diff --git a/.github/actions/playwright-install/action.yml b/.github/actions/playwright-install/action.yml
index 6af9cc878b..3a759b5b2c 100644
--- a/.github/actions/playwright-install/action.yml
+++ b/.github/actions/playwright-install/action.yml
@@ -10,7 +10,7 @@ runs:
       shell: bash
     - name: Cache Playwright browsers
       id: playwright-cache
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
       with:
         path: ~/.cache/ms-playwright
         key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
diff --git a/.github/actions/setup-docker/action.yml b/.github/actions/setup-docker/action.yml
deleted file mode 100644
index 71a2034751..0000000000
--- a/.github/actions/setup-docker/action.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: 'Setup Docker'
-description: 'Ensure Docker is installed (>= v25) and running.'
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Ensure Docker is installed and running
-      shell: bash
-      run: |
-        # -o DPkg::Lock::Timeout waits for the lock instead of failing (safe for parallel jobs)
-        # -o DPkg::Lock::Timeout waits for the lock instead of failing (safe for parallel jobs)
-        sudo apt-get install -y -o DPkg::Lock::Timeout=120 docker.io
-        sudo systemctl enable --now docker
-        # Wait for daemon to create the socket (systemctl returns before it's ready).
-        # Exits as soon as the socket appears; 10s is just the failure ceiling.
-        timeout 10 bash -c 'until [ -S /var/run/docker.sock ]; do sleep 0.5; done'
-        # usermod only takes effect in a new session; chmod the socket so the
-        # current process can reach the daemon immediately without re-login.
-        sudo chmod 666 /var/run/docker.sock
-        # Verify Docker is actually reachable
-        docker ps
diff --git a/.github/workflows/api-snapshot.yml b/.github/workflows/api-snapshot.yml
index bec39cc6bd..769d845a84 100644
--- a/.github/workflows/api-snapshot.yml
+++ b/.github/workflows/api-snapshot.yml
@@ -15,11 +15,10 @@ jobs:
   api-snapshot:
     name: API Snapshot
     runs-on: ubuntu-latest
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
diff --git a/.github/workflows/bencher-benchmarks-pr.yml b/.github/workflows/bencher-benchmarks-pr.yml
index 1d73287aec..b2515d927f 100644
--- a/.github/workflows/bencher-benchmarks-pr.yml
+++ b/.github/workflows/bencher-benchmarks-pr.yml
@@ -8,12 +8,17 @@ jobs:
   playwright-install:
     name: Install Playwright
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: self-hosted
+    permissions:
+      contents: read
+    runs-on: [self-hosted, benchmark]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
+          cache: 'npm'
       - run: npm ci
       - uses: ./.github/actions/playwright-install
 
@@ -49,4 +54,3 @@ jobs:
       base_sha: ${{ github.event.pull_request.base.sha }}
     secrets:
       BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
diff --git a/.github/workflows/bencher-benchmarks.yml b/.github/workflows/bencher-benchmarks.yml
index 717fe62696..c15ecd230c 100644
--- a/.github/workflows/bencher-benchmarks.yml
+++ b/.github/workflows/bencher-benchmarks.yml
@@ -7,9 +7,13 @@ on:
 jobs:
   playwright-install:
     name: Install Playwright
-    runs-on: self-hosted
+    permissions:
+      contents: read
+    runs-on: [self-hosted, benchmark]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
diff --git a/.github/workflows/bencher-file-sizes-pr.yml b/.github/workflows/bencher-file-sizes-pr.yml
index 0a04500a3b..2a2a0f8bcb 100644
--- a/.github/workflows/bencher-file-sizes-pr.yml
+++ b/.github/workflows/bencher-file-sizes-pr.yml
@@ -17,4 +17,3 @@ jobs:
       base_sha: ${{ github.event.pull_request.base.sha }}
     secrets:
       BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
diff --git a/.github/workflows/bundle-sizes.js.yml b/.github/workflows/bundle-sizes.js.yml
index 66c8f2f506..88669d16c4 100644
--- a/.github/workflows/bundle-sizes.js.yml
+++ b/.github/workflows/bundle-sizes.js.yml
@@ -6,12 +6,19 @@ on:
     paths:
       - 'packages/replicache/**'
 
+permissions:
+  contents: read
+
 jobs:
-  bundle-size:
-    name: Bundle Sizes Check
+  measure:
+    name: Measure bundle sizes
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -25,6 +32,31 @@ jobs:
         run: npx tsx tool/bundle-sizes.ts --bundles replicache.mjs replicache.mjs.br replicache.min.mjs replicache.min.mjs.br | tee bundle-sizes.json
         working-directory: packages/replicache
 
+      - name: Upload bundle size output
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: bundle-size-output
+          path: packages/replicache/bundle-sizes.json
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    name: Publish bundle sizes
+    needs: measure
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Download bundle size output
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: bundle-size-output
+          path: packages/replicache
+
       # Run `github-action-benchmark` action
       - name: Store bundle size
         uses: rhysd/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1
@@ -33,7 +65,7 @@ jobs:
           tool: 'customSmallerIsBetter'
           output-file-path: packages/replicache/bundle-sizes.json
           fail-on-alert: true
-          github-token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
+          github-token: ${{ github.token }}
           benchmark-data-dir-path: bundle-sizes
           auto-push: true
           alert-threshold: '105%'
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
deleted file mode 100644
index ef917ca03a..0000000000
--- a/.github/workflows/claude.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@51ea8ea73a139f2a74ff649e3092c25a904aed7e # v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://docs.claude.com/en/docs/claude-code/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr:*)'
diff --git a/.github/workflows/js.yml b/.github/workflows/js.yml
index d3cef9ee36..4be830bd22 100644
--- a/.github/workflows/js.yml
+++ b/.github/workflows/js.yml
@@ -18,17 +18,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
           cache: 'npm'
-      - run: npx syncpack lint
+      - run: npm ci
+      - run: npm exec -- syncpack lint
 
   verify-deps:
     name: Verify Package Dependencies
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -40,26 +45,25 @@ jobs:
     name: Oxfmt
     runs-on: ubuntu-latest
     needs: [syncpack, verify-deps]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
           cache: 'npm'
-      - run: npx oxfmt@^0.45.0 --check
+      - run: npm ci
+      - run: npm run check-format
 
   lint:
     name: Lint
     runs-on: ubuntu-latest
     needs: [syncpack, verify-deps]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -71,11 +75,10 @@ jobs:
     name: Check Types
     runs-on: ubuntu-latest
     needs: [syncpack, verify-deps]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -91,13 +94,11 @@ jobs:
       fail-fast: false
       matrix:
         shard: [1, 2, 3]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 100
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -116,21 +117,15 @@ jobs:
       matrix:
         pg-version: [18, 17, 16, 15]
         shard: [1, 2]
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 100
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
           cache: 'npm'
       - run: npm ci
       - name: Run tests
-        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
-        with:
-          timeout_minutes: 10
-          max_attempts: 3
-          command: TEST_PG_MODE=pg-${{ matrix.pg-version }} npm run test -- --shard=${{ matrix.shard }}/2
+        run: TEST_PG_MODE=pg-${{ matrix.pg-version }} npm run test -- --shard=${{ matrix.shard }}/2
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 00c6687eb9..4ffe721a93 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -4,22 +4,32 @@ on:
     branches:
       - 'main'
 
+permissions:
+  contents: read
+
 jobs:
   mirror_job:
     runs-on: ubuntu-latest
     name: Mirror main branch to sandbox and terabugs branch
     steps:
-      - name: Mirror main to sandbox
-        id: mirror-sandbox
-        uses: google/mirror-branch-action@30c52ee21f5d3bd7fb28b95501c11aae7f17eebb # v2.0
-        with:
-          github-token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
-          source: 'main'
-          dest: 'sandbox'
-      - name: Mirror main to terabugs
-        id: mirror-terabugs
-        uses: google/mirror-branch-action@30c52ee21f5d3bd7fb28b95501c11aae7f17eebb # v2.0
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          github-token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
-          source: 'main'
-          dest: 'terabugs'
+          client-id: ${{ vars.ROCICORP_MIRROR_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ROCICORP_MIRROR_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: mono
+          permission-contents: write
+
+      - name: Mirror main
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          for branch in sandbox terabugs; do
+            gh api \
+              --method PATCH \
+              "/repos/$GITHUB_REPOSITORY/git/refs/heads/$branch" \
+              -f "sha=$GITHUB_SHA" \
+              -F force=true
+          done
diff --git a/.github/workflows/perf-v2.js.yml b/.github/workflows/perf-v2.js.yml
index 45d3af559e..98b40aa886 100644
--- a/.github/workflows/perf-v2.js.yml
+++ b/.github/workflows/perf-v2.js.yml
@@ -9,12 +9,17 @@ on:
       - '.github/**'
       - 'package-lock.json'
 
+permissions:
+  contents: read
+
 jobs:
   playwright-install:
     name: Install Playwright
-    runs-on: self-hosted
+    runs-on: [self-hosted, benchmark]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -25,9 +30,13 @@ jobs:
   benchmark:
     name: Performance regression check
     needs: playwright-install
-    runs-on: self-hosted
+    permissions:
+      contents: read
+    runs-on: [self-hosted, benchmark]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
@@ -49,6 +58,33 @@ jobs:
           npx tsx tool/split-perf.ts perf-temp-output.json perf-v2-output.json perf-v2-p95-output.json
         shell: bash
 
+      - name: Upload benchmark outputs
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: perf-v2-results
+          path: |
+            packages/replicache-perf/perf-v2-output.json
+            packages/replicache-perf/perf-v2-p95-output.json
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    name: Publish performance results
+    needs: benchmark
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Download benchmark outputs
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: perf-v2-results
+          path: packages/replicache-perf
+
       # Disable git hooks so github-action-benchmark can commit to gh-pages
       # (the pre-commit hook references tools/ which doesn't exist on gh-pages)
       - run: git config core.hooksPath /dev/null
@@ -63,7 +99,7 @@ jobs:
           output-file-path: packages/replicache-perf/perf-v2-output.json
           # Workflow will fail when an alert happens
           fail-on-alert: true
-          github-token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
+          github-token: ${{ github.token }}
           benchmark-data-dir-path: perf-v2
           auto-push: true
           alert-threshold: '130%'
@@ -78,7 +114,7 @@ jobs:
           output-file-path: packages/replicache-perf/perf-v2-p95-output.json
           # Workflow will NOT fail when an alert happens
           fail-on-alert: false
-          github-token: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
+          github-token: ${{ github.token }}
           benchmark-data-dir-path: perf-v2/p95
           auto-push: true
           alert-threshold: '1000%'
diff --git a/.github/workflows/reusable-benchmark.yml b/.github/workflows/reusable-benchmark.yml
index 06b04b239a..dab5f483b9 100644
--- a/.github/workflows/reusable-benchmark.yml
+++ b/.github/workflows/reusable-benchmark.yml
@@ -11,6 +11,11 @@ on:
         required: true
         type: string
         description: 'Working directory (e.g., packages/zero-client)'
+      upload_results:
+        required: false
+        type: boolean
+        default: true
+        description: 'Whether to upload benchmark results to Bencher'
       ci_id:
         required: false
         type: string
@@ -34,28 +39,21 @@ on:
         description: 'Base SHA for PR runs'
     secrets:
       BENCHER_API_TOKEN:
-        required: true
-      TURBO_TOKEN:
         required: false
 
 jobs:
   benchmark:
     name: ${{ inputs.package_name }} Benchmarks
     permissions:
-      checks: write
-      pull-requests: write
-    runs-on: self-hosted
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
+      contents: read
+    runs-on: [self-hosted, benchmark]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
-      - uses: bencherdev/bencher@a495d2b34f9ab1f3b0f581848f85b389fb0bcda0 # main
-
-      - uses: ./.github/actions/setup-docker
 
       - run: npm ci
 
@@ -63,17 +61,45 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
         run: npm run --silent bench:bmf:silent > output.json
 
-      - name: Upload benchmark results (main)
+      - name: Upload benchmark output
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: benchmark-output-${{ inputs.package_name }}
+          path: ${{ inputs.working_directory }}/output.json
+          if-no-files-found: error
+          retention-days: 1
+
+  upload:
+    name: Upload ${{ inputs.package_name }} Benchmarks
+    if: ${{ inputs.upload_results }}
+    needs: benchmark
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
+    steps:
+      - name: Download benchmark output
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: benchmark-output-${{ inputs.package_name }}
+          path: benchmark-output
+
+      - uses: bencherdev/bencher@a495d2b34f9ab1f3b0f581848f85b389fb0bcda0 # main
+
+      - name: Upload benchmark results
         if: ${{ !inputs.is_pr }}
-        working-directory: ${{ inputs.working_directory }}
+        working-directory: benchmark-output
+        env:
+          BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           cat output.json |\
           bencher run \
           --project zero \
           --testbed self-hosted-metal \
-          --token '${{ secrets.BENCHER_API_TOKEN }}' \
+          --token "$BENCHER_API_TOKEN" \
           --adapter json \
-          --github-actions '${{ github.token }}' \
+          --github-actions "$GITHUB_TOKEN" \
           --start-point main \
           --threshold-measure throughput \
           --threshold-test t_test \
@@ -84,19 +110,26 @@ jobs:
 
       - name: Upload benchmark results (PR)
         if: ${{ inputs.is_pr }}
-        working-directory: ${{ inputs.working_directory }}
+        working-directory: benchmark-output
+        env:
+          BASE_REF: ${{ inputs.base_ref }}
+          BASE_SHA: ${{ inputs.base_sha }}
+          BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
+          CI_ID: ${{ inputs.ci_id }}
+          GITHUB_TOKEN: ${{ github.token }}
+          HEAD_REF: ${{ inputs.head_ref }}
         run: |
           cat output.json |\
           bencher run \
           --project zero \
           --testbed self-hosted-metal \
-          --token '${{ secrets.BENCHER_API_TOKEN }}' \
+          --token "$BENCHER_API_TOKEN" \
           --adapter json \
-          --github-actions '${{ github.token }}' \
-          --ci-id ${{ inputs.ci_id }} \
-          --branch "${{ inputs.head_ref }}" \
-          --start-point "${{ inputs.base_ref }}" \
-          --start-point-hash '${{ inputs.base_sha }}' \
+          --github-actions "$GITHUB_TOKEN" \
+          --ci-id "$CI_ID" \
+          --branch "$HEAD_REF" \
+          --start-point "$BASE_REF" \
+          --start-point-hash "$BASE_SHA" \
           --start-point-clone-thresholds \
           --start-point-reset \
           --threshold-measure throughput \
diff --git a/.github/workflows/reusable-file-sizes.yml b/.github/workflows/reusable-file-sizes.yml
index 8de048be77..42fefdffdb 100644
--- a/.github/workflows/reusable-file-sizes.yml
+++ b/.github/workflows/reusable-file-sizes.yml
@@ -3,6 +3,11 @@ name: Reusable File Sizes Workflow
 on:
   workflow_call:
     inputs:
+      upload_results:
+        required: false
+        type: boolean
+        default: true
+        description: 'Whether to upload file size results to Bencher'
       is_pr:
         required: false
         type: boolean
@@ -22,27 +27,22 @@ on:
         description: 'Base SHA for PR runs'
     secrets:
       BENCHER_API_TOKEN:
-        required: true
-      TURBO_TOKEN:
         required: false
 
 jobs:
-  file_sizes:
+  build_file_sizes:
     name: File Sizes
     permissions:
-      checks: write
-      pull-requests: write
+      contents: read
     runs-on: ubuntu-latest
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
           cache: 'npm'
-      - uses: bencherdev/bencher@a495d2b34f9ab1f3b0f581848f85b389fb0bcda0 # main
 
       - run: npm ci
       - run: npm run build
@@ -61,15 +61,46 @@ jobs:
         working-directory: packages/zero
         run: brotli out/zero.js
 
-      - name: Upload benchmarks results to bencher.dev (main)
+      - name: Upload file size outputs
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: file-size-output
+          path: |
+            packages/zero/out/zero-package.tgz
+            packages/zero/out/zero.js.br
+            packages/zero/out/zero.js
+          if-no-files-found: error
+          retention-days: 1
+
+  upload:
+    name: Upload File Sizes
+    if: ${{ inputs.upload_results }}
+    needs: build_file_sizes
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
+    steps:
+      - name: Download file size outputs
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: file-size-output
+          path: packages/zero/out
+
+      - uses: bencherdev/bencher@a495d2b34f9ab1f3b0f581848f85b389fb0bcda0 # main
+
+      - name: Upload benchmarks results to bencher.dev
         if: ${{ !inputs.is_pr }}
         working-directory: packages/zero
+        env:
+          BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           bencher run \
           --project zero \
-          --token '${{ secrets.BENCHER_API_TOKEN }}' \
+          --token "$BENCHER_API_TOKEN" \
           --adapter json \
-          --github-actions '${{ secrets.GITHUB_TOKEN }}' \
+          --github-actions "$GITHUB_TOKEN" \
           --start-point main \
           --threshold-measure file-size \
           --threshold-test percentage \
@@ -83,16 +114,22 @@ jobs:
       - name: Upload PR benchmarks results to bencher.dev
         if: ${{ inputs.is_pr }}
         working-directory: packages/zero
+        env:
+          BASE_REF: ${{ inputs.base_ref }}
+          BASE_SHA: ${{ inputs.base_sha }}
+          BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
+          HEAD_REF: ${{ inputs.head_ref }}
         run: |
           bencher run \
           --project zero \
-          --token '${{ secrets.BENCHER_API_TOKEN }}' \
+          --token "$BENCHER_API_TOKEN" \
           --adapter json \
-          --github-actions '${{ secrets.GITHUB_TOKEN }}' \
+          --github-actions "$GITHUB_TOKEN" \
           --ci-id size \
-          --branch "${{ inputs.head_ref }}" \
-          --start-point "${{ inputs.base_ref }}" \
-          --start-point-hash '${{ inputs.base_sha }}' \
+          --branch "$HEAD_REF" \
+          --start-point "$BASE_REF" \
+          --start-point-hash "$BASE_SHA" \
           --start-point-clone-thresholds \
           --start-point-reset \
           --threshold-measure file-size \
diff --git a/.github/workflows/sst-gigabugs-deploy.yml b/.github/workflows/sst-gigabugs-deploy.yml
index a5db41de95..b0e8ca8056 100644
--- a/.github/workflows/sst-gigabugs-deploy.yml
+++ b/.github/workflows/sst-gigabugs-deploy.yml
@@ -3,17 +3,26 @@ name: Build and Deploy Gigabugs Zero-Cache AWS SST
 on:
   push:
     branches: [gigabugs]
+
 env:
-  # Setting an environment variable with the value of a configuration variable
   ECR_IMAGE_ZERO_CACHE: zero-zgigabugs
   AWS_DEFAULT_REGION: ${{ vars.AWS_DEFAULT_REGION }}
+
 jobs:
-  deploy:
+  build:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+    outputs:
+      sha: ${{ steps.pack.outputs.sha }}
+      zero_version: ${{ steps.pack.outputs.zero_version }}
+      zero_sync_protocol_version: ${{ steps.protocols.outputs.ZERO_SYNC_PROTOCOL_VERSION }}
+      zero_min_supported_sync_protocol_version: ${{ steps.protocols.outputs.ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -21,60 +30,91 @@ jobs:
           node-version: 24.x
           cache: 'npm'
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_DEFAULT_REGION }}
-
-      - name: Set up QEMU for amd64
-        run: |
-          docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-        if: runner.os == 'Linux'
-
-      - name: Set up Docker for amd64
-        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
-        with:
-          platforms: linux/amd64
+      - name: Install dependencies
+        run: npm ci
 
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - name: Build packages
+        run: npx turbo run build
 
-      - name: Login to Amazon ECR
-        run: |
-          aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
-      - name: Install dependencies
-        run: |
-          npm run build-ci
       - name: Resolve Zero protocol versions
+        id: protocols
         run: |
           node --experimental-strip-types -e "
             import {PROTOCOL_VERSION, MIN_SERVER_SUPPORTED_SYNC_PROTOCOL} from './packages/zero-protocol/src/protocol-version.ts';
             console.log('ZERO_SYNC_PROTOCOL_VERSION=' + PROTOCOL_VERSION);
             console.log('ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION=' + MIN_SERVER_SUPPORTED_SYNC_PROTOCOL);
-          " >> "$GITHUB_ENV"
-      - name: Create package tarball
-        run: |
-          cd packages/zero
-          npm pack
-          cp rocicorp-zero-*.tgz ./pkgs/
-      - name: Get Git SHA
-        id: git-sha
-        run: echo "SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+          " >> "$GITHUB_OUTPUT"
+
       - name: Create package tarball
+        id: pack
         run: |
+          SHA="$(git rev-parse --short HEAD)"
           cd packages/zero
           npm pack
-          ZERO_TARBALL="$(ls rocicorp-zero-*.tgz | xargs -- basename -s .tgz)+${{ env.SHA }}.tgz"
+          ZERO_TARBALL="$(ls rocicorp-zero-*.tgz | xargs -- basename -s .tgz)+$SHA.tgz"
+          mkdir -p ./pkgs
           mv rocicorp-zero-*.tgz ./pkgs/$ZERO_TARBALL
-          echo "ZERO_VERSION=$ZERO_TARBALL" >> $GITHUB_ENV
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          echo "zero_version=$ZERO_TARBALL" >> "$GITHUB_OUTPUT"
+
+      - name: Upload package tarball
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: zero-package-${{ steps.pack.outputs.sha }}
+          path: packages/zero/pkgs/${{ steps.pack.outputs.zero_version }}
+          if-no-files-found: error
+          retention-days: 1
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24.x
+          package-manager-cache: false
+
+      - name: Download package tarball
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: zero-package-${{ needs.build.outputs.sha }}
+          path: packages/zero/pkgs
+
+      - name: Install deploy dependencies
+        working-directory: prod/sst
+        run: npm ci --ignore-scripts
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2
+        with:
+          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_GIGABUGS_ARN }}
+          role-session-name: github-actions-zero-gigabugs-deploy
+          aws-region: ${{ vars.AWS_DEFAULT_REGION }}
+
+      - name: Login to Amazon ECR
+        run: |
+          aws ecr get-login-password --region "$AWS_DEFAULT_REGION" | docker login --username AWS --password-stdin ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
+
       - name: Build and push Docker image
+        env:
+          ZERO_VERSION: ${{ needs.build.outputs.zero_version }}
+          ZERO_SYNC_PROTOCOL_VERSION: ${{ needs.build.outputs.zero_sync_protocol_version }}
+          ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION: ${{ needs.build.outputs.zero_min_supported_sync_protocol_version }}
+          SHA: ${{ needs.build.outputs.sha }}
         run: |
           cd packages/zero
-          docker buildx create --use
-          docker buildx inspect --bootstrap
-          docker buildx build --platform linux/amd64 --build-arg ZERO_VERSION=${{ env.ZERO_VERSION }} --build-arg ZERO_SYNC_PROTOCOL_VERSION=${{ env.ZERO_SYNC_PROTOCOL_VERSION }} --build-arg ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION=${{ env.ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION }} -t ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_IMAGE_ZERO_CACHE:${{ env.SHA }} -f ./Dockerfile --push .
+          DOCKER_BUILDKIT=1 docker build --platform linux/amd64 --build-arg ZERO_VERSION="$ZERO_VERSION" --build-arg ZERO_SYNC_PROTOCOL_VERSION="$ZERO_SYNC_PROTOCOL_VERSION" --build-arg ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION="$ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION" -t ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_IMAGE_ZERO_CACHE:$SHA -f ./Dockerfile .
+          docker push ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_IMAGE_ZERO_CACHE:$SHA
+
       - name: Deploy SST app
         env:
           ZERO_UPSTREAM_DB: ${{ secrets.GIGABUGS_ZERO_UPSTREAM_DB }}
@@ -86,15 +126,15 @@ jobs:
           ZERO_AUTH_JWK: ${{ secrets.GIGABUGS_ZERO_AUTH_JWK }}
           ZERO_APP_PUBLICATIONS: ${{ vars.GIGABUGS_ZERO_APP_PUBLICATIONS }}
           AWS_REGION: ${{ vars.AWS_DEFAULT_REGION }}
-          ZERO_IMAGE_URL: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_DEFAULT_REGION }}.amazonaws.com/${{ env.ECR_IMAGE_ZERO_CACHE }}:${{ env.SHA }}
+          ZERO_IMAGE_URL: ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_DEFAULT_REGION }}.amazonaws.com/${{ env.ECR_IMAGE_ZERO_CACHE }}:${{ needs.build.outputs.sha }}
           DOMAIN_NAME: 'zgigabugs-sync.rocicorp.dev'
           DOMAIN_CERT: 'arn:aws:acm:us-east-1:712907626835:certificate/83339ba0-dc7e-4fb7-b834-65e8307eeb4f'
           DATADOG_API_KEY: ${{ secrets.GIGABUGS_DATADOG_API_KEY }}
           ZERO_ADMIN_PASSWORD: ${{ secrets.ZERO_ADMIN_PASSWORD }}
         run: |
           cd prod/sst
-          npm install
           npx sst deploy --stage gigabugs-ebs
+
       - name: Deploy SST app non ebs
         env:
           ZERO_APP_ID: 'gigabugs1'
@@ -106,12 +146,11 @@ jobs:
           ZERO_CHANGE_DB: ${{ secrets.GIGABUGS_ZERO_CHANGE_DB }}2
           ZERO_AUTH_JWK: ${{ secrets.GIGABUGS_ZERO_AUTH_JWK }}
           AWS_REGION: ${{ vars.AWS_DEFAULT_REGION }}
-          ZERO_IMAGE_URL: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_DEFAULT_REGION }}.amazonaws.com/${{ env.ECR_IMAGE_ZERO_CACHE }}:${{ env.SHA }}
+          ZERO_IMAGE_URL: ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_DEFAULT_REGION }}.amazonaws.com/${{ env.ECR_IMAGE_ZERO_CACHE }}:${{ needs.build.outputs.sha }}
           DOMAIN_NAME: 'zgigabugs2-sync.rocicorp.dev'
           DOMAIN_CERT: 'arn:aws:acm:us-east-1:712907626835:certificate/b0dd8b0b-2007-42e7-b61d-6573b571b19c'
           DATADOG_API_KEY: ${{ secrets.GIGABUGS_DATADOG_API_KEY }}
           ZERO_ADMIN_PASSWORD: ${{ secrets.ZERO_ADMIN_PASSWORD }}
         run: |
           cd prod/sst
-          npm install
           npx sst deploy --stage gigabugs
diff --git a/.github/workflows/sst-prod-deploy.yml b/.github/workflows/sst-prod-deploy.yml
index d3e5968c5d..28c71e99e5 100644
--- a/.github/workflows/sst-prod-deploy.yml
+++ b/.github/workflows/sst-prod-deploy.yml
@@ -3,17 +3,26 @@ name: Build and Deploy Production Zero-Cache AWS SST
 on:
   push:
     branches: [main]
+
 env:
-  # Setting an environment variable with the value of a configuration variable
   ECR_IMAGE_ZERO_CACHE: zero-zbugs
   AWS_DEFAULT_REGION: ${{ vars.AWS_DEFAULT_REGION }}
+
 jobs:
-  deploy:
+  build:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+    outputs:
+      sha: ${{ steps.pack.outputs.sha }}
+      zero_version: ${{ steps.pack.outputs.zero_version }}
+      zero_sync_protocol_version: ${{ steps.protocols.outputs.ZERO_SYNC_PROTOCOL_VERSION }}
+      zero_min_supported_sync_protocol_version: ${{ steps.protocols.outputs.ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -21,55 +30,91 @@ jobs:
           node-version: 24.x
           cache: 'npm'
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_DEFAULT_REGION }}
-
-      - name: Set up QEMU for amd64
-        run: |
-          docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-        if: runner.os == 'Linux'
-
-      - name: Set up Docker for amd64
-        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
-        with:
-          platforms: linux/amd64
+      - name: Install dependencies
+        run: npm ci
 
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - name: Build packages
+        run: npx turbo run build
 
-      - name: Login to Amazon ECR
-        run: |
-          aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
-      - name: Install dependencies
-        run: |
-          npm run build-ci
       - name: Resolve Zero protocol versions
+        id: protocols
         run: |
           node --experimental-strip-types -e "
             import {PROTOCOL_VERSION, MIN_SERVER_SUPPORTED_SYNC_PROTOCOL} from './packages/zero-protocol/src/protocol-version.ts';
             console.log('ZERO_SYNC_PROTOCOL_VERSION=' + PROTOCOL_VERSION);
             console.log('ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION=' + MIN_SERVER_SUPPORTED_SYNC_PROTOCOL);
-          " >> "$GITHUB_ENV"
-      - name: Get Git SHA
-        id: git-sha
-        run: echo "SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+          " >> "$GITHUB_OUTPUT"
+
       - name: Create package tarball
+        id: pack
         run: |
+          SHA="$(git rev-parse --short HEAD)"
           cd packages/zero
           npm pack
-          ZERO_TARBALL="$(ls rocicorp-zero-*.tgz | xargs -- basename -s .tgz)+${{ env.SHA }}.tgz"
+          ZERO_TARBALL="$(ls rocicorp-zero-*.tgz | xargs -- basename -s .tgz)+$SHA.tgz"
+          mkdir -p ./pkgs
           mv rocicorp-zero-*.tgz ./pkgs/$ZERO_TARBALL
-          echo "ZERO_VERSION=$ZERO_TARBALL" >> $GITHUB_ENV
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          echo "zero_version=$ZERO_TARBALL" >> "$GITHUB_OUTPUT"
+
+      - name: Upload package tarball
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: zero-package-${{ steps.pack.outputs.sha }}
+          path: packages/zero/pkgs/${{ steps.pack.outputs.zero_version }}
+          if-no-files-found: error
+          retention-days: 1
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24.x
+          package-manager-cache: false
+
+      - name: Download package tarball
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: zero-package-${{ needs.build.outputs.sha }}
+          path: packages/zero/pkgs
+
+      - name: Install deploy dependencies
+        working-directory: prod/sst
+        run: npm ci --ignore-scripts
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2
+        with:
+          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_PROD_ARN }}
+          role-session-name: github-actions-zero-prod-deploy
+          aws-region: ${{ vars.AWS_DEFAULT_REGION }}
+
+      - name: Login to Amazon ECR
+        run: |
+          aws ecr get-login-password --region "$AWS_DEFAULT_REGION" | docker login --username AWS --password-stdin ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
+
       - name: Build and push Docker image
+        env:
+          ZERO_VERSION: ${{ needs.build.outputs.zero_version }}
+          ZERO_SYNC_PROTOCOL_VERSION: ${{ needs.build.outputs.zero_sync_protocol_version }}
+          ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION: ${{ needs.build.outputs.zero_min_supported_sync_protocol_version }}
+          SHA: ${{ needs.build.outputs.sha }}
         run: |
           cd packages/zero
-          docker buildx create --use
-          docker buildx inspect --bootstrap
-          docker buildx build --platform linux/amd64 --build-arg ZERO_VERSION=${{ env.ZERO_VERSION }} --build-arg ZERO_SYNC_PROTOCOL_VERSION=${{ env.ZERO_SYNC_PROTOCOL_VERSION }} --build-arg ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION=${{ env.ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION }} -t ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_IMAGE_ZERO_CACHE:${{ env.SHA }} -f ./Dockerfile --push .
+          DOCKER_BUILDKIT=1 docker build --platform linux/amd64 --build-arg ZERO_VERSION="$ZERO_VERSION" --build-arg ZERO_SYNC_PROTOCOL_VERSION="$ZERO_SYNC_PROTOCOL_VERSION" --build-arg ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION="$ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION" -t ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_IMAGE_ZERO_CACHE:$SHA -f ./Dockerfile .
+          docker push ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_IMAGE_ZERO_CACHE:$SHA
+
       - name: Deploy SST app
         env:
           ZERO_UPSTREAM_DB: ${{ secrets.PROD_ZERO_UPSTREAM_DB }}
@@ -82,7 +127,7 @@ jobs:
           ZERO_AUTH_JWK: ${{ secrets.PROD_ZERO_AUTH_JWK }}
           ZERO_APP_PUBLICATIONS: ${{ vars.PROD_ZERO_APP_PUBLICATIONS }}
           AWS_REGION: ${{ vars.AWS_DEFAULT_REGION }}
-          ZERO_IMAGE_URL: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_DEFAULT_REGION }}.amazonaws.com/${{ env.ECR_IMAGE_ZERO_CACHE }}:${{ env.SHA }}
+          ZERO_IMAGE_URL: ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_DEFAULT_REGION }}.amazonaws.com/${{ env.ECR_IMAGE_ZERO_CACHE }}:${{ needs.build.outputs.sha }}
           DOMAIN_NAME: 'zbugs-sync.rocicorp.dev'
           DOMAIN_CERT: ${{ vars.PROD_CERTIFICATE_ARN }}
           DATADOG_API_KEY: ${{ secrets.PROD_DATADOG_API_KEY }}
@@ -91,5 +136,4 @@ jobs:
           OTEL_RESOURCE_ATTRIBUTES: ${{ vars.PROD_OTEL_RESOURCE_ATTRIBUTES }}
         run: |
           cd prod/sst
-          npm install
           npx sst deploy --stage production
diff --git a/.github/workflows/sst-sandbox-deploy.yml b/.github/workflows/sst-sandbox-deploy.yml
index 9c2d2b8e91..b734c3e407 100644
--- a/.github/workflows/sst-sandbox-deploy.yml
+++ b/.github/workflows/sst-sandbox-deploy.yml
@@ -3,17 +3,26 @@ name: Build and Deploy Sandbox Zero-Cache AWS SST
 on:
   push:
     branches: [sandbox]
+
 env:
-  # Setting an environment variable with the value of a configuration variable
   ECR_IMAGE_ZERO_CACHE: zero-zbugs-sandbox
   AWS_DEFAULT_REGION: ${{ vars.AWS_DEFAULT_REGION }}
+
 jobs:
-  deploy:
+  build:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+    outputs:
+      sha: ${{ steps.pack.outputs.sha }}
+      zero_version: ${{ steps.pack.outputs.zero_version }}
+      zero_sync_protocol_version: ${{ steps.protocols.outputs.ZERO_SYNC_PROTOCOL_VERSION }}
+      zero_min_supported_sync_protocol_version: ${{ steps.protocols.outputs.ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -21,55 +30,91 @@ jobs:
           node-version: 24.x
           cache: 'npm'
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_DEFAULT_REGION }}
-
-      - name: Set up QEMU for amd64
-        run: |
-          docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-        if: runner.os == 'Linux'
-
-      - name: Set up Docker for amd64
-        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
-        with:
-          platforms: linux/amd64
+      - name: Install dependencies
+        run: npm ci
 
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - name: Build packages
+        run: npx turbo run build
 
-      - name: Login to Amazon ECR
-        run: |
-          aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
-      - name: Install dependencies
-        run: |
-          npm run build-ci
       - name: Resolve Zero protocol versions
+        id: protocols
         run: |
           node --experimental-strip-types -e "
             import {PROTOCOL_VERSION, MIN_SERVER_SUPPORTED_SYNC_PROTOCOL} from './packages/zero-protocol/src/protocol-version.ts';
             console.log('ZERO_SYNC_PROTOCOL_VERSION=' + PROTOCOL_VERSION);
             console.log('ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION=' + MIN_SERVER_SUPPORTED_SYNC_PROTOCOL);
-          " >> "$GITHUB_ENV"
-      - name: Get Git SHA
-        id: git-sha
-        run: echo "SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+          " >> "$GITHUB_OUTPUT"
+
       - name: Create package tarball
+        id: pack
         run: |
+          SHA="$(git rev-parse --short HEAD)"
           cd packages/zero
           npm pack
-          ZERO_TARBALL="$(ls rocicorp-zero-*.tgz | xargs -- basename -s .tgz)+${{ env.SHA }}.tgz"
+          ZERO_TARBALL="$(ls rocicorp-zero-*.tgz | xargs -- basename -s .tgz)+$SHA.tgz"
+          mkdir -p ./pkgs
           mv rocicorp-zero-*.tgz ./pkgs/$ZERO_TARBALL
-          echo "ZERO_VERSION=$ZERO_TARBALL" >> $GITHUB_ENV
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          echo "zero_version=$ZERO_TARBALL" >> "$GITHUB_OUTPUT"
+
+      - name: Upload package tarball
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: zero-package-${{ steps.pack.outputs.sha }}
+          path: packages/zero/pkgs/${{ steps.pack.outputs.zero_version }}
+          if-no-files-found: error
+          retention-days: 1
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24.x
+          package-manager-cache: false
+
+      - name: Download package tarball
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: zero-package-${{ needs.build.outputs.sha }}
+          path: packages/zero/pkgs
+
+      - name: Install deploy dependencies
+        working-directory: prod/sst
+        run: npm ci --ignore-scripts
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2
+        with:
+          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_SANDBOX_ARN }}
+          role-session-name: github-actions-zero-sandbox-deploy
+          aws-region: ${{ vars.AWS_DEFAULT_REGION }}
+
+      - name: Login to Amazon ECR
+        run: |
+          aws ecr get-login-password --region "$AWS_DEFAULT_REGION" | docker login --username AWS --password-stdin ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
+
       - name: Build and push Docker image
+        env:
+          ZERO_VERSION: ${{ needs.build.outputs.zero_version }}
+          ZERO_SYNC_PROTOCOL_VERSION: ${{ needs.build.outputs.zero_sync_protocol_version }}
+          ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION: ${{ needs.build.outputs.zero_min_supported_sync_protocol_version }}
+          SHA: ${{ needs.build.outputs.sha }}
         run: |
           cd packages/zero
-          docker buildx create --use
-          docker buildx inspect --bootstrap
-          docker buildx build --platform linux/amd64 --build-arg ZERO_VERSION=${{ env.ZERO_VERSION }} --build-arg ZERO_SYNC_PROTOCOL_VERSION=${{ env.ZERO_SYNC_PROTOCOL_VERSION }} --build-arg ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION=${{ env.ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION }} -t ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_IMAGE_ZERO_CACHE:${{ env.SHA }} -f ./Dockerfile --push .
+          DOCKER_BUILDKIT=1 docker build --platform linux/amd64 --build-arg ZERO_VERSION="$ZERO_VERSION" --build-arg ZERO_SYNC_PROTOCOL_VERSION="$ZERO_SYNC_PROTOCOL_VERSION" --build-arg ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION="$ZERO_MIN_SUPPORTED_SYNC_PROTOCOL_VERSION" -t ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_IMAGE_ZERO_CACHE:$SHA -f ./Dockerfile .
+          docker push ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_IMAGE_ZERO_CACHE:$SHA
+
       - name: Deploy SST app
         env:
           ZERO_UPSTREAM_DB: ${{ secrets.SANDBOX_ZERO_UPSTREAM_DB }}
@@ -81,12 +126,11 @@ jobs:
           ZERO_AUTH_JWK: ${{ secrets.SANDBOX_ZERO_AUTH_JWK }}
           ZERO_APP_PUBLICATIONS: ${{ vars.SANDBOX_ZERO_APP_PUBLICATIONS }}
           AWS_REGION: ${{ vars.AWS_DEFAULT_REGION }}
-          ZERO_IMAGE_URL: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_DEFAULT_REGION }}.amazonaws.com/${{ env.ECR_IMAGE_ZERO_CACHE }}:${{ env.SHA }}
+          ZERO_IMAGE_URL: ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_DEFAULT_REGION }}.amazonaws.com/${{ env.ECR_IMAGE_ZERO_CACHE }}:${{ needs.build.outputs.sha }}
           DOMAIN_NAME: 'zbugs-sync-sandbox.rocicorp.dev'
           DOMAIN_CERT: ${{ vars.SANDBOX_CERTIFICATE_ARN }}
           DATADOG_API_KEY: ${{ secrets.SANDBOX_DATADOG_API_KEY }}
           ZERO_ADMIN_PASSWORD: ${{ secrets.ZERO_ADMIN_PASSWORD }}
         run: |
           cd prod/sst
-          npm install
           npx sst deploy --stage sandbox
diff --git a/package.json b/package.json
index bbf6e31a75..4b0a287950 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,6 @@
     "check-format": "oxfmt --check",
     "check-types": "npx turbo run check-types",
     "check-types:watch": "npx turbo watch check-types",
-    "build-ci": "npm install && npx turbo run build",
     "start-zero-cache": "cd packages/zero-cache && npm run start",
     "verify-deps": "cd tools/verify-package-deps && npm run verify",
     "verify-deps:fix": "cd tools/verify-package-deps && npm run verify:fix",
diff --git a/packages/replicache/.github/workflows/upload-release-assets.yml b/packages/replicache/.github/workflows/upload-release-assets.yml
index 47ea7c45b1..c59971ca7a 100644
--- a/packages/replicache/.github/workflows/upload-release-assets.yml
+++ b/packages/replicache/.github/workflows/upload-release-assets.yml
@@ -8,10 +8,6 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: rocicorp
-      TURBO_REMOTE_ONLY: true
     steps:
       - uses: actions/checkout@v6