diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 5fac2767f5287..ac05e192e575e 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -24,6 +24,10 @@ inputs:
     required: false
     default: false
     description: "Install cue."
+  libsasl2:
+    required: false
+    default: false
+    description: "Install libsasl2." # Required to fully build Vector
 
   # prepare.sh - rust
   rust: # rustup module
@@ -155,7 +159,7 @@ runs:
           ${{ runner.os }}-cargo-
 
     - name: Install mold
-      if: ${{ inputs.mold == 'true' || env.VDEV_NEEDS_COMPILE == 'true' }}
+      if: ${{ runner.os == 'Linux' && (inputs.mold == 'true' || env.VDEV_NEEDS_COMPILE == 'true') }}
       shell: bash
       run: |
         echo "Installing mold"
@@ -206,7 +210,11 @@ runs:
       shell: bash
       run: |
         echo "Installing protoc"
-        sudo bash ./scripts/environment/install-protoc.sh
+        if [[ "${{ runner.os }}" == "macOS" ]]; then
+          sudo bash ./scripts/environment/install-protoc.sh /usr/local/bin
+        else
+          sudo bash ./scripts/environment/install-protoc.sh
+        fi
 
     - name: Install cue
       if: ${{ inputs.cue == 'true' }}
@@ -223,6 +231,11 @@ runs:
         sudo cp "${TEMP}/cue" /usr/bin/cue
         rm -rf "$TEMP"
 
+    - name: Install libsasl2
+      if: ${{ inputs.libsasl2 == 'true' }}
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y libsasl2-dev
+
     - name: Install vdev
       if: ${{ inputs.vdev == 'true' }}
       uses: ./.github/actions/install-vdev
diff --git a/.github/workflows/ci-review-trigger.yml b/.github/workflows/ci-review-trigger.yml
index d85ffc9e5d7fa..d74974e42d3fb 100644
--- a/.github/workflows/ci-review-trigger.yml
+++ b/.github/workflows/ci-review-trigger.yml
@@ -29,7 +29,7 @@ on:
     types: [submitted]
 
 permissions:
-  statuses: write
+  contents: read
 
 env:
   DD_ENV: "ci"
@@ -85,9 +85,10 @@ jobs:
         run: exit 1
 
   cli:
-    needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-cli')
     uses: ./.github/workflows/cli.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   make-test-behavior:
@@ -95,6 +96,7 @@ jobs:
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-test-behavior')
     uses: ./.github/workflows/test-make-command.yml
     with:
+      ref: ${{ github.event.review.commit_id }}
       command: test-behavior
       job_name: make test-behavior
     secrets: inherit
@@ -104,6 +106,7 @@ jobs:
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-check-examples')
     uses: ./.github/workflows/test-make-command.yml
     with:
+      ref: ${{ github.event.review.commit_id }}
       command: check-examples
       job_name: make check-examples
     secrets: inherit
@@ -113,6 +116,7 @@ jobs:
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-test-docs')
     uses: ./.github/workflows/test-make-command.yml
     with:
+      ref: ${{ github.event.review.commit_id }}
       command: test-docs
       job_name: make test-docs
     secrets: inherit
@@ -121,40 +125,54 @@ jobs:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-deny')
     uses: ./.github/workflows/deny.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   component-features:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-component-features')
     uses: ./.github/workflows/component_features.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   cross:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-cross')
     uses: ./.github/workflows/cross.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   unit-mac:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-unit-mac')
     uses: ./.github/workflows/unit_mac.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   unit-windows:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-unit-windows')
     uses: ./.github/workflows/unit_windows.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   environment:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-environment')
     uses: ./.github/workflows/environment.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   k8s:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-k8s')
     uses: ./.github/workflows/k8s_e2e.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index 1c08d63d29c4d..19b63afa464e6 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -2,61 +2,30 @@ name: CLI - Linux
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   test-cli:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
-    env:
-      CARGO_INCREMENTAL: 0
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: CLI - Linux
-          status: pending
-
-      - name: (PR review) Checkout review SHA
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.review.commit_id }}
-
-      - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
-      - name: Cache Cargo registry + index
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+          ref: ${{ inputs.ref }}
+      - uses: ./.github/actions/setup
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
-      - run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
-      - run: bash scripts/environment/prepare.sh --modules=cargo-nextest,datadog-ci
-      - run: echo "::add-matcher::.github/matchers/rust.json"
+          rust: true
+          cargo-nextest: true
+          protoc: true
+          datadog-ci: true
       - run: make test-cli
       - name: Upload test results
         run: scripts/upload-test-results.sh
         if: always()
-
-      - name: (PR review) Set latest commit status as ${{ job.status }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: always() && github.event_name == 'pull_request_review'
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: CLI - Linux
-          status: ${{ job.status }}
diff --git a/.github/workflows/component_features.yml b/.github/workflows/component_features.yml
index 146239086a8b2..04492c62c9283 100644
--- a/.github/workflows/component_features.yml
+++ b/.github/workflows/component_features.yml
@@ -11,49 +11,39 @@ name: Component Features - Linux
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
   workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
   schedule:
     - cron: '0 10 * * 1' # 10:00 UTC Monday (6 AM EST NYC)
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   check-component-features:
     # use free tier on schedule and 8 core to expedite results on demand invocation
     runs-on: ${{ github.event_name == 'schedule' && 'ubuntu-24.04' || 'ubuntu-24.04-8core' }}
     timeout-minutes: 180 # Usually takes 2h but this prevents it from hanging for an indefinite time
-    if: github.event_name == 'pull_request_review' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: github.event_name == 'pull_request_review'
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Component Features - Linux
-          status: pending
-
-      - name: (PR review) Checkout PR branch
-        if: github.event_name == 'pull_request_review'
+      - name: Checkout branch
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
-          ref: ${{ github.event.review.commit_id }}
+          ref: ${{ inputs.ref }}
 
-      - name: Checkout branch
-        if: github.event_name != 'pull_request_review'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          cargo-nextest: true
+          protoc: true
+          libsasl2: true
 
-      - run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
-      - run: bash scripts/environment/prepare.sh --modules=rustup
-      - run: echo "::add-matcher::.github/matchers/rust.json"
       - run: make check-component-features
-
-      - name: (PR review) Set latest commit status as ${{ job.status }}
-        if: always() && github.event_name == 'pull_request_review'
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Component Features - Linux
-          status: ${{ job.status }}
diff --git a/.github/workflows/cross.yml b/.github/workflows/cross.yml
index fd781154fbde0..0ea0b45cbfc85 100644
--- a/.github/workflows/cross.yml
+++ b/.github/workflows/cross.yml
@@ -2,9 +2,14 @@ name: Cross
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   cross-linux:
@@ -25,24 +30,10 @@ jobs:
           - arm-unknown-linux-gnueabi
           - arm-unknown-linux-musleabi
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Cross
-          status: pending
-
-      - name: (PR review) Checkout PR branch
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.review.commit_id }}
-
       - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: ${{ inputs.ref }}
 
       - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         name: Cache Cargo registry + index
@@ -68,27 +59,3 @@ jobs:
         with:
           name: "vector-debug-${{ matrix.target }}"
           path: "./target/${{ matrix.target }}/debug/vector"
-
-      - name: (PR review) Set latest commit status as failed
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: failure() && github.event_name == 'pull_request_review'
-        with:
-          sha: ${{ steps.comment-branch.outputs.head_sha }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Cross
-          status: 'failure'
-
-  update-pr-status:
-    name: (PR review) Signal result to PR
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    needs: cross-linux
-    if: needs.cross-linux.result == 'success' && github.event_name == 'pull_request_review'
-    steps:
-      - name: (PR review) Submit PR result as success
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Cross
-          status: 'success'
diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
index 4127dbb73dc56..b55c0bc659be8 100644
--- a/.github/workflows/deny.yml
+++ b/.github/workflows/deny.yml
@@ -12,7 +12,19 @@ name: Deny - Linux
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
+
   workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
+
   pull_request:
   schedule:
     # Same schedule as nightly.yml
@@ -23,7 +35,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   changes:
@@ -39,7 +51,10 @@ jobs:
     env:
       CARGO_INCREMENTAL: 0
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Checkout branch
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: ${{ inputs.ref }}
 
       - uses: ./.github/actions/setup
         with:
diff --git a/.github/workflows/environment.yml b/.github/workflows/environment.yml
index d1cd30f8a4b75..2efb015133fdb 100644
--- a/.github/workflows/environment.yml
+++ b/.github/workflows/environment.yml
@@ -2,12 +2,23 @@ name: Environment Suite
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
+
   workflow_dispatch:
     inputs:
       push:
         description: "Push image when manually triggered"
         type: boolean
         default: false
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
+
   schedule:
     - cron: '0 6 * * 1'  # Every Monday at 06:00 UTC
 
@@ -17,31 +28,17 @@ env:
   SHOULD_PUBLISH: ${{ (github.event_name != 'workflow_dispatch' && github.ref == 'refs/heads/master') || (github.event_name == 'workflow_dispatch' && github.event.inputs.push == 'true') }}
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   publish-new-environment:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Environment Suite
-          status: pending
-
-      - name: (PR review) Checkout PR branch
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.review.commit_id }}
-
       - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: ${{ inputs.ref }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
@@ -99,12 +96,3 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-      - name: (PR review) Set latest commit status as ${{ job.status }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: always() && github.event_name == 'pull_request_review'
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Environment Suite
-          status: ${{ job.status }}
diff --git a/.github/workflows/install-sh.yml b/.github/workflows/install-sh.yml
index 69b30d750dc00..873a3a3d6f420 100644
--- a/.github/workflows/install-sh.yml
+++ b/.github/workflows/install-sh.yml
@@ -2,49 +2,31 @@ name: Update install.sh Suite
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
   workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   test-install:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - name: (PR comment) Get PR branch
-        if: ${{ github.event_name == 'issue_comment' }}
-        uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v3.0.0
-        id: comment-branch
-
-      - name: (PR comment) Set latest commit status as pending
-        if: ${{ github.event_name == 'issue_comment' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ steps.comment-branch.outputs.head_sha }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Update install.sh Suite
-          status: pending
-
-      - name: (PR comment) Checkout PR branch
-        if: ${{ github.event_name == 'issue_comment' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ steps.comment-branch.outputs.head_ref }}
-
       - name: Checkout branch
-        if: ${{ github.event_name != 'issue_comment' }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: ${{ inputs.ref }}
 
       - run: sudo apt-get install --yes bc
       - run: bash distribution/install.sh -- -y
       - run: ~/.vector/bin/vector --version
-
-      - name: (PR comment) Set latest commit status as ${{ job.status }}
-        if: github.event_name == 'issue_comment'
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ steps.comment-branch.outputs.head_sha }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Update install.sh Suite
-          status: ${{ job.status }}
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index b60953ca61e2c..defc764659e35 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -15,11 +15,21 @@
 name: K8S E2E Suite
 
 permissions:
-  statuses: write
+  contents: read
 
 on:
   workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
   pull_request:
   merge_group:
     types: [checks_requested]
@@ -67,40 +77,17 @@ jobs:
       CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 256
       CARGO_INCREMENTAL: 0
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          status: pending
-
-      - name: (PR review) Checkout PR branch
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.review.commit_id }}
-
       - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
-      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-
+          ref: ${{ inputs.ref }}
       - run: sudo -E bash scripts/ci-free-disk-space.sh
-      - run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
-      - run: bash scripts/environment/prepare.sh --modules=rustup,cross
-      - run: rustup target add x86_64-unknown-linux-gnu
-      - run: echo "::add-matcher::.github/matchers/rust.json"
 
-      # TODO: Use the setup action in this workflow.
-      - name: Install vdev
-        uses: ./.github/actions/install-vdev
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          cross: true
+          mold: false
 
       - run: VECTOR_VERSION="$(vdev version)" make package-deb-x86_64-unknown-linux-gnu
 
@@ -109,14 +96,6 @@ jobs:
           name: e2e-test-deb-package
           path: target/artifacts/*
 
-      - name: (PR review) Set latest commit status as 'failure'
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: failure() && github.event_name == 'pull_request_review'
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          status: 'failure'
-
   # GitHub Actions don't support `matrix` at the job-level `if:` condition.
   # We apply this workaround - compute `matrix` in a preceding job, and assign
   # it's value dynamically at the actual test job.
@@ -191,20 +170,10 @@ jobs:
       matrix: ${{ fromJson(needs.compute-k8s-test-plan.outputs.matrix) }}
       fail-fast: false
     steps:
-      - name: (PR review) Get PR branch
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v3.0.0
-        id: comment-branch
-
-      - name: (PR review) Checkout PR branch
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ steps.comment-branch.outputs.head_ref }}
-
       - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: ${{ inputs.ref }}
 
       - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
@@ -230,14 +199,6 @@ jobs:
           max_attempts: 3
           command: make test-e2e-kubernetes
 
-      - name: (PR review) Set latest commit status as failure
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: failure() && github.event_name == 'pull_request_review'
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          status: 'failure'
-
   final-result:
     name: K8s E2E Suite
     runs-on: ubuntu-24.04
@@ -251,19 +212,6 @@ jobs:
     env:
       FAILED: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
     steps:
-      - name: (PR review) Get PR branch
-        if: github.event_name == 'pull_request_review' && env.FAILED != 'true'
-        uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v3.0.0
-        id: comment-branch
-
-      - name: (PR review) Submit PR result as success
-        if: github.event_name == 'pull_request_review' && env.FAILED != 'true'
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          status: 'success'
-
       - name: Check all jobs status
         run: |
           if [[ "${{ env.FAILED }}" == "true" ]]; then
diff --git a/.github/workflows/master_merge_queue.yml b/.github/workflows/master_merge_queue.yml
index b73039c209cb4..b5fff32db3377 100644
--- a/.github/workflows/master_merge_queue.yml
+++ b/.github/workflows/master_merge_queue.yml
@@ -20,7 +20,7 @@ on:
     types: [checks_requested]
 
 permissions:
-  statuses: write
+  contents: read
 
 concurrency:
   # `github.ref` is unique for MQ runs and PRs
diff --git a/.github/workflows/msrv.yml b/.github/workflows/msrv.yml
index a44bc1018627a..f209f7d4f4ffc 100644
--- a/.github/workflows/msrv.yml
+++ b/.github/workflows/msrv.yml
@@ -22,6 +22,8 @@ jobs:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: ${{ inputs.checkout_ref }}
-      - run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
-      - run: bash scripts/environment/prepare.sh --modules=cargo-msrv
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          cargo-msrv: true
       - run: cargo msrv verify
diff --git a/.github/workflows/test-make-command.yml b/.github/workflows/test-make-command.yml
index f36a3ca7b9f26..fe565bc486192 100644
--- a/.github/workflows/test-make-command.yml
+++ b/.github/workflows/test-make-command.yml
@@ -11,9 +11,14 @@ on:
         description: 'Display name for the job/status check'
         required: true
         type: string
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
+
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   run-make-command:
@@ -22,47 +27,14 @@ jobs:
     env:
       CARGO_INCREMENTAL: 0
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: ${{ inputs.job_name }}
-          status: pending
-
-      - name: (PR review) Checkout review SHA
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.review.commit_id }}
-
       - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
-      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
-        name: Cache Cargo registry + index
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
+          ref: ${{ inputs.ref }}
 
-      - run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
-      - run: bash scripts/environment/prepare.sh --modules=rustup
-      - run: echo "::add-matcher::.github/matchers/rust.json"
-      - run: make ${{ inputs.command }}
-
-      - name: (PR review) Set latest commit status as ${{ job.status }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: always() && github.event_name == 'pull_request_review'
+      - uses: ./.github/actions/setup
         with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: ${{ inputs.job_name }}
-          status: ${{ job.status }}
+          rust: true
+          protoc: true
+          libsasl2: true
+      - run: make ${{ inputs.command }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 40eb50d0267d5..ed5c8f7645ba6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -47,7 +47,7 @@ jobs:
         with:
           rust: true
           protoc: true
-      - run: sudo apt-get update && sudo apt-get install -y libsasl2-dev
+          libsasl2: true
       - run: make check-clippy
 
   test:
@@ -63,7 +63,7 @@ jobs:
           cargo-nextest: true
           datadog-ci: true
           protoc: true
-      - run: sudo apt-get update && sudo apt-get install -y libsasl2-dev
+          libsasl2: true
       - name: Unit Test
         run: make test
         env:
@@ -153,12 +153,12 @@ jobs:
     needs: changes
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - run: sudo apt-get update && sudo apt-get install -y libsasl2-dev
       - uses: ./.github/actions/setup
         with:
           rust: true
           protoc: true
           cue: true
+          libsasl2: true
       - run: make check-component-docs
 
   check-rust-docs:
diff --git a/.github/workflows/unit_mac.yml b/.github/workflows/unit_mac.yml
index ba96994b72110..e69390f2bd7df 100644
--- a/.github/workflows/unit_mac.yml
+++ b/.github/workflows/unit_mac.yml
@@ -2,9 +2,15 @@ name: Unit - Mac
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
+
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   unit-mac:
@@ -13,40 +19,16 @@ jobs:
     env:
       CARGO_INCREMENTAL: 0
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Unit - Mac
-          status: pending
-
-      - name: (PR review) Checkout PR branch
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.review.commit_id }}
-
       - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
-      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
-        name: Cache Cargo registry + index
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
+          ref: ${{ inputs.ref }}
 
-      - run: bash scripts/environment/bootstrap-macos.sh
-      - run: bash scripts/environment/prepare.sh --modules=cargo-nextest
-      - run: echo "::add-matcher::.github/matchers/rust.json"
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          cargo-nextest: true
+          protoc: true
 
       # Some tests e.g. `reader_exits_cleanly_when_writer_done_and_in_flight_acks` are flaky.
       - name: Run tests
@@ -57,12 +39,3 @@ jobs:
           command: make test
 
       - run: make test-behavior
-
-      - name: (PR review) Set latest commit status as ${{ job.status }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: always() && github.event_name == 'pull_request_review'
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Unit - Mac
-          status: ${{ job.status }}
diff --git a/.github/workflows/unit_windows.yml b/.github/workflows/unit_windows.yml
index d0d64040dcb51..879970c7d59f2 100644
--- a/.github/workflows/unit_windows.yml
+++ b/.github/workflows/unit_windows.yml
@@ -2,45 +2,28 @@ name: Unit - Windows
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
+
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   test-windows:
     runs-on: windows-2025-8core
     timeout-minutes: 60
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Unit - Windows
-          status: pending
-
-      - name: (PR review) Checkout PR branch
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.review.commit_id }}
-
       - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: ${{ inputs.ref }}
 
       - uses: actions/setup-python@v6
         with:
           python-version: "3.10"
       - run: .\scripts\environment\bootstrap-windows-2025.ps1
       - run: make test
-
-      - name: (PR review) Set latest commit status as ${{ job.status }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: always() && github.event_name == 'pull_request_review'
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Unit - Windows
-          status: ${{ job.status }}