRUE(allocator2.Init(mAllocator, mPath, mPlatformFS).IsNone());
+    ASSERT_TRUE(allocator3.Init(mAllocator, mPath, mPlatformFS).IsNone());
 
     EXPECT_CALL(mPlatformFS, GetAvailableSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
@@ -167,7 +170,7 @@ TEST_F(SpaceallocatorTest, OutdatedItems)
     EXPECT_CALL(mPlatformFS, GetTotalSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(effectiveTotalSize, ErrorEnum::eNone)));
 
-    ASSERT_TRUE(mSpaceAllocator.Init(mPath, mPlatformFS, 100, &mRemover).IsNone());
+    ASSERT_TRUE(mSpaceAllocator.Init(mAllocator, mPath, mPlatformFS, 100, &mRemover).IsNone());
 
     std::vector<std::string> removedFiles;
     EXPECT_CALL(mRemover, RemoveItem(testing::_, testing::_))
@@ -268,7 +271,7 @@ TEST_F(SpaceallocatorTest, PartLimit)
     SpaceAllocator<2> mSpaceAllocator;
 
     // Initialize allocator with 50% limit
-    ASSERT_TRUE(mSpaceAllocator.Init(mPath, mPlatformFS, 50).IsNone());
+    ASSERT_TRUE(mSpaceAllocator.Init(mAllocator, mPath, mPlatformFS, 50).IsNone());
 
     EXPECT_CALL(mPlatformFS, GetDirSize(mPath))
         .WillOnce(Return(RetWithError<size_t>(totalExistSize, ErrorEnum::eNone)));
@@ -306,7 +309,7 @@ TEST_F(SpaceallocatorTest, ResizeSpace)
     EXPECT_CALL(mPlatformFS, GetTotalSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
 
-    ASSERT_TRUE(mSpaceAllocator.Init(mPath, mPlatformFS, mLimit).IsNone());
+    ASSERT_TRUE(mSpaceAllocator.Init(mAllocator, mPath, mPlatformFS, mLimit).IsNone());
 
     EXPECT_CALL(mPlatformFS, GetAvailableSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
@@ -344,7 +347,7 @@ TEST_F(SpaceallocatorTest, ResizeSpaceEviction)
     EXPECT_CALL(mPlatformFS, GetTotalSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
 
-    ASSERT_TRUE(mSpaceAllocator.Init(mPath, mPlatformFS, mLimit, &mRemover).IsNone());
+    ASSERT_TRUE(mSpaceAllocator.Init(mAllocator, mPath, mPlatformFS, mLimit, &mRemover).IsNone());
 
     EXPECT_CALL(mPlatformFS, GetAvailableSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
@@ -383,7 +386,7 @@ TEST_F(SpaceallocatorTest, ResizeSpaceInsufficientSpace)
     EXPECT_CALL(mPlatformFS, GetTotalSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
 
-    ASSERT_TRUE(mSpaceAllocator.Init(mPath, mPlatformFS, mLimit).IsNone());
+    ASSERT_TRUE(mSpaceAllocator.Init(mAllocator, mPath, mPlatformFS, mLimit).IsNone());
 
     EXPECT_CALL(mPlatformFS, GetAvailableSize(mMountPoint))
         .WillOnce(Return(RetWithError<size_t>(mTotalSize, ErrorEnum::eNone)));
diff --git a/src/core/common/tests/crypto/providers/cryptofactoryitf.hpp b/src/core/common/tests/crypto/providers/cryptofactoryitf.hpp
index 8260181f3..959a88862 100644
--- a/src/core/common/tests/crypto/providers/cryptofactoryitf.hpp
+++ b/src/core/common/tests/crypto/providers/cryptofactoryitf.hpp
@@ -28,9 +28,10 @@ class CryptoFactoryItf {
     /**
      * Initializes crypto factory.
      *
+     * @param allocator allocator to use for crypto provider.
      * @return Error.
      */
-    virtual Error Init() = 0;
+    virtual Error Init(AllocatorItf& allocator) = 0;
 
     /**
      * Returns crypto factory name.
diff --git a/src/core/common/tests/crypto/providers/mbedtlsfactory.cpp b/src/core/common/tests/crypto/providers/mbedtlsfactory.cpp
index 95d8a486a..80238f628 100644
--- a/src/core/common/tests/crypto/providers/mbedtlsfactory.cpp
+++ b/src/core/common/tests/crypto/providers/mbedtlsfactory.cpp
@@ -385,9 +385,9 @@ MBedTLSCryptoFactory::MBedTLSCryptoFactory()
 {
 }
 
-Error MBedTLSCryptoFactory::Init()
+Error MBedTLSCryptoFactory::Init(AllocatorItf& allocator)
 {
-    return mProvider.Init();
+    return mProvider.Init(allocator);
 }
 
 std::string MBedTLSCryptoFactory::GetName()
diff --git a/src/core/common/tests/crypto/providers/mbedtlsfactory.hpp b/src/core/common/tests/crypto/providers/mbedtlsfactory.hpp
index 4acda37a8..0e3c521df 100644
--- a/src/core/common/tests/crypto/providers/mbedtlsfactory.hpp
+++ b/src/core/common/tests/crypto/providers/mbedtlsfactory.hpp
@@ -26,9 +26,10 @@ class MBedTLSCryptoFactory : public CryptoFactoryItf {
     /**
      * Initializes crypto factory.
      *
+     * @param allocator allocator to use for crypto provider.
      * @return Error.
      */
-    Error Init() override;
+    Error Init(AllocatorItf& allocator) override;
 
     /**
      * Returns crypto factory name.
diff --git a/src/core/common/tests/crypto/providers/opensslfactory.cpp b/src/core/common/tests/crypto/providers/opensslfactory.cpp
index dfd8d43ca..badff0bf3 100644
--- a/src/core/common/tests/crypto/providers/opensslfactory.cpp
+++ b/src/core/common/tests/crypto/providers/opensslfactory.cpp
@@ -407,9 +407,9 @@ OpenSSLCryptoFactory::OpenSSLCryptoFactory()
 {
 }
 
-Error OpenSSLCryptoFactory::Init()
+Error OpenSSLCryptoFactory::Init(AllocatorItf& allocator)
 {
-    return mProvider.Init();
+    return mProvider.Init(allocator);
 }
 
 std::string OpenSSLCryptoFactory::GetName()
diff --git a/src/core/common/tests/crypto/providers/opensslfactory.hpp b/src/core/common/tests/crypto/providers/opensslfactory.hpp
index 8965f242f..1174d6208 100644
--- a/src/core/common/tests/crypto/providers/opensslfactory.hpp
+++ b/src/core/common/tests/crypto/providers/opensslfactory.hpp
@@ -26,9 +26,10 @@ class OpenSSLCryptoFactory : public CryptoFactoryItf {
     /**
      * Initializes crypto factory.
      *
+     * @param allocator allocator to use for crypto provider.
      * @return Error.
      */
-    Error Init() override;
+    Error Init(AllocatorItf& allocator) override;
 
     /**
      * Returns crypto factory name.
diff --git a/src/core/common/tests/crypto/softhsmenv.cpp b/src/core/common/tests/crypto/softhsmenv.cpp
index a2c551464..9b14bde95 100644
--- a/src/core/common/tests/crypto/softhsmenv.cpp
+++ b/src/core/common/tests/crypto/softhsmenv.cpp
@@ -11,13 +11,17 @@
 
 namespace aos::test {
 
-Error SoftHSMEnv::Init(
-    const String& pin, const String& label, const char* confFile, const char* tokensDir, const char* libPath)
+Error SoftHSMEnv::Init(AllocatorItf& allocator, const String& pin, const String& label, const char* confFile,
+    const char* tokensDir, const char* libPath)
 {
     // Clear softhsm directory
     fs::ClearDir(tokensDir);
     setenv("SOFTHSM2_CONF", confFile, true);
 
+    if (auto err = mManager.Init(allocator); !err.IsNone()) {
+        return AOS_ERROR_WRAP(err);
+    }
+
     mLibrary = mManager.OpenLibrary(libPath);
     if (!mLibrary) {
         return ErrorEnum::eFailed;
diff --git a/src/core/common/tests/crypto/softhsmenv.hpp b/src/core/common/tests/crypto/softhsmenv.hpp
index 78a7517de..66d449ea3 100644
--- a/src/core/common/tests/crypto/softhsmenv.hpp
+++ b/src/core/common/tests/crypto/softhsmenv.hpp
@@ -14,8 +14,9 @@ namespace aos::test {
 
 class SoftHSMEnv {
 public:
-    Error Init(const String& pin, const String& label, const char* confFile = SOFTHSM_BASE_DIR "/softhsm2.conf",
-        const char* tokensDir = SOFTHSM_BASE_DIR "/tokens", const char* libPath = SOFTHSM2_LIB);
+    Error Init(AllocatorItf& allocator, const String& pin, const String& label,
+        const char* confFile = SOFTHSM_BASE_DIR "/softhsm2.conf", const char* tokensDir = SOFTHSM_BASE_DIR "/tokens",
+        const char* libPath = SOFTHSM2_LIB);
 
     RetWithError<SharedPtr<pkcs11::SessionContext>> OpenUserSession(const String& pin, bool login = true);
 
diff --git a/src/core/common/tests/stubs/spaceallocatorstub.hpp b/src/core/common/tests/stubs/spaceallocatorstub.hpp
index b40a35a66..09b3689a1 100644
--- a/src/core/common/tests/stubs/spaceallocatorstub.hpp
+++ b/src/core/common/tests/stubs/spaceallocatorstub.hpp
@@ -8,6 +8,7 @@
 #define AOS_CORE_COMMON_TESTS_STUBS_SPACEALLOCATORSTUB_HPP_
 
 #include <core/common/spaceallocator/spaceallocator.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/common/tools/memory.hpp>
 
 namespace aos::spaceallocator {
@@ -78,7 +79,12 @@ class SpaceAllocatorStub : public SpaceAllocatorItf {
      */
     RetWithError<UniquePtr<SpaceItf>> AllocateSpace(size_t size) override
     {
-        return {UniquePtr<SpaceItf>(MakeUnique<SpaceStub>(&mAllocator, size))};
+        auto space = MakeUnique<SpaceStub>(&mAllocator, size);
+        if (!space) {
+            return {nullptr, ErrorEnum::eNoMemory};
+        }
+
+        return UniquePtr<SpaceItf>(Move(space));
     }
 
     /**
@@ -133,7 +139,7 @@ class SpaceAllocatorStub : public SpaceAllocatorItf {
     Error AllocateDone() override { return ErrorEnum::eNone; }
 
 private:
-    StaticAllocator<1024> mAllocator;
+    HeapAllocator mAllocator;
 };
 
 } // namespace aos::spaceallocator
diff --git a/src/core/common/tools/CMakeLists.txt b/src/core/common/tools/CMakeLists.txt
index a62b5212f..c9f65fd3b 100644
--- a/src/core/common/tools/CMakeLists.txt
+++ b/src/core/common/tools/CMakeLists.txt
@@ -22,7 +22,6 @@ set(SOURCES fs.cpp semver.cpp time.cpp timer.cpp uuid.cpp)
 
 set(HEADERS
     algorithm.hpp
-    allocator.hpp
     array.hpp
     buffer.hpp
     config.hpp
@@ -30,6 +29,7 @@ set(HEADERS
     error.hpp
     fs.hpp
     function.hpp
+    heapallocator.hpp
     identifierpool.hpp
     list.hpp
     log.hpp
diff --git a/src/core/common/tools/allocator.hpp b/src/core/common/tools/allocator.hpp
deleted file mode 100644
index 5e63d1660..000000000
--- a/src/core/common/tools/allocator.hpp
+++ /dev/null
@@ -1,356 +0,0 @@
-/*
- * Copyright (C) 2023 Renesas Electronics Corporation.
- * Copyright (C) 2023 EPAM Systems, Inc.
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#ifndef AOS_CORE_COMMON_TOOLS_ALLOCATOR_HPP_
-#define AOS_CORE_COMMON_TOOLS_ALLOCATOR_HPP_
-
-#include <assert.h>
-#include <cstdint>
-
-#include "buffer.hpp"
-#include "list.hpp"
-#include "noncopyable.hpp"
-#include "thread.hpp"
-
-namespace aos {
-
-/**
- * Allocator instance.
- */
-class Allocator {
-public:
-    /**
-     * Allocation instance.
-     */
-    class Allocation {
-    public:
-        /**
-         * Creates allocation.
-         */
-        Allocation() = default;
-
-        /**
-         * Creates allocation.
-         *
-         * @param data pointer to allocated data.
-         * @param size allocated size.
-         */
-        Allocation(uint8_t* data, size_t size)
-            : mData(data)
-            , mSize(size)
-            , mSharedCount(0)
-        {
-        }
-
-        /**
-         * Returns pointer to allocated data.
-         *
-         * @return uint8_t* pointer to allocated data.
-         */
-        uint8_t* Data() const { return mData; }
-
-        /**
-         * Returns allocated size.
-         *
-         * @return size_t allocated size.
-         */
-        size_t Size() const { return mSize; }
-
-        /**
-         * Increases shared count.
-         *
-         * @param mutex mutex to lock context.
-         * @return size_t chared count value;
-         */
-        size_t Take(Mutex& mutex)
-        {
-            LockGuard lock(mutex);
-
-            return ++mSharedCount;
-        }
-
-        /**
-         * Decreases shared count.
-         *
-         * @param mutex mutex to lock context.
-         * @return size_t chared count value;
-         */
-        size_t Give(Mutex& mutex)
-        {
-            LockGuard lock(mutex);
-
-            return --mSharedCount;
-        }
-
-    private:
-        uint8_t* mData        = nullptr;
-        size_t   mSize        = 0;
-        size_t   mSharedCount = 0;
-    };
-
-    /**
-     * Clears allocator.
-     */
-    void Clear()
-    {
-        LockGuard lock {mMutex};
-
-        mAllocations->Clear();
-    }
-
-    /**
-     * Allocates data with specified size.
-     *
-     * @param size allocate size.
-     * @return void* pointer to allocated data.
-     */
-    void* Allocate(size_t size)
-    {
-        LockGuard lock {mMutex};
-
-        if (mAllocations->IsFull() || GetAllocatedSize() + size > mMaxSize) {
-            assert(!mAllocations->IsFull());
-            assert(GetAllocatedSize() + size <= mMaxSize);
-
-            return nullptr;
-        }
-
-        auto* pos = mBuffer;
-        auto  it  = mAllocations->begin();
-
-        for (; it != mAllocations->end(); ++it) {
-            size_t availableSize = it->Data() - pos;
-
-            if (availableSize >= size) {
-                return Allocate(it, pos, size);
-            }
-
-            pos = it->Data() + it->Size();
-        }
-
-        if (pos + size <= mBuffer + mMaxSize) {
-            return Allocate(mAllocations->end(), pos, size);
-        }
-
-        assert(false);
-
-        return nullptr;
-    }
-
-    /**
-     * Frees previously allocated data.
-     *
-     * @param data allocated data to free.
-     */
-    void Free(void* data)
-    {
-        LockGuard lock {mMutex};
-
-        [[maybe_unused]] auto curSize = mAllocations->Size();
-        mAllocations->RemoveIf([data](const Allocation& allocation) { return allocation.Data() == data; });
-        [[maybe_unused]] auto newSize = mAllocations->Size();
-
-        assert(curSize != newSize);
-    }
-
-    /**
-     * Finds allocation by data.
-     *
-     * @param data allocated data.
-     * @return List<Allocation>::Iterator.
-     */
-    RetWithError<List<Allocation>::Iterator> FindAllocation(const void* data)
-    {
-        LockGuard lock {mMutex};
-
-        return mAllocations->FindIf([data](const Allocation& allocation) { return allocation.Data() == data; });
-    }
-
-    /**
-     * Increases allocation shared count.
-     *
-     * @param it allocation to increase shared count.
-     * @return size_t allocation shared count.
-     */
-    size_t TakeAllocation(List<Allocation>::Iterator it) { return it->Take(mMutex); }
-
-    /**
-     * Decreases allocation shared count.
-     *
-     * @param it allocation to increase shared count.
-     * @return size_t allocation shared count.
-     */
-    size_t GiveAllocation(List<Allocation>::Iterator it) { return it->Give(mMutex); }
-
-    /**
-     * Returns allocator free size.
-     *
-     * @return size_t free size.
-     */
-    size_t FreeSize() const
-    {
-        LockGuard lock {mMutex};
-
-        return mMaxSize - GetAllocatedSize();
-    }
-
-    /**
-     * Return allocator max size.
-     *
-     * @return size_t max size.
-     */
-    size_t MaxSize() const
-    {
-        LockGuard lock {mMutex};
-
-        return mMaxSize;
-    }
-
-    /**
-     * Return max allocated size.
-     *
-     * @return size_t max allocated size.
-     */
-    size_t MaxAllocatedSize() const
-    {
-        LockGuard lock {mMutex};
-
-        return mMaxAllocatedSize;
-    }
-
-    /**
-     * Resets max allocated size.
-     */
-    void ResetMaxAllocatedSize()
-    {
-        LockGuard lock {mMutex};
-
-        mMaxAllocatedSize = 0;
-    }
-
-protected:
-    void SetBuffer(const Buffer& buffer, List<Allocation>& allocations)
-    {
-        mBuffer      = static_cast<uint8_t*>(buffer.Get());
-        mMaxSize     = buffer.Size();
-        mAllocations = &allocations;
-        mAllocations->Clear();
-    }
-
-private:
-    // cppcheck-suppress passedByValue
-    void* Allocate(List<Allocation>::ConstIterator it, uint8_t* data, size_t size)
-    {
-        [[maybe_unused]] auto err = mAllocations->Emplace(it, Allocation(data, size));
-        assert(err.IsNone());
-
-        if (GetAllocatedSize() > mMaxAllocatedSize) {
-            mMaxAllocatedSize = GetAllocatedSize();
-        }
-
-        return data;
-    }
-
-    size_t GetAllocatedSize() const
-    {
-        size_t allocatedSize = 0;
-
-        for (const auto& allocation : *mAllocations) {
-            allocatedSize += allocation.Size();
-        }
-
-        return allocatedSize;
-    }
-
-    uint8_t*          mBuffer           = {};
-    List<Allocation>* mAllocations      = {};
-    size_t            mMaxSize          = {};
-    size_t            mMaxAllocatedSize = {};
-    mutable Mutex     mMutex;
-};
-
-/**
- * Buffer allocator instance.
- */
-template <size_t cNumAllocations = 8>
-class BufferAllocator : public Allocator {
-public:
-    /**
-     * Creates buffer allocator instance.
-     */
-    explicit BufferAllocator(const Buffer& buffer) { SetBuffer(buffer, mAllocations); }
-
-private:
-    StaticArray<Allocator::Allocation, cNumAllocations> mAllocations;
-};
-
-/**
- * Static allocator instance.
- */
-template <size_t cSize, size_t cNumAllocations = 8>
-class StaticAllocator : public Allocator {
-public:
-    /**
-     * Creates static allocator instance.
-     */
-    StaticAllocator() { SetBuffer(mBuffer, mAllocations); }
-
-private:
-    StaticBuffer<cSize>                                mBuffer;
-    StaticList<Allocator::Allocation, cNumAllocations> mAllocations;
-};
-
-} // namespace aos
-
-/**
- * Overloads placement new operator to allocate object on Aos buffer.
- *
- * @param size allocate size.
- * @param allocator allocator.
- * @return void* allocated space.
- */
-inline void* operator new(size_t size, aos::Allocator* allocator)
-{
-    assert(allocator);
-
-    auto data = allocator->Allocate(size);
-    assert(data);
-
-    return data;
-}
-
-/**
- * Overloads placement sized new operator to allocate object on Aos buffer.
- *
- * @param size allocate size.
- * @param allocator allocator.
- * @return void* allocated space.
- */
-inline void* operator new[](size_t size, aos::Allocator* allocator)
-{
-    assert(allocator);
-
-    auto data = allocator->Allocate(size);
-    assert(data);
-
-    return data;
-}
-
-/**
- * Overloads placement delete operator to release object on Aos buffer.
- *
- * @param data pointer to allocated data.
- * @param allocator allocator.
- */
-inline void operator delete(void* data, aos::Allocator* allocator)
-{
-    assert(allocator);
-
-    allocator->Free(data);
-}
-
-#endif
diff --git a/src/core/common/tools/array.hpp b/src/core/common/tools/array.hpp
index 7415eb779..995717373 100644
--- a/src/core/common/tools/array.hpp
+++ b/src/core/common/tools/array.hpp
@@ -45,7 +45,6 @@ class Array : public AlgorithmItf<T, T*, const T*> {
      * @param size C array size.
      */
     Array(const T* items, size_t size)
-        // cppcheck-suppress templateRecursion
         : mItems(const_cast<RemoveConstType<T>*>(items))
         , mSize(size)
         , mMaxSize(size)
diff --git a/src/core/common/tools/fs.cpp b/src/core/common/tools/fs.cpp
index d957625f1..877675a0f 100644
--- a/src/core/common/tools/fs.cpp
+++ b/src/core/common/tools/fs.cpp
@@ -15,17 +15,6 @@
 
 namespace aos::fs {
 
-/***********************************************************************************************************************
- * Static
- **********************************************************************************************************************/
-
-namespace {
-
-Mutex                                     sCalculateSizeMutex;
-StaticAllocator<sizeof(DirIteratorArray)> sCalculateSizeAllocator;
-
-} // namespace
-
 /***********************************************************************************************************************
  * DirIterator implementation
  **********************************************************************************************************************/
@@ -97,8 +86,9 @@ bool DirIterator::Next()
  * FileInfoProvider implementation
  **********************************************************************************************************************/
 
-Error FileInfoProvider::Init(crypto::HasherItf& hashProvider)
+Error FileInfoProvider::Init(AllocatorItf& allocator, crypto::HasherItf& hashProvider)
 {
+    mAllocator    = &allocator;
     mHashProvider = &hashProvider;
 
     return ErrorEnum::eNone;
@@ -106,7 +96,7 @@ Error FileInfoProvider::Init(crypto::HasherItf& hashProvider)
 
 Error FileInfoProvider::GetFileInfo(const String& path, FileInfo& info, crypto::Hash hashAlg)
 {
-    auto [size, err] = CalculateSize(path);
+    auto [size, err] = CalculateSize(*mAllocator, path);
     if (!err.IsNone()) {
         return err;
     }
@@ -511,10 +501,8 @@ Error WriteStringToFile(const String& fileName, const String& text, uint32_t per
     return WriteFile(fileName, buff, perm);
 }
 
-RetWithError<size_t> CalculateSize(const String& path)
+RetWithError<size_t> CalculateSize(AllocatorItf& allocator, const String& path)
 {
-    LockGuard lock {sCalculateSizeMutex};
-
     struct stat st;
 
     if (auto ret = stat(path.CStr(), &st); ret != 0) {
@@ -525,8 +513,12 @@ RetWithError<size_t> CalculateSize(const String& path)
         return {static_cast<size_t>(st.st_size)};
     }
 
-    size_t size         = 0;
-    auto   dirIterators = MakeUnique<DirIteratorArray>(&sCalculateSizeAllocator);
+    size_t size = 0;
+
+    auto dirIterators = MakeUnique<DirIteratorArray>(&allocator);
+    if (!dirIterators) {
+        return {0, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
 
     if (auto err = dirIterators->EmplaceBack(path); !err.IsNone()) {
         return {0, AOS_ERROR_WRAP(err)};
diff --git a/src/core/common/tools/fs.hpp b/src/core/common/tools/fs.hpp
index 1dced1488..bcd503c7f 100644
--- a/src/core/common/tools/fs.hpp
+++ b/src/core/common/tools/fs.hpp
@@ -15,6 +15,7 @@
 #include <core/common/types/common.hpp>
 
 #include "config.hpp"
+#include "memory.hpp"
 #include "noncopyable.hpp"
 #include "string.hpp"
 
@@ -291,10 +292,11 @@ class FileInfoProvider : public FileInfoProviderItf {
     /**
      * Initializes file info provider.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param hashProvider hash provider.
      * @return Error.
      */
-    Error Init(crypto::HasherItf& hashProvider);
+    Error Init(AllocatorItf& allocator, crypto::HasherItf& hashProvider);
 
     /**
      * Gets file info.
@@ -306,6 +308,7 @@ class FileInfoProvider : public FileInfoProviderItf {
     Error GetFileInfo(const String& path, FileInfo& info, crypto::Hash hashAlg = crypto::HashEnum::eSHA256) override;
 
 private:
+    AllocatorItf*      mAllocator {};
     crypto::HasherItf* mHashProvider {};
 };
 
@@ -474,10 +477,11 @@ Error WriteStringToFile(const String& fileName, const String& text, uint32_t per
 /**
  * Calculates size of the file or directory.
  *
+ * @param allocator allocator to use for temporary objects.
  * @param path file or directory path.
  * @return RetWithError<size_t>.
  */
-RetWithError<size_t> CalculateSize(const String& path);
+RetWithError<size_t> CalculateSize(AllocatorItf& allocator, const String& path);
 
 /**
  * File class.
diff --git a/src/core/common/tools/heapallocator.hpp b/src/core/common/tools/heapallocator.hpp
new file mode 100644
index 000000000..17e17ebb6
--- /dev/null
+++ b/src/core/common/tools/heapallocator.hpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2023 Renesas Electronics Corporation.
+ * Copyright (C) 2023 EPAM Systems, Inc.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef AOS_CORE_COMMON_TOOLS_HEAPALLOCATOR_HPP_
+#define AOS_CORE_COMMON_TOOLS_HEAPALLOCATOR_HPP_
+
+#include <cstdlib>
+
+#include "memory.hpp"
+
+namespace aos {
+
+/**
+ * Heap allocator instance. Backs the AllocatorItf interface with the standard heap
+ * (malloc/free). Intended for hosted targets (e.g. Linux) where dynamic memory allocation
+ * is acceptable, and for unit tests; safety critical/embedded targets should provide their
+ * own custom AllocatorItf implementation.
+ */
+class HeapAllocator : public AllocatorItf {
+public:
+    /**
+     * Allocates data with specified size.
+     *
+     * @param size allocate size.
+     * @return void* pointer to allocated data, nullptr if allocation failed.
+     */
+    void* Allocate(size_t size) override { return std::malloc(size); }
+
+    /**
+     * Frees previously allocated data.
+     *
+     * @param data allocated data to free.
+     */
+    void Free(void* data) override { std::free(data); }
+};
+
+} // namespace aos
+
+#endif
diff --git a/src/core/common/tools/memory.hpp b/src/core/common/tools/memory.hpp
index a92d02f56..0c1e0e9bf 100644
--- a/src/core/common/tools/memory.hpp
+++ b/src/core/common/tools/memory.hpp
@@ -8,10 +8,46 @@
 #ifndef AOS_CORE_COMMON_TOOLS_MEMORY_HPP_
 #define AOS_CORE_COMMON_TOOLS_MEMORY_HPP_
 
-#include "allocator.hpp"
+#include <assert.h>
+#include <new>
+#include <stddef.h>
+
+#include "noncopyable.hpp"
+#include "thread.hpp"
+#include "utils.hpp"
 
 namespace aos {
 
+/**
+ * Allocator interface.
+ *
+ * Any implementation only has to provide Allocate/Free semantics, so it can be backed by a
+ * heap (see HeapAllocator) or by any custom allocation strategy required by a specific target
+ * (e.g. a static/embedded arena for safety critical domains).
+ */
+class AllocatorItf {
+public:
+    /**
+     * Allocates data with specified size.
+     *
+     * @param size allocate size.
+     * @return void* pointer to allocated data, nullptr if allocation failed.
+     */
+    virtual void* Allocate(size_t size) = 0;
+
+    /**
+     * Frees previously allocated data.
+     *
+     * @param data allocated data to free.
+     */
+    virtual void Free(void* data) = 0;
+
+    /**
+     * Destroys allocator instance.
+     */
+    virtual ~AllocatorItf() = default;
+};
+
 /**
  * Default deleter invokes delete operator for the given pointer.
  */
@@ -23,7 +59,7 @@ class DefaultDeleter : public NonCopyable {
      *
      * @param allocator input allocator.
      */
-    explicit DefaultDeleter(Allocator* allocator = nullptr)
+    explicit DefaultDeleter(AllocatorItf* allocator = nullptr)
         : mAllocator(allocator)
     {
     }
@@ -51,9 +87,9 @@ class DefaultDeleter : public NonCopyable {
     /**
      * Returns allocator.
      *
-     * @return Allocator*.
+     * @return AllocatorItf*.
      */
-    Allocator* GetAllocator() const { return mAllocator; }
+    AllocatorItf* GetAllocator() const { return mAllocator; }
 
     /**
      * Destroys object & deallocates memory.
@@ -64,149 +100,29 @@ class DefaultDeleter : public NonCopyable {
     {
         if (mAllocator) {
             ptr->~T();
-            operator delete(ptr, mAllocator);
+            mAllocator->Free(ptr);
         }
     }
 
 private:
-    Allocator* mAllocator;
+    AllocatorItf* mAllocator;
 };
 
 /**
- * Deleter function for shared pointer.
+ * Deleter function for objects adopted by a shared pointer.
  */
 template <typename T>
-inline void SmartPtrDeleter(void* ptr, Allocator* allocator)
+inline void SmartPtrDeleter(void* ptr, AllocatorItf* allocator)
 {
     if (ptr) {
         static_cast<T*>(ptr)->~T();
 
         if (allocator) {
-            operator delete(ptr, allocator);
+            allocator->Free(ptr);
         }
     }
 }
 
-/**
- * Smart pointer instance.
- *
- * @tparam T holding object type.
- */
-template <typename T>
-class SmartPtr {
-public:
-    /**
-     * Deleter.
-     */
-    using Deleter = void (*)(void*, Allocator*);
-
-    // cppcheck-suppress noExplicitConstructor
-    /**
-     * Creates smart pointer.
-     *
-     * @param allocator allocator.
-     * @param object object to make smart pointer.
-     */
-    SmartPtr(Allocator* allocator = nullptr, T* object = nullptr, Deleter deleter = SmartPtrDeleter<T>)
-        : mAllocator(allocator)
-        , mObject(object)
-        , mDeleter(deleter)
-    {
-        assert(!(object && !allocator && !deleter));
-    }
-
-    /**
-     * Deletes holding object and release smart pointer.
-     *
-     * @param allocator new allocator.
-     * @param object new object.
-     */
-    void Reset(Allocator* allocator = nullptr, T* object = nullptr, Deleter deleter = SmartPtrDeleter<T>)
-    {
-        if (mAllocator && mObject && mDeleter) {
-            mDeleter(const_cast<RemoveConstType<T>*>(mObject), mAllocator);
-        }
-
-        assert(!(object && !allocator));
-
-        Release(allocator, object, deleter);
-    }
-
-    /**
-     * Releases smart pointer.
-     *
-     * @param allocator new allocator.
-     * @param object new object.
-     * @return T* pointer to holding object.
-     */
-    T* Release(Allocator* allocator = nullptr, T* object = nullptr, Deleter deleter = SmartPtrDeleter<T>)
-    {
-        auto curObject = mObject;
-
-        mObject    = object;
-        mAllocator = allocator;
-        mDeleter   = deleter;
-
-        return curObject;
-    }
-
-    /**
-     * Returns holding object.
-     *
-     * @return T* holding object.
-     */
-    T* Get() const { return mObject; }
-
-    /**
-     * Returns holding allocator.
-     *
-     * @return Allocator* holding allocator.
-     */
-    Allocator* GetAllocator() const { return mAllocator; }
-
-    /**
-     * Returns holding deleter.
-     *
-     * @return Deleter.
-     */
-    Deleter GetDeleter() const { return mDeleter; }
-
-    /**
-     * Checks if pointer holds object.
-     *
-     * @return bool.
-     */
-    explicit operator bool() const { return mObject != nullptr; }
-
-    /**
-     * Compares two smart pointers.
-     *
-     * @param ptr1 first smart pointer.
-     * @param ptr2 second smart pointer.
-     * @return bool.
-     */
-    friend bool operator==(const SmartPtr& ptr1, const SmartPtr& ptr2) { return ptr1.mObject == ptr2.mObject; }
-
-    /**
-     * Provides access to holding object fields.
-     *
-     * @return T* holding object pointer.
-     */
-    T* operator->() const { return mObject; }
-
-    /**
-     * Dereferences holding object.
-     *
-     * @return T& holding object value.
-     */
-    T& operator*() const { return *(mObject); }
-
-private:
-    Allocator* mAllocator {};
-    T*         mObject {};
-    Deleter    mDeleter {};
-};
-
 /**
  * Unique pointer instance.
  *
@@ -236,7 +152,7 @@ class UniquePtr : private NonCopyable {
      * @param allocator allocator that object was allocated with.
      *
      */
-    UniquePtr(T* ptr = nullptr, Allocator* allocator = nullptr)
+    UniquePtr(T* ptr = nullptr, AllocatorItf* allocator = nullptr)
         : mObject(ptr)
         , mDeleter(DefaultDeleter<T>(allocator))
     {
@@ -387,30 +303,203 @@ class UniquePtr : private NonCopyable {
     Deleter mDeleter;
 };
 
+/**
+ * Defers object destruction till the end of the current scope.
+ *
+ * @tparam T type of the object to be destroyed.
+ * @tparam Deleter type of the deleter.
+ * @param ptr pointer to the object to be destroyed.
+ * @param deleter functor object to be deferred.
+ * @return UniquePtr<T, Deleter>.
+ */
+template <typename T, typename Deleter>
+inline UniquePtr<T, Deleter> DeferRelease(T* ptr, Deleter&& deleter)
+{
+    return UniquePtr<T, Deleter>(ptr, Move(deleter));
+}
+
+/**
+ * Base class for shared pointer control blocks.
+ *
+ * Owns the reference count and knows how to dispose of itself (and whatever it holds) through
+ * the same AllocatorItf it was created with. This keeps SharedPtr's ref-counting independent
+ * from any allocator-specific bookkeeping, so it works the same way for any AllocatorItf
+ * implementation (heap based or static/embedded).
+ *
+ * Take/Give are mutex protected so that a control block can be safely shared (copied, reset)
+ * across multiple threads, e.g. via SharedPtr instances passed between them.
+ */
+class SharedControlBlock : private NonCopyable {
+public:
+    /**
+     * Creates control block instance.
+     *
+     * @param allocator allocator the control block itself was allocated from.
+     */
+    explicit SharedControlBlock(AllocatorItf& allocator)
+        : mAllocator(allocator)
+    {
+    }
+
+    /**
+     * Increases shared count.
+     *
+     * @return size_t shared count value.
+     */
+    size_t Take()
+    {
+        LockGuard lock(mMutex);
+
+        return ++mRefCount;
+    }
+
+    /**
+     * Decreases shared count. Disposes the control block once the count reaches zero.
+     *
+     * @return size_t shared count value.
+     */
+    size_t Give()
+    {
+        UniqueLock<Mutex> lock(mMutex);
+
+        auto count = --mRefCount;
+
+        if (count == 0) {
+            // Unlock before disposing as disposal destroys this object (and its mutex).
+            lock.Unlock();
+
+            Dispose();
+        }
+
+        return count;
+    }
+
+    /**
+     * Destroys control block instance.
+     */
+    virtual ~SharedControlBlock() = default;
+
+protected:
+    /**
+     * Allocator the control block itself was allocated from.
+     */
+    AllocatorItf& mAllocator;
+
+private:
+    virtual void Dispose() = 0;
+
+    Mutex  mMutex;
+    size_t mRefCount = 1;
+};
+
+/**
+ * Control block that owns an object of type T directly (single allocation). Used by MakeShared.
+ *
+ * @tparam T holding object type.
+ */
+template <typename T>
+class SharedObjectControlBlock : public SharedControlBlock {
+public:
+    /**
+     * Creates control block instance constructing the held object in place.
+     *
+     * @param allocator allocator the control block is allocated from.
+     * @param args holding object constructor parameters.
+     */
+    template <typename... Args>
+    explicit SharedObjectControlBlock(AllocatorItf& allocator, Args&&... args)
+        : SharedControlBlock(allocator)
+        , mObject(args...)
+    {
+    }
+
+    /**
+     * Returns pointer to the held object.
+     *
+     * @return T*.
+     */
+    T* GetObject() { return &mObject; }
+
+private:
+    void Dispose() override
+    {
+        auto& allocator = mAllocator;
+
+        this->~SharedObjectControlBlock();
+        allocator.Free(this);
+    }
+
+    T mObject;
+};
+
+/**
+ * Control block that adopts an already constructed, separately allocated object.
+ *
+ * @tparam T holding object type.
+ */
+template <typename T>
+class SharedAdoptControlBlock : public SharedControlBlock {
+public:
+    /**
+     * Deleter.
+     */
+    using Deleter = void (*)(void*, AllocatorItf*);
+
+    /**
+     * Creates control block instance.
+     *
+     * @param allocator allocator the control block itself is allocated from.
+     * @param object object to adopt.
+     * @param deleter functor destroying the adopted object.
+     */
+    SharedAdoptControlBlock(AllocatorItf& allocator, T* object, Deleter deleter)
+        : SharedControlBlock(allocator)
+        , mObject(object)
+        , mDeleter(deleter)
+    {
+    }
+
+private:
+    void Dispose() override
+    {
+        auto& allocator = mAllocator;
+
+        if (mDeleter) {
+            mDeleter(mObject, &allocator);
+        }
+
+        this->~SharedAdoptControlBlock();
+        allocator.Free(this);
+    }
+
+    T*      mObject;
+    Deleter mDeleter;
+};
+
 /**
  * Shared pointer instance.
  *
  * @tparam T holding object type.
  */
 template <typename T>
-class SharedPtr : public SmartPtr<T> {
+class SharedPtr {
 public:
     /**
      * Deleter.
      */
-    using typename SmartPtr<T>::Deleter;
+    using Deleter = void (*)(void*, AllocatorItf*);
 
     // cppcheck-suppress noExplicitConstructor
     /**
-     * Creates shared pointer.
+     * Creates shared pointer adopting an already allocated object.
+     *
+     * @param allocator allocator object was allocated with.
+     * @param object object to adopt.
+     * @param deleter functor destroying the object.
      */
-    SharedPtr(Allocator* allocator = nullptr, T* object = nullptr, Deleter deleter = SmartPtrDeleter<T>)
-        : SmartPtr<T>(allocator, object, deleter)
+    SharedPtr(AllocatorItf* allocator = nullptr, T* object = nullptr, Deleter deleter = SmartPtrDeleter<T>)
     {
-        if (allocator && object) {
-            mAllocation = allocator->FindAllocation(object).mValue;
-            SmartPtr<T>::GetAllocator()->TakeAllocation(mAllocation);
-        }
+        Adopt(allocator, object, deleter);
     }
 
     /**
@@ -419,11 +508,11 @@ class SharedPtr : public SmartPtr<T> {
      * @param ptr pointer to create from.
      */
     SharedPtr(const SharedPtr& ptr)
-        : SmartPtr<T>(ptr.GetAllocator(), ptr.Get(), ptr.GetDeleter())
-        , mAllocation(ptr.mAllocation)
+        : mObject(ptr.mObject)
+        , mControlBlock(ptr.mControlBlock)
     {
-        if (SmartPtr<T>::GetAllocator()) {
-            SmartPtr<T>::GetAllocator()->TakeAllocation(mAllocation);
+        if (mControlBlock) {
+            mControlBlock->Take();
         }
     }
 
@@ -434,11 +523,17 @@ class SharedPtr : public SmartPtr<T> {
      */
     SharedPtr& operator=(const SharedPtr& ptr)
     {
-        SmartPtr<T>::Release(ptr.GetAllocator(), ptr.Get(), ptr.GetDeleter());
-        mAllocation = ptr.mAllocation;
+        if (this == &ptr) {
+            return *this;
+        }
+
+        Reset();
 
-        if (SmartPtr<T>::GetAllocator()) {
-            SmartPtr<T>::GetAllocator()->TakeAllocation(mAllocation);
+        mObject       = ptr.mObject;
+        mControlBlock = ptr.mControlBlock;
+
+        if (mControlBlock) {
+            mControlBlock->Take();
         }
 
         return *this;
@@ -452,11 +547,11 @@ class SharedPtr : public SmartPtr<T> {
     template <typename P>
     // cppcheck-suppress noExplicitConstructor
     SharedPtr(const SharedPtr<P>& ptr)
-        : SmartPtr<T>(ptr.GetAllocator(), ptr.Get(), ptr.GetDeleter())
-        , mAllocation(ptr.mAllocation)
+        : mObject(ptr.mObject)
+        , mControlBlock(ptr.mControlBlock)
     {
-        if (SmartPtr<T>::GetAllocator()) {
-            SmartPtr<T>::GetAllocator()->TakeAllocation(mAllocation);
+        if (mControlBlock) {
+            mControlBlock->Take();
         }
     }
 
@@ -468,40 +563,76 @@ class SharedPtr : public SmartPtr<T> {
     template <typename P>
     SharedPtr& operator=(const SharedPtr<P>& ptr)
     {
-        SmartPtr<T>::Release(ptr.GetAllocator(), ptr.Get(), ptr.GetDeleter());
-        mAllocation = ptr.mAllocation;
+        Reset();
 
-        if (SmartPtr<T>::GetAllocator()) {
-            SmartPtr<T>::GetAllocator()->TakeAllocation(mAllocation);
+        mObject       = ptr.mObject;
+        mControlBlock = ptr.mControlBlock;
+
+        if (mControlBlock) {
+            mControlBlock->Take();
         }
 
         return *this;
     }
 
-    // cppcheck-suppress duplInheritedMember
     /**
      * Resets shared pointer.
      *
      * @param allocator new allocator.
      * @param object new object.
+     * @param deleter functor destroying the object.
      */
-    void Reset(Allocator* allocator = nullptr, T* object = nullptr, Deleter deleter = SmartPtrDeleter<T>)
+    void Reset(AllocatorItf* allocator = nullptr, T* object = nullptr, Deleter deleter = SmartPtrDeleter<T>)
     {
-        if (SmartPtr<T>::GetAllocator() && SmartPtr<T>::GetAllocator()->GiveAllocation(mAllocation) == 0) {
-            SmartPtr<T>::Reset(allocator, object, deleter);
+        if (mControlBlock) {
+            mControlBlock->Give();
         }
 
-        SmartPtr<T>::Release(allocator, object, deleter);
-        mAllocation = {};
+        mObject       = nullptr;
+        mControlBlock = nullptr;
 
-        if (allocator && object) {
-            mAllocation = allocator->FindAllocation(object).mValue;
-            SmartPtr<T>::GetAllocator()->TakeAllocation(mAllocation);
-        }
+        Adopt(allocator, object, deleter);
     }
 
     /**
-     * Destroys unique pointer.
+     * Returns holding object.
+     *
+     * @return T* holding object.
+     */
+    T* Get() const { return mObject; }
+
+    /**
+     * Checks if pointer holds object.
+     *
+     * @return bool.
+     */
+    explicit operator bool() const { return mObject != nullptr; }
+
+    /**
+     * Compares two shared pointers.
+     *
+     * @param ptr1 first shared pointer.
+     * @param ptr2 second shared pointer.
+     * @return bool.
+     */
+    friend bool operator==(const SharedPtr& ptr1, const SharedPtr& ptr2) { return ptr1.mObject == ptr2.mObject; }
+
+    /**
+     * Provides access to holding object fields.
+     *
+     * @return T* holding object pointer.
+     */
+    T* operator->() const { return mObject; }
+
+    /**
+     * Dereferences holding object.
+     *
+     * @return T& holding object value.
+     */
+    T& operator*() const { return *(mObject); }
+
+    /**
+     * Destroys shared pointer.
      */
     ~SharedPtr() { Reset(); }
 
@@ -509,7 +640,36 @@ class SharedPtr : public SmartPtr<T> {
     template <typename>
     friend class SharedPtr;
 
-    List<Allocator::Allocation>::Iterator mAllocation;
+    template <typename U, typename... Args>
+    friend SharedPtr<U> MakeShared(AllocatorItf* allocator, Args&&... args);
+
+    SharedPtr(SharedControlBlock* controlBlock, T* object)
+        : mObject(object)
+        , mControlBlock(controlBlock)
+    {
+    }
+
+    void Adopt(AllocatorItf* allocator, T* object, Deleter deleter)
+    {
+        if (!allocator || !object) {
+            return;
+        }
+
+        auto data = allocator->Allocate(sizeof(SharedAdoptControlBlock<T>));
+        if (!data) {
+            if (deleter) {
+                deleter(object, allocator);
+            }
+
+            return;
+        }
+
+        mControlBlock = new (data) SharedAdoptControlBlock<T>(*allocator, object, deleter);
+        mObject       = object;
+    }
+
+    T*                  mObject {};
+    SharedControlBlock* mControlBlock {};
 };
 
 /**
@@ -519,29 +679,19 @@ class SharedPtr : public SmartPtr<T> {
  * @tparam Args holding object constructor parameters types.
  * @param allocator allocator.
  * @param args holding object constructor parameters.
- * @return UniquePtr<T> constructed unique ptr.
+ * @return UniquePtr<T> constructed unique ptr, empty if allocation failed.
  */
 template <typename T, typename... Args>
-inline UniquePtr<T> MakeUnique(Allocator* allocator, Args&&... args)
+inline UniquePtr<T> MakeUnique(AllocatorItf* allocator, Args&&... args)
 {
     assert(allocator);
 
-    return UniquePtr<T>(new (allocator) T(args...), DefaultDeleter<T>(allocator));
-}
+    auto data = allocator->Allocate(sizeof(T));
+    if (!data) {
+        return UniquePtr<T>();
+    }
 
-/**
- * Defers object destruction till the end of the current scope.
- *
- * @tparam T type of the object to be destroyed.
- * @tparam Deleter type of the deleter.
- * @param ptr pointer to the object to be destroyed.
- * @param deleter functor object to be deferred.
- * @return UniquePtr<T, Deleter>.
- */
-template <typename T, typename Deleter>
-inline UniquePtr<T, Deleter> DeferRelease(T* ptr, Deleter&& deleter)
-{
-    return UniquePtr<T, Deleter>(ptr, Move(deleter));
+    return UniquePtr<T>(new (data) T(args...), DefaultDeleter<T>(allocator));
 }
 
 /**
@@ -551,14 +701,21 @@ inline UniquePtr<T, Deleter> DeferRelease(T* ptr, Deleter&& deleter)
  * @tparam Args holding object constructor parameters types.
  * @param allocator allocator.
  * @param args holding object constructor parameters.
- * @return SharedPtr<T> constructed shared ptr.
+ * @return SharedPtr<T> constructed shared ptr, empty if allocation failed.
  */
 template <typename T, typename... Args>
-inline SharedPtr<T> MakeShared(Allocator* allocator, Args&&... args)
+inline SharedPtr<T> MakeShared(AllocatorItf* allocator, Args&&... args)
 {
     assert(allocator);
 
-    return SharedPtr<T>(allocator, new (allocator) T(args...), SmartPtrDeleter<T>);
+    auto data = allocator->Allocate(sizeof(SharedObjectControlBlock<T>));
+    if (!data) {
+        return SharedPtr<T>();
+    }
+
+    auto* controlBlock = new (data) SharedObjectControlBlock<T>(*allocator, args...);
+
+    return SharedPtr<T>(controlBlock, controlBlock->GetObject());
 }
 
 } // namespace aos
diff --git a/src/core/common/tools/tests/allocator.cpp b/src/core/common/tools/tests/allocator.cpp
index 1fa84c9a0..602f4306a 100644
--- a/src/core/common/tools/tests/allocator.cpp
+++ b/src/core/common/tools/tests/allocator.cpp
@@ -7,80 +7,46 @@
 
 #include <gtest/gtest.h>
 
-#include <core/common/tools/allocator.hpp>
+#include <core/common/tools/heapallocator.hpp>
+#include <core/common/tools/memory.hpp>
 
 using namespace aos;
 
-TEST(AllocatorTest, Allocator)
+TEST(AllocatorTest, HeapAllocator)
 {
-    StaticAllocator<256> allocator;
+    HeapAllocator allocator;
 
-    EXPECT_EQ(allocator.MaxSize(), 256);
-    EXPECT_EQ(allocator.FreeSize(), 256);
+    auto* data = allocator.Allocate(128);
+    ASSERT_NE(data, nullptr);
 
-    struct TestItem {
-        void*  mData;
-        size_t mSize;
-    };
-
-    TestItem testData[] = {{nullptr, 32}, {nullptr, 64}, {nullptr, 128}};
-
-    auto freeSize = allocator.MaxSize();
-
-    for (auto& item : testData) {
-        item.mData = allocator.Allocate(item.mSize);
-        freeSize -= item.mSize;
-        EXPECT_EQ(allocator.FreeSize(), freeSize);
-    }
+    allocator.Free(data);
 
-    for (size_t i = 0; i < ArraySize(testData); i++) {
-        freeSize += testData[i].mSize;
-        allocator.Free(testData[i].mData);
-
-        EXPECT_EQ(allocator.FreeSize(), freeSize);
-    }
-
-    allocator.Allocate(32);
-
-    allocator.Clear();
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
-}
+    struct TestStruct {
+        TestStruct(int a, int b)
+            : mA(a)
+            , mB(b)
+        {
+        }
 
-TEST(AllocatorTest, New)
-{
-    StaticAllocator<256> allocator;
-
-    auto freeSize = allocator.MaxSize();
-
-    auto val1 = new (&allocator) uint8_t();
-    freeSize -= sizeof(uint8_t);
-    EXPECT_EQ(allocator.FreeSize(), freeSize);
-
-    auto val2 = new (&allocator) uint16_t();
-    freeSize -= sizeof(uint16_t);
-    EXPECT_EQ(allocator.FreeSize(), freeSize);
-
-    auto val3 = new (&allocator) uint32_t();
-    freeSize -= sizeof(uint32_t);
-    EXPECT_EQ(allocator.FreeSize(), freeSize);
-
-    auto val4 = new (&allocator) uint64_t();
-    freeSize -= sizeof(uint64_t);
-    EXPECT_EQ(allocator.FreeSize(), freeSize);
+        int mA;
+        int mB;
+    };
 
-    operator delete(val4, &allocator);
-    freeSize += sizeof(uint64_t);
-    EXPECT_EQ(allocator.FreeSize(), freeSize);
+    auto uPtr = MakeUnique<TestStruct>(&allocator, 1, 2);
+    ASSERT_TRUE(uPtr);
+    EXPECT_EQ(uPtr->mA, 1);
+    EXPECT_EQ(uPtr->mB, 2);
 
-    operator delete(val3, &allocator);
-    freeSize += sizeof(uint32_t);
-    EXPECT_EQ(allocator.FreeSize(), freeSize);
+    auto shPtr = MakeShared<TestStruct>(&allocator, 3, 4);
+    ASSERT_TRUE(shPtr);
+    EXPECT_EQ(shPtr->mA, 3);
+    EXPECT_EQ(shPtr->mB, 4);
 
-    operator delete(val2, &allocator);
-    freeSize += sizeof(uint16_t);
-    EXPECT_EQ(allocator.FreeSize(), freeSize);
+    auto shPtr2 = shPtr;
+    EXPECT_EQ(shPtr2->mA, 3);
 
-    operator delete(val1, &allocator);
-    freeSize += sizeof(uint8_t);
-    EXPECT_EQ(allocator.FreeSize(), freeSize);
+    shPtr.Reset();
+    EXPECT_FALSE(shPtr);
+    EXPECT_TRUE(shPtr2);
+    EXPECT_EQ(shPtr2->mB, 4);
 }
diff --git a/src/core/common/tools/tests/fs.cpp b/src/core/common/tools/tests/fs.cpp
index e5f5deedd..7fc2b05cf 100644
--- a/src/core/common/tools/tests/fs.cpp
+++ b/src/core/common/tools/tests/fs.cpp
@@ -14,6 +14,7 @@
 
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tools/fs.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/common/tools/memory.hpp>
 
 using namespace testing;
@@ -52,6 +53,10 @@ class FSTest : public Test {
 
         tests::utils::InitLog();
     }
+
+protected:
+    // cppcheck-suppress unusedStructMember
+    HeapAllocator mAllocator;
 };
 
 TEST_F(FSTest, AppendPath)
@@ -446,7 +451,7 @@ TEST_F(FSTest, CalculateSize)
     ASSERT_TRUE(fs::MakeDirAll(multipleSubDirs.c_str()).IsNone());
     CreateFile((multipleSubDirs / "fff.txt").c_str(), std::string(2048, 'a').c_str(), 0444);
 
-    EXPECT_EQ(fs::CalculateSize(walkDirRoot.c_str()), RetWithError<size_t>(2048));
+    EXPECT_EQ(fs::CalculateSize(mAllocator, walkDirRoot.c_str()), RetWithError<size_t>(2048));
 
     const std::vector folders = {
         walkDirRoot / "d1",
@@ -460,13 +465,13 @@ TEST_F(FSTest, CalculateSize)
         CreateFile((folder / "f.txt").c_str(), std::string(1024, 'a').c_str(), 0444);
     }
 
-    EXPECT_EQ(fs::CalculateSize(walkDirRoot.c_str()), RetWithError<size_t>(3 * 1024 + 2048));
+    EXPECT_EQ(fs::CalculateSize(mAllocator, walkDirRoot.c_str()), RetWithError<size_t>(3 * 1024 + 2048));
 
     const auto singleFile = walkDirRoot / "single.txt";
     CreateFile(singleFile.c_str(), std::string(512, 'b').c_str(), 0444);
-    EXPECT_EQ(fs::CalculateSize(singleFile.c_str()), RetWithError<size_t>(512));
+    EXPECT_EQ(fs::CalculateSize(mAllocator, singleFile.c_str()), RetWithError<size_t>(512));
 
-    auto [size, err] = fs::CalculateSize("does-not-exists");
+    auto [size, err] = fs::CalculateSize(mAllocator, "does-not-exists");
     EXPECT_FALSE(err.IsNone());
     EXPECT_EQ(size, 0);
 }
@@ -501,7 +506,7 @@ TEST_F(FSTest, CalculateNoMemory)
         }
     }
 
-    EXPECT_EQ(fs::CalculateSize(walkDirRoot.c_str()), RetWithError<size_t>(cExpectedSize));
+    EXPECT_EQ(fs::CalculateSize(mAllocator, walkDirRoot.c_str()), RetWithError<size_t>(cExpectedSize));
 }
 
 TEST_F(FSTest, BaseName)
diff --git a/src/core/common/tools/tests/memory.cpp b/src/core/common/tools/tests/memory.cpp
index 70ea4a780..2b23628f7 100644
--- a/src/core/common/tools/tests/memory.cpp
+++ b/src/core/common/tools/tests/memory.cpp
@@ -7,6 +7,7 @@
 
 #include <gmock/gmock.h>
 
+#include <core/common/tools/heapallocator.hpp>
 #include <core/common/tools/memory.hpp>
 
 using namespace aos;
@@ -38,35 +39,36 @@ class NewClass : public BaseClass {
 
 TEST(MemoryTest, UniquePtr)
 {
-    StaticAllocator<256> allocator;
+    HeapAllocator allocator;
 
     // Basic test
 
     {
         UniquePtr<uint32_t> uPtr = MakeUnique<uint32_t>(&allocator, 0);
-        EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(uint32_t));
+        EXPECT_TRUE(uPtr);
+        EXPECT_EQ(*uPtr, 0U);
     }
 
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
-
     // Construct with allocator
 
     {
-        UniquePtr<uint32_t> uPtr(new (&allocator) uint32_t(), &allocator);
-        EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(uint32_t));
-    }
+        auto* raw = static_cast<uint32_t*>(allocator.Allocate(sizeof(uint32_t)));
+        ASSERT_NE(raw, nullptr);
 
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
+        UniquePtr<uint32_t> uPtr(new (raw) uint32_t(), &allocator);
+        EXPECT_TRUE(uPtr);
+    }
 
     // Construct with deleter
 
     {
         auto deleter = [&allocator](uint32_t* ptr) { allocator.Free(ptr); };
 
-        UniquePtr<uint32_t, decltype(deleter)> uPtr(new (&allocator) uint32_t(), Move(deleter));
-    }
+        auto* raw = static_cast<uint32_t*>(allocator.Allocate(sizeof(uint32_t)));
+        ASSERT_NE(raw, nullptr);
 
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
+        UniquePtr<uint32_t, decltype(deleter)> uPtr(new (raw) uint32_t(), Move(deleter));
+    }
 
     // Move ownership
 
@@ -80,37 +82,36 @@ TEST(MemoryTest, UniquePtr)
         uPtr = MakeUnique<uint32_t>(&allocator);
     }
 
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(uint32_t));
+    EXPECT_TRUE(uPtr);
 
     OwnUniquePtr(Move(uPtr));
 
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
+    EXPECT_FALSE(uPtr);
 
     // Make unique
 
     auto uPtr2 = MakeUnique<uint32_t>(&allocator);
-
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(uint32_t));
+    EXPECT_TRUE(uPtr2);
 
     // Check reset
 
     uPtr2.Reset();
-
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
+    EXPECT_FALSE(uPtr2);
 }
 
 TEST(MemoryTest, SharedPtr)
 {
-    StaticAllocator<256> allocator;
+    HeapAllocator allocator;
 
     // Basic test
 
     {
-        SharedPtr<uint32_t> shPtr(&allocator, new (&allocator) uint32_t());
-        EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(uint32_t));
-    }
+        auto* raw = static_cast<uint32_t*>(allocator.Allocate(sizeof(uint32_t)));
+        ASSERT_NE(raw, nullptr);
 
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
+        SharedPtr<uint32_t> shPtr(&allocator, new (raw) uint32_t());
+        EXPECT_TRUE(shPtr);
+    }
 
     // Test share
 
@@ -122,69 +123,58 @@ TEST(MemoryTest, SharedPtr)
         EXPECT_TRUE(nullptr == shPtr);
 
         {
-            shPtr = SharedPtr<uint32_t>(&allocator, new (&allocator) uint32_t());
+            auto* raw = static_cast<uint32_t*>(allocator.Allocate(sizeof(uint32_t)));
+            ASSERT_NE(raw, nullptr);
+
+            shPtr = SharedPtr<uint32_t>(&allocator, new (raw) uint32_t());
         }
 
-        EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(uint32_t));
+        EXPECT_TRUE(shPtr);
 
         TakeSharedPtr(shPtr);
     }
 
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
-
     // Make shared
 
     auto shPtr2 = MakeShared<uint32_t>(&allocator);
-
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(uint32_t));
+    EXPECT_TRUE(shPtr2);
 
     // Check reset
 
     shPtr2.Reset();
-
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
+    EXPECT_FALSE(shPtr2);
 }
 
 TEST(MemoryTest, UniquePtrDerivedClass)
 {
-    StaticAllocator<256> allocator;
-
-    {
-        UniquePtr<BaseClass> basePtr;
+    HeapAllocator allocator;
 
-        {
-            auto newPtr = MakeUnique<NewClass>(&allocator);
+    UniquePtr<BaseClass> basePtr;
 
-            EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(NewClass));
-
-            basePtr = Move(newPtr);
-        }
+    {
+        auto newPtr = MakeUnique<NewClass>(&allocator);
+        EXPECT_TRUE(newPtr);
 
-        EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(NewClass));
+        basePtr = Move(newPtr);
     }
 
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
+    EXPECT_TRUE(basePtr);
 }
 
 TEST(MemoryTest, SharedPtrDerivedClass)
 {
-    StaticAllocator<256> allocator;
+    HeapAllocator allocator;
 
-    {
-        SharedPtr<BaseClass> basePtr;
-
-        {
-            auto newPtr = MakeShared<NewClass>(&allocator);
-
-            EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(NewClass));
+    SharedPtr<BaseClass> basePtr;
 
-            basePtr = newPtr;
-        }
+    {
+        auto newPtr = MakeShared<NewClass>(&allocator);
+        EXPECT_TRUE(newPtr);
 
-        EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(NewClass));
+        basePtr = newPtr;
     }
 
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
+    EXPECT_TRUE(basePtr);
 }
 
 TEST(MemoryTest, DeferRelease)
@@ -268,16 +258,13 @@ TEST(MemoryTest, SharedPtrDerivedValueClass)
         MockFunction<void()>* mFunc;
     };
 
-    StaticAllocator<256> allocator;
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
+    HeapAllocator allocator;
 
     // Check NewClass destructor is called
     EXPECT_CALL(callback, Call()).Times(1);
 
     {
         SharedPtr<BaseClass> basePtr = MakeShared<Child>(&allocator, &callback);
-        EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize() - sizeof(NewClass));
+        EXPECT_TRUE(basePtr);
     }
-
-    EXPECT_EQ(allocator.FreeSize(), allocator.MaxSize());
 }
diff --git a/src/core/iam/certhandler/certhandler.cpp b/src/core/iam/certhandler/certhandler.cpp
index 88f8c57ef..3c41dda41 100644
--- a/src/core/iam/certhandler/certhandler.cpp
+++ b/src/core/iam/certhandler/certhandler.cpp
@@ -15,7 +15,8 @@ namespace aos::iam::certhandler {
  * Public
  **********************************************************************************************************************/
 
-CertHandler::CertHandler()
+CertHandler::CertHandler(AllocatorItf& allocator)
+    : mAllocator(&allocator)
 {
     srand(time(nullptr));
 }
@@ -165,7 +166,10 @@ Error CertHandler::SubscribeListener(const String& certType, iamclient::CertList
         return AOS_ERROR_WRAP(ErrorEnum::eNotFound);
     }
 
-    auto certInfo = MakeUnique<CertInfo>(&mAllocator);
+    auto certInfo = MakeUnique<CertInfo>(mAllocator);
+    if (!certInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = module->GetCertificate(Array<uint8_t>(), Array<uint8_t>(), *certInfo);
     if (!err.IsNone()) {
@@ -243,7 +247,10 @@ CertModule* CertHandler::FindModule(const String& certType) const
 
 Error CertHandler::UpdateCerts(CertModule& certModule)
 {
-    auto certInfo = MakeUnique<CertInfo>(&mAllocator);
+    auto certInfo = MakeUnique<CertInfo>(mAllocator);
+    if (!certInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = certModule.GetCertificate(Array<uint8_t>(), Array<uint8_t>(), *certInfo);
     if (!err.IsNone()) {
diff --git a/src/core/iam/certhandler/certhandler.hpp b/src/core/iam/certhandler/certhandler.hpp
index fd3a96219..a7a55d997 100644
--- a/src/core/iam/certhandler/certhandler.hpp
+++ b/src/core/iam/certhandler/certhandler.hpp
@@ -28,8 +28,10 @@ class CertHandler : public CertHandlerItf, private NonCopyable {
 public:
     /**
      * Creates a new object instance.
+     *
+     * @param allocator allocator to use for temporary objects.
      */
-    CertHandler();
+    explicit CertHandler(AllocatorItf& allocator);
 
     /**
      * Registers module.
@@ -160,7 +162,7 @@ class CertHandler : public CertHandlerItf, private NonCopyable {
     };
 
     StaticArray<CertListenerSubscription, cIAMCertSubsMaxCount> mCertListenerSubscriptions;
-    StaticAllocator<sizeof(CertInfo)>                           mAllocator;
+    AllocatorItf*                                               mAllocator {};
 };
 
 /** @}*/
diff --git a/src/core/iam/certhandler/certmodule.cpp b/src/core/iam/certhandler/certmodule.cpp
index dd6c8e049..c1ae449d7 100644
--- a/src/core/iam/certhandler/certmodule.cpp
+++ b/src/core/iam/certhandler/certmodule.cpp
@@ -16,9 +16,10 @@ namespace aos::iam::certhandler {
  * Public
  **********************************************************************************************************************/
 
-Error CertModule::Init(const String& certType, const ModuleConfig& config, crypto::x509::ProviderItf& x509Provider,
-    HSMItf& hsm, StorageItf& storage)
+Error CertModule::Init(AllocatorItf& allocator, const String& certType, const ModuleConfig& config,
+    crypto::x509::ProviderItf& x509Provider, HSMItf& hsm, StorageItf& storage)
 {
+    mAllocator    = &allocator;
     mCertType     = certType;
     mModuleConfig = config;
     mX509Provider = &x509Provider;
@@ -35,7 +36,10 @@ Error CertModule::Init(const String& certType, const ModuleConfig& config, crypt
         return ErrorEnum::eNone;
     }
 
-    auto validCerts = MakeUnique<ModuleCertificates>(&mAllocator);
+    auto validCerts = MakeUnique<ModuleCertificates>(mAllocator);
+    if (!validCerts) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mHSM->ValidateCertificates(mInvalidCerts, mInvalidKeys, *validCerts); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -46,7 +50,10 @@ Error CertModule::Init(const String& certType, const ModuleConfig& config, crypt
 
 Error CertModule::GetCertificate(const Array<uint8_t>& issuer, const Array<uint8_t>& serial, CertInfo& resCert)
 {
-    auto certsInStorage = MakeUnique<ModuleCertificates>(&mAllocator);
+    auto certsInStorage = MakeUnique<ModuleCertificates>(mAllocator);
+    if (!certsInStorage) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (serial.IsEmpty()) {
         auto err = mStorage->GetCertsInfo(GetCertType(), *certsInStorage);
@@ -58,7 +65,12 @@ Error CertModule::GetCertificate(const Array<uint8_t>& issuer, const Array<uint8
             return AOS_ERROR_WRAP(ErrorEnum::eNotFound);
         }
 
-        resCert = *MakeUnique<CertInfo>(&mAllocator);
+        auto clearCertInfo = MakeShared<CertInfo>(mAllocator);
+        if (!clearCertInfo) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
+
+        resCert = *clearCertInfo;
 
         for (const auto& item : *certsInStorage) {
             if (resCert.mNotAfter.IsZero() || resCert.mNotAfter < item.mNotAfter) {
@@ -121,7 +133,11 @@ RetWithError<SharedPtr<crypto::PrivateKeyItf>> CertModule::CreateKey(const Strin
 
 Error CertModule::CreateCSR(const String& subjectCommonName, const crypto::PrivateKeyItf& privKey, String& pemCSR)
 {
-    auto                       templ = MakeUnique<crypto::x509::CSR>(&mAllocator);
+    auto templ = MakeUnique<crypto::x509::CSR>(mAllocator);
+    if (!templ) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
     StaticString<cDNStringLen> subject;
 
     templ->mDNSNames = mModuleConfig.mAlternativeNames;
@@ -181,7 +197,10 @@ Error CertModule::CreateCSR(const String& subjectCommonName, const crypto::Priva
 
 Error CertModule::ApplyCert(const String& pemCert, CertInfo& info)
 {
-    auto certificates = MakeUnique<crypto::x509::CertificateChain>(&mAllocator);
+    auto certificates = MakeUnique<crypto::x509::CertificateChain>(mAllocator);
+    if (!certificates) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = mX509Provider->PEMToX509Certs(pemCert, *certificates);
     if (!err.IsNone()) {
@@ -221,7 +240,11 @@ Error CertModule::CreateSelfSignedCert(const String& password)
     }
 
     const uint64_t serial = Time::Now().UnixNano();
-    auto           templ  = MakeUnique<crypto::x509::Certificate>(&mAllocator);
+
+    auto templ = MakeUnique<crypto::x509::Certificate>(mAllocator);
+    if (!templ) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     templ->mSerial    = Array<uint8_t>(reinterpret_cast<const uint8_t*>(&serial), sizeof(serial));
     templ->mNotBefore = Time::Now();
@@ -237,14 +260,20 @@ Error CertModule::CreateSelfSignedCert(const String& password)
         return AOS_ERROR_WRAP(err);
     }
 
-    auto pemCert = MakeUnique<SelfSignedCertificate>(&mAllocator);
+    auto pemCert = MakeUnique<SelfSignedCertificate>(mAllocator);
+    if (!pemCert) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     err = mX509Provider->CreateCertificate(*templ, *templ, *key.mValue, *pemCert);
     if (!err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
 
-    auto certInfo = MakeUnique<CertInfo>(&mAllocator);
+    auto certInfo = MakeUnique<CertInfo>(mAllocator);
+    if (!certInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     return ApplyCert(*pemCert, *certInfo);
 }
@@ -312,7 +341,10 @@ Error CertModule::RemoveInvalidKeys(const String& password)
 
 Error CertModule::TrimCerts(const String& password)
 {
-    auto certsInStorage = MakeUnique<ModuleCertificates>(&mAllocator);
+    auto certsInStorage = MakeUnique<ModuleCertificates>(mAllocator);
+    if (!certsInStorage) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = mStorage->GetCertsInfo(GetCertType(), *certsInStorage);
     if (!err.IsNone() && err != ErrorEnum::eNotFound) {
@@ -404,7 +436,10 @@ Error CertModule::CheckCertChain(const Array<crypto::x509::Certificate>& chain)
 
 Error CertModule::SyncValidCerts(const Array<CertInfo>& validCerts)
 {
-    auto certsInStorage = MakeUnique<ModuleCertificates>(&mAllocator);
+    auto certsInStorage = MakeUnique<ModuleCertificates>(mAllocator);
+    if (!certsInStorage) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = mStorage->GetCertsInfo(GetCertType(), *certsInStorage);
     if (!err.IsNone() && err != ErrorEnum::eNotFound) {
diff --git a/src/core/iam/certhandler/certmodule.hpp b/src/core/iam/certhandler/certmodule.hpp
index 13d7f0297..3cb9bd9a3 100644
--- a/src/core/iam/certhandler/certmodule.hpp
+++ b/src/core/iam/certhandler/certmodule.hpp
@@ -8,8 +8,8 @@
 #ifndef AOS_CORE_IAM_CERTHANDLER_CERTMODULE_HPP_
 #define AOS_CORE_IAM_CERTHANDLER_CERTMODULE_HPP_
 
-#include <core/common/tools/allocator.hpp>
 #include <core/common/tools/enum.hpp>
+#include <core/common/tools/memory.hpp>
 #include <core/common/tools/string.hpp>
 #include <core/common/tools/time.hpp>
 #include <core/common/tools/utils.hpp>
@@ -28,6 +28,7 @@ class CertModule {
     /**
      * Initializes certificate module.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param certType certificate type.
      * @param config module config.
      * @param x509Provider provider of x509 certificates, csr, keys.
@@ -35,8 +36,8 @@ class CertModule {
      * @param storage a reference to certificate storage.
      * @return Error.
      */
-    Error Init(const String& certType, const ModuleConfig& config, crypto::x509::ProviderItf& x509Provider, HSMItf& hsm,
-        StorageItf& storage);
+    Error Init(AllocatorItf& allocator, const String& certType, const ModuleConfig& config,
+        crypto::x509::ProviderItf& x509Provider, HSMItf& hsm, StorageItf& storage);
 
     /**
      * Returns IAM module certificate type.
@@ -140,11 +141,7 @@ class CertModule {
 
     StaticArray<StaticString<cURLLen>, cCertsPerModule> mInvalidCerts, mInvalidKeys;
 
-    StaticAllocator<Max(2U * sizeof(ModuleCertificates),
-        sizeof(SelfSignedCertificate) + sizeof(CertInfo) + sizeof(crypto::x509::CertificateChain)
-            + sizeof(ModuleCertificates) + sizeof(crypto::x509::Certificate),
-        sizeof(crypto::x509::CSR) + sizeof(CertInfo))>
-        mAllocator;
+    AllocatorItf* mAllocator {};
 };
 
 } // namespace aos::iam::certhandler
diff --git a/src/core/iam/certhandler/certmodules/pkcs11/pkcs11.cpp b/src/core/iam/certhandler/certmodules/pkcs11/pkcs11.cpp
index e5508e9ee..ff4161606 100644
--- a/src/core/iam/certhandler/certmodules/pkcs11/pkcs11.cpp
+++ b/src/core/iam/certhandler/certmodules/pkcs11/pkcs11.cpp
@@ -19,9 +19,10 @@ namespace aos::iam::certhandler {
  * Public
  **********************************************************************************************************************/
 
-Error PKCS11Module::Init(const String& certType, const PKCS11ModuleConfig& config, pkcs11::PKCS11Manager& pkcs11,
-    crypto::CryptoProviderItf& cryptoProvider)
+Error PKCS11Module::Init(AllocatorItf& allocator, const String& certType, const PKCS11ModuleConfig& config,
+    pkcs11::PKCS11Manager& pkcs11, crypto::CryptoProviderItf& cryptoProvider)
 {
+    mAllocator      = &allocator;
     mCertType       = certType;
     mConfig         = config;
     mCryptoProvider = &cryptoProvider;
@@ -165,8 +166,15 @@ Error PKCS11Module::Clear()
     }
 
     // certs, privKeys, pubKeys
-    auto objects = MakeUnique<StaticArray<SearchObject, cCertsPerModule * 3>>(&mTmpObjAllocator);
-    auto filter  = MakeUnique<SearchObject>(&mTmpObjAllocator);
+    auto objects = MakeUnique<StaticArray<SearchObject, cCertsPerModule * 3>>(mAllocator);
+    if (!objects) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto filter = MakeUnique<SearchObject>(mAllocator);
+    if (!filter) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     err = FindObject(*session, *filter, *objects);
     if (err.IsNone()) {
@@ -211,7 +219,7 @@ RetWithError<SharedPtr<crypto::PrivateKeyItf>> PKCS11Module::CreateKey(const Str
 
     switch (keyType.GetValue()) {
     case crypto::KeyTypeEnum::eRSA:
-        Tie(pendingKey.mKey, err) = pkcs11::Utils(session, *mCryptoProvider, mLocalCacheAllocator)
+        Tie(pendingKey.mKey, err) = pkcs11::Utils(*mAllocator, session, *mCryptoProvider)
                                         .GenerateRSAKeyPairWithLabel(pendingKey.mUUID, mCertType, cRSAKeyLength);
         if (!err.IsNone()) {
             return {nullptr, AOS_ERROR_WRAP(err)};
@@ -219,7 +227,7 @@ RetWithError<SharedPtr<crypto::PrivateKeyItf>> PKCS11Module::CreateKey(const Str
         break;
 
     case crypto::KeyTypeEnum::eECDSA:
-        Tie(pendingKey.mKey, err) = pkcs11::Utils(session, *mCryptoProvider, mLocalCacheAllocator)
+        Tie(pendingKey.mKey, err) = pkcs11::Utils(*mAllocator, session, *mCryptoProvider)
                                         .GenerateECDSAKeyPairWithLabel(pendingKey.mUUID, mCertType, cECSDACurveID);
         if (!err.IsNone()) {
             return {nullptr, AOS_ERROR_WRAP(err)};
@@ -235,7 +243,7 @@ RetWithError<SharedPtr<crypto::PrivateKeyItf>> PKCS11Module::CreateKey(const Str
 
     err = TokenMemInfo();
     if (!err.IsNone()) {
-        pkcs11::Utils(session, *mCryptoProvider, mLocalCacheAllocator).DeletePrivateKey(pendingKey.mKey);
+        pkcs11::Utils(*mAllocator, session, *mCryptoProvider).DeletePrivateKey(pendingKey.mKey);
         return {nullptr, err};
     }
 
@@ -244,7 +252,7 @@ RetWithError<SharedPtr<crypto::PrivateKeyItf>> PKCS11Module::CreateKey(const Str
 
         auto oldKey = mPendingKeys.Front().mKey;
 
-        err = pkcs11::Utils(session, *mCryptoProvider, mLocalCacheAllocator).DeletePrivateKey(oldKey);
+        err = pkcs11::Utils(*mAllocator, session, *mCryptoProvider).DeletePrivateKey(oldKey);
         if (!err.IsNone()) {
             LOG_ERR() << "Can't delete pending key: err=" << err;
         }
@@ -325,7 +333,7 @@ Error PKCS11Module::RemoveCert(const String& certURL, const String& password)
         return err;
     }
 
-    return pkcs11::Utils(session, *mCryptoProvider, mLocalCacheAllocator).DeleteCertificate(id, label);
+    return pkcs11::Utils(*mAllocator, session, *mCryptoProvider).DeleteCertificate(id, label);
 }
 
 Error PKCS11Module::RemoveKey(const String& keyURL, const String& password)
@@ -348,12 +356,12 @@ Error PKCS11Module::RemoveKey(const String& keyURL, const String& password)
         return err;
     }
 
-    const auto privKey = pkcs11::Utils(session, *mCryptoProvider, mLocalCacheAllocator).FindPrivateKey(id, label);
+    const auto privKey = pkcs11::Utils(*mAllocator, session, *mCryptoProvider).FindPrivateKey(id, label);
     if (!privKey.mError.IsNone()) {
         return AOS_ERROR_WRAP(privKey.mError);
     }
 
-    err = pkcs11::Utils(session, *mCryptoProvider, mLocalCacheAllocator).DeletePrivateKey(privKey.mValue);
+    err = pkcs11::Utils(*mAllocator, session, *mCryptoProvider).DeletePrivateKey(privKey.mValue);
     if (!err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
@@ -484,7 +492,10 @@ RetWithError<pkcs11::SlotID> PKCS11Module::GetSlotID()
         }
 
         if ((slotInfo.mFlags & CKF_TOKEN_PRESENT) != 0) {
-            auto tokenInfo = MakeUnique<pkcs11::TokenInfo>(&mTmpObjAllocator);
+            auto tokenInfo = MakeUnique<pkcs11::TokenInfo>(mAllocator);
+            if (!tokenInfo) {
+                return {0, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+            }
 
             err = mPKCS11->GetTokenInfo(slotID, *tokenInfo);
             if (!err.IsNone()) {
@@ -512,7 +523,10 @@ RetWithError<pkcs11::SlotID> PKCS11Module::GetSlotID()
 
 RetWithError<bool> PKCS11Module::IsOwned() const
 {
-    auto tokenInfo = MakeUnique<pkcs11::TokenInfo>(&mTmpObjAllocator);
+    auto tokenInfo = MakeUnique<pkcs11::TokenInfo>(mAllocator);
+    if (!tokenInfo) {
+        return {false, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
 
     auto err = mPKCS11->GetTokenInfo(mSlotID, *tokenInfo);
     if (!err.IsNone()) {
@@ -632,7 +646,10 @@ RetWithError<SharedPtr<pkcs11::SessionContext>> PKCS11Module::CreateSession(bool
 
     LOG_DBG() << "Create session: session=" << mSession->GetHandle() << ", slotID=" << mSlotID;
 
-    auto sessionInfo = MakeShared<pkcs11::SessionInfo>(&mTmpObjAllocator);
+    auto sessionInfo = MakeShared<pkcs11::SessionInfo>(mAllocator);
+    if (!sessionInfo) {
+        return {nullptr, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
+    }
 
     err = mSession->GetSessionInfo(*sessionInfo);
     if (!err.IsNone()) {
@@ -770,7 +787,7 @@ bool PKCS11Module::CheckCertificate(const crypto::x509::Certificate& cert, const
 Error PKCS11Module::CreateCertificateChain(const SharedPtr<pkcs11::SessionContext>& session, const Array<uint8_t>& id,
     const String& label, const Array<crypto::x509::Certificate>& chain)
 {
-    auto utils = pkcs11::Utils(session, *mCryptoProvider, mLocalCacheAllocator);
+    auto utils = pkcs11::Utils(*mAllocator, session, *mCryptoProvider);
 
     LOG_DBG() << "Import certificate with id: " << aos::uuid::UUIDToString(id);
     auto err = utils.ImportCertificate(id, label, chain[0]);
@@ -818,8 +835,15 @@ Error PKCS11Module::CreateURL(const String& label, const Array<uint8_t>& id, Str
         paramList.Append(name).Append("=").Append(param);
     };
 
-    auto opaque = MakeUnique<StaticString<cURLLen>>(&mTmpObjAllocator);
-    auto query  = MakeUnique<StaticString<cURLLen>>(&mTmpObjAllocator);
+    auto opaque = MakeUnique<StaticString<cURLLen>>(mAllocator);
+    if (!opaque) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto query = MakeUnique<StaticString<cURLLen>>(mAllocator);
+    if (!query) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     // create opaque part of url
     AddParam("token", mTokenLabel.CStr(), true, *opaque);
@@ -894,8 +918,15 @@ Error PKCS11Module::GetValidInfo(const pkcs11::SessionContext& session, Array<Se
         LOG_DBG() << "Certificate found: ID=" << uuid::UUIDToString(cert->mID);
 
         // create certInfo
-        auto x509Cert  = MakeUnique<crypto::x509::Certificate>(&mTmpObjAllocator);
-        auto validCert = MakeUnique<CertInfo>(&mTmpObjAllocator);
+        auto x509Cert = MakeUnique<crypto::x509::Certificate>(mAllocator);
+        if (!x509Cert) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
+
+        auto validCert = MakeUnique<CertInfo>(mAllocator);
+        if (!validCert) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         auto err = GetX509Cert(session, cert->mHandle, *x509Cert);
         if (!err.IsNone()) {
@@ -938,7 +969,10 @@ Error PKCS11Module::GetX509Cert(
 {
     static constexpr auto cSingleAttribute = 1;
 
-    auto certBuffer = MakeUnique<DERCert>(&mTmpObjAllocator);
+    auto certBuffer = MakeUnique<DERCert>(mAllocator);
+    if (!certBuffer) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     StaticArray<pkcs11::AttributeType, cSingleAttribute> types;
     StaticArray<Array<uint8_t>, cSingleAttribute>        values;
diff --git a/src/core/iam/certhandler/certmodules/pkcs11/pkcs11.hpp b/src/core/iam/certhandler/certmodules/pkcs11/pkcs11.hpp
index c5f97ab6f..bcad83d74 100644
--- a/src/core/iam/certhandler/certmodules/pkcs11/pkcs11.hpp
+++ b/src/core/iam/certhandler/certmodules/pkcs11/pkcs11.hpp
@@ -71,14 +71,15 @@ class PKCS11Module : public HSMItf {
     /**
      * Initializes module.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param certType certificate type.
      * @param config module configuration.
      * @param pkcs11 reference to pkcs11 library context.
      * @param cryptoProvider reference to crypto provider interface.
      * @return Error.
      */
-    Error Init(const String& certType, const PKCS11ModuleConfig& config, pkcs11::PKCS11Manager& pkcs11,
-        crypto::CryptoProviderItf& cryptoProvider);
+    Error Init(AllocatorItf& allocator, const String& certType, const PKCS11ModuleConfig& config,
+        pkcs11::PKCS11Manager& pkcs11, crypto::CryptoProviderItf& cryptoProvider);
 
     /**
      * Owns the module.
@@ -217,13 +218,7 @@ class PKCS11Module : public HSMItf {
     StaticString<cTeeLoginTypeLen>  mTeeLoginType;
     StaticString<pkcs11::cPINLen>   mUserPIN;
 
-    mutable StaticAllocator<aos::Max(sizeof(crypto::x509::Certificate) + sizeof(DERCert) + sizeof(CertInfo),
-                                sizeof(StaticArray<SearchObject, cCertsPerModule * 3>) + sizeof(SearchObject)
-                                    + sizeof(pkcs11::TokenInfo) + sizeof(pkcs11::SessionInfo))
-        + sizeof(StaticString<cURLLen>) * 2>
-        mTmpObjAllocator;
-    StaticAllocator<pkcs11::cPrivateKeyMaxSize * cCertsPerModule + pkcs11::Utils::cLocalObjectsMaxSize>
-        mLocalCacheAllocator;
+    AllocatorItf* mAllocator {};
 
     StaticArray<PendingKey, cCertsPerModule> mPendingKeys;
     SharedPtr<pkcs11::SessionContext>        mSession;
diff --git a/src/core/iam/certhandler/tests/certhandler.cpp b/src/core/iam/certhandler/tests/certhandler.cpp
index 9572b6773..459ee441d 100644
--- a/src/core/iam/certhandler/tests/certhandler.cpp
+++ b/src/core/iam/certhandler/tests/certhandler.cpp
@@ -12,6 +12,7 @@
 #include <core/common/tests/mocks/certprovidermock.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tools/fs.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/iam/certhandler/certhandler.hpp>
 #include <core/iam/certhandler/certmodules/pkcs11/pkcs11.hpp>
 #include <core/iam/tests/stubs/certhandlerstub.hpp>
@@ -30,11 +31,12 @@ class CerthandlerTest : public Test {
     {
         tests::utils::InitLog();
 
-        ASSERT_TRUE(mCryptoFactory.Init().IsNone());
+        ASSERT_TRUE(mCryptoFactory.Init(mAllocator).IsNone());
         mCryptoProvider = &mCryptoFactory.GetCryptoProvider();
 
-        mCertHandler = MakeShared<CertHandler>(&mAllocator);
-        ASSERT_TRUE(mSOFTHSMEnv.Init("", "certhanler-integr-tests").IsNone());
+        mCertHandler = MakeShared<CertHandler>(&mAllocator, mAllocator);
+        ASSERT_TRUE(mCertHandler);
+        ASSERT_TRUE(mSOFTHSMEnv.Init(mAllocator, "", "certhanler-integr-tests").IsNone());
     }
 
     // Default parameters
@@ -52,10 +54,12 @@ class CerthandlerTest : public Test {
         auto& certModule   = mCertModules.Back();
 
         ASSERT_TRUE(
-            pkcs11Module.Init(name, GetPKCS11ModuleConfig(), mSOFTHSMEnv.GetManager(), *mCryptoProvider).IsNone());
-        ASSERT_TRUE(
-            certModule.Init(name, GetCertModuleConfig(keyType, isSelfSigned), *mCryptoProvider, pkcs11Module, mStorage)
+            pkcs11Module.Init(mAllocator, name, GetPKCS11ModuleConfig(), mSOFTHSMEnv.GetManager(), *mCryptoProvider)
                 .IsNone());
+        ASSERT_TRUE(certModule
+                        .Init(mAllocator, name, GetCertModuleConfig(keyType, isSelfSigned), *mCryptoProvider,
+                            pkcs11Module, mStorage)
+                        .IsNone());
 
         ASSERT_TRUE(mCertHandler->RegisterModule(certModule).IsNone());
     }
@@ -89,6 +93,10 @@ class CerthandlerTest : public Test {
         return config;
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     // Service providers
     crypto::DefaultCryptoFactory mCryptoFactory;
     crypto::CryptoProviderItf*   mCryptoProvider = nullptr;
@@ -101,8 +109,6 @@ class CerthandlerTest : public Test {
     StaticArray<CertModule, cMaxModulesCount>   mCertModules;
 
     // Certificate handler
-    StaticAllocator<sizeof(CertHandler) * 2 + pkcs11::cPrivateKeyMaxSize + pkcs11::Utils::cLocalObjectsMaxSize>
-                           mAllocator;
     SharedPtr<CertHandler> mCertHandler;
 };
 
@@ -478,7 +484,8 @@ TEST_F(CerthandlerTest, ValidateCertificates)
     ASSERT_TRUE(mStorage.AddCertInfo("iam", badCert).IsNone());
 
     // Create CertHandler
-    mCertHandler = MakeShared<CertHandler>(&mAllocator);
+    mCertHandler = MakeShared<CertHandler>(&mAllocator, mAllocator);
+    ASSERT_TRUE(mCertHandler);
     RegisterPKCS11Module("iam");
 
     // Check Storage is restored.
@@ -518,7 +525,7 @@ TEST_F(CerthandlerTest, RemoveInvalidPKCS11Objects)
 
     ASSERT_TRUE(mCryptoProvider->PEMToX509Certs(pemCert, caCert).IsNone());
 
-    err = pkcs11::Utils(session, *mCryptoProvider, mAllocator).ImportCertificate(certId, "iam", caCert[0]);
+    err = pkcs11::Utils(mAllocator, session, *mCryptoProvider).ImportCertificate(certId, "iam", caCert[0]);
     ASSERT_TRUE(err.IsNone());
 
     // generate invalid key pair
@@ -529,7 +536,7 @@ TEST_F(CerthandlerTest, RemoveInvalidPKCS11Objects)
     ASSERT_TRUE(err.IsNone());
 
     Tie(privKey, err)
-        = pkcs11::Utils(session, *mCryptoProvider, mAllocator).GenerateRSAKeyPairWithLabel(keyId, "iam", 2048);
+        = pkcs11::Utils(mAllocator, session, *mCryptoProvider).GenerateRSAKeyPairWithLabel(keyId, "iam", 2048);
     ASSERT_TRUE(err.IsNone());
 
     // find invalid object handles
@@ -546,7 +553,8 @@ TEST_F(CerthandlerTest, RemoveInvalidPKCS11Objects)
     mCertHandler.Reset();
 
     // reinit certhandler to sync certificates/keys with PKCS11 storage
-    mCertHandler = MakeShared<CertHandler>(&mAllocator);
+    mCertHandler = MakeShared<CertHandler>(&mAllocator, mAllocator);
+    ASSERT_TRUE(mCertHandler);
     RegisterPKCS11Module("iam");
 
     // create key, because certmodule updates PKCS11 storage after that only
@@ -582,7 +590,8 @@ TEST_F(CerthandlerTest, RenewCertificate)
     ASSERT_EQ(handles.Size(), 3); // 1 root certificate + 2 generated
 
     // reinit certhandler to sync certificates/keys with PKCS11 storage
-    mCertHandler = MakeShared<CertHandler>(&mAllocator);
+    mCertHandler = MakeShared<CertHandler>(&mAllocator, mAllocator);
+    ASSERT_TRUE(mCertHandler);
     RegisterPKCS11Module("iam");
     RegisterPKCS11Module("sm");
 
diff --git a/src/core/iam/certhandler/tests/certmodules.cpp b/src/core/iam/certhandler/tests/certmodules.cpp
index 89b702cf2..f846b7950 100644
--- a/src/core/iam/certhandler/tests/certmodules.cpp
+++ b/src/core/iam/certhandler/tests/certmodules.cpp
@@ -9,6 +9,7 @@
 
 #include <core/common/tests/mocks/cryptomock.hpp>
 #include <core/common/tests/utils/log.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/iam/certhandler/certmodule.hpp>
 #include <core/iam/tests/mocks/certhandlermock.hpp>
 #include <core/iam/tests/stubs/certhandlerstub.hpp>
@@ -37,6 +38,9 @@ class CertModuleTest : public Test {
         mCertInfo.mNotAfter = Time::Now();
     }
 
+    // cppcheck-suppress unusedStructMember
+    HeapAllocator mAllocator;
+
     CertInfo mCertInfo;
 
     // cppcheck-suppress unusedStructMember
@@ -56,7 +60,7 @@ TEST_F(CertModuleTest, InitSucceeds)
 {
     CertModule certModule;
 
-    auto err = certModule.Init(cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
+    auto err = certModule.Init(mAllocator, cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
     ASSERT_EQ(ErrorEnum::eNone, err) << "Init failed: " << err.StrValue();
 }
 
@@ -67,7 +71,7 @@ TEST_F(CertModuleTest, InitSelfSignedModuleSucceeds)
     mModuleConfig.mIsSelfSigned    = true;
     mModuleConfig.mMaxCertificates = 1;
 
-    auto err = certModule.Init(cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
+    auto err = certModule.Init(mAllocator, cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
     ASSERT_EQ(ErrorEnum::eNone, err) << "Init failed: " << err.StrValue();
 }
 
@@ -78,7 +82,7 @@ TEST_F(CertModuleTest, InitFailsOnOneMaxCertsConfigValueForNonSelfSignedModule)
     mModuleConfig.mIsSelfSigned    = false;
     mModuleConfig.mMaxCertificates = 1;
 
-    auto err = certModule.Init(cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
+    auto err = certModule.Init(mAllocator, cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
     ASSERT_EQ(ErrorEnum::eInvalidArgument, err) << "Invalid argument expected: " << err.StrValue();
 }
 
@@ -88,7 +92,7 @@ TEST_F(CertModuleTest, InitFailsOnZeroMaxCertsConfigValue)
 
     mModuleConfig.mMaxCertificates = 0;
 
-    auto err = certModule.Init(cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
+    auto err = certModule.Init(mAllocator, cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
     ASSERT_EQ(ErrorEnum::eInvalidArgument, err) << "Invalid argument expected: " << err.StrValue();
 }
 
@@ -98,7 +102,7 @@ TEST_F(CertModuleTest, InitFailsNoMemory)
 
     mModuleConfig.mMaxCertificates = cCertsPerModule + 1;
 
-    auto err = certModule.Init(cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
+    auto err = certModule.Init(mAllocator, cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
     ASSERT_EQ(ErrorEnum::eNoMemory, err) << "No memory expected: " << err.StrValue();
 }
 
@@ -108,7 +112,7 @@ TEST_F(CertModuleTest, ApplyCert)
 
     mModuleConfig.mSkipValidation = true;
 
-    auto err = certModule.Init(cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
+    auto err = certModule.Init(mAllocator, cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
     ASSERT_EQ(ErrorEnum::eNone, err) << "Init failed: " << err.StrValue();
 
     EXPECT_CALL(mX509Provider, ASN1DecodeDN).WillRepeatedly(Return(ErrorEnum::eNone));
@@ -148,7 +152,7 @@ TEST_F(CertModuleTest, ApplyCertOldCertsAreTrimmed)
 
     mModuleConfig.mSkipValidation = true;
 
-    auto err = certModule.Init(cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
+    auto err = certModule.Init(mAllocator, cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
     ASSERT_EQ(ErrorEnum::eNone, err) << "Init failed: " << err.StrValue();
 
     err = mStorage.AddCertInfo(cCertType, mCertInfo);
@@ -187,7 +191,7 @@ TEST_F(CertModuleTest, ApplyCertOldCertsAreTrimmedOnMaxCertsLimitReached)
     mModuleConfig.mSkipValidation  = true;
     mModuleConfig.mMaxCertificates = cCertsPerModule;
 
-    auto err = certModule.Init(cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
+    auto err = certModule.Init(mAllocator, cCertType, mModuleConfig, mX509Provider, mHSM, mStorage);
     ASSERT_EQ(ErrorEnum::eNone, err) << "Init failed: " << err.StrValue();
 
     for (size_t i = 0; i < cCertsPerModule; ++i) {
diff --git a/src/core/iam/nodemanager/nodemanager.cpp b/src/core/iam/nodemanager/nodemanager.cpp
index b5a52a47f..1a0a62a65 100644
--- a/src/core/iam/nodemanager/nodemanager.cpp
+++ b/src/core/iam/nodemanager/nodemanager.cpp
@@ -15,15 +15,19 @@ namespace aos::iam::nodemanager {
  * Public
  **********************************************************************************************************************/
 
-Error NodeManager::Init(StorageItf& storage)
+Error NodeManager::Init(AllocatorItf& allocator, StorageItf& storage)
 {
     LockGuard lock {mMutex};
 
     LOG_DBG() << "Init node manager";
 
-    mStorage = &storage;
+    mAllocator = &allocator;
+    mStorage   = &storage;
 
-    auto nodeIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumNodes>>(&mAllocator);
+    auto nodeIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumNodes>>(mAllocator);
+    if (!nodeIDs) {
+        return ErrorEnum::eNoMemory;
+    }
 
     auto err = storage.GetAllNodeIDs(*nodeIDs);
     if (!err.IsNone()) {
@@ -31,7 +35,10 @@ Error NodeManager::Init(StorageItf& storage)
     }
 
     for (const auto& nodeID : *nodeIDs) {
-        auto nodeInfo = MakeUnique<NodeInfo>(&mAllocator);
+        auto nodeInfo = MakeUnique<NodeInfo>(mAllocator);
+        if (!nodeInfo) {
+            return ErrorEnum::eNoMemory;
+        }
 
         err = storage.GetNodeInfo(nodeID, *nodeInfo);
         if (!err.IsNone()) {
@@ -76,7 +83,10 @@ Error NodeManager::SetNodeState(const String& nodeID, const NodeState& state)
         return AOS_ERROR_WRAP(ErrorEnum::eNotFound);
     }
 
-    auto nodeInfo = MakeUnique<NodeInfo>(&mAllocator);
+    auto nodeInfo = MakeUnique<NodeInfo>(mAllocator);
+    if (!nodeInfo) {
+        return ErrorEnum::eNoMemory;
+    }
 
     *nodeInfo        = *cachedInfo;
     nodeInfo->mState = state;
@@ -103,7 +113,10 @@ Error NodeManager::SetNodeConnected(const String& nodeID, bool isConnected)
         return AOS_ERROR_WRAP(ErrorEnum::eNotFound);
     }
 
-    auto nodeInfo = MakeUnique<NodeInfo>(&mAllocator);
+    auto nodeInfo = MakeUnique<NodeInfo>(mAllocator);
+    if (!nodeInfo) {
+        return ErrorEnum::eNoMemory;
+    }
 
     *nodeInfo              = *cachedInfo;
     nodeInfo->mIsConnected = isConnected;
@@ -216,8 +229,12 @@ Error NodeManager::UpdateCache(const NodeInfo& nodeInfo)
 
 Error NodeManager::UpdateStorage(const NodeInfo& info)
 {
-    auto        storageInfo = MakeUnique<NodeInfo>(&mAllocator);
-    const auto* cachedInfo  = GetNodeFromCache(info.mNodeID);
+    auto storageInfo = MakeUnique<NodeInfo>(mAllocator);
+    if (!storageInfo) {
+        return ErrorEnum::eNoMemory;
+    }
+
+    const auto* cachedInfo = GetNodeFromCache(info.mNodeID);
 
     *storageInfo = info;
 
diff --git a/src/core/iam/nodemanager/nodemanager.hpp b/src/core/iam/nodemanager/nodemanager.hpp
index 01c55aa8f..f5e43ce9b 100644
--- a/src/core/iam/nodemanager/nodemanager.hpp
+++ b/src/core/iam/nodemanager/nodemanager.hpp
@@ -29,10 +29,11 @@ class NodeManager : public NodeManagerItf {
     /**
      * Initializes node manager.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param storage node info storage.
      * @return Error.
      */
-    Error Init(StorageItf& storage);
+    Error Init(AllocatorItf& allocator, StorageItf& storage);
 
     /**
      * Updates whole information for a node.
@@ -94,8 +95,6 @@ class NodeManager : public NodeManagerItf {
     Error UnsubscribeListener(iamclient::NodeInfoListenerItf& listener) override;
 
 private:
-    static constexpr auto cAllocatorSize
-        = sizeof(StaticArray<StaticString<cIDLen>, cMaxNumNodes>) + 2 * sizeof(NodeInfo);
     static constexpr auto cMaxNumListeners = 1;
 
     NodeInfo*               GetNodeFromCache(const String& nodeID);
@@ -110,7 +109,7 @@ class NodeManager : public NodeManagerItf {
     StaticArray<NodeInfo, cMaxNumNodes>                            mNodeInfoCache;
     mutable Mutex                                                  mMutex;
 
-    StaticAllocator<cAllocatorSize> mAllocator;
+    AllocatorItf* mAllocator {};
 };
 
 /** @}*/
diff --git a/src/core/iam/nodemanager/tests/nodemanager.cpp b/src/core/iam/nodemanager/tests/nodemanager.cpp
index 9f466e048..749de920b 100644
--- a/src/core/iam/nodemanager/tests/nodemanager.cpp
+++ b/src/core/iam/nodemanager/tests/nodemanager.cpp
@@ -9,6 +9,7 @@
 
 #include <core/common/tests/mocks/nodeinfoprovidermock.hpp>
 #include <core/common/tests/utils/log.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/iam/nodemanager/nodemanager.hpp>
 
 #include "mocks/storagemock.hpp"
@@ -28,9 +29,13 @@ class NodeManagerTest : public Test {
         tests::utils::InitLog();
 
         EXPECT_CALL(mStorage, GetAllNodeIDs(_)).WillOnce(Return(ErrorEnum::eNone));
-        ASSERT_TRUE(mManager.Init(mStorage).IsNone());
+        ASSERT_TRUE(mManager.Init(mAllocator, mStorage).IsNone());
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     StorageMock mStorage;
     NodeManager mManager;
 };
@@ -85,7 +90,7 @@ TEST_F(NodeManagerTest, Init)
         return ErrorEnum::eNone;
     }));
 
-    ASSERT_TRUE(mManager.Init(mStorage).IsNone());
+    ASSERT_TRUE(mManager.Init(mAllocator, mStorage).IsNone());
 
     StaticArray<StaticString<cIDLen>, 2> ids;
 
diff --git a/src/core/iam/permhandler/tests/permhandler.cpp b/src/core/iam/permhandler/tests/permhandler.cpp
index cd40ee2e5..d12944289 100644
--- a/src/core/iam/permhandler/tests/permhandler.cpp
+++ b/src/core/iam/permhandler/tests/permhandler.cpp
@@ -12,6 +12,7 @@
 #include <core/common/crypto/cryptoprovider.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tools/buffer.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/iam/permhandler/permhandler.hpp>
 
 using namespace testing;
@@ -28,10 +29,14 @@ class PermHandlerTest : public Test {
     {
         tests::utils::InitLog();
 
-        ASSERT_TRUE(mCryptoProvider.Init().IsNone()) << "Failed to initialize crypto provider";
+        ASSERT_TRUE(mCryptoProvider.Init(mAllocator).IsNone()) << "Failed to initialize crypto provider";
         ASSERT_TRUE(mPermHandler.Init(mCryptoProvider).IsNone()) << "Failed to initialize PermHandler";
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     crypto::DefaultCryptoProvider mCryptoProvider;
     PermHandler                   mPermHandler;
 };
diff --git a/src/core/sm/imagemanager/imagemanager.cpp b/src/core/sm/imagemanager/imagemanager.cpp
index 55fa9f846..5873bcd77 100644
--- a/src/core/sm/imagemanager/imagemanager.cpp
+++ b/src/core/sm/imagemanager/imagemanager.cpp
@@ -49,13 +49,14 @@ Error AddPathIfNotExist(Array<StaticString<cFilePathLen>>& list, const String& p
  * Public
  **********************************************************************************************************************/
 
-Error ImageManager::Init(const Config& config, BlobInfoProviderItf& blobInfoProvider,
+Error ImageManager::Init(AllocatorItf& allocator, const Config& config, BlobInfoProviderItf& blobInfoProvider,
     spaceallocator::SpaceAllocatorItf& spaceAllocator, downloader::DownloaderItf& downloader,
     fs::FileInfoProviderItf& fileInfoProvider, oci::OCISpecItf& ociSpec, ImageHandlerItf& imageHandler,
     StorageItf& storage)
 {
     LOG_DBG() << "Init image manager";
 
+    mAllocator        = &allocator;
     mConfig           = config;
     mBlobInfoProvider = &blobInfoProvider;
     mSpaceAllocator   = &spaceAllocator;
@@ -144,7 +145,7 @@ Error ImageManager::GetAllInstalledItems(Array<UpdateItemStatus>& statuses) cons
 
     LOG_DBG() << "Get all installed items";
 
-    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(&mAllocator);
+    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(mAllocator);
     if (!itemsData) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -191,7 +192,7 @@ Error ImageManager::InstallUpdateItem(const UpdateItemInfo& itemInfo)
         return err;
     }
 
-    auto manifest = MakeUnique<oci::ImageManifest>(&mAllocator);
+    auto manifest = MakeUnique<oci::ImageManifest>(mAllocator);
     if (!manifest) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -395,7 +396,7 @@ Error ImageManager::ValidateLayer(const String& path, const String& diffDigest)
 {
     LOG_DBG() << "Validate layer" << Log::Field("path", path) << Log::Field("diffDigest", diffDigest);
 
-    auto [size, err] = fs::CalculateSize(path);
+    auto [size, err] = fs::CalculateSize(*mAllocator, path);
 
     if (size > oci::cDigestLen) {
         return AOS_ERROR_WRAP(Error(ErrorEnum::eInvalidArgument, "not link to unpacked layer"));
@@ -802,7 +803,7 @@ Error ImageManager::InstallServiceLayers(const oci::ImageManifest& manifest, Ins
         return err;
     }
 
-    auto config = MakeUnique<oci::ImageConfig>(&mAllocator);
+    auto config = MakeUnique<oci::ImageConfig>(mAllocator);
     if (!config) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -889,7 +890,7 @@ RetWithError<size_t> ImageManager::CropUpdateItems()
 
     LOG_DBG() << "Crop update items";
 
-    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(&mAllocator);
+    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(mAllocator);
     if (!itemsData) {
         return {0, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
     }
@@ -1013,7 +1014,7 @@ Error ImageManager::UpdateOutdatedItems()
 {
     LOG_DBG() << "Update outdated items";
 
-    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(&mAllocator);
+    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(mAllocator);
     if (!itemsData) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -1051,7 +1052,7 @@ Error ImageManager::ValidateUpdateItem(const UpdateItemData& itemData)
         return err;
     }
 
-    auto manifest = MakeUnique<oci::ImageManifest>(&mAllocator);
+    auto manifest = MakeUnique<oci::ImageManifest>(mAllocator);
     if (!manifest) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -1079,7 +1080,7 @@ Error ImageManager::ValidateUpdateItem(const UpdateItemData& itemData)
             return err;
         }
 
-        auto config = MakeUnique<oci::ImageConfig>(&mAllocator);
+        auto config = MakeUnique<oci::ImageConfig>(mAllocator);
         if (!config) {
             return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
         }
@@ -1122,7 +1123,7 @@ Error ImageManager::HandleOutdatedItems()
 {
     LOG_DBG() << "Handle outdated items";
 
-    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(&mAllocator);
+    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(mAllocator);
     if (!itemsData) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -1151,7 +1152,7 @@ Error ImageManager::HandleItemsIntegrity()
 {
     LOG_DBG() << "Handle items integrity";
 
-    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(&mAllocator);
+    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(mAllocator);
     if (!itemsData) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -1221,7 +1222,7 @@ Error ImageManager::CalcItemBlobsAndLayers(const UpdateItemData& itemData, Array
         return err;
     }
 
-    auto manifest = MakeUnique<oci::ImageManifest>(&mAllocator);
+    auto manifest = MakeUnique<oci::ImageManifest>(mAllocator);
     if (!manifest) {
         return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
     }
@@ -1253,7 +1254,7 @@ Error ImageManager::CalcItemBlobsAndLayers(const UpdateItemData& itemData, Array
             return AOS_ERROR_WRAP(err);
         }
 
-        auto config = MakeUnique<oci::ImageConfig>(&mAllocator);
+        auto config = MakeUnique<oci::ImageConfig>(mAllocator);
         if (!config) {
             return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
         }
@@ -1320,7 +1321,7 @@ RetWithError<size_t> ImageManager::RemoveOrphanBlobs(const Array<StaticString<cF
                 continue;
             }
 
-            auto [blobSize, err] = fs::CalculateSize(blobPath);
+            auto [blobSize, err] = fs::CalculateSize(*mAllocator, blobPath);
             if (!err.IsNone()) {
                 LOG_ERR() << "Failed to get blob size" << Log::Field("path", blobPath) << Log::Field(err);
             } else {
@@ -1361,7 +1362,7 @@ RetWithError<size_t> ImageManager::RemoveOrphanLayers(const Array<StaticString<c
                 continue;
             }
 
-            auto [layerSize, err] = fs::CalculateSize(layerPath);
+            auto [layerSize, err] = fs::CalculateSize(*mAllocator, layerPath);
             if (!err.IsNone()) {
                 LOG_ERR() << "Failed to get layer size" << Log::Field("path", layerPath) << Log::Field(err);
             } else {
@@ -1383,7 +1384,7 @@ RetWithError<size_t> ImageManager::RemoveOrphans()
 {
     LOG_DBG() << "Remove orphans";
 
-    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(&mAllocator);
+    auto itemsData = MakeUnique<UpdateItemDataStaticArray>(mAllocator);
     if (!itemsData) {
         return {0, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
     }
@@ -1392,12 +1393,12 @@ RetWithError<size_t> ImageManager::RemoveOrphans()
         return {0, AOS_ERROR_WRAP(err)};
     }
 
-    auto usedBlobs = MakeUnique<StaticArray<StaticString<cFilePathLen>, cMaxNumInstalledBlobs>>(&mAllocator);
+    auto usedBlobs = MakeUnique<StaticArray<StaticString<cFilePathLen>, cMaxNumInstalledBlobs>>(mAllocator);
     if (!usedBlobs) {
         return {0, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
     }
 
-    auto usedLayers = MakeUnique<StaticArray<StaticString<cFilePathLen>, cMaxNumInstalledLayers>>(&mAllocator);
+    auto usedLayers = MakeUnique<StaticArray<StaticString<cFilePathLen>, cMaxNumInstalledLayers>>(mAllocator);
     if (!usedLayers) {
         return {0, AOS_ERROR_WRAP(ErrorEnum::eNoMemory)};
     }
diff --git a/src/core/sm/imagemanager/imagemanager.hpp b/src/core/sm/imagemanager/imagemanager.hpp
index 92ff0f405..719939366 100644
--- a/src/core/sm/imagemanager/imagemanager.hpp
+++ b/src/core/sm/imagemanager/imagemanager.hpp
@@ -10,6 +10,9 @@
 #include <core/common/downloader/itf/downloader.hpp>
 #include <core/common/ocispec/itf/ocispec.hpp>
 #include <core/common/spaceallocator/itf/spaceallocator.hpp>
+#include <core/common/tools/list.hpp>
+#include <core/common/tools/memory.hpp>
+#include <core/common/tools/thread.hpp>
 #include <core/common/tools/timer.hpp>
 
 #include "itf/blobinfoprovider.hpp"
@@ -34,6 +37,7 @@ class ImageManager : public ImageManagerItf, public ItemInfoProviderItf, public
     /**
      * Initializes image manager.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config image manager config.
      * @param blobInfoProvider blob info provider.
      * @param spaceAllocator space allocator.
@@ -44,7 +48,7 @@ class ImageManager : public ImageManagerItf, public ItemInfoProviderItf, public
      * @param storage image manager storage.
      * @return Error.
      */
-    Error Init(const Config& config, BlobInfoProviderItf& blobInfoProvider,
+    Error Init(AllocatorItf& allocator, const Config& config, BlobInfoProviderItf& blobInfoProvider,
         spaceallocator::SpaceAllocatorItf& spaceAllocator, downloader::DownloaderItf& downloader,
         fs::FileInfoProviderItf& fileInfoProvider, oci::OCISpecItf& ociSpec, ImageHandlerItf& imageHandler,
         StorageItf& storage);
@@ -117,18 +121,6 @@ class ImageManager : public ImageManagerItf, public ItemInfoProviderItf, public
     static constexpr auto cMaxNumItemBlobs       = oci::cMaxNumLayers + 3;
     static constexpr auto cMaxNumInstalledBlobs  = cMaxNumUpdateItems * (cMaxNumItemBlobs);
     static constexpr auto cMaxNumInstalledLayers = cMaxNumUpdateItems * oci::cMaxNumLayers;
-    // Worst case: RemoveItem (mutex held) runs RemoveOrphans->CalcItemBlobsAndLayers (1 manifest + 1 config)
-    // while cMaxNumConcurrentItems service installs are in their layer-download step inside the if(eService)
-    // block (manifest + config both alive, no mutex held). Config in InstallUpdateItem is scoped to the
-    // if(eService) block and freed before StoreUpdateItem, so only the +1 from CalcItemBlobsAndLayers adds
-    // to the manifest/config count beyond the N concurrent installs.
-    // Allocation count: 3 fixed (items array + usedBlobs + usedLayers) + 2 per slot (manifest+config).
-    static constexpr auto cAllocatorSize = sizeof(UpdateItemDataStaticArray)
-        + sizeof(StaticArray<StaticString<cFilePathLen>, cMaxNumInstalledBlobs>)
-        + sizeof(StaticArray<StaticString<cFilePathLen>, cMaxNumInstalledLayers>)
-        + (cMaxNumConcurrentItems + 1) * (sizeof(oci::ImageManifest) + sizeof(oci::ImageConfig));
-    static constexpr auto cMaxNumAllocations = 3 + 2 * (cMaxNumConcurrentItems + 1);
-
     struct InstallItem {
         StaticString<cIDLen>                                           mID;
         StaticString<cVersionLen>                                      mVersion;
@@ -184,7 +176,7 @@ class ImageManager : public ImageManagerItf, public ItemInfoProviderItf, public
     ImageHandlerItf*                   mImageHandler {};
     StorageItf*                        mStorage {};
 
-    mutable StaticAllocator<cAllocatorSize, cMaxNumAllocations> mAllocator;
+    AllocatorItf* mAllocator {};
 
     Timer                                                             mTimer;
     mutable Mutex                                                     mMutex;
diff --git a/src/core/sm/imagemanager/tests/imagemanager.cpp b/src/core/sm/imagemanager/tests/imagemanager.cpp
index b6e5f3793..82f5a2b68 100644
--- a/src/core/sm/imagemanager/tests/imagemanager.cpp
+++ b/src/core/sm/imagemanager/tests/imagemanager.cpp
@@ -15,6 +15,7 @@
 #include <core/common/tests/mocks/spaceallocatormock.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tests/utils/utils.hpp>
+#include <core/common/tools/heapallocator.hpp>
 
 #include <core/sm/imagemanager/imagemanager.hpp>
 
@@ -175,7 +176,7 @@ class ImageManagerTest : public Test {
     {
         Config config {cTestImagePath, 0, cUpdateItemTTL, cRemoveOutdatedPeriod};
 
-        auto err = mImageManager.Init(config, mBlobInfoProviderMock, mSpaceAllocatorMock, mDownloaderMock,
+        auto err = mImageManager.Init(mAllocator, config, mBlobInfoProviderMock, mSpaceAllocatorMock, mDownloaderMock,
             mFileInfoProviderMock, mOCISpecMock, mImageHandlerMock, mStorageStub);
         EXPECT_TRUE(err.IsNone()) << "Failed to initialize image manager: " << tests::utils::ErrorToStr(err);
 
@@ -217,15 +218,18 @@ class ImageManagerTest : public Test {
         EXPECT_TRUE(err.IsNone()) << "Failed to remove test image path: " << tests::utils::ErrorToStr(err);
     }
 
-    ImageManager                                           mImageManager;
-    NiceMock<BlobInfoProviderMock>                         mBlobInfoProviderMock;
-    NiceMock<spaceallocator::SpaceAllocatorMock>           mSpaceAllocatorMock;
-    NiceMock<downloader::DownloaderMock>                   mDownloaderMock;
-    NiceMock<fs::FileInfoProviderMock>                     mFileInfoProviderMock;
-    NiceMock<oci::OCISpecMock>                             mOCISpecMock;
-    NiceMock<ImageHandlerMock>                             mImageHandlerMock;
-    StorageStub                                            mStorageStub;
-    StaticAllocator<1 * sizeof(spaceallocator::SpaceMock)> mAllocator;
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
+    ImageManager                                 mImageManager;
+    NiceMock<BlobInfoProviderMock>               mBlobInfoProviderMock;
+    NiceMock<spaceallocator::SpaceAllocatorMock> mSpaceAllocatorMock;
+    NiceMock<downloader::DownloaderMock>         mDownloaderMock;
+    NiceMock<fs::FileInfoProviderMock>           mFileInfoProviderMock;
+    NiceMock<oci::OCISpecMock>                   mOCISpecMock;
+    NiceMock<ImageHandlerMock>                   mImageHandlerMock;
+    StorageStub                                  mStorageStub;
 };
 
 /***********************************************************************************************************************
diff --git a/src/core/sm/launcher/launcher.cpp b/src/core/sm/launcher/launcher.cpp
index d2c4fef42..554ecf41c 100644
--- a/src/core/sm/launcher/launcher.cpp
+++ b/src/core/sm/launcher/launcher.cpp
@@ -14,13 +14,16 @@ namespace aos::sm::launcher {
  * Public
  **********************************************************************************************************************/
 
-Error Launcher::Init(const Array<RuntimeItf*>& runtimes, imagemanager::ImageManagerItf& imageManager, SenderItf& sender,
-    StorageItf& storage, oci::OCISpecItf& ociSpec, imagemanager::ItemInfoProviderItf& itemInfoProvider,
-    cloudconnection::CloudConnectionItf& cloudConnection, networkmanager::NetworkManagerItf& networkManager,
-    InstanceIDProviderItf& instanceIDProvider, resourcemanager::ResourceInfoProviderItf& resourceInfoProvider)
+Error Launcher::Init(AllocatorItf& allocator, const Array<RuntimeItf*>& runtimes,
+    imagemanager::ImageManagerItf& imageManager, SenderItf& sender, StorageItf& storage, oci::OCISpecItf& ociSpec,
+    imagemanager::ItemInfoProviderItf& itemInfoProvider, cloudconnection::CloudConnectionItf& cloudConnection,
+    networkmanager::NetworkManagerItf& networkManager, InstanceIDProviderItf& instanceIDProvider,
+    resourcemanager::ResourceInfoProviderItf& resourceInfoProvider)
 {
     LOG_DBG() << "Init launcher";
 
+    mAllocator = &allocator;
+
     for (auto* runtime : runtimes) {
         if (auto err = mRuntimes.Set(runtime, ""); !err.IsNone()) {
             return AOS_ERROR_WRAP(err);
@@ -73,13 +76,18 @@ Error Launcher::Start()
         return AOS_ERROR_WRAP(err);
     }
 
-    auto storedInstances = MakeUnique<InstanceInfoArray>(&mAllocator);
+    auto storedInstances = MakeUnique<InstanceInfoArray>(mAllocator);
+    if (!storedInstances) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mStorage->GetAllInstancesInfos(*storedInstances); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
 
-    InitInstances(*storedInstances);
+    if (auto err = InitInstances(*storedInstances); !err.IsNone()) {
+        return AOS_ERROR_WRAP(err);
+    }
 
     lock.Unlock();
 
@@ -152,23 +160,39 @@ Error Launcher::Stop()
 
 Error Launcher::UpdateInstances(const Array<InstanceIdent>& stopInstances, const Array<InstanceInfo>& startInstances)
 {
-    if (auto err = StartLaunch(); !err.IsNone()) {
+    auto err = StartLaunch();
+    if (!err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
 
+    auto finishLaunch = DeferRelease(this, [&err](Launcher* self) {
+        if (!err.IsNone()) {
+            self->FinishLaunch();
+        }
+    });
+
     // Wait in case previous request is not yet finished
     mThread.Join();
 
-    auto stop  = MakeShared<StaticArray<InstanceIdent, cMaxNumInstances>>(&mAllocator, stopInstances);
-    auto start = MakeShared<InstanceInfoArray>(&mAllocator, startInstances);
+    auto stop = MakeShared<StaticArray<InstanceIdent, cMaxNumInstances>>(mAllocator, stopInstances);
+    if (!stop) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
+
+    auto start = MakeShared<InstanceInfoArray>(mAllocator, startInstances);
+    if (!start) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
-    if (auto err = mThread.Run([this, stop, start](void*) {
+    if (err = mThread.Run([this, stop, start](void*) {
             UpdateInstancesImpl(*stop, *start);
             FinishLaunch();
         });
         !err.IsNone()) {
-        FinishLaunch();
-
         return AOS_ERROR_WRAP(err);
     }
 
@@ -363,12 +387,15 @@ void Launcher::OnDisconnect()
     StartTTLTimer();
 }
 
-void Launcher::InitInstances(const Array<InstanceInfo>& instancesInfo)
+Error Launcher::InitInstances(const Array<InstanceInfo>& instancesInfo)
 {
     LOG_DBG() << "Init instances" << Log::Field("numInstances", instancesInfo.Size());
 
     for (auto& it : mRuntimes) {
-        auto runtimeInstances = MakeUnique<InstanceInfoArray>(&mAllocator);
+        auto runtimeInstances = MakeUnique<InstanceInfoArray>(mAllocator);
+        if (!runtimeInstances) {
+            return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+        }
 
         for (const auto& instanceInfo : instancesInfo) {
             if (instanceInfo.mRuntimeID != it.mSecond) {
@@ -388,6 +415,8 @@ void Launcher::InitInstances(const Array<InstanceInfo>& instancesInfo)
                       << Log::Field(AOS_ERROR_WRAP(err));
         }
     }
+
+    return ErrorEnum::eNone;
 }
 
 void Launcher::RunRebootThread()
@@ -539,7 +568,12 @@ void Launcher::SendNodeInstancesStatuses()
 {
     LOG_INF() << "Send node instances statuses" << Log::Field("count", mInstances.Size());
 
-    auto statuses = MakeUnique<InstanceStatusArray>(&mAllocator);
+    auto statuses = MakeUnique<InstanceStatusArray>(mAllocator);
+    if (!statuses) {
+        LOG_ERR() << "Failed to allocate instance statuses" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
 
     for (const auto& instance : mInstances) {
         LOG_INF() << "Node instance status" << Log::Field("instance", instance.mInfo)
@@ -577,7 +611,10 @@ Error Launcher::HandleComponentStatus(const aos::InstanceStatus& status)
         return ErrorEnum::eNone;
     }
 
-    auto instanceInfo = MakeUnique<InstanceInfo>(&mAllocator);
+    auto instanceInfo = MakeUnique<InstanceInfo>(mAllocator);
+    if (!instanceInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     static_cast<InstanceIdent&>(*instanceInfo) = status;
     instanceInfo->mRuntimeID                   = status.mRuntimeID;
@@ -594,8 +631,15 @@ Error Launcher::HandleComponentStatus(const aos::InstanceStatus& status)
 
 Error Launcher::LoadInstanceData(InstanceData& instanceData)
 {
-    auto itemConfig  = MakeUnique<oci::ItemConfig>(&mAllocator);
-    auto imageConfig = MakeUnique<oci::ImageConfig>(&mAllocator);
+    auto itemConfig = MakeUnique<oci::ItemConfig>(mAllocator);
+    if (!itemConfig) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto imageConfig = MakeUnique<oci::ImageConfig>(mAllocator);
+    if (!imageConfig) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = GetInstanceConfigs(instanceData.mInfo, *itemConfig, *imageConfig); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -673,7 +717,12 @@ void Launcher::UpdateInstancesImpl(Array<InstanceIdent>& stopInstances, const Ar
         LOG_ERR() << "Failed to append instances with modified params to stop list" << Log::Field(AOS_ERROR_WRAP(err));
     }
 
-    auto removeItems = MakeUnique<StaticArray<UpdateItemInfo, cMaxNumUpdateItems>>(&mAllocator);
+    auto removeItems = MakeUnique<StaticArray<UpdateItemInfo, cMaxNumUpdateItems>>(mAllocator);
+    if (!removeItems) {
+        LOG_ERR() << "Failed to allocate remove update items" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
 
     if (!mFirstStart) {
         GetRemoveUpdateItems(stopInstances, startInstances, *removeItems);
@@ -814,7 +863,12 @@ void Launcher::StopAllNetworks()
     }
 
     if (errBegin.IsNone()) {
-        auto failedIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumInstances>>(&mAllocator);
+        auto failedIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumInstances>>(mAllocator);
+        if (!failedIDs) {
+            LOG_ERR() << "Failed to allocate failed network IDs" << Log::Field(ErrorEnum::eNoMemory);
+
+            return;
+        }
 
         mNetworkManager->FlushBatch(*failedIDs);
 
@@ -838,8 +892,15 @@ Error Launcher::PrepareInstance(InstanceData& instanceData)
         return ErrorEnum::eNone;
     }
 
-    auto itemConfig  = MakeUnique<oci::ItemConfig>(&mAllocator);
-    auto imageConfig = MakeUnique<oci::ImageConfig>(&mAllocator);
+    auto itemConfig = MakeUnique<oci::ItemConfig>(mAllocator);
+    if (!itemConfig) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto imageConfig = MakeUnique<oci::ImageConfig>(mAllocator);
+    if (!imageConfig) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = GetInstanceConfigs(instanceData.mInfo, *itemConfig, *imageConfig); !err.IsNone()) {
         return err;
@@ -957,7 +1018,12 @@ void Launcher::StartNetworks(const Array<InstanceInfo>& startInstances)
     }
 
     if (errBegin.IsNone()) {
-        auto failedIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumInstances>>(&mAllocator);
+        auto failedIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumInstances>>(mAllocator);
+        if (!failedIDs) {
+            LOG_ERR() << "Failed to allocate failed network IDs" << Log::Field(ErrorEnum::eNoMemory);
+
+            return;
+        }
 
         mNetworkManager->FlushBatch(*failedIDs);
 
@@ -1034,7 +1100,12 @@ void Launcher::StopNetworks(const Array<InstanceIdent>& stopInstances)
     }
 
     if (errBegin.IsNone()) {
-        auto failedIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumInstances>>(&mAllocator);
+        auto failedIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumInstances>>(mAllocator);
+        if (!failedIDs) {
+            LOG_ERR() << "Failed to allocate failed network IDs" << Log::Field(ErrorEnum::eNoMemory);
+
+            return;
+        }
 
         mNetworkManager->FlushBatch(*failedIDs);
 
@@ -1281,8 +1352,19 @@ void Launcher::RemoveUpdateItems(const Array<UpdateItemInfo>& removeItems)
 
 void Launcher::InstallUpdateItems(const Array<InstanceInfo>& startInstances)
 {
-    auto currentItems = MakeUnique<StaticArray<imagemanager::UpdateItemStatus, cMaxNumUpdateItems>>(&mAllocator);
-    auto installItems = MakeUnique<StaticArray<imagemanager::UpdateItemInfo, cMaxNumUpdateItems>>(&mAllocator);
+    auto currentItems = MakeUnique<StaticArray<imagemanager::UpdateItemStatus, cMaxNumUpdateItems>>(mAllocator);
+    if (!currentItems) {
+        LOG_ERR() << "Failed to allocate current items" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
+
+    auto installItems = MakeUnique<StaticArray<imagemanager::UpdateItemInfo, cMaxNumUpdateItems>>(mAllocator);
+    if (!installItems) {
+        LOG_ERR() << "Failed to allocate install items" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
 
     if (auto err = mImageManager->GetAllInstalledItems(*currentItems); !err.IsNone()) {
         LOG_ERR() << "Get update items statuses failed" << Log::Field(AOS_ERROR_WRAP(err));
@@ -1426,13 +1508,19 @@ Error Launcher::GetInstanceConfigs(
 {
     LOG_DBG() << "Get instance configs" << Log::Field("instance", instance);
 
-    auto path = MakeUnique<StaticString<cFilePathLen>>(&mAllocator);
+    auto path = MakeUnique<StaticString<cFilePathLen>>(mAllocator);
+    if (!path) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mItemInfoProvider->GetBlobPath(instance.mManifestDigest, *path); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
     }
 
-    auto manifest = MakeUnique<oci::ImageManifest>(&mAllocator);
+    auto manifest = MakeUnique<oci::ImageManifest>(mAllocator);
+    if (!manifest) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mOCISpec->LoadImageManifest(*path, *manifest); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -1466,7 +1554,10 @@ Error Launcher::GetInstanceNetworkConfig(const InstanceInfo& instance, const oci
 {
     networkConfig.mInstanceIdent = static_cast<const InstanceIdent&>(instance);
 
-    auto resourceInfo = MakeUnique<resourcemanager::ResourceInfo>(&mAllocator);
+    auto resourceInfo = MakeUnique<resourcemanager::ResourceInfo>(mAllocator);
+    if (!resourceInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     for (const auto& resource : itemConfig.mResources) {
 
@@ -1515,7 +1606,10 @@ Error Launcher::GetInstanceNetworkConfig(const InstanceInfo& instance, const oci
 Error Launcher::CreateNetwork(
     const InstanceData& instanceData, const oci::ItemConfig& itemConfig, const oci::ImageConfig& imageConfig)
 {
-    auto networkConfig = MakeUnique<networkmanager::InstanceNetworkConfig>(&mAllocator);
+    auto networkConfig = MakeUnique<networkmanager::InstanceNetworkConfig>(mAllocator);
+    if (!networkConfig) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = GetInstanceNetworkConfig(instanceData.mInfo, itemConfig, imageConfig, *networkConfig);
         !err.IsNone()) {
diff --git a/src/core/sm/launcher/launcher.hpp b/src/core/sm/launcher/launcher.hpp
index f6c17a9a1..69fdc14ef 100644
--- a/src/core/sm/launcher/launcher.hpp
+++ b/src/core/sm/launcher/launcher.hpp
@@ -11,8 +11,8 @@
 #include <core/common/instancestatusprovider/itf/instancestatusprovider.hpp>
 #include <core/common/monitoring/itf/instanceinfoprovider.hpp>
 #include <core/common/ocispec/itf/ocispec.hpp>
-#include <core/common/tools/allocator.hpp>
 #include <core/common/tools/map.hpp>
+#include <core/common/tools/memory.hpp>
 #include <core/common/tools/thread.hpp>
 #include <core/common/types/instance.hpp>
 #include <core/sm/imagemanager/imagemanager.hpp>
@@ -45,6 +45,7 @@ class Launcher : public LauncherItf,
     /**
      * Initializes launcher.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param runtimes available runtimes.
      * @param imageManager image manager.
      * @param statusSender sender.
@@ -58,10 +59,11 @@ class Launcher : public LauncherItf,
      *
      * @return Error.
      */
-    Error Init(const Array<RuntimeItf*>& runtimes, imagemanager::ImageManagerItf& imageManager, SenderItf& sender,
-        StorageItf& storage, oci::OCISpecItf& ociSpec, imagemanager::ItemInfoProviderItf& itemInfoProvider,
-        cloudconnection::CloudConnectionItf& cloudConnection, networkmanager::NetworkManagerItf& networkManager,
-        InstanceIDProviderItf& instanceIDProvider, resourcemanager::ResourceInfoProviderItf& resourceInfoProvider);
+    Error Init(AllocatorItf& allocator, const Array<RuntimeItf*>& runtimes, imagemanager::ImageManagerItf& imageManager,
+        SenderItf& sender, StorageItf& storage, oci::OCISpecItf& ociSpec,
+        imagemanager::ItemInfoProviderItf& itemInfoProvider, cloudconnection::CloudConnectionItf& cloudConnection,
+        networkmanager::NetworkManagerItf& networkManager, InstanceIDProviderItf& instanceIDProvider,
+        resourcemanager::ResourceInfoProviderItf& resourceInfoProvider);
 
     /**
      * Starts launcher.
@@ -172,17 +174,6 @@ class Launcher : public LauncherItf,
     static constexpr auto cThreadTaskSize    = 512;
     static constexpr auto cMaxNumSubscribers = 4;
 
-    static constexpr auto cAllocatorSize = 2 * sizeof(StaticArray<InstanceIdent, cMaxNumInstances>)
-        + 3 * sizeof(InstanceInfoArray) + sizeof(InstanceStatusArray)
-        + cMaxNumConcurrentItems
-            * (sizeof(oci::ImageConfig) + sizeof(oci::ItemConfig)
-                + Max(sizeof(StaticString<cFilePathLen>) + sizeof(oci::ImageManifest),
-                    sizeof(networkmanager::InstanceNetworkConfig) + sizeof(resourcemanager::ResourceInfo)))
-        + Max(sizeof(StaticArray<UpdateItemInfo, cMaxNumUpdateItems>),
-            sizeof(StaticArray<imagemanager::UpdateItemInfo, cMaxNumUpdateItems>)
-                + sizeof(StaticArray<imagemanager::UpdateItemStatus, cMaxNumUpdateItems>));
-    static constexpr auto cMaxNumAllocations = 5 + cMaxNumConcurrentItems * 4;
-
     void  OnConnect() override;
     void  OnDisconnect() override;
     void  RunRebootThread();
@@ -234,9 +225,9 @@ class Launcher : public LauncherItf,
     void               StartTTLTimer();
     void               StopExpiredInstances(UniqueLock<Mutex>& lock);
     void               SendNodeInstancesStatuses();
-    void               InitInstances(const Array<InstanceInfo>& instancesInfo);
+    Error              InitInstances(const Array<InstanceInfo>& instancesInfo);
 
-    StaticAllocator<cAllocatorSize, cMaxNumAllocations>                   mAllocator;
+    AllocatorItf*                                                         mAllocator {};
     StaticArray<instancestatusprovider::ListenerItf*, cMaxNumSubscribers> mSubscribers;
     Thread<cThreadTaskSize>                                               mThread;
     Thread<cThreadTaskSize>                                               mRebootThread;
diff --git a/src/core/sm/launcher/tests/launcher.cpp b/src/core/sm/launcher/tests/launcher.cpp
index 2eaf05cd7..4dde8006e 100644
--- a/src/core/sm/launcher/tests/launcher.cpp
+++ b/src/core/sm/launcher/tests/launcher.cpp
@@ -16,6 +16,7 @@
 #include <core/common/tests/mocks/ocispecmock.hpp>
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tests/utils/utils.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/sm/imagemanager/tests/mocks/iteminfoprovidermock.hpp>
 #include <core/sm/launcher/itf/rebooter.hpp>
 #include <core/sm/launcher/itf/updatechecker.hpp>
@@ -208,6 +209,10 @@ class LauncherTest : public Test {
         return runtimes;
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     Launcher mLauncher;
 
     StrictMock<RuntimeMock>                               mRuntime0;
@@ -236,8 +241,8 @@ class LauncherTest : public Test {
 
 TEST_F(LauncherTest, NoStoredInstancesOnModuleStart)
 {
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mLauncher.Start();
@@ -263,8 +268,8 @@ TEST_F(LauncherTest, InitInstances)
 
     mStorage.Init(cStoredInfos);
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mRuntime0, InitInstances(Array<InstanceInfo>(&cRuntime0Infos.front(), cRuntime0Infos.size())))
@@ -341,8 +346,8 @@ TEST_F(LauncherTest, SendActiveComponentNodeInstancesStatusOnModuleStart)
         return ErrorEnum::eNone;
     }));
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mLauncher.Start();
@@ -390,8 +395,8 @@ TEST_F(LauncherTest, DoNotSendUpdateInstancesStatusesBeforeModuleStart)
         return ErrorEnum::eNone;
     }));
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mLauncher.Start();
@@ -427,8 +432,8 @@ TEST_F(LauncherTest, LauncherStartsStoredInstancesOnModuleStart)
 
     mStorage.Init(cStoredInfos);
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mRuntime0, StartInstance).WillOnce(Invoke([](const InstanceInfo& instance, InstanceStatus& status) {
@@ -473,8 +478,8 @@ TEST_F(LauncherTest, StartNetworks_FlushFailure_FailsInstance)
 
     mStorage.Init(cStoredInfos);
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mInstanceIDProvider, GetInstanceID)
@@ -540,8 +545,8 @@ TEST_F(LauncherTest, StopInstancesWithExpiredOfflineTTL)
 
     mStorage.Init(cStoredInfos);
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mRuntime0, StartInstance).WillOnce(Invoke([](const InstanceInfo& instance, InstanceStatus& status) {
@@ -618,8 +623,8 @@ TEST_F(LauncherTest, UpdateInstances)
 
     mStorage.Init(cStoredInfos);
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mRuntime0, StartInstance).WillOnce(Invoke([](const InstanceInfo& instance, InstanceStatus& status) {
@@ -726,8 +731,8 @@ TEST_F(LauncherTest, UpdateInstancesRestartsInstancesWithModifiedParams)
 
     mStorage.Init(cStoredInfos);
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mRuntime0, StartInstance).WillOnce(Invoke([](const InstanceInfo& instance, InstanceStatus& status) {
@@ -800,8 +805,8 @@ TEST_F(LauncherTest, ParallelUpdateInstancesDoesNotInterfere)
     const Array<InstanceInfo> cStartFirstInstance(&cStartInstanceInfos.front(), 1);
     const Array<InstanceInfo> cStartInstances(&cStartInstanceInfos.front(), cStartInstanceInfos.size());
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mLauncher.Start();
@@ -846,8 +851,8 @@ TEST_F(LauncherTest, ParallelUpdateInstancesDoesNotInterfere)
 
 TEST_F(LauncherTest, GetInstancesStatusesReturnsEmptyArray)
 {
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     auto storedData = std::make_unique<InstanceInfoArray>();
@@ -873,8 +878,8 @@ TEST_F(LauncherTest, GetInstancesStatuses)
     };
     const Array<InstanceInfo> cStartInstances(&cStartInstanceInfos.front(), cStartInstanceInfos.size());
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mRuntime0, StartInstance(cStartInstanceInfos[0], _))
@@ -937,8 +942,8 @@ TEST_F(LauncherTest, GetInstanceMonitoringParams)
 
     const Array<InstanceInfo> cStartInstances(&startInstance, 1);
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mRuntime0, StartInstance(startInstance, _))
@@ -995,8 +1000,8 @@ TEST_F(LauncherTest, GetInstanceMonitoringData)
     const Array<InstanceInfo> cStartInstances(&cInstanceInfo, 1);
     const auto                cMonitoringData = CreateMonitoringData(cInstanceInfo);
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mLauncher.Start();
@@ -1042,8 +1047,8 @@ TEST_F(LauncherTest, GetInstanceMonitoringData)
 
 TEST_F(LauncherTest, GetRuntimesInfos)
 {
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mLauncher.Start();
@@ -1075,8 +1080,8 @@ TEST_F(LauncherTest, OnInstanceStatusChanged)
 
     mStorage.Init({cInstanceInfo});
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mLauncher.SubscribeListener(mStatusListener);
@@ -1121,8 +1126,8 @@ TEST_F(LauncherTest, RebootRuntimeOnStartInstance)
 
     mStorage.Init({cInstanceInfo});
 
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     EXPECT_CALL(mRuntime0, StartInstance).WillOnce(Invoke([&](const InstanceInfo& instance, InstanceStatus& status) {
@@ -1174,8 +1179,8 @@ TEST_F(LauncherTest, RebootRuntimeOnStartInstance)
 
 TEST_F(LauncherTest, RebootRuntime)
 {
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mLauncher.SubscribeListener(mStatusListener);
@@ -1212,8 +1217,8 @@ TEST_F(LauncherTest, RebootRuntime)
 
 TEST_F(LauncherTest, OnInstancesStatusesReceived)
 {
-    auto err = mLauncher.Init(GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec, mItemInfoProvider,
-        mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
+    auto err = mLauncher.Init(mAllocator, GetRuntimesArray(), mImageManager, mSender, mStorage, mOCISpec,
+        mItemInfoProvider, mCloudConnection, mNetworkManager, mInstanceIDProvider, mResourceInfoProvider);
     ASSERT_TRUE(err.IsNone()) << tests::utils::ErrorToStr(err);
 
     err = mLauncher.SubscribeListener(mStatusListener);
diff --git a/src/core/sm/networkmanager/networkmanager.cpp b/src/core/sm/networkmanager/networkmanager.cpp
index b4242480a..dd35e67d8 100644
--- a/src/core/sm/networkmanager/networkmanager.cpp
+++ b/src/core/sm/networkmanager/networkmanager.cpp
@@ -15,13 +15,14 @@ namespace aos::sm::networkmanager {
  * Public
  **********************************************************************************************************************/
 
-Error NetworkManager::Init(StorageItf& storage, BridgeNetworkItf& bridgeNet, FirewallItf& firewall,
-    BandwidthItf& bandwidth, DNSNameItf& dnsName, TrafficMonitorItf& netMonitor, NamespaceManagerItf& netns,
-    InterfaceManagerItf& netIf, crypto::RandomItf& random, InterfaceFactoryItf& netIfFactory,
-    aos::networkmanager::NetworkProviderItf& networkProvider, const String& nodeID)
+Error NetworkManager::Init(AllocatorItf& allocator, StorageItf& storage, BridgeNetworkItf& bridgeNet,
+    FirewallItf& firewall, BandwidthItf& bandwidth, DNSNameItf& dnsName, TrafficMonitorItf& netMonitor,
+    NamespaceManagerItf& netns, InterfaceManagerItf& netIf, crypto::RandomItf& random,
+    InterfaceFactoryItf& netIfFactory, aos::networkmanager::NetworkProviderItf& networkProvider, const String& nodeID)
 {
     LOG_DBG() << "Init network manager";
 
+    mAllocator       = &allocator;
     mStorage         = &storage;
     mBridgeNetwork   = &bridgeNet;
     mFirewall        = &firewall;
@@ -35,8 +36,10 @@ Error NetworkManager::Init(StorageItf& storage, BridgeNetworkItf& bridgeNet, Fir
     mNetworkProvider = &networkProvider;
     mNodeID          = nodeID;
 
-    auto instanceNetworkInfos
-        = MakeUnique<StaticArray<InstanceNetworkInfo, cMaxNumInstances>>(&mInstanceNetworkInfosAllocator);
+    auto instanceNetworkInfos = MakeUnique<StaticArray<InstanceNetworkInfo, cMaxNumInstances>>(mAllocator);
+    if (!instanceNetworkInfos) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mStorage->GetInstanceNetworksInfo(*instanceNetworkInfos); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -46,7 +49,10 @@ Error NetworkManager::Init(StorageItf& storage, BridgeNetworkItf& bridgeNet, Fir
         mInstanceNetworkInfos.Set(instanceNetworkInfo.mInstanceID, instanceNetworkInfo);
     }
 
-    auto networkInfos = MakeUnique<StaticArray<NetworkInfo, cMaxNumOwners>>(&mNetworkInfosAllocator);
+    auto networkInfos = MakeUnique<StaticArray<NetworkInfo, cMaxNumOwners>>(mAllocator);
+    if (!networkInfos) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mStorage->GetNetworksInfo(*networkInfos); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -203,13 +209,23 @@ Error NetworkManager::CreateInstanceNetwork(
         return err;
     }
 
-    auto serviceData = MakeUnique<UpdateItemNetworkParams>(&mAllocator);
+    auto serviceData = MakeUnique<UpdateItemNetworkParams>(mAllocator);
+    if (!serviceData) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     if (err = PrepareUpdateItemNetworkParams(instanceNetworkParameters, networkID, *serviceData); !err.IsNone()) {
         return err;
     }
 
-    auto allocatedParams = MakeUnique<aos::InstanceNetworkAllocation>(&mAllocator);
+    auto allocatedParams = MakeUnique<aos::InstanceNetworkAllocation>(mAllocator);
+    if (!allocatedParams) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     if (err = mNetworkProvider->AllocateInstanceNetwork(
             instanceNetworkParameters.mInstanceIdent, networkID, mNodeID, *serviceData, *allocatedParams);
@@ -228,7 +244,12 @@ Error NetworkManager::CreateInstanceNetwork(
         });
 
     auto info = MakeUnique<InstanceNetworkInfo>(
-        &mAllocator, instanceID, networkID, instanceNetworkParameters, *allocatedParams);
+        mAllocator, instanceID, networkID, instanceNetworkParameters, *allocatedParams);
+    if (!info) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     if (err = mStorage->AddInstanceNetworkInfo(*info); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -247,7 +268,10 @@ Error NetworkManager::StartInstanceNetwork(const String& instanceID, const Strin
 {
     LOG_DBG() << "Start instance network" << Log::Field("instanceID", instanceID) << Log::Field("networkID", networkID);
 
-    auto cachedInfo = MakeUnique<InstanceNetworkInfo>(&mAllocator);
+    auto cachedInfo = MakeUnique<InstanceNetworkInfo>(mAllocator);
+    if (!cachedInfo) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     {
         LockGuard lock {mMutex};
@@ -303,7 +327,10 @@ Error NetworkManager::GetResolvServers(const String& instanceID, Array<StaticStr
 {
     StaticString<cIDLen> networkID;
     StaticString<cIPLen> bridgeIP;
-    auto                 dns = MakeUnique<StaticArray<StaticString<cIPLen>, cMaxNumDNSServers>>(&mResolvHostsAllocator);
+    auto                 dns = MakeUnique<StaticArray<StaticString<cIPLen>, cMaxNumDNSServers>>(mAllocator);
+    if (!dns) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     {
         LockGuard lock {mMutex};
@@ -350,7 +377,10 @@ Error NetworkManager::GetHosts(const String& instanceID, Array<Host>& hosts) con
     StaticString<cIDLen>       networkID;
     StaticString<cIPLen>       instanceIP;
     StaticString<cHostNameLen> hostname;
-    auto                       customHosts = MakeUnique<StaticArray<Host, cMaxNumHosts>>(&mResolvHostsAllocator);
+    auto                       customHosts = MakeUnique<StaticArray<Host, cMaxNumHosts>>(mAllocator);
+    if (!customHosts) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     {
         LockGuard lock {mMutex};
@@ -665,7 +695,10 @@ Error NetworkManager::ReapplyInstancePolicy(const BatchEntry& entry)
         return err;
     }
 
-    auto info = MakeUnique<InstanceNetworkInfo>(&mAllocator);
+    auto info = MakeUnique<InstanceNetworkInfo>(mAllocator);
+    if (!info) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     {
         LockGuard lock {mMutex};
@@ -678,7 +711,10 @@ Error NetworkManager::ReapplyInstancePolicy(const BatchEntry& entry)
         *info = it->mSecond;
     }
 
-    auto firewallParams = MakeUnique<InstanceFirewallParams>(&mAllocator);
+    auto firewallParams = MakeUnique<InstanceFirewallParams>(mAllocator);
+    if (!firewallParams) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = PrepareInstanceFirewallParams(info->mNetworkConfig, info->mAllocatedParams, *firewallParams);
         !err.IsNone()) {
@@ -862,7 +898,12 @@ Error NetworkManager::AddInstanceToNetwork(const String& instanceID, const Strin
         }
     });
 
-    auto hosts = MakeUnique<StaticArray<StaticString<cHostNameLen>, cMaxNumHosts>>(&mAllocator);
+    auto hosts = MakeUnique<StaticArray<StaticString<cHostNameLen>, cMaxNumHosts>>(mAllocator);
+    if (!hosts) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     if (err = PrepareHosts(instanceID, networkID, networkConfig, *hosts); !err.IsNone()) {
         return err;
@@ -875,7 +916,12 @@ Error NetworkManager::AddInstanceToNetwork(const String& instanceID, const Strin
         return err;
     }
 
-    auto bridgeParams = MakeUnique<BridgeParams>(&mAllocator);
+    auto bridgeParams = MakeUnique<BridgeParams>(mAllocator);
+    if (!bridgeParams) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     if (err = PrepareBridgeParams(networkID, networkParams, *bridgeParams); !err.IsNone()) {
         return err;
@@ -897,7 +943,12 @@ Error NetworkManager::AddInstanceToNetwork(const String& instanceID, const Strin
         }
     });
 
-    auto firewallParams = MakeUnique<InstanceFirewallParams>(&mAllocator);
+    auto firewallParams = MakeUnique<InstanceFirewallParams>(mAllocator);
+    if (!firewallParams) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     if (err = PrepareInstanceFirewallParams(networkConfig, networkParams, *firewallParams); !err.IsNone()) {
         return err;
@@ -916,7 +967,12 @@ Error NetworkManager::AddInstanceToNetwork(const String& instanceID, const Strin
         }
     });
 
-    auto bandwidthParams = MakeUnique<BandwidthParams>(&mAllocator);
+    auto bandwidthParams = MakeUnique<BandwidthParams>(mAllocator);
+    if (!bandwidthParams) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     if (err = PrepareBandwidthParams(networkConfig, *bandwidthParams); !err.IsNone()) {
         return err;
@@ -952,7 +1008,12 @@ Error NetworkManager::AddInstanceToNetwork(const String& instanceID, const Strin
         dnsServer = it->mSecond;
     }
 
-    auto dnsParams = MakeUnique<DNSAliasesParams>(&mAllocator);
+    auto dnsParams = MakeUnique<DNSAliasesParams>(mAllocator);
+    if (!dnsParams) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     if (err = PrepareDNSAliasesParams(networkParams, *hosts, *dnsParams); !err.IsNone()) {
         return err;
@@ -993,7 +1054,12 @@ Error NetworkManager::AddInstanceToNetwork(const String& instanceID, const Strin
         return err;
     }
 
-    auto info = MakeUnique<InstanceNetworkInfo>(&mAllocator);
+    auto info = MakeUnique<InstanceNetworkInfo>(mAllocator);
+    if (!info) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     {
         LockGuard lock {mMutex};
@@ -1112,7 +1178,16 @@ Error NetworkManager::DeleteInstanceNetworkConfig(const String& instanceID, cons
     }
 
     if (err.IsNone() && !hostIfName.IsEmpty()) {
-        auto info        = MakeUnique<InstanceNetworkInfo>(&mAllocator);
+        auto info = MakeUnique<InstanceNetworkInfo>(mAllocator);
+        if (!info) {
+            LOG_ERR() << "Failed to allocate instance network info" << Log::Field("instanceID", instanceID)
+                      << Log::Field(ErrorEnum::eNoMemory);
+
+            err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+            return err;
+        }
+
         bool needPersist = false;
 
         {
@@ -1238,9 +1313,15 @@ Error NetworkManager::InitInstance(const String& instanceID, const String& netwo
         }
     });
 
-    auto                 config = MakeUnique<InstanceNetworkConfig>(&mAllocator);
     StaticString<cIPLen> instanceIP;
 
+    auto config = MakeUnique<InstanceNetworkConfig>(mAllocator);
+    if (!config) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
+
     {
         LockGuard lock {mMutex};
 
@@ -1255,7 +1336,12 @@ Error NetworkManager::InitInstance(const String& instanceID, const String& netwo
         instanceIP = it->mSecond.mAllocatedParams.mIP;
     }
 
-    auto hosts = MakeUnique<InstanceHosts>(&mAllocator);
+    auto hosts = MakeUnique<InstanceHosts>(mAllocator);
+    if (!hosts) {
+        err = AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+
+        return err;
+    }
 
     if (err = PrepareHosts(instanceID, networkID, *config, *hosts); !err.IsNone()) {
         return err;
@@ -1294,7 +1380,10 @@ Error NetworkManager::ReconcileInstances()
         StaticString<cInterfaceLen> mBridgeIfName;
     };
 
-    auto entries = MakeUnique<StaticArray<Entry, cMaxNumInstances>>(&mAllocator);
+    auto entries = MakeUnique<StaticArray<Entry, cMaxNumInstances>>(mAllocator);
+    if (!entries) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     {
         LockGuard lock {mMutex};
@@ -1359,8 +1448,15 @@ Error NetworkManager::ReconcileInstances()
 
 Error NetworkManager::RemoveFirewallOrphans()
 {
-    auto knownInstanceIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumInstances>>(&mAllocator);
-    auto knownMasquerades = MakeUnique<StaticArray<MasqueradeParams, cMaxNumOwners>>(&mAllocator);
+    auto knownInstanceIDs = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumInstances>>(mAllocator);
+    if (!knownInstanceIDs) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
+
+    auto knownMasquerades = MakeUnique<StaticArray<MasqueradeParams, cMaxNumOwners>>(mAllocator);
+    if (!knownMasquerades) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     {
         LockGuard lock {mMutex};
@@ -1387,7 +1483,10 @@ Error NetworkManager::RemoveFirewallOrphans()
 
 Error NetworkManager::RemoveDNSOrphans()
 {
-    auto known = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumOwners>>(&mAllocator);
+    auto known = MakeUnique<StaticArray<StaticString<cIDLen>, cMaxNumOwners>>(mAllocator);
+    if (!known) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     {
         LockGuard lock {mMutex};
@@ -1889,8 +1988,19 @@ void NetworkManager::OnPendingFirewallUpdate(
     StaticString<cIDLen> networkID;
     bool                 isRunning = false;
 
-    auto networkConfig   = MakeUnique<InstanceNetworkConfig>(&mAllocator);
-    auto allocatedParams = MakeUnique<aos::InstanceNetworkAllocation>(&mAllocator);
+    auto networkConfig = MakeUnique<InstanceNetworkConfig>(mAllocator);
+    if (!networkConfig) {
+        LOG_ERR() << "Failed to allocate network config" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
+
+    auto allocatedParams = MakeUnique<aos::InstanceNetworkAllocation>(mAllocator);
+    if (!allocatedParams) {
+        LOG_ERR() << "Failed to allocate network allocation params" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
 
     StaticString<cInterfaceLen> hostIfName;
 
@@ -1924,7 +2034,13 @@ void NetworkManager::OnPendingFirewallUpdate(
         allocatedParams->mFirewallRules = update.mFirewallRules;
 
         auto info = MakeUnique<InstanceNetworkInfo>(
-            &mInstanceNetworkInfosAllocator, instanceID, networkID, *networkConfig, *allocatedParams, hostIfName);
+            mAllocator, instanceID, networkID, *networkConfig, *allocatedParams, hostIfName);
+        if (!info) {
+            LOG_ERR() << "Failed to allocate instance network info" << Log::Field("instanceID", instanceID)
+                      << Log::Field(ErrorEnum::eNoMemory);
+
+            return;
+        }
 
         if (auto err = mStorage->UpdateInstanceNetworkInfo(*info); !err.IsNone()) {
             LOG_ERR() << "Failed to update instance network info" << Log::Field("instanceID", instanceID)
@@ -1950,7 +2066,12 @@ void NetworkManager::OnConnect()
 {
     LOG_DBG() << "SM connected to CM, synchronizing network state";
 
-    auto instances = MakeUnique<StaticArray<InstanceNetworkStateInfo, cMaxNumInstances>>(&mAllocator);
+    auto instances = MakeUnique<StaticArray<InstanceNetworkStateInfo, cMaxNumInstances>>(mAllocator);
+    if (!instances) {
+        LOG_ERR() << "Failed to allocate instances sync state" << Log::Field(ErrorEnum::eNoMemory);
+
+        return;
+    }
 
     {
         LockGuard lock {mMutex};
@@ -1983,7 +2104,10 @@ Error NetworkManager::UpdateInstanceFirewall(const String& instanceID, const Str
     LOG_DBG() << "Updating instance firewall" << Log::Field("instanceID", instanceID)
               << Log::Field("networkID", networkID);
 
-    auto firewallParams = MakeUnique<InstanceFirewallParams>(&mAllocator);
+    auto firewallParams = MakeUnique<InstanceFirewallParams>(mAllocator);
+    if (!firewallParams) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = PrepareInstanceFirewallParams(networkConfig, networkParams, *firewallParams); !err.IsNone()) {
         return err;
diff --git a/src/core/sm/networkmanager/networkmanager.hpp b/src/core/sm/networkmanager/networkmanager.hpp
index eb58deb5e..9c31659b0 100644
--- a/src/core/sm/networkmanager/networkmanager.hpp
+++ b/src/core/sm/networkmanager/networkmanager.hpp
@@ -10,6 +10,7 @@
 #include <core/common/crypto/itf/rand.hpp>
 #include <core/common/tools/fs.hpp>
 #include <core/common/tools/map.hpp>
+#include <core/common/tools/memory.hpp>
 #include <core/common/tools/thread.hpp>
 
 #include <core/common/networkmanager/itf/networkprovider.hpp>
@@ -45,6 +46,7 @@ class NetworkManager : public NetworkManagerItf {
     /**
      * Initializes network manager.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param storage storage interface.
      * @param bridgeNet bridge network interface.
      * @param firewall firewall interface.
@@ -55,9 +57,9 @@ class NetworkManager : public NetworkManagerItf {
      * @param netIf network interface manager.
      * @return Error.
      */
-    Error Init(StorageItf& storage, BridgeNetworkItf& bridgeNet, FirewallItf& firewall, BandwidthItf& bandwidth,
-        DNSNameItf& dnsName, TrafficMonitorItf& netMonitor, NamespaceManagerItf& netns, InterfaceManagerItf& netIf,
-        crypto::RandomItf& random, InterfaceFactoryItf& netIfFactory,
+    Error Init(AllocatorItf& allocator, StorageItf& storage, BridgeNetworkItf& bridgeNet, FirewallItf& firewall,
+        BandwidthItf& bandwidth, DNSNameItf& dnsName, TrafficMonitorItf& netMonitor, NamespaceManagerItf& netns,
+        InterfaceManagerItf& netIf, crypto::RandomItf& random, InterfaceFactoryItf& netIfFactory,
         aos::networkmanager::NetworkProviderItf& networkProvider, const String& nodeID);
 
     /**
@@ -207,36 +209,6 @@ class NetworkManager : public NetworkManagerItf {
         BatchOp              mOp;
     };
 
-    // StartInstanceNetwork keeps its cached InstanceNetworkInfo alive across the nested call to
-    // AddInstanceToNetwork, which in turn allocates hosts, bridge/firewall/bandwidth/DNS params and
-    // its own InstanceNetworkInfo before returning. That is the largest concurrent footprint of any
-    // mAllocator call chain, so it sizes the per-concurrent-item budget below (it dominates the
-    // smaller CreateInstanceNetwork and OnPendingFirewallUpdate chains).
-    static constexpr auto cMaxOperationAllocatorSize = 2 * sizeof(InstanceNetworkInfo) + sizeof(InstanceHosts)
-        + sizeof(BridgeParams) + sizeof(InstanceFirewallParams) + sizeof(BandwidthParams) + sizeof(DNSAliasesParams);
-
-    // Start()/OnConnect() run once, outside the concurrent instance-operation hot path, so their
-    // allocations are added rather than multiplied by cMaxNumConcurrentItems: RemoveDNSOrphans' known
-    // networks list, RemoveFirewallOrphans' known instance and masquerade lists, ReconcileInstances'
-    // leftover entries (instance/network IDs plus host/bridge interface names, so four ID-sized strings
-    // per instance) plus, alive at the same time, either the InstanceNetworkInfo
-    // DeleteInstanceNetworkConfig allocates while clearing a host interface or the config and hosts
-    // InitInstance allocates while restoring the runtime cache, and OnConnect's state sync snapshot.
-    static constexpr auto cAllocatorSize = cMaxOperationAllocatorSize * cMaxNumConcurrentItems
-        + sizeof(StaticArray<StaticString<cIDLen>, cMaxNumOwners>)
-        + sizeof(StaticArray<StaticString<cIDLen>, cMaxNumInstances>) * 5
-        + sizeof(StaticArray<MasqueradeParams, cMaxNumOwners>) + sizeof(InstanceNetworkInfo)
-        + sizeof(InstanceNetworkConfig) + sizeof(InstanceHosts)
-        + sizeof(StaticArray<InstanceNetworkStateInfo, cMaxNumInstances>);
-    static constexpr auto cNumAllocations = 8 * cMaxNumConcurrentItems;
-
-    // GetHosts/GetResolvServers are const methods that instance start/stop pool tasks call
-    // concurrently (one call per in-flight instance), each making a single allocation off
-    // mResolvHostsAllocator that stays alive for the call's duration. Size it for
-    // cMaxNumConcurrentItems concurrent callers instead of just one.
-    static constexpr auto cResolvHostsAllocatorSize = cMaxNumConcurrentItems
-        * (sizeof(StaticArray<Host, cMaxNumHosts>) + sizeof(StaticArray<StaticString<cIPLen>, cMaxNumDNSServers>));
-
     static constexpr uint64_t cBurstLen              = 12800;
     static constexpr auto     cMaxExposedPort        = 2;
     static constexpr auto     cCountRetriesIfNameGen = 10;
@@ -303,31 +275,28 @@ class NetworkManager : public NetworkManagerItf {
         return ErrorEnum::eNotFound;
     }
 
-    StorageItf*                                                                            mStorage {};
-    BridgeNetworkItf*                                                                      mBridgeNetwork {};
-    FirewallItf*                                                                           mFirewall {};
-    BandwidthItf*                                                                          mBandwidth {};
-    DNSNameItf*                                                                            mDNSName {};
-    TrafficMonitorItf*                                                                     mNetMonitor {};
-    NamespaceManagerItf*                                                                   mNetns {};
-    InterfaceManagerItf*                                                                   mNetIf {};
-    crypto::RandomItf*                                                                     mRandom {};
-    InterfaceFactoryItf*                                                                   mNetIfFactory {};
-    aos::networkmanager::NetworkProviderItf*                                               mNetworkProvider {};
-    StaticString<cIDLen>                                                                   mNodeID;
-    NetworkCache                                                                           mRuntimeCache;
-    StaticMap<StaticString<cIDLen>, NetworkInfo, cMaxNumOwners>                            mNetworkProviders;
-    StaticMap<StaticString<cIDLen>, DNSServerItf*, cMaxNumOwners>                          mDNSServers;
-    StaticMap<StaticString<cIDLen>, InstanceNetworkInfo, cMaxNumInstances * cMaxNumOwners> mInstanceNetworkInfos;
-    StaticArray<StaticString<cIDLen>, cMaxNumOwners>                                       mPhysicalNetworks;
-    bool                                                                                   mBatchMode {false};
-    StaticArray<BatchEntry, cMaxNumInstances * cMaxNumOwners>                              mBatchEntries;
-    StaticAllocator<sizeof(StaticArray<NetworkInfo, cMaxNumOwners>)>                       mNetworkInfosAllocator;
-    StaticAllocator<sizeof(StaticArray<InstanceNetworkInfo, cMaxNumInstances>)> mInstanceNetworkInfosAllocator;
-
-    mutable Mutex                                                                  mMutex;
-    StaticAllocator<cAllocatorSize, cNumAllocations>                               mAllocator;
-    mutable StaticAllocator<cResolvHostsAllocatorSize, 2 * cMaxNumConcurrentItems> mResolvHostsAllocator;
+    StorageItf*                                                            mStorage {};
+    BridgeNetworkItf*                                                      mBridgeNetwork {};
+    FirewallItf*                                                           mFirewall {};
+    BandwidthItf*                                                          mBandwidth {};
+    DNSNameItf*                                                            mDNSName {};
+    TrafficMonitorItf*                                                     mNetMonitor {};
+    NamespaceManagerItf*                                                   mNetns {};
+    InterfaceManagerItf*                                                   mNetIf {};
+    crypto::RandomItf*                                                     mRandom {};
+    InterfaceFactoryItf*                                                   mNetIfFactory {};
+    aos::networkmanager::NetworkProviderItf*                               mNetworkProvider {};
+    StaticString<cIDLen>                                                   mNodeID;
+    NetworkCache                                                           mRuntimeCache;
+    StaticMap<StaticString<cIDLen>, NetworkInfo, cMaxNumOwners>            mNetworkProviders;
+    StaticMap<StaticString<cIDLen>, DNSServerItf*, cMaxNumOwners>          mDNSServers;
+    StaticMap<StaticString<cIDLen>, InstanceNetworkInfo, cMaxNumInstances> mInstanceNetworkInfos;
+    StaticArray<StaticString<cIDLen>, cMaxNumOwners>                       mPhysicalNetworks;
+    bool                                                                   mBatchMode {false};
+    StaticArray<BatchEntry, cMaxNumInstances>                              mBatchEntries;
+
+    mutable Mutex mMutex;
+    AllocatorItf* mAllocator {};
 };
 
 /** @}*/
diff --git a/src/core/sm/networkmanager/tests/networkmanager.cpp b/src/core/sm/networkmanager/tests/networkmanager.cpp
index 8432aaa45..8f19adee6 100644
--- a/src/core/sm/networkmanager/tests/networkmanager.cpp
+++ b/src/core/sm/networkmanager/tests/networkmanager.cpp
@@ -14,6 +14,7 @@
 
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tools/fs.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/sm/networkmanager/networkmanager.hpp>
 #include <core/sm/tests/mocks/storagemock.hpp>
 
@@ -72,8 +73,8 @@ class NetworkManagerTest : public Test {
         EXPECT_CALL(mStorage, GetInstanceNetworksInfo(_))
             .WillOnce(DoAll(SetArgReferee<0>(mInstanceNetworkInfos), Return(aos::ErrorEnum::eNone)));
 
-        ASSERT_EQ(mNetManager->Init(mStorage, mBridgeNetwork, mFirewall, mBandwidth, mDNSName, mTrafficMonitor, mNetns,
-                      mNetIf, mRandom, mNetIfFactory, mNetworkProvider, "test-node"),
+        ASSERT_EQ(mNetManager->Init(mAllocator, mStorage, mBridgeNetwork, mFirewall, mBandwidth, mDNSName,
+                      mTrafficMonitor, mNetns, mNetIf, mRandom, mNetIfFactory, mNetworkProvider, "test-node"),
             aos::ErrorEnum::eNone);
         ASSERT_EQ(mNetManager->Start(), aos::ErrorEnum::eNone);
     }
@@ -223,8 +224,8 @@ class NetworkManagerTest : public Test {
 
         mNetManager = std::make_unique<NetworkManager>();
 
-        ASSERT_EQ(mNetManager->Init(mStorage, mBridgeNetwork, mFirewall, mBandwidth, mDNSName, mTrafficMonitor, mNetns,
-                      mNetIf, mRandom, mNetIfFactory, mNetworkProvider, "test-node"),
+        ASSERT_EQ(mNetManager->Init(mAllocator, mStorage, mBridgeNetwork, mFirewall, mBandwidth, mDNSName,
+                      mTrafficMonitor, mNetns, mNetIf, mRandom, mNetIfFactory, mNetworkProvider, "test-node"),
             aos::ErrorEnum::eNone);
     }
 
@@ -266,8 +267,8 @@ class NetworkManagerTest : public Test {
 
         mNetManager = std::make_unique<NetworkManager>();
 
-        ASSERT_EQ(mNetManager->Init(mStorage, mBridgeNetwork, mFirewall, mBandwidth, mDNSName, mTrafficMonitor, mNetns,
-                      mNetIf, mRandom, mNetIfFactory, mNetworkProvider, "test-node"),
+        ASSERT_EQ(mNetManager->Init(mAllocator, mStorage, mBridgeNetwork, mFirewall, mBandwidth, mDNSName,
+                      mTrafficMonitor, mNetns, mNetIf, mRandom, mNetIfFactory, mNetworkProvider, "test-node"),
             aos::ErrorEnum::eNone);
     }
 
@@ -329,6 +330,10 @@ class NetworkManagerTest : public Test {
         EXPECT_CALL(mFirewall, RemoveInstance(_)).Times(times).WillRepeatedly(Return(aos::ErrorEnum::eNone));
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    aos::HeapAllocator mAllocator;
+
     StrictMock<StorageMock>                                                               mStorage;
     StrictMock<BridgeNetworkMock>                                                         mBridgeNetwork;
     StrictMock<FirewallMock>                                                              mFirewall;
@@ -1356,8 +1361,8 @@ TEST_F(NetworkManagerTest, InitWithExistingNetworks)
         .WillOnce(DoAll(SetArgReferee<0>(mInstanceNetworkInfos), Return(aos::ErrorEnum::eNone)));
 
     mNetManager = std::make_unique<NetworkManager>();
-    ASSERT_EQ(mNetManager->Init(mStorage, mBridgeNetwork, mFirewall, mBandwidth, mDNSName, mTrafficMonitor, mNetns,
-                  mNetIf, mRandom, mNetIfFactory, mNetworkProvider, "test-node"),
+    ASSERT_EQ(mNetManager->Init(mAllocator, mStorage, mBridgeNetwork, mFirewall, mBandwidth, mDNSName, mTrafficMonitor,
+                  mNetns, mNetIf, mRandom, mNetIfFactory, mNetworkProvider, "test-node"),
         aos::ErrorEnum::eNone);
 
     const aos::String instanceID      = "test-instance";
diff --git a/src/core/sm/nodeconfig/nodeconfig.cpp b/src/core/sm/nodeconfig/nodeconfig.cpp
index 3ad412b29..463da1c3a 100644
--- a/src/core/sm/nodeconfig/nodeconfig.cpp
+++ b/src/core/sm/nodeconfig/nodeconfig.cpp
@@ -16,10 +16,11 @@ namespace aos::sm::nodeconfig {
  * Public
  **********************************************************************************************************************/
 
-Error NodeConfig::Init(const Config& config, aos::nodeconfig::JSONProviderItf& jsonProvider)
+Error NodeConfig::Init(AllocatorItf& allocator, const Config& config, aos::nodeconfig::JSONProviderItf& jsonProvider)
 {
     LOG_DBG() << "Init node config";
 
+    mAllocator      = &allocator;
     mNodeConfigFile = config.mNodeConfigFile;
     mJSONProvider   = &jsonProvider;
 
@@ -66,7 +67,10 @@ Error NodeConfig::UpdateNodeConfig(const aos::NodeConfig& config)
 
     mNodeConfig = config;
 
-    auto nodeConfigJSON = MakeUnique<StaticString<aos::nodeconfig::cNodeConfigJSONLen>>(&mAllocator);
+    auto nodeConfigJSON = MakeUnique<StaticString<aos::nodeconfig::cNodeConfigJSONLen>>(mAllocator);
+    if (!nodeConfigJSON) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     if (auto err = mJSONProvider->NodeConfigToJSON(config, *nodeConfigJSON); !err.IsNone()) {
         return AOS_ERROR_WRAP(err);
@@ -145,7 +149,10 @@ Error NodeConfig::LoadConfig()
 {
     LOG_DBG() << "Load config";
 
-    auto nodeConfigJSON = MakeUnique<StaticString<aos::nodeconfig::cNodeConfigJSONLen>>(&mAllocator);
+    auto nodeConfigJSON = MakeUnique<StaticString<aos::nodeconfig::cNodeConfigJSONLen>>(mAllocator);
+    if (!nodeConfigJSON) {
+        return AOS_ERROR_WRAP(ErrorEnum::eNoMemory);
+    }
 
     auto err = fs::ReadFileToString(mNodeConfigFile, *nodeConfigJSON);
     if (!err.IsNone()) {
diff --git a/src/core/sm/nodeconfig/nodeconfig.hpp b/src/core/sm/nodeconfig/nodeconfig.hpp
index 15df9f89d..64475228d 100644
--- a/src/core/sm/nodeconfig/nodeconfig.hpp
+++ b/src/core/sm/nodeconfig/nodeconfig.hpp
@@ -9,7 +9,7 @@
 
 #include <core/common/nodeconfig/itf/jsonprovider.hpp>
 #include <core/common/nodeconfig/itf/nodeconfigprovider.hpp>
-#include <core/common/tools/allocator.hpp>
+#include <core/common/tools/memory.hpp>
 #include <core/common/tools/thread.hpp>
 
 #include "config.hpp"
@@ -29,11 +29,12 @@ class NodeConfig : public NodeConfigHandlerItf, public aos::nodeconfig::NodeConf
     /**
      * Initializes node config.
      *
+     * @param allocator allocator to use for temporary objects.
      * @param config node config configuration.
      * @param jsonProvider JSON provider.
      * @return Error.
      */
-    Error Init(const Config& config, aos::nodeconfig::JSONProviderItf& jsonProvider);
+    Error Init(AllocatorItf& allocator, const Config& config, aos::nodeconfig::JSONProviderItf& jsonProvider);
 
     /**
      * Checks node config.
@@ -85,7 +86,6 @@ class NodeConfig : public NodeConfigHandlerItf, public aos::nodeconfig::NodeConf
 
 private:
     static constexpr auto cMaxNumListeners = 4;
-    static constexpr auto cAllocatorSize   = sizeof(StaticString<aos::nodeconfig::cNodeConfigJSONLen>);
 
     Error LoadConfig();
     Error CheckVersion(const String& version);
@@ -97,7 +97,7 @@ class NodeConfig : public NodeConfigHandlerItf, public aos::nodeconfig::NodeConf
     Error                             mNodeConfigError;
     mutable Mutex                     mMutex;
     StaticArray<aos::nodeconfig::NodeConfigListenerItf*, cMaxNumListeners> mListeners;
-    StaticAllocator<cAllocatorSize>                                        mAllocator;
+    AllocatorItf*                                                          mAllocator {};
 };
 
 /** @}*/
diff --git a/src/core/sm/nodeconfig/tests/nodeconfig.cpp b/src/core/sm/nodeconfig/tests/nodeconfig.cpp
index d00bfc79a..099abc567 100644
--- a/src/core/sm/nodeconfig/tests/nodeconfig.cpp
+++ b/src/core/sm/nodeconfig/tests/nodeconfig.cpp
@@ -9,6 +9,7 @@
 
 #include <core/common/tests/utils/log.hpp>
 #include <core/common/tools/fs.hpp>
+#include <core/common/tools/heapallocator.hpp>
 #include <core/sm/nodeconfig/nodeconfig.hpp>
 
 #include "mocks/jsonprovidermock.hpp"
@@ -75,6 +76,10 @@ class NodeConfigTest : public Test {
         ASSERT_TRUE(err.IsNone()) << "Failed to create test config file";
     }
 
+    // mAllocator must be declared (and therefore destroyed) after any member that allocates from it, since
+    // members are destroyed in reverse declaration order.
+    HeapAllocator mAllocator;
+
     StrictMock<JSONProviderMock> mJSONProvider;
     NodeConfig                   mNodeConfig;
 };
@@ -89,7 +94,7 @@ TEST_F(NodeConfigTest, InitWithValidConfig)
 
     SetupValidNodeConfig();
 
-    auto err = mNodeConfig.Init({cTestConfigFile}, mJSONProvider);
+    auto err = mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider);
 
     EXPECT_TRUE(err.IsNone());
 }
@@ -100,14 +105,14 @@ TEST_F(NodeConfigTest, InitWithInvalidConfig)
 
     EXPECT_CALL(mJSONProvider, NodeConfigFromJSON(_, _)).WillOnce(Return(ErrorEnum::eInvalidArgument));
 
-    auto err = mNodeConfig.Init({cTestConfigFile}, mJSONProvider);
+    auto err = mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider);
 
     EXPECT_TRUE(err.IsNone());
 }
 
 TEST_F(NodeConfigTest, InitWithMissingConfigFile)
 {
-    auto err = mNodeConfig.Init({cTestConfigFile}, mJSONProvider);
+    auto err = mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider);
 
     EXPECT_TRUE(err.IsNone());
 
@@ -125,7 +130,7 @@ TEST_F(NodeConfigTest, GetNodeConfigStatusValid)
 
     SetupValidNodeConfig();
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     NodeConfigStatus status;
     auto             err = mNodeConfig.GetNodeConfigStatus(status);
@@ -142,7 +147,7 @@ TEST_F(NodeConfigTest, GetNodeConfigStatusWithError)
 
     EXPECT_CALL(mJSONProvider, NodeConfigFromJSON(_, _)).WillOnce(Return(ErrorEnum::eInvalidArgument));
 
-    auto err = mNodeConfig.Init({cTestConfigFile}, mJSONProvider);
+    auto err = mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider);
 
     EXPECT_TRUE(err.IsNone());
 
@@ -160,7 +165,7 @@ TEST_F(NodeConfigTest, GetNodeConfig)
 
     SetupValidNodeConfig();
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     aos::NodeConfig config;
     auto            err = mNodeConfig.GetNodeConfig(config);
@@ -177,7 +182,7 @@ TEST_F(NodeConfigTest, CheckNodeConfigValidVersion)
 
     SetupValidNodeConfig();
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     auto newConfig = CreateTestNodeConfig("2.0.0");
 
@@ -191,7 +196,7 @@ TEST_F(NodeConfigTest, CheckNodeConfigSameVersion)
 
     SetupValidNodeConfig();
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     auto sameVersionConfig = CreateTestNodeConfig("1.0.0");
 
@@ -205,7 +210,7 @@ TEST_F(NodeConfigTest, CheckNodeConfigLowerVersion)
 
     SetupValidNodeConfig();
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     auto lowerVersionConfig = CreateTestNodeConfig("0.9.0");
 
@@ -219,7 +224,7 @@ TEST_F(NodeConfigTest, CheckNodeConfigWithFailedState)
 
     EXPECT_CALL(mJSONProvider, NodeConfigFromJSON(_, _)).WillOnce(Return(ErrorEnum::eInvalidArgument));
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     auto newConfig = CreateTestNodeConfig("2.0.0");
 
@@ -233,7 +238,7 @@ TEST_F(NodeConfigTest, UpdateNodeConfigSuccess)
 
     SetupValidNodeConfig();
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     auto newConfig = CreateTestNodeConfig("2.0.0");
 
@@ -255,7 +260,7 @@ TEST_F(NodeConfigTest, UpdateNodeConfigSameVersion)
 
     SetupValidNodeConfig();
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     auto sameVersionConfig = CreateTestNodeConfig("1.0.0");
 
@@ -265,7 +270,7 @@ TEST_F(NodeConfigTest, UpdateNodeConfigSameVersion)
 
 TEST_F(NodeConfigTest, UpdateNodeConfigFromAbsentState)
 {
-    auto err = mNodeConfig.Init({cTestConfigFile}, mJSONProvider);
+    auto err = mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider);
     EXPECT_TRUE(err.IsNone());
 
     auto newConfig = CreateTestNodeConfig("1.0.0");
@@ -289,7 +294,7 @@ TEST_F(NodeConfigTest, SubscribeAndNotifyListener)
 
     SetupValidNodeConfig();
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     class TestListener : public aos::nodeconfig::NodeConfigListenerItf {
     public:
@@ -325,7 +330,7 @@ TEST_F(NodeConfigTest, UnsubscribeListener)
 
     SetupValidNodeConfig();
 
-    ASSERT_TRUE(mNodeConfig.Init({cTestConfigFile}, mJSONProvider).IsNone());
+    ASSERT_TRUE(mNodeConfig.Init(mAllocator, {cTestConfigFile}, mJSONProvider).IsNone());
 
     class TestListener : public aos::nodeconfig::NodeConfigListenerItf {
     public:
diff --git a/suppressions.txt b/suppressions.txt
index 414b63dcb..6caa8cea2 100644
--- a/suppressions.txt
+++ b/suppressions.txt
@@ -3,4 +3,3 @@ unusedFunction
 missingIncludeSystem
 unusedScopedObject
 syntaxError
-templateRecursion