diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3ffbcd81d4..256b493d88 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,102 +16,18 @@ jobs:
       matrix:
         include:
 
-          # Minimal 64-bit arch builds
-          - CC: gcc
-            feature_set: min
-            arch: amd64
-            os: ubuntu-latest
-            unittests: false
-            DISTCHECK: false
-
-          - CC: g++
-            feature_set: min
-            arch: amd64
-            os: ubuntu-latest
-            unittests: false
-            DISTCHECK: false
-
-          - CC: clang
-            feature_set: min
-            arch: amd64
-            os: ubuntu-latest
-            unittests: false
-            DISTCHECK: false
-
-          # Maximal 64-bit arch builds
-          - CC: gcc
-            feature_set: max
-            arch: amd64
-            os: ubuntu-latest
-            unittests: true
-            DISTCHECK: true
-
-          - CC: g++
-            feature_set: max
-            arch: amd64
-            os: ubuntu-latest
-            unittests: false
-            DISTCHECK: false
-
           - CC: clang
             feature_set: max
             arch: amd64
             os: ubuntu-latest
             unittests: true
-            DISTCHECK: true
-
-          - CC: clang
-            feature_set: max
-            arch: amd64
-            os: ubuntu-latest
-            unittests: true
-            DISTCHECK: false
-            name_extra: and AddressSanitized
-            CFLAGS: "-fsanitize=address -ggdb"
-            LDFLAGS: "-fsanitize=address"
-
-          # Maximal debug 64-bit arch builds
-          # Check we can also do a static build without
-          # installing .a files
-          - CC: gcc
-            feature_set: max
-            arch: amd64
-            os: ubuntu-latest
-            unittests: true
-            DISTCHECK: false
-            name_extra: and DEBUG
-            CONF_FLAGS_EXTRA: "--enable-devel-all --disable-static"
-
-          # Maximal 32-bit arch builds
-          - CC: gcc
-            feature_set: max
-            arch: i386
-            os: ubuntu-latest
-            unittests: true
-            DISTCHECK: false
-            name_extra: for 32-bit arch (legacy OS)
-            CFLAGS: "-m32"
-            LDFLAGS: "-m32"
-
-          - CC: g++
-            feature_set: max
-            arch: i386
-            os: ubuntu-latest
-            unittests: false
-            DISTCHECK: false
-            name_extra: for 32-bit arch (legacy OS)
-            CFLAGS: "-m32"
-            LDFLAGS: "-m32"
-
-          - CC: clang
-            feature_set: max
-            arch: i386
-            os: ubuntu-latest
-            unittests: true
             DISTCHECK: false
-            name_extra: for 32-bit arch (legacy OS)
-            CFLAGS: "-m32"
-            LDFLAGS: "-m32"
+            name_extra: and UndefinedBehaviorSanitized
+            # -fsanitize=nullability is only available for Clang
+            # TODO: enable alignment
+            CFLAGS: "-fsanitize=undefined -fsanitize=nullability -fno-sanitize=alignment -ggdb"
+            LDFLAGS: "-fsanitize=undefined -fsanitize=nullability -fno-sanitize=alignment"
+            UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1:report_error_type=1
 
     name: ${{ matrix.feature_set }} features with ${{ matrix.CC }} ${{ matrix.name_extra }}
     runs-on: ${{ matrix.os }}
@@ -119,6 +35,7 @@ jobs:
       CC: ${{ matrix.CC }}
       CFLAGS: ${{ matrix.CFLAGS }}
       LDFLAGS: ${{ matrix.LDFLAGS }}
+      UBSAN_OPTIONS: ${{ matrix.UBSAN_OPTIONS }}
 
       # HACK (2020-11-16): github actions doesn't support YAML anchors/aliases to
       # avoid repeating long config values. So instead the config values are defined
@@ -173,62 +90,3 @@ jobs:
         with:
           name: test-suite-distcheck-${{ matrix.cc }}-${{ matrix.feature_set }}
           path: ${{ github.workspace }}/xrdp-*/_build/sub/tests/xrdp/test-suite.log
-
-  cppcheck:
-    name: cppcheck
-    runs-on: ubuntu-latest
-    env:
-      CC: gcc
-      # This is required to use a version of cppcheck other than that
-      # supplied with the operating system
-      CPPCHECK_VER: "2.18.3"
-      CPPCHECK_REPO: https://github.com/danmar/cppcheck.git
-    steps:
-      # Set steps.os.outputs.image to the specific OS (e.g. 'ubuntu20')
-      - name: Get operating system name and version.
-        id: os
-        run: echo "image=$ImageOS" >>$GITHUB_OUTPUT
-        shell: bash
-      - uses: actions/checkout@v4
-      - name: Cache cppcheck
-        uses: actions/cache@v4
-        env:
-          cache-name: cache-cppcheck
-        with:
-          path: ~/cppcheck.local
-          key: ${{ steps.os.outputs.image }}-build-${{ env.cache-name }}-${{ env.CPPCHECK_VER }}
-      - run: sudo scripts/install_cppcheck_dependencies_with_apt.sh $CPPCHECK_VER
-      - run: ./bootstrap
-      - run: ./configure
-      - run: scripts/install_cppcheck.sh $CPPCHECK_REPO $CPPCHECK_VER
-      - run: scripts/run_cppcheck.sh -v $CPPCHECK_VER
-
-  code_formatting_check:
-    name: code formatting check
-    runs-on: ubuntu-latest
-    env:
-      CC: gcc
-      # This is required to use a version of astyle other than that
-      # supplied with the operating system
-      ASTYLE_VER: 3.4.14
-      ASTYLE_REPO: https://gitlab.com/saalen/astyle.git
-    steps:
-      # Set steps.os.outputs.image to the specific OS (e.g. 'ubuntu20')
-      - name: Get operating system name and version.
-        id: os
-        run: echo "image=$ImageOS" >>$GITHUB_OUTPUT
-        shell: bash
-      - uses: actions/checkout@v4
-      - name: Cache astyle
-        uses: actions/cache@v4
-        env:
-          cache-name: cache-astyle
-        with:
-          path: ~/astyle.local
-          key: ${{ steps.os.outputs.image }}-build-${{ env.cache-name }}-${{ env.ASTYLE_VER }}
-      - run: sudo scripts/install_astyle_dependencies_with_apt.sh
-      - run: scripts/install_astyle.sh $ASTYLE_REPO $ASTYLE_VER
-      - name: Format code with astyle
-        run: scripts/run_astyle.sh -v $ASTYLE_VER
-      - name: Check code formatting
-        run: git diff --exit-code