diff --git a/.github/linters/typos.toml b/.github/linters/typos.toml
deleted file mode 100644
index 605b9ebb..00000000
--- a/.github/linters/typos.toml
+++ /dev/null
@@ -1,18 +0,0 @@
-[default]
-extend-ignore-re = [
-  "(?Rm)^.*(#|//)\\s*spellchecker:disable-line$",
-  "(?s)(#|//)\\s*spellchecker:off.*?\\n\\s*(#|//)\\s*spellchecker:on"
-]
-
-[default.extend-words]
-SEH = "SEH"
-ser = "ser"
-nd = "nd"
-
-[files]
-extend-exclude = [
-  "subprojects/*",
-  "third-party/*",
-  "test/catch2/*",
-  "test/fff/*"
-]
diff --git a/.github/linters/urunc-dict.txt b/.github/linters/urunc-dict.txt
index 2912e201..c38ddff0 100644
--- a/.github/linters/urunc-dict.txt
+++ b/.github/linters/urunc-dict.txt
@@ -471,3 +471,4 @@ Crootfs
 APIC
 makefs
 Nachiket
+archs
diff --git a/.github/workflows/build-latest.yml b/.github/workflows/build-latest.yml
index 2dfa801d..11dccb11 100644
--- a/.github/workflows/build-latest.yml
+++ b/.github/workflows/build-latest.yml
@@ -3,18 +3,12 @@ name: 🍜 Build/publish urunc-deploy image
 on:
   workflow_call:
     inputs:
-      runner:
-        type: string
-        default: '["base", "dind", "2204"]'
       runner-archs:
         type: string
         default: '["amd64", "aarch64"]'
       dockerfiles:
         type: string
         default: '["Dockerfile"]'
-      runner-arch-map:
-        type: string
-        default: '[{"amd64":"x86_64", "aarch64":"aarch64", "armv7l":"armv7l"}]'
       registry:
         type: string
         default: 'ghcr.io'
@@ -57,9 +51,6 @@ jobs:
       - name: Checkout the repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set short SHA
-        run: echo "SHA_SHORT=${GITHUB_SHA::7}" >> $GITHUB_ENV
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
@@ -78,36 +69,6 @@ jobs:
           tags: |
             type=sha,prefix=${{ env.ARCH }}-
 
-      - name: Get revision SHA and branch (safe)
-        id: get-rev
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          IS_MERGED: ${{ github.event.pull_request.merged }}
-          GITHUB_SHA: ${{ github.sha }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-          REF_NAME: ${{ github.ref_name }}
-        run: |
-          if [ "$EVENT_NAME" == "pull_request" ]; then
-            if [ "$IS_MERGED" == "true" ]; then
-              sha="$GITHUB_SHA"
-              branch="$PR_BASE_REF"
-              echo "PR merged. SHA: ${sha}, Branch: ${branch}"
-            else
-              sha="$PR_HEAD_SHA"
-              branch="$PR_HEAD_REF"
-              echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}"
-            fi
-          else
-            sha="$GITHUB_SHA"
-            branch="$REF_NAME"
-            echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}"
-          fi
-
-          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
-          echo "branch=${branch}" >> "$GITHUB_OUTPUT"
- 
       - name: Build and push urunc-deploy-${{ matrix.arch}}
         id: build-and-push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # master
@@ -118,15 +79,9 @@ jobs:
           push: true
           file: ${{ inputs.dockerfiles }}
           build-args: |
-            BRANCH=${{ steps.get-rev.outputs.branch }}
+            BRANCH=${{ github.ref_name }}
             REPO=${{ github.repository }}
           provenance: false
- 
-      - name: Get image digest
-        run: |
-          echo "IMAGE_DIGEST=$(docker inspect \
-          ${{ env.REGISTRY }}/${{ github.repository }}/urunc-deploy:${{ env.ARCH }}-${{ env.SHA_SHORT }} | \
-          jq -r '.[0].Id')" >> $GITHUB_ENV
 
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # main
diff --git a/.github/workflows/build-trigger.yml b/.github/workflows/build-trigger.yml
index f6d7d7b8..b97f4acf 100644
--- a/.github/workflows/build-trigger.yml
+++ b/.github/workflows/build-trigger.yml
@@ -61,7 +61,6 @@ jobs:
     uses: ./.github/workflows/build-latest.yml
     secrets: inherit
     with:
-      runner: '["base", "dind", "2204"]'
       runner-archs: '["amd64", "arm64"]'
       dockerfiles: 'deployment/urunc-deploy/Dockerfile'
       version-tag: ${{ needs.get-changed-files.outputs.version == 'true' }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 63fad4b2..0fd1f685 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -52,36 +52,6 @@ jobs:
       run: |
         go version
 
-    - name: Get revision SHA and branch (safe)
-      id: get-rev
-      env:
-        EVENT_NAME: ${{ github.event_name }}
-        IS_MERGED: ${{ github.event.pull_request.merged }}
-        GITHUB_SHA: ${{ github.sha }}
-        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-        PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-        REF_NAME: ${{ github.ref_name }}
-      run: |
-        if [ "$EVENT_NAME" == "pull_request" ]; then
-          if [ "$IS_MERGED" == "true" ]; then
-            sha="$GITHUB_SHA"
-            branch="$PR_BASE_REF"
-            echo "PR merged. SHA: ${sha}, Branch: ${branch}"
-          else
-            sha="$PR_HEAD_SHA"
-            branch="$PR_HEAD_REF"
-            echo "PR not yet merged. SHA: ${sha}, Branch: ${branch}"
-          fi
-        else
-          sha="$GITHUB_SHA"
-          branch="$REF_NAME"
-          echo "$EVENT_NAME event. SHA: ${sha}, Branch: ${branch}"
-        fi
-
-        echo "sha=${sha}" >> "$GITHUB_OUTPUT"
-        echo "branch=${branch}" >> "$GITHUB_OUTPUT"
-
     - name: Build urunc binaries
       id: build-urunc-binaries
       run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fe4fe165..8d4dc44e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,7 +67,11 @@ jobs:
     name: E2E test
     uses: ./.github/workflows/vm_test.yml
     with:
-      ref: ${{ inputs.ref }}
+      # Run the e2e suite from the base branch, so a PR cannot silently weaken
+      # the tests that gate its own binary. Changes under tests/ are exercised
+      # with the PR's own test code by e2e-test-changes.yml. Falls back to the
+      # caller ref for non-PR runs (nightly/release), where base.sha is empty.
+      ref: ${{ github.event.pull_request.base.sha || inputs.ref }}
       go_version: ${{ inputs.go_version }}
       runner-archs: '["amd64", "arm64"]'
       runc_version: '1.3.0'
@@ -92,3 +96,56 @@ jobs:
       solo5_version: 'v0.9.3'
       runc_version: '1.3.0'
     secrets: inherit
+
+  # The vm_test job above runs the base branch's e2e code. In order to also
+  # test changes in the e2e testing code, re-run the vm_test with the changed
+  # e2e test code. HOwever, do that only when a change in these files has
+  # taken place.
+  detect-test-changes:
+    if: ${{ github.event_name == 'pull_request' && inputs.skip-build != 'yes' }}
+    name: Detect test changes
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      tests_changed: ${{ steps.check.outputs.tests_changed }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - name: Check whether the PR touches tests/
+        id: check
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+            const roots = ['tests/', 'Makefile', 'script/dm_create.sh'];
+            const changed = files.some(f => roots.some(r => f.filename.startsWith(r)));
+            core.setOutput('tests_changed', changed ? 'yes' : 'no');
+
+  vm_test_head:
+    if: ${{ inputs.skip-build != 'yes' && needs.detect-test-changes.outputs.tests_changed == 'yes' }}
+    needs: [build, unit_test, detect-test-changes]
+    name: E2E test (PR test code)
+    uses: ./.github/workflows/vm_test.yml
+    with:
+      ref: ${{ inputs.ref }}
+      go_version: ${{ inputs.go_version }}
+      runner-archs: '["amd64", "arm64"]'
+      runc_version: '1.3.0'
+      containerd_version: '2.1.3'
+      cni_version: '1.7.1'
+      nerdctl_version: '2.1.3'
+      crictl_version: 'v1.30.0'
+      firecracker_version: 'v1.7.0'
+      cloud_hypervisor_version: 'v50.0'
+      solo5_version: 'v0.9.3'
+      hyperlight_unikraft_version: 'v0.12.1'
+    secrets: inherit
diff --git a/.github/workflows/kind_test.yml b/.github/workflows/kind_test.yml
index c77f757d..4e8d8057 100644
--- a/.github/workflows/kind_test.yml
+++ b/.github/workflows/kind_test.yml
@@ -5,15 +5,6 @@ on:
       ref:
         type: string
         default: ''
-      runner:
-        type: string
-        default: '["base", "dind", "2204"]'
-      runner-archs:
-        type: string
-        default: '["amd64", "arm64"]'
-      runner-arch-map:
-        type: string
-        default: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]'
       firecracker_version:
         type: string
         required: true
@@ -23,10 +14,6 @@ on:
       runc_version:
         required: true
         type: string
-    secrets:
-      GIT_CLONE_PAT:
-        required: false
-  workflow_dispatch:     
 permissions:
   contents: read
 
@@ -50,11 +37,9 @@ jobs:
 
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: ${{ inputs.ref }}
 
-    - name: Install base dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y git wget build-essential libseccomp-dev pkg-config bc make 
     - name: Install kind
       run: |
         ARCH=$(uname -m)
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 484a308e..439aab09 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -33,7 +33,7 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ inputs.ref }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ inputs.go_version }}
diff --git a/.github/workflows/pr-merge.yml b/.github/workflows/pr-merge.yml
index 2982dfb4..7717abbd 100644
--- a/.github/workflows/pr-merge.yml
+++ b/.github/workflows/pr-merge.yml
@@ -51,8 +51,6 @@ jobs:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
           PR_BRANCH: ${{ github.event.pull_request.base.ref }}
         run: |
-          PR_BRANCH=${{ github.event.pull_request.base.ref }}
-
           # Create the pull request
           PR_URL=$(gh pr create \
             --head "$PR_BRANCH" \
diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml
index 05522255..e517a523 100644
--- a/.github/workflows/unit_test.yml
+++ b/.github/workflows/unit_test.yml
@@ -37,7 +37,7 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ inputs.ref }}
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
diff --git a/.github/workflows/urunc-deploy-test.yml b/.github/workflows/urunc-deploy-test.yml
index 02d25100..6f42ea90 100644
--- a/.github/workflows/urunc-deploy-test.yml
+++ b/.github/workflows/urunc-deploy-test.yml
@@ -5,12 +5,6 @@ on:
       ref:
         type: string
         default: ""
-      runner-archs:
-        type: string
-        default: '["amd64", "arm64"]'
-      runner-arch-map:
-        type: string
-        default: '[{"amd64":"x86_64","arm64":"aarch64"}]'
       runc_version:
         required: true
         type: string
diff --git a/.github/workflows/vm_test.yml b/.github/workflows/vm_test.yml
index fb15dfbc..64c2704b 100644
--- a/.github/workflows/vm_test.yml
+++ b/.github/workflows/vm_test.yml
@@ -8,15 +8,9 @@ on:
       go_version:
         required: true
         type: string
-      runner:
-        type: string
-        default: '["base", "dind", "2204"]'
       runner-archs:
         type: string
         default: '["amd64"]'
-      runner-arch-map:
-        type: string
-        default: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]'
       runc_version:
         required: true
         type: string
@@ -44,11 +38,6 @@ on:
       hyperlight_unikraft_version:
         required: true
         type: string
-    secrets:
-      GIT_CLONE_PAT:
-        required: false
-
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -82,18 +71,9 @@ jobs:
         SOLO5_VERSION: ${{ inputs.solo5_version }}
         HYPERLIGHT_UNIKRAFT_VERSION: ${{ inputs.hyperlight_unikraft_version }}
       run: |
-        SAFE_GO_VERSION="$GO_VERSION"
-        SAFE_RUNC_VERSION="$RUNC_VERSION"
-        SAFE_CONTAINERD_VERSION="$CONTAINERD_VERSION"
-        SAFE_CNI_VERSION="$CNI_VERSION"
-        SAFE_NERDCTL_VERSION="$NERDCTL_VERSION"
-        SAFE_CRICTL_VERSION="$CRICTL_VERSION"
-        SAFE_FIRECRACKER_VERSION="$FIRECRACKER_VERSION"
-        SAFE_CLOUD_HYPERVISOR_VERSION="$CLOUD_HYPERVISOR_VERSION"
-        SAFE_SOLO5_VERSION="$SOLO5_VERSION"
-        SAFE_HYPERLIGHT_UNIKRAFT_VERSION="$HYPERLIGHT_UNIKRAFT_VERSION"
-
-        for var in SAFE_GO_VERSION SAFE_RUNC_VERSION SAFE_CONTAINERD_VERSION SAFE_CNI_VERSION SAFE_NERDCTL_VERSION SAFE_CRICTL_VERSION SAFE_FIRECRACKER_VERSION SAFE_CLOUD_HYPERVISOR_VERSION SAFE_SOLO5_VERSION SAFE_HYPERLIGHT_UNIKRAFT_VERSION; do
+        for var in GO_VERSION RUNC_VERSION CONTAINERD_VERSION CNI_VERSION \
+                   NERDCTL_VERSION CRICTL_VERSION FIRECRACKER_VERSION \
+                   CLOUD_HYPERVISOR_VERSION SOLO5_VERSION HYPERLIGHT_UNIKRAFT_VERSION; do
           value="${!var}"
           if ! [[ "$value" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
             echo "Invalid format for $var: $value"
@@ -108,6 +88,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: ${{ inputs.ref }}
 
     - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
@@ -362,14 +344,13 @@ jobs:
         EOF
         sudo chmod +x /usr/local/bin/containerd-shim-urunc-fc-v2
 
-    - name: Add runner user to KVM group
+    - name: Grant access to /dev/kvm
       if: ${{ matrix.arch == 'amd64' }}
       id: kvm-setup
       run: |
         echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
         sudo udevadm control --reload-rules
         sudo udevadm trigger --name-match=kvm
-        sudo usermod -a -G kvm $USER
 
     - name: Prepare urunc folder
       id: prepare