diff --git a/.devcontainer/cuda12.9-conda/devcontainer.json b/.devcontainer/cuda12.9-conda/devcontainer.json
index 4df9d429..218ac598 100644
--- a/.devcontainer/cuda12.9-conda/devcontainer.json
+++ b/.devcontainer/cuda12.9-conda/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "12.9",
       "PYTHON_PACKAGE_MANAGER": "conda",
       "BASE": "rapidsai/devcontainers:26.08-cpp-mambaforge"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.08-cuda12.9-conda"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.devcontainer/cuda12.9-pip/devcontainer.json b/.devcontainer/cuda12.9-pip/devcontainer.json
index af8eecdf..39974d24 100644
--- a/.devcontainer/cuda12.9-pip/devcontainer.json
+++ b/.devcontainer/cuda12.9-pip/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "12.9",
       "PYTHON_PACKAGE_MANAGER": "pip",
       "BASE": "rapidsai/devcontainers:26.08-cpp-cuda12.9-ucx1.19.0-openmpi5.0.10"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.08-cuda12.9-pip"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.devcontainer/cuda13.0-conda/devcontainer.json b/.devcontainer/cuda13.0-conda/devcontainer.json
deleted file mode 100644
index eae63e47..00000000
--- a/.devcontainer/cuda13.0-conda/devcontainer.json
+++ /dev/null
@@ -1,112 +0,0 @@
-{
-  "build": {
-    "context": "${localWorkspaceFolder}/.devcontainer",
-    "dockerfile": "${localWorkspaceFolder}/.devcontainer/rapids.Dockerfile",
-    "args": {
-      "CUDA": "13.0",
-      "PYTHON_PACKAGE_MANAGER": "conda",
-      "BASE": "rapidsai/devcontainers:26.08-cpp-mambaforge"
-    }
-  },
-  "runArgs": [
-    "--rm",
-    "--name",
-    "${localEnv:USER:anon}-rapids-${localWorkspaceFolderBasename}-26.08-cuda13.0-conda",
-    "--ulimit",
-    "nofile=500000"
-  ],
-  "containerEnv": {"PYTHON_VERSION": "3.13"},
-  "hostRequirements": {"gpu": "optional"},
-  "features": {
-    "./features/src/cuda": {
-      "version": "13.0",
-      "installCompilers": false,
-      "installProfilers": true,
-      "installCTKLibraries": false,
-      "installDevPackages": false,
-      "installcuDNN": false,
-      "installcuTensor": false,
-      "installNCCL": false,
-      "installCUDARuntime": false,
-      "installNVRTC": false,
-      "installOpenCL": false,
-      "installcuBLAS": false,
-      "installcuSPARSE": false,
-      "installcuFFT": false,
-      "installcuFile": false,
-      "installcuRAND": false,
-      "installcuSOLVER": false,
-      "installNPP": false,
-      "installnvJPEG": false,
-      "pruneStaticLibs": true
-    },
-    "./features/src/utils": {},
-    "./features/src/rapids-build-utils": {}
-  },
-  "overrideFeatureInstallOrder": [
-    "./features/src/cuda",
-    "./features/src/utils",
-    "./features/src/rapids-build-utils"
-  ],
-  "initializeCommand": ["/bin/bash", "-c", "mkdir -m 0755 -p ${localWorkspaceFolder}/../.{aws,cache,config,conda/pkgs,conda/${localWorkspaceFolderBasename}-cuda13.0-envs,log/devcontainer-utils} ${localWorkspaceFolder}/../{rmm,dask-cuda,kvikio,ucxx,cudf,rapidsmpf,raft,cuvs,cuml,nvforest,cugraph,cugraph-gnn,nx-cugraph,cuopt}"],
-  "postAttachCommand": ["/bin/bash", "-c", "if [ ${CODESPACES:-false} = 'true' ]; then . devcontainer-utils-post-attach-command; fi"],
-  "workspaceFolder": "/home/coder",
-  "workspaceMount": "source=${localWorkspaceFolder},target=/home/coder/devcontainers,type=bind,consistency=consistent",
-  "mounts": [
-    "source=/etc/timezone,target=/etc/timezone,type=bind,consistency=consistent",
-    "source=/etc/localtime,target=/etc/localtime,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../rmm,target=/home/coder/rmm,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../dask-cuda,target=/home/coder/dask-cuda,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../kvikio,target=/home/coder/kvikio,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../ucxx,target=/home/coder/ucxx,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cudf,target=/home/coder/cudf,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../rapidsmpf,target=/home/coder/rapidsmpf,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../raft,target=/home/coder/raft,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cuvs,target=/home/coder/cuvs,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cuml,target=/home/coder/cuml,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../nvforest,target=/home/coder/nvforest,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cugraph,target=/home/coder/cugraph,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cugraph-gnn,target=/home/coder/cugraph-gnn,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../nx-cugraph,target=/home/coder/nx-cugraph,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cuopt,target=/home/coder/cuopt,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.aws,target=/home/coder/.aws,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.cache,target=/home/coder/.cache,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.config,target=/home/coder/.config,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.conda/pkgs,target=/home/coder/.conda/pkgs,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.conda/${localWorkspaceFolderBasename}-cuda13.0-envs,target=/home/coder/.conda/envs,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.log/devcontainer-utils,target=/var/log/devcontainer-utils,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/.devcontainer/cuda13.0-conda/features/src/utils/opt/devcontainer/bin,target=/opt/devcontainer/bin,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/.devcontainer/cuda13.0-conda/features/src/rapids-build-utils/opt/rapids-build-utils,target=/opt/rapids-build-utils,type=bind,consistency=consistent"
-  ],
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "augustocdias.tasks-shell-input",
-        "ms-python.flake8",
-        "nvidia.nsight-vscode-edition"
-      ],
-      "settings": {
-        "files.watcherExclude": {
-          "**/build/**": true,
-          "**/_skbuild/**": true,
-          "**/target/**": true,
-          "/home/coder/.aws/**/*": true,
-          "/home/coder/.cache/**/*": true,
-          "/home/coder/.conda/**/*": true,
-          "/home/coder/.local/share/**/*": true,
-          "/home/coder/.vscode-server/**/*": true
-        },
-        "search.exclude": {
-          "**/build/**": true,
-          "**/_skbuild/**": true,
-          "**/*.code-search": true,
-          "/home/coder/.aws/**/*": true,
-          "/home/coder/.cache/**/*": true,
-          "/home/coder/.conda/**/*": true,
-          "/home/coder/.local/share/**/*": true,
-          "/home/coder/.vscode-server/**/*": true
-        }
-      }
-    }
-  }
-}
diff --git a/.devcontainer/cuda13.0-conda/features b/.devcontainer/cuda13.0-conda/features
deleted file mode 120000
index c9012f29..00000000
--- a/.devcontainer/cuda13.0-conda/features
+++ /dev/null
@@ -1 +0,0 @@
-../../features
\ No newline at end of file
diff --git a/.devcontainer/cuda13.0-pip/devcontainer.json b/.devcontainer/cuda13.0-pip/devcontainer.json
deleted file mode 100644
index 9810995c..00000000
--- a/.devcontainer/cuda13.0-pip/devcontainer.json
+++ /dev/null
@@ -1,99 +0,0 @@
-{
-  "build": {
-    "context": "${localWorkspaceFolder}/.devcontainer",
-    "dockerfile": "${localWorkspaceFolder}/.devcontainer/rapids.Dockerfile",
-    "args": {
-      "CUDA": "13.0",
-      "PYTHON_PACKAGE_MANAGER": "pip",
-      "BASE": "rapidsai/devcontainers:26.08-cpp-cuda13.0-ucx1.19.0-openmpi5.0.10"
-    }
-  },
-  "runArgs": [
-    "--rm",
-    "--name",
-    "${localEnv:USER:anon}-rapids-${localWorkspaceFolderBasename}-26.08-cuda13.0-pip",
-    "--ulimit",
-    "nofile=500000"
-  ],
-  "hostRequirements": {"gpu": "optional"},
-  "features": {
-    "./features/src/cuda": {
-      "version": "13.0",
-      "cuDNNVersion": "9",
-      "installcuBLAS": true,
-      "installcuDNN": true,
-      "installcuDSS": true,
-      "installcuSOLVER": true,
-      "installcuRAND": true,
-      "installcuSPARSE": true,
-      "installProfilers": true
-    },
-    "./features/src/utils": {},
-    "./features/src/rapids-build-utils": {}
-  },
-  "overrideFeatureInstallOrder": [
-    "./features/src/cuda",
-    "./features/src/utils",
-    "./features/src/rapids-build-utils"
-  ],
-  "initializeCommand": ["/bin/bash", "-c", "mkdir -m 0755 -p ${localWorkspaceFolder}/../.{aws,cache,config/pip,local/share/${localWorkspaceFolderBasename}-cuda13.0-venvs,log/devcontainer-utils} ${localWorkspaceFolder}/../{rmm,dask-cuda,kvikio,ucxx,cudf,rapidsmpf,raft,cuvs,cuml,nvforest,cugraph,cugraph-gnn,nx-cugraph,cuopt}"],
-  "postAttachCommand": ["/bin/bash", "-c", "if [ ${CODESPACES:-false} = 'true' ]; then . devcontainer-utils-post-attach-command; fi"],
-  "workspaceFolder": "/home/coder",
-  "workspaceMount": "source=${localWorkspaceFolder},target=/home/coder/devcontainers,type=bind,consistency=consistent",
-  "mounts": [
-    "source=/etc/timezone,target=/etc/timezone,type=bind,consistency=consistent",
-    "source=/etc/localtime,target=/etc/localtime,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../rmm,target=/home/coder/rmm,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../dask-cuda,target=/home/coder/dask-cuda,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../kvikio,target=/home/coder/kvikio,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../ucxx,target=/home/coder/ucxx,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cudf,target=/home/coder/cudf,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../raft,target=/home/coder/raft,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../rapidsmpf,target=/home/coder/rapidsmpf,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cuvs,target=/home/coder/cuvs,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cuml,target=/home/coder/cuml,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../nvforest,target=/home/coder/nvforest,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cugraph,target=/home/coder/cugraph,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cugraph-gnn,target=/home/coder/cugraph-gnn,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../nx-cugraph,target=/home/coder/nx-cugraph,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../cuopt,target=/home/coder/cuopt,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.aws,target=/home/coder/.aws,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.cache,target=/home/coder/.cache,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.config,target=/home/coder/.config,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.local/share/${localWorkspaceFolderBasename}-cuda13.0-venvs,target=/home/coder/.local/share/venvs,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/../.log/devcontainer-utils,target=/var/log/devcontainer-utils,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/.devcontainer/cuda13.0-pip/features/src/utils/opt/devcontainer/bin,target=/opt/devcontainer/bin,type=bind,consistency=consistent",
-    "source=${localWorkspaceFolder}/.devcontainer/cuda13.0-pip/features/src/rapids-build-utils/opt/rapids-build-utils,target=/opt/rapids-build-utils,type=bind,consistency=consistent"
-  ],
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "augustocdias.tasks-shell-input",
-        "ms-python.flake8",
-        "nvidia.nsight-vscode-edition"
-      ],
-      "settings": {
-        "files.watcherExclude": {
-          "**/build/**": true,
-          "**/_skbuild/**": true,
-          "**/target/**": true,
-          "/home/coder/.aws/**/*": true,
-          "/home/coder/.cache/**/*": true,
-          "/home/coder/.conda/**/*": true,
-          "/home/coder/.local/share/**/*": true,
-          "/home/coder/.vscode-server/**/*": true
-        },
-        "search.exclude": {
-          "**/build/**": true,
-          "**/_skbuild/**": true,
-          "**/*.code-search": true,
-          "/home/coder/.aws/**/*": true,
-          "/home/coder/.cache/**/*": true,
-          "/home/coder/.conda/**/*": true,
-          "/home/coder/.local/share/**/*": true,
-          "/home/coder/.vscode-server/**/*": true
-        }
-      }
-    }
-  }
-}
diff --git a/.devcontainer/cuda13.0-pip/features b/.devcontainer/cuda13.0-pip/features
deleted file mode 120000
index c9012f29..00000000
--- a/.devcontainer/cuda13.0-pip/features
+++ /dev/null
@@ -1 +0,0 @@
-../../features
\ No newline at end of file
diff --git a/.devcontainer/cuda13.2-conda/devcontainer.json b/.devcontainer/cuda13.2-conda/devcontainer.json
index 533b46fd..21cf59f2 100644
--- a/.devcontainer/cuda13.2-conda/devcontainer.json
+++ b/.devcontainer/cuda13.2-conda/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "13.2",
       "PYTHON_PACKAGE_MANAGER": "conda",
       "BASE": "rapidsai/devcontainers:26.08-cpp-mambaforge"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.08-cuda13.1-conda"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.devcontainer/cuda13.2-pip/devcontainer.json b/.devcontainer/cuda13.2-pip/devcontainer.json
index 571d43a5..475072dc 100644
--- a/.devcontainer/cuda13.2-pip/devcontainer.json
+++ b/.devcontainer/cuda13.2-pip/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "13.2",
       "PYTHON_PACKAGE_MANAGER": "pip",
       "BASE": "rapidsai/devcontainers:26.08-cpp-cuda13.2-ucx1.19.0-openmpi5.0.10"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.08-cuda13.2-pip"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.github/actions/build-linux-image/action.yml b/.github/actions/build-linux-image/action.yml
index 5ed50528..865ba8e2 100644
--- a/.github/actions/build-linux-image/action.yml
+++ b/.github/actions/build-linux-image/action.yml
@@ -44,7 +44,7 @@ runs:
         if test "${push}" = true; then
           outputs+=(--output "type=image,compression=zstd,force-compression=true,oci-mediatypes=true,push=true,push-by-digest=true,name=${repo}");
           # HACK: remove the `-t` arg from the `docker buildx build` command generated by `devcontainer build`
-          sed -i 's/,t.map(v=>l.push("-t",v))//g' "$(npm list -g | head -n1)"/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js;
+          sed -i 's/,t.map(G=>l.push("-t",G))//g' "$(npm list -g | head -n1)"/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js;
         fi
 
         until devcontainer build \
diff --git a/.github/actions/install-devcontainers-cli/action.yml b/.github/actions/install-devcontainers-cli/action.yml
index 934c88ff..654cfa00 100644
--- a/.github/actions/install-devcontainers-cli/action.yml
+++ b/.github/actions/install-devcontainers-cli/action.yml
@@ -6,12 +6,12 @@ runs:
   using: composite
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
-        node-version: '20'
+        node-version: '24'
     - name: Install devcontainers CLI
       shell: bash
       run: |
         sudo apt update;
         sudo apt install -y --no-install-recommends build-essential;
-        npm install -g @devcontainers/cli@v0.80.2;
+        npm install -g @devcontainers/cli@v0.85.0;
diff --git a/.github/actions/setup-runner-env/action.yml b/.github/actions/setup-runner-env/action.yml
index 3d819c59..4cdc2891 100644
--- a/.github/actions/setup-runner-env/action.yml
+++ b/.github/actions/setup-runner-env/action.yml
@@ -26,13 +26,13 @@ runs:
 
     - if: runner.environment == 'self-hosted'
       name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
-        node-version: '20'
+        node-version: '24'
 
     - if: runner.environment != 'self-hosted'
       name: Set up QEMU
-      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
 
     - name: Create docker context
       shell: bash
@@ -40,14 +40,14 @@ runs:
 
     - if: runner.environment != 'self-hosted'
       name: Setup docker buildx on github-hosted runners
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
       with:
         buildkitd-flags: --debug
         endpoint: builder
 
     - if: runner.environment == 'self-hosted'
       name: Setup docker buildx on self-hosted runners
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
       with:
         buildkitd-flags: --debug --config /etc/buildkit/buildkitd.toml
         endpoint: builder
diff --git a/.github/workflows/build-and-test-feature.yml b/.github/workflows/build-and-test-feature.yml
index 1608e3f9..d97dd34c 100644
--- a/.github/workflows/build-and-test-feature.yml
+++ b/.github/workflows/build-and-test-feature.yml
@@ -22,12 +22,12 @@ jobs:
         arch: [amd64, arm64]
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER }}
           password: ${{ secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/build-devcontainers.yml b/.github/workflows/build-devcontainers.yml
new file mode 100644
index 00000000..69afcdf7
--- /dev/null
+++ b/.github/workflows/build-devcontainers.yml
@@ -0,0 +1,57 @@
+name: Build devcontainers
+
+concurrency:
+  group: build-devcontainers-from-${{ github.ref_name }}
+  cancel-in-progress: true
+
+on:
+  workflow_call:
+    inputs:
+      cuda:
+        description: |
+          Stringified JSON array of CUDA versions to run this workflow for.
+          This is used to select .devcontainer/ directories local to wherever this workflow is invoked from.
+          For example, if a repository has directories '.devcontainer/cuda12.9-pip/' and '.devcontainer/cuda13.2-pip/',
+          '["12.9", "13.2"]' could be passed here to build both of those devcontainers in CI.
+        type: string
+        default: '["12.9", "13.2"]'
+      python_package_manager:
+        description: |
+          Stringified JSON array of Python package managers to run devcontainer builds for.
+          One of: '["conda"]', '["pip"]', '["conda", "pip"]'.
+        type: string
+        default: '["conda", "pip"]'
+      push:
+        type: string
+        default: true
+  workflow_dispatch:
+    inputs:
+      cuda:
+        description: |
+          Stringified JSON array of CUDA versions to run this workflow for.
+          This is used to select .devcontainer/ directories local to wherever this workflow is invoked from.
+          For example, if a repository has directories '.devcontainer/cuda12.9-pip/' and '.devcontainer/cuda13.2-pip/',
+          '["12.9", "13.2"]' could be passed here to build both of those devcontainers in CI.
+        type: string
+        default: '["12.9", "13.2"]'
+      python_package_manager:
+        description: |
+          Stringified JSON array of Python package managers to run devcontainer builds for.
+          One of: '["conda"]', '["pip"]', '["conda", "pip"]'.
+        type: string
+        default: '["conda", "pip"]'
+      push:
+        type: boolean
+        default: true
+
+jobs:
+  build:
+    name: Build devcontainers
+    secrets: inherit  # zizmor: ignore[secrets-inherit]
+    uses: rapidsai/shared-workflows/.github/workflows/build-devcontainers.yaml@main  # zizmor: ignore[unpinned-uses]
+    permissions:
+      packages: write
+    with:
+      cuda: "${{ inputs.cuda }}"
+      python_package_manager: "${{ inputs.python_package_manager }}"
+      push: ${{ inputs.push }}
diff --git a/.github/workflows/build-test-and-push-linux-image.yml b/.github/workflows/build-test-and-push-linux-image.yml
index 8085db28..6216d117 100644
--- a/.github/workflows/build-test-and-push-linux-image.yml
+++ b/.github/workflows/build-test-and-push-linux-image.yml
@@ -41,7 +41,7 @@ jobs:
       version: ${{ steps.json.outputs.version }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -58,7 +58,7 @@ jobs:
           container_env: "${{ inputs.container_env }}"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER }}
           password: ${{ secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER }}
           password: ${{ secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/build-test-and-push-windows-image.yml b/.github/workflows/build-test-and-push-windows-image.yml
index bbb27147..4ad09786 100644
--- a/.github/workflows/build-test-and-push-windows-image.yml
+++ b/.github/workflows/build-test-and-push-windows-image.yml
@@ -37,7 +37,7 @@ jobs:
           - { edition: "2022", runner: "${{ github.repository != 'rapidsai/devcontainers' && 'windows-2022' || 'windows-amd64-cpu4' }}" }
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -68,7 +68,7 @@ jobs:
           EOF
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER }}
           password: ${{ secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index b833cdc6..a9293d58 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -20,7 +20,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release-features.yml b/.github/workflows/release-features.yml
index f4bbd1c6..ab874ab2 100644
--- a/.github/workflows/release-features.yml
+++ b/.github/workflows/release-features.yml
@@ -13,7 +13,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release-linux.yml b/.github/workflows/release-linux.yml
index e5dbd716..79623f45 100644
--- a/.github/workflows/release-linux.yml
+++ b/.github/workflows/release-linux.yml
@@ -21,7 +21,7 @@ jobs:
       scenarios: "${{ steps.matrix.outputs.scenarios }}"
     steps:
       - name: "Checkout ${{ github.repository }}"
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -45,7 +45,7 @@ jobs:
       linux: ${{ steps.matrix.outputs.linux }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/release-windows.yml b/.github/workflows/release-windows.yml
index f42e5328..f2cd3c63 100644
--- a/.github/workflows/release-windows.yml
+++ b/.github/workflows/release-windows.yml
@@ -20,7 +20,7 @@ jobs:
       windows: ${{ steps.matrix.outputs.windows }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2c43f1e7..98bc8c10 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
       scenarios: "${{ steps.matrix.outputs.scenarios }}"
     steps:
       - name: "Checkout ${{ github.repository }}"
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -71,7 +71,7 @@ jobs:
       windows: ${{ steps.matrix.outputs.windows }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -129,3 +129,27 @@ jobs:
       packages: write
     secrets: inherit  # zizmor: ignore[secrets-inherit]
     uses: ./.github/workflows/release-features.yml
+
+  build-devcontainers-after-images-released:
+    if: needs.image-matrix.outputs.linux != '{"include":[]}'
+    needs: [image-matrix, release-linux]
+    name: Build devcontainers
+    secrets: inherit  # zizmor: ignore[secrets-inherit]
+    uses: rapidsai/shared-workflows/.github/workflows/build-devcontainers.yaml@main  # zizmor: ignore[unpinned-uses]
+    permissions:
+      packages: write
+    with:
+      push: true
+      cuda: '["12.9", "13.2"]'
+
+  build-devcontainers-after-features-released:
+    if: needs.image-matrix.outputs.linux == '{"include":[]}' && (needs.features-matrix.outputs.features != '[]' || needs.features-matrix.outputs.scenarios != '[]')
+    needs: [image-matrix, features-matrix, release-features]
+    name: Build devcontainers
+    secrets: inherit  # zizmor: ignore[secrets-inherit]
+    uses: rapidsai/shared-workflows/.github/workflows/build-devcontainers.yaml@main  # zizmor: ignore[unpinned-uses]
+    permissions:
+      packages: write
+    with:
+      push: true
+      cuda: '["12.9", "13.2"]'
diff --git a/.github/workflows/test-rapids-build-times.yml b/.github/workflows/test-rapids-build-times.yml
index 813f010e..c67d6333 100644
--- a/.github/workflows/test-rapids-build-times.yml
+++ b/.github/workflows/test-rapids-build-times.yml
@@ -55,7 +55,7 @@ jobs:
 
     with:
       arch: '["amd64", "arm64"]'
-      cuda: '["12.9", "13.1"]'
+      cuda: '["12.9", "13.2"]'
       node_type: ${{ inputs.node_type }}
       timeout-minutes: 720
       # 1. Prohibit sccache from shutting down automatically
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9800a7b4..1f8957df 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -65,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
@@ -90,7 +90,7 @@ jobs:
       scenarios: ${{ steps.matrix.outputs.scenarios }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -171,7 +171,7 @@ jobs:
       windows: ${{ steps.matrix.outputs.windows }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false