diff --git a/.github/workflows/clp-artifact-build.yaml b/.github/workflows/clp-artifact-build.yaml
index 235be7765..efe6894dc 100644
--- a/.github/workflows/clp-artifact-build.yaml
+++ b/.github/workflows/clp-artifact-build.yaml
@@ -34,12 +34,8 @@ concurrency:
 jobs:
   filter-relevant-changes:
     name: "filter-relevant-changes"
-    runs-on: &runner >-
-      ${{
-        github.repository_owner == 'y-scope'
-        && fromJSON('["self-hosted", "x64", "ubuntu-noble"]')
-        || 'ubuntu-24.04'
-      }}
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     outputs:
       centos_stream_9_image_changed: "${{steps.filter.outputs.centos_stream_9_image}}"
       manylinux_2_28_image_changed: "${{steps.filter.outputs.manylinux_2_28_image}}"
@@ -118,7 +114,8 @@ jobs:
     name: "centos-stream-9-deps-image"
     if: "needs.filter-relevant-changes.outputs.centos_stream_9_image_changed == 'true'"
     needs: "filter-relevant-changes"
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -149,9 +146,11 @@ jobs:
       matrix:
         include:
           - arch: "amd64"
-            runner: *runner
+            runner: >-
+              ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
           - arch: "arm64"
-            runner: "ubuntu-24.04-arm"
+            runner: >-
+              ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_ARM64 || '["ubuntu-24.04-arm"]') }}
     runs-on: "${{matrix.runner}}"
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
@@ -187,7 +186,8 @@ jobs:
       && needs.manylinux_2_28-deps-image.result == 'success'
     needs:
       - "manylinux_2_28-deps-image"
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - name: "Login to Image Registry"
         uses: "docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121"  # v4.1.0
@@ -224,7 +224,8 @@ jobs:
       && needs.musllinux_1_2-deps-image.result == 'success'
     needs:
       - "musllinux_1_2-deps-image"
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - name: "Login to Image Registry"
         uses: "docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121"  # v4.1.0
@@ -258,9 +259,11 @@ jobs:
       matrix:
         include:
           - arch: "amd64"
-            runner: *runner
+            runner: >-
+              ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
           - arch: "arm64"
-            runner: "ubuntu-24.04-arm"
+            runner: >-
+              ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_ARM64 || '["ubuntu-24.04-arm"]') }}
     runs-on: "${{matrix.runner}}"
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
@@ -288,7 +291,8 @@ jobs:
     name: "ubuntu-jammy-x86_64-deps-image"
     if: "needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'true'"
     needs: "filter-relevant-changes"
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -317,7 +321,8 @@ jobs:
       && github.event_name != 'pull_request'
       && github.ref == 'refs/heads/main'
     needs: "filter-relevant-changes"
-    runs-on: "ubuntu-24.04-arm"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_ARM64 || '["ubuntu-24.04-arm"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -352,7 +357,8 @@ jobs:
         use_shared_libs: [true, false]
     name: "centos-stream-9-${{matrix.use_shared_libs == true && 'dynamic' || 'static'}}-linked-bins"
     continue-on-error: true
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -396,7 +402,8 @@ jobs:
     name: >-
       manylinux_2_28-x86_64-${{matrix.use_shared_libs == true && 'dynamic' || 'static'}}-linked-bins
     continue-on-error: true
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -439,7 +446,8 @@ jobs:
       OS_NAME: "manylinux_2_28"
     name: "manylinux_2_28-x86_64-python-wheels"
     continue-on-error: true
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -497,7 +505,8 @@ jobs:
     name: >-
       musllinux_1_2-x86_64-${{matrix.use_shared_libs == true && 'dynamic' || 'static'}}-linked-bins
     continue-on-error: true
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -543,7 +552,8 @@ jobs:
       OS_NAME: "ubuntu-jammy"
     name: "ubuntu-jammy-${{matrix.use_shared_libs == true && 'dynamic' || 'static'}}-linked-bins"
     continue-on-error: true
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -590,7 +600,8 @@ jobs:
     # Run if the ancestor jobs were successful/skipped and building clp was successful.
     if: "!cancelled() && !failure() && needs.ubuntu-jammy-binaries.result == 'success'"
     needs: "ubuntu-jammy-binaries"
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     env:
       OS_NAME: "ubuntu-jammy"
       TMP_OUTPUT_DIR: "/tmp"
@@ -657,7 +668,8 @@ jobs:
     needs:
       - "filter-relevant-changes"
       - "ubuntu-jammy-x86_64-deps-image"
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -724,36 +736,64 @@ jobs:
               'build/lint-clang-tidy/**/*'
             )}}
 
-  package-image:
-    name: "package-image-${{matrix.arch}}"
-    # NOTE: The aarch64 job is skipped on PRs, so we accept both 'success' and 'skipped'.
+  package-image-amd64:
+    name: "package-image-amd64"
     if: >-
       !cancelled() && !failure() && (
-        needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'false' ||
-        (needs.ubuntu-jammy-x86_64-deps-image.result == 'success'
-        && (needs.ubuntu-jammy-aarch64-deps-image.result == 'success'
-        || needs.ubuntu-jammy-aarch64-deps-image.result == 'skipped'))
+        needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'false'
+        || needs.ubuntu-jammy-x86_64-deps-image.result == 'success'
       )
     needs:
       - "filter-relevant-changes"
       - "ubuntu-jammy-x86_64-deps-image"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        with:
+          submodules: "recursive"
+
+      - name: "Workaround actions/runner-images/issues/6775"
+        shell: "bash"
+        run: "chown $(id -u):$(id -g) -R ."
+
+      - name: "Build the package without the package image"
+        uses: "./.github/actions/run-on-image"
+        env:
+          OS_NAME: "ubuntu-jammy"
+        with:
+          image_name: "${{format('{0}ubuntu-jammy', env.DEPS_IMAGE_NAME_PREFIX_X86)}}"
+          use_published_image: >-
+            ${{needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'false'
+            || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')}}
+          run_command: >-
+            CLP_CPP_MAX_PARALLELISM_PER_BUILD_TASK=$(getconf _NPROCESSORS_ONLN)
+            HOME=/tmp
+            task package-build-deps
+
+      - uses: "./.github/actions/clp-build-runtime-image"
+        with:
+          image_registry: "ghcr.io"
+          image_registry_username: "${{github.actor}}"
+          image_registry_password: "${{secrets.GITHUB_TOKEN}}"
+          arch: "amd64"
+          platform_version_codename: "jammy"
+
+  package-image-arm64:
+    name: "package-image-arm64"
+    # Only build arm64 images on push to main to save CI resources on PRs.
+    if: >-
+      !cancelled() && !failure()
+      && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+      && (
+        needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'false'
+        || needs.ubuntu-jammy-aarch64-deps-image.result == 'success'
+      )
+    needs:
+      - "filter-relevant-changes"
       - "ubuntu-jammy-aarch64-deps-image"
-    strategy:
-      matrix:
-        # Only build arm64 images on push to main to save CI resources on PRs.
-        arch: >-
-          ${{github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
-          && fromJSON('["amd64", "arm64"]') || fromJSON('["amd64"]')}}
     runs-on: >-
-      ${{
-        matrix.arch == 'amd64'
-        && (github.repository_owner == 'y-scope'
-            && fromJSON('["self-hosted", "x64", "ubuntu-noble"]')
-            || 'ubuntu-24.04')
-        || (github.repository_owner == 'y-scope'
-            && fromJSON('["self-hosted", "arm64", "ubuntu-noble"]')
-            || 'ubuntu-24.04-arm')
-      }}
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_ARM64 || '["ubuntu-24.04-arm"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -768,10 +808,7 @@ jobs:
         env:
           OS_NAME: "ubuntu-jammy"
         with:
-          image_name: >-
-            ${{format('{0}ubuntu-jammy',
-            matrix.arch == 'amd64' && env.DEPS_IMAGE_NAME_PREFIX_X86
-            || env.DEPS_IMAGE_NAME_PREFIX_AARCH64)}}
+          image_name: "${{format('{0}ubuntu-jammy', env.DEPS_IMAGE_NAME_PREFIX_AARCH64)}}"
           use_published_image: >-
             ${{needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'false'
             || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')}}
@@ -785,7 +822,7 @@ jobs:
           image_registry: "ghcr.io"
           image_registry_username: "${{github.actor}}"
           image_registry_password: "${{secrets.GITHUB_TOKEN}}"
-          arch: "${{matrix.arch}}"
+          arch: "arm64"
           platform_version_codename: "jammy"
 
   package-image-multiarch-manifest:
@@ -793,9 +830,13 @@ jobs:
     if: >-
       github.event_name != 'pull_request'
       && github.ref == 'refs/heads/main'
-      && needs.package-image.result == 'success'
-    needs: "package-image"
-    runs-on: *runner
+      && needs.package-image-amd64.result == 'success'
+      && needs.package-image-arm64.result == 'success'
+    needs:
+      - "package-image-amd64"
+      - "package-image-arm64"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - name: "Login to Image Registry"
         uses: "docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121"  # v4.1.0
@@ -837,7 +878,8 @@ jobs:
     needs:
       - "filter-relevant-changes"
       - "ubuntu-jammy-x86_64-deps-image"
-    runs-on: *runner
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     permissions:
       # To check out the repository.
       contents: "read"
diff --git a/.github/workflows/clp-core-build-macos.yaml b/.github/workflows/clp-core-build-macos.yaml
index f098c20b4..0ebb9842a 100644
--- a/.github/workflows/clp-core-build-macos.yaml
+++ b/.github/workflows/clp-core-build-macos.yaml
@@ -32,6 +32,7 @@ concurrency:
 jobs:
   build-macos:
     name: "build-macos"
+    if: "vars.GH_DISABLE_MACOS != 'true'"
     strategy:
       matrix:
         os:
diff --git a/.github/workflows/clp-docs-generated-code-checks.yaml b/.github/workflows/clp-docs-generated-code-checks.yaml
index 43cb3ab68..3d160a2cb 100644
--- a/.github/workflows/clp-docs-generated-code-checks.yaml
+++ b/.github/workflows/clp-docs-generated-code-checks.yaml
@@ -12,8 +12,9 @@ concurrency:
 
 jobs:
   check-generated:
-    # Runs only on Ubuntu Jammy (22.04) since the Rust components are only built on this platform.
-    runs-on: "ubuntu-22.04"
+    # CPU-bound (cargo build --release codegen), so uses GH_RUNNER_LINUX_HEAVY_X64.
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_HEAVY_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
diff --git a/.github/workflows/clp-docs-macos.yaml b/.github/workflows/clp-docs-macos.yaml
new file mode 100644
index 000000000..231939dd5
--- /dev/null
+++ b/.github/workflows/clp-docs-macos.yaml
@@ -0,0 +1,41 @@
+name: "clp-docs-macos"
+
+on:
+  pull_request:
+  push:
+  schedule:
+    # Run daily at 00:15 UTC (the 15 is to avoid periods of high load)
+    - cron: "15 0 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: "${{github.workflow}}-${{github.ref}}"
+  # Cancel in-progress jobs for efficiency
+  cancel-in-progress: true
+
+jobs:
+  build-macos:
+    if: "vars.GH_DISABLE_MACOS != 'true'"
+    name: "build-macos"
+    runs-on: "macos-15"
+    permissions:
+      # To check out the repository.
+      contents: "read"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        with:
+          persist-credentials: false
+          lfs: "true"
+          submodules: "recursive"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-python"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-go-task"
+        with:
+          version: "3.48.0"
+
+      - name: "Build docs"
+        shell: "bash"
+        run: "task docs:site"
diff --git a/.github/workflows/clp-docs.yaml b/.github/workflows/clp-docs.yaml
index e9c80eba1..8fef11318 100644
--- a/.github/workflows/clp-docs.yaml
+++ b/.github/workflows/clp-docs.yaml
@@ -16,12 +16,8 @@ concurrency:
 jobs:
   build:
     name: "build"
-    strategy:
-      matrix:
-        os:
-          - "macos-15"
-          - "ubuntu-24.04"
-    runs-on: "${{matrix.os}}"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -42,7 +38,6 @@ jobs:
       - if: >-
           contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name)
           && ('refs/heads/main' == github.ref || startsWith(github.ref, 'refs/tags/v'))
-          && 'ubuntu-24.04' == matrix.os
         uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
         with:
           name: "docs-html"
diff --git a/.github/workflows/clp-lint-macos.yaml b/.github/workflows/clp-lint-macos.yaml
new file mode 100644
index 000000000..86392d385
--- /dev/null
+++ b/.github/workflows/clp-lint-macos.yaml
@@ -0,0 +1,63 @@
+name: "clp-lint-macos"
+
+on:
+  pull_request:
+  push:
+  schedule:
+    # Run daily at 00:15 UTC (the 15 is to avoid periods of high load)
+    - cron: "15 0 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: "${{github.workflow}}-${{github.ref}}"
+  # Cancel in-progress jobs for efficiency
+  cancel-in-progress: true
+
+jobs:
+  lint-check-macos:
+    if: "vars.GH_DISABLE_MACOS != 'true'"
+    name: "lint-check-macos"
+    runs-on: "macos-15"
+    permissions:
+      # To check out the repository.
+      contents: "read"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        with:
+          persist-credentials: false
+          submodules: "recursive"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-python"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-go-task"
+        with:
+          version: "3.48.0"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-uv"
+        with:
+          version: "0.8"
+
+      # This is a necessary dependency for the Python mariadb package which is a transitive
+      # dependency of `lint:py-check`.
+      - name: "Install MariaDB Connector/C"
+        shell: "bash"
+        run: |-
+          brew update
+          brew install mariadb-connector-c
+          PREFIX="$(brew --prefix mariadb-connector-c)"
+          MARIADB_CONFIG_PATH="$PREFIX/bin/mariadb_config"
+          echo "MARIADB_CONFIG=$MARIADB_CONFIG_PATH" >> "$GITHUB_ENV"
+
+      - name: "Lint .js files"
+        shell: "bash"
+        run: "task lint:check-js"
+
+      - name: "Lint .py files"
+        shell: "bash"
+        run: "task lint:check-py"
+
+      - name: "Lint .yaml files"
+        shell: "bash"
+        run: "task lint:check-yaml"
diff --git a/.github/workflows/clp-lint.yaml b/.github/workflows/clp-lint.yaml
index eebd6821a..5e6e3a5e4 100644
--- a/.github/workflows/clp-lint.yaml
+++ b/.github/workflows/clp-lint.yaml
@@ -16,12 +16,8 @@ concurrency:
 jobs:
   lint-check:
     name: "lint-check"
-    strategy:
-      matrix:
-        os:
-          - "macos-15"
-          - "ubuntu-24.04"
-    runs-on: "${{matrix.os}}"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -42,23 +38,9 @@ jobs:
       - name: "Install MariaDB Connector/C"
         shell: "bash"
         run: |-
-          case "${{ matrix.os }}" in
-            ubuntu-24.04)
-              sudo apt-get update
-              sudo apt-get install -y libmariadb-dev
-              MARIADB_CONFIG_PATH="$(command -v mariadb_config)"
-              ;;
-            macos-15)
-              brew update
-              brew install mariadb-connector-c
-              PREFIX="$(brew --prefix mariadb-connector-c)"
-              MARIADB_CONFIG_PATH="$PREFIX/bin/mariadb_config"
-              ;;
-            *)
-              # Control flow should not reach here
-              exit 1
-              ;;
-          esac
+          sudo apt-get update
+          sudo apt-get install -y libmariadb-dev
+          MARIADB_CONFIG_PATH="$(command -v mariadb_config)"
           echo "MARIADB_CONFIG=$MARIADB_CONFIG_PATH" >> "$GITHUB_ENV"
 
       - name: "Lint .js files"
diff --git a/.github/workflows/clp-package-helm.yaml b/.github/workflows/clp-package-helm.yaml
index e6b08daa1..6494fa816 100644
--- a/.github/workflows/clp-package-helm.yaml
+++ b/.github/workflows/clp-package-helm.yaml
@@ -22,7 +22,8 @@ concurrency:
 
 jobs:
   lint:
-    runs-on: "ubuntu-24.04"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -46,7 +47,8 @@ jobs:
       github.event_name != 'pull_request'
       && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/v'))
     needs: "lint"
-    runs-on: "ubuntu-24.04"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_X64 || '["ubuntu-24.04"]') }}
     permissions:
       # To push to the `gh-pages` branch.
       contents: "write"
diff --git a/.github/workflows/clp-pr-title-checks.yaml b/.github/workflows/clp-pr-title-checks.yaml
index 6aed037a9..bf1c2f8f8 100644
--- a/.github/workflows/clp-pr-title-checks.yaml
+++ b/.github/workflows/clp-pr-title-checks.yaml
@@ -24,7 +24,8 @@ jobs:
     permissions:
       # For amannn/action-semantic-pull-request
       pull-requests: "read"
-    runs-on: "ubuntu-24.04"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017"
         env:
diff --git a/.github/workflows/clp-rust-checks.yaml b/.github/workflows/clp-rust-checks.yaml
index f37315a1a..f0c4942ba 100644
--- a/.github/workflows/clp-rust-checks.yaml
+++ b/.github/workflows/clp-rust-checks.yaml
@@ -28,7 +28,10 @@ concurrency:
 
 jobs:
   rust-checks:
-    runs-on: "ubuntu-22.04"
+    # Stays on GH_RUNNER_LINUX_LIGHT_X64: tests:rust-all uses LocalStack on
+    # 127.0.0.1, broken on self-hosted.
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
diff --git a/.github/workflows/clp-s-generated-code-checks-macos.yaml b/.github/workflows/clp-s-generated-code-checks-macos.yaml
new file mode 100644
index 000000000..81451870f
--- /dev/null
+++ b/.github/workflows/clp-s-generated-code-checks-macos.yaml
@@ -0,0 +1,55 @@
+name: "clp-s-generated-code-checks-macos"
+
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: "${{github.workflow}}-${{github.ref}}"
+  # Cancel in-progress jobs for efficiency
+  cancel-in-progress: true
+
+jobs:
+  antlr-code-committed-macos:
+    if: "vars.GH_DISABLE_MACOS != 'true'"
+    name: "antlr-code-committed-macos"
+    runs-on: "macos-15"
+    permissions:
+      # To check out the repository.
+      contents: "read"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        with:
+          persist-credentials: false
+          submodules: "recursive"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-java"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-go-task"
+        with:
+          version: "3.48.0"
+
+      - name: "Generate parsers"
+        shell: "bash"
+        run: "task codegen:clp-s-generate-parsers"
+
+      - name: "Check if the generated parsers are the latest"
+        shell: "bash"
+        run: |-
+          generated_paths=(
+            components/core/src/clp_s/search/kql/generated
+            components/core/src/clp_s/search/sql/generated
+          )
+          stale_files="$(git status --porcelain "${generated_paths[@]}")"
+          if [[ -n "${stale_files}" ]]; then
+            echo >&2 "ERROR: The following generated files are out of date:"
+            echo >&2 "${stale_files}"
+            echo >&2 ""
+            echo >&2 "Please run 'task codegen:clp-s-generate-parsers' locally and commit the" \
+              "updated files."
+            git diff >&2 "${generated_paths[@]}"
+            exit 1
+          fi
diff --git a/.github/workflows/clp-s-generated-code-checks.yaml b/.github/workflows/clp-s-generated-code-checks.yaml
index e921ab049..42c6429dd 100644
--- a/.github/workflows/clp-s-generated-code-checks.yaml
+++ b/.github/workflows/clp-s-generated-code-checks.yaml
@@ -13,12 +13,8 @@ concurrency:
 jobs:
   antlr-code-committed:
     name: "antlr-code-committed"
-    strategy:
-      matrix:
-        os:
-          - "macos-15"
-          - "ubuntu-24.04"
-    runs-on: "${{matrix.os}}"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
diff --git a/.github/workflows/clp-uv-checks-macos.yaml b/.github/workflows/clp-uv-checks-macos.yaml
new file mode 100644
index 000000000..14803b962
--- /dev/null
+++ b/.github/workflows/clp-uv-checks-macos.yaml
@@ -0,0 +1,59 @@
+name: "clp-uv-checks-macos"
+
+on:
+  pull_request:
+    paths: &monitored_paths
+      - ".github/workflows/clp-uv-checks-macos.yaml"
+      - "taskfile.yaml"
+      - "taskfiles/**"
+      - "tools/yscope-dev-utils"
+      - "components/clp-mcp-server/pyproject.toml"
+      - "components/clp-mcp-server/uv.lock"
+      - "components/clp-package-utils/pyproject.toml"
+      - "components/clp-package-utils/uv.lock"
+      - "components/clp-py-utils/pyproject.toml"
+      - "components/clp-py-utils/uv.lock"
+      - "components/job-orchestration/pyproject.toml"
+      - "components/job-orchestration/uv.lock"
+      - "integration-tests/pyproject.toml"
+      - "integration-tests/uv.lock"
+      - "python-wheels/yscope-clp-core/pyproject.toml"
+      - "python-wheels/yscope-clp-core/uv.lock"
+  push:
+    paths: *monitored_paths
+  schedule:
+    # Run daily at 00:15 UTC (the 15 is to avoid periods of high load)
+    - cron: "15 0 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: "${{github.workflow}}-${{github.ref}}"
+  # Cancel in-progress jobs for efficiency
+  cancel-in-progress: true
+
+jobs:
+  uv-checks-macos:
+    if: "vars.GH_DISABLE_MACOS != 'true'"
+    runs-on: "macos-15"
+    permissions:
+      # To check out the repository.
+      contents: "read"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        with:
+          persist-credentials: false
+          submodules: "recursive"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-go-task"
+        with:
+          version: "3.48.0"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-uv"
+        with:
+          version: "0.8"
+
+      - name: "Validate lock files"
+        shell: "bash"
+        run: "task deps:lock:check-uv"
diff --git a/.github/workflows/clp-uv-checks.yaml b/.github/workflows/clp-uv-checks.yaml
index 498f9239f..2f9f60826 100644
--- a/.github/workflows/clp-uv-checks.yaml
+++ b/.github/workflows/clp-uv-checks.yaml
@@ -33,13 +33,8 @@ concurrency:
 
 jobs:
   uv-checks:
-    strategy:
-      matrix:
-        os:
-          - "macos-15"
-          - "ubuntu-22.04"
-          - "ubuntu-24.04"
-    runs-on: "${{matrix.os}}"
+    runs-on: >-
+      ${{ fromJSON(vars.GH_RUNNER_LINUX_LIGHT_X64 || '["ubuntu-24.04"]') }}
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with: