diff --git a/.github/docker/wolfcose-ci/Dockerfile b/.github/docker/wolfcose-ci/Dockerfile
new file mode 100644
index 0000000..95abfed
--- /dev/null
+++ b/.github/docker/wolfcose-ci/Dockerfile
@@ -0,0 +1,61 @@
+# Shared dependencies for wolfCOSE Linux CI. Rebuild through publish-ci-image.yml.
+FROM ubuntu:24.04
+
+LABEL org.opencontainers.image.source="https://github.com/wolfSSL/wolfCOSE" \
+      org.opencontainers.image.description="wolfCOSE Linux CI toolchains and test dependencies" \
+      org.opencontainers.image.licenses="GPL-3.0-or-later"
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    RUSTUP_HOME=/opt/rustup \
+    CARGO_HOME=/opt/cargo \
+    PATH=/opt/python-cwt/bin:/opt/ci-tools/bin:/usr/local/go/bin:/opt/cargo/bin:$PATH
+
+# Package installation belongs here, rather than in individual CI jobs.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        build-essential gcc-11 gcc-12 gcc-13 \
+        clang clang-14 clang-15 clang-17 clang-tools clang-tidy \
+        libclang-rt-18-dev cppcheck=2.13.0-2ubuntu3 \
+        autoconf automake libtool libtool-bin pkg-config m4 \
+        libssl-dev libffi-dev \
+        lcov bc valgrind \
+        git gh curl ca-certificates jq \
+        python3 python3-dev python3-pip python3-venv \
+        zip unzip xz-utils zstd file procps \
+    && rm -rf /var/lib/apt/lists/*
+
+# Preserve the existing Go 1.24.x and stable Rust policies, resolved at image
+# build time rather than downloaded in every interop job.
+RUN curl --fail --silent --show-error --location \
+        'https://go.dev/dl/?mode=json&include=all' -o /tmp/go-releases.json \
+    && read -r go_archive go_sha < <(jq -r \
+        '[.[] | select(.stable and (.version | test("^go1\\.24\\.[0-9]+$")))] \
+         | first | .files[] \
+         | select(.os == "linux" and .arch == "amd64" and .kind == "archive") \
+         | [.filename, .sha256] | @tsv' /tmp/go-releases.json) \
+    && test -n "$go_archive" && test -n "$go_sha" \
+    && curl --fail --silent --show-error --location \
+        "https://go.dev/dl/$go_archive" -o /tmp/go.tar.gz \
+    && echo "$go_sha  /tmp/go.tar.gz" | sha256sum --check - \
+    && tar -xzf /tmp/go.tar.gz -C /usr/local \
+    && rm /tmp/go.tar.gz /tmp/go-releases.json
+
+RUN curl --fail --silent --show-error --location \
+        https://sh.rustup.rs -o /tmp/rustup-init.sh \
+    && sh /tmp/rustup-init.sh -y --profile minimal \
+        --default-toolchain stable --no-modify-path \
+    && rm /tmp/rustup-init.sh
+
+# Keep the pinned interop environment independent of analysis-tool dependencies.
+COPY tests/interop/python_cwt/requirements.txt /tmp/python-cwt-requirements.txt
+RUN python3 -m venv /opt/python-cwt \
+    && /opt/python-cwt/bin/python -m pip install --no-cache-dir \
+        --requirement /tmp/python-cwt-requirements.txt \
+    && python3 -m venv /opt/ci-tools \
+    && /opt/ci-tools/bin/python -m pip install --no-cache-dir semgrep codespell \
+    && rm /tmp/python-cwt-requirements.txt
+
+COPY .github/docker/wolfcose-ci/smoke-test.sh /usr/local/bin/wolfcose-ci-smoke
+RUN chmod +x /usr/local/bin/wolfcose-ci-smoke && wolfcose-ci-smoke
diff --git a/.github/docker/wolfcose-ci/Dockerfile.dockerignore b/.github/docker/wolfcose-ci/Dockerfile.dockerignore
new file mode 100644
index 0000000..f7fdea8
--- /dev/null
+++ b/.github/docker/wolfcose-ci/Dockerfile.dockerignore
@@ -0,0 +1,10 @@
+# Only send the image assets and pinned Python peer requirements to Docker.
+**
+!.github/
+!.github/docker/
+!.github/docker/wolfcose-ci/
+!.github/docker/wolfcose-ci/**
+!tests/
+!tests/interop/
+!tests/interop/python_cwt/
+!tests/interop/python_cwt/requirements.txt
diff --git a/.github/docker/wolfcose-ci/README.md b/.github/docker/wolfcose-ci/README.md
new file mode 100644
index 0000000..e398814
--- /dev/null
+++ b/.github/docker/wolfcose-ci/README.md
@@ -0,0 +1,49 @@
+# wolfCOSE CI image
+
+Linux workflows pin `ghcr.io/wolfssl/wolfcose-ci` by its immutable image digest.
+Native macOS builds retain their Homebrew dependencies. The image contains the
+C compiler matrix, analysis and coverage tools, Go 1.24.x, stable Rust, and
+Python 3.12 peers.
+The GitHub CLI supports the existing wiki publishing action.
+Python interop requirements come from the existing pinned requirements file;
+Semgrep and Codespell use a separate environment.
+
+From the repository root:
+
+```sh
+docker build --platform linux/amd64 \
+    -f .github/docker/wolfcose-ci/Dockerfile -t wolfcose-ci .
+docker run --rm --platform linux/amd64 wolfcose-ci wolfcose-ci-smoke
+```
+
+The Dockerfile-specific ignore file restricts the build context to image assets
+and Python interop requirements. Add shared dependencies here instead of
+installing them in workflow jobs. Go patch releases, stable Rust, Semgrep, and
+Codespell are resolved when the image is rebuilt.
+
+In `wolfSSL/wolfCOSE`, `publish-ci-image.yml` runs on relevant pushes to
+`main` and manual dispatches targeting `main`. Publication is restricted to
+`refs/heads/main`. It builds and smoke-tests the image, then publishes
+`latest` and `sha-<commit>` tags. Publication is serialized and uses the
+repository's `GITHUB_TOKEN`. The GHCR package must be public so fork PRs can
+pull anonymously.
+
+After publishing, a container job uses the build's output digest to repeat the
+smoke checks in the GitHub runner environment and exercises the wiki action in
+dry-run mode without publishing documentation.
+
+Consumers should never fall back to building the image or installing packages.
+
+Container jobs trust the mounted GitHub workspace after checkout so Git can
+read a repository owned by the host runner. Their explicit Bash command keeps
+the previous host shell's error behavior.
+
+Linux wolfSSL caches use the `wolfcose-ci-v1` prefix to separate them from
+previous host builds. Bump this prefix if an image change makes cached builds
+incompatible.
+
+To adopt a rebuilt image, inspect its `sha-<commit>` tag with
+`docker buildx imagetools inspect` and copy the reported image digest into the
+consumer workflows in a reviewed change. The publisher's smoke job tests the
+new digest immediately, while consumer jobs keep using their reviewed digest.
+To roll back, restore the previous digest in those workflows.
diff --git a/.github/docker/wolfcose-ci/smoke-test.sh b/.github/docker/wolfcose-ci/smoke-test.sh
new file mode 100644
index 0000000..45ec4cd
--- /dev/null
+++ b/.github/docker/wolfcose-ci/smoke-test.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+# Exercise the installed toolchains before an image is published.
+set -euo pipefail
+
+smoke_dir=$(mktemp -d)
+trap 'rm -rf "$smoke_dir"' EXIT
+cat > "$smoke_dir/main.c" <<'EOF'
+int main(void)
+{
+    return 0;
+}
+EOF
+
+for compiler in gcc gcc-11 gcc-12 gcc-13 clang clang-14 clang-15 clang-17; do
+    "$compiler" --version | head -n 1
+    "$compiler" -std=c99 -Wall -Wextra -Werror "$smoke_dir/main.c" \
+        -o "$smoke_dir/compiler-test"
+    "$smoke_dir/compiler-test"
+done
+
+test "$(cppcheck --version)" = 'Cppcheck 2.13.0'
+cppcheck --addon=misra --error-exitcode=1 "$smoke_dir/main.c"
+for tool in autoconf automake libtool pkg-config clang-tidy scan-build \
+            lcov bc valgrind git gh curl jq zip unzip; do
+    command -v "$tool"
+done
+pkg-config --exists openssl
+go version
+rustc --version
+cargo --version
+python -c 'import sys; assert sys.version_info[:2] == (3, 12); import cbor2, cwt, cryptography, pyhpke'
+python -m pip check
+/opt/ci-tools/bin/python -m pip check
+semgrep --version
+codespell --version
diff --git a/.github/workflows/_resolve-wolfssl.yml b/.github/workflows/_resolve-wolfssl.yml
index 36a9d56..c0e4ec2 100644
--- a/.github/workflows/_resolve-wolfssl.yml
+++ b/.github/workflows/_resolve-wolfssl.yml
@@ -19,10 +19,16 @@ on:
 permissions:
   contents: read
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   resolve:
     name: Resolve wolfSSL version matrix
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
       refs: ${{ steps.set-matrix.outputs.refs }}
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 46e308c..48cf8b1 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -11,6 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   discover:
     uses: ./.github/workflows/_resolve-wolfssl.yml
@@ -19,20 +23,24 @@ jobs:
     name: ${{ matrix.os }} (wolfSSL ${{ matrix.wolfssl-ref }})
     needs: discover
     runs-on: ${{ matrix.os }}
+    container: ${{ matrix.container }}
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, ubuntu-22.04, macos-latest]
+        os: [ubuntu-latest, macos-latest]
         wolfssl-ref: ${{ fromJson(needs.discover.outputs.refs) }}
+        include:
+          - os: ubuntu-latest
+            container: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
+          - os: macos-latest
+            container: ''
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies (Linux)
+    - name: Trust workspace
       if: runner.os == 'Linux'
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Install dependencies (macOS)
       if: runner.os == 'macOS'
@@ -44,7 +52,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-${{ matrix.os }}-${{ matrix.wolfssl-ref }}-v5-lms
+        key: ${{ runner.os == 'Linux' && 'wolfcose-ci-v1-' || '' }}wolfssl-${{ matrix.os }}-${{ matrix.wolfssl-ref }}-v5-lms
 
     - name: Build wolfSSL (${{ matrix.wolfssl-ref }})
       if: matrix.wolfssl-ref == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
@@ -208,6 +216,8 @@ jobs:
     name: LMS lean profiles (wolfSSL ${{ matrix.wolfssl-ref }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix:
@@ -216,10 +226,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (${{ matrix.wolfssl-ref }})
       if: matrix.wolfssl-ref != 'master'
@@ -227,7 +236,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-ubuntu-latest-${{ matrix.wolfssl-ref }}-v5-lms
+        key: wolfcose-ci-v1-wolfssl-ubuntu-latest-${{ matrix.wolfssl-ref }}-v5-lms
 
     - name: Build wolfSSL (${{ matrix.wolfssl-ref }})
       if: matrix.wolfssl-ref == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
@@ -282,14 +291,15 @@ jobs:
   lms-verify-only:
     name: LMS verify-only wolfSSL profile
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     # Build wolfSSL with LMS support that cannot sign, mirroring a verifier
     # deployment. --enable-lms=verify-only records WOLFSSL_LMS_VERIFY_ONLY in
@@ -342,6 +352,8 @@ jobs:
     name: Code Coverage (wolfSSL ${{ matrix.wolfssl-version }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.discover.outputs.matrix) }}
@@ -349,10 +361,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool lcov
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version != 'master'
@@ -360,7 +371,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-coverage-${{ matrix.wolfssl-version }}-v5-lms
+        key: wolfcose-ci-v1-wolfssl-coverage-${{ matrix.wolfssl-version }}-v5-lms
 
     - name: Build wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/c99-compliance.yml b/.github/workflows/c99-compliance.yml
index 9afa262..7262432 100644
--- a/.github/workflows/c99-compliance.yml
+++ b/.github/workflows/c99-compliance.yml
@@ -11,10 +11,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   c99-check:
     name: ISO C99 conformance (${{ matrix.cc }})
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix:
@@ -23,10 +29,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -36,7 +41,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-ubuntu-latest-v3-full-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v3-full-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/cmdline-test.yml b/.github/workflows/cmdline-test.yml
index 64f39aa..9ac4460 100644
--- a/.github/workflows/cmdline-test.yml
+++ b/.github/workflows/cmdline-test.yml
@@ -11,6 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   discover:
     uses: ./.github/workflows/_resolve-wolfssl.yml
@@ -19,6 +23,8 @@ jobs:
     name: Command-line tool (wolfSSL ${{ matrix.wolfssl-version }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.discover.outputs.matrix) }}
@@ -26,10 +32,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version != 'master'
@@ -37,7 +42,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-clitest-${{ matrix.wolfssl-version }}-v3
+        key: wolfcose-ci-v1-wolfssl-clitest-${{ matrix.wolfssl-version }}-v3
 
     - name: Build wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0c8ebf3..d612c08 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,18 +17,23 @@ permissions:
   # Required so CodeQL can upload findings to the Security tab.
   security-events: write
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   analyze:
     name: CodeQL (C, security)
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y autoconf automake libtool
+      - name: Trust workspace
+        if: runner.os == 'Linux'
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       # Full-feature wolfSSL so every wolfCOSE code path is compiled and
       # therefore visible to CodeQL.
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 1855d6c..648e3f6 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -11,18 +11,26 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   codespell:
     name: Check for spelling errors
     runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
 
+      - name: Trust workspace
+        if: runner.os == 'Linux'
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Run codespell
-        uses: codespell-project/actions-codespell@v2.1
-        with:
-          check_filenames: true
-          check_hidden: true
-          ignore_words_list: adin,aNULL,cLen,dout,haveA,inOut,inout,parm,parms,ser,siz,te,Te,bstr,tstr,uint
-          skip: '.git'
+        run: |
+          codespell --check-filenames --check-hidden \
+            --ignore-words-list='adin,aNULL,cLen,dout,haveA,inOut,inout,parm,parms,ser,siz,te,Te,bstr,tstr,uint' \
+            --skip='.git' .
diff --git a/.github/workflows/comprehensive-tests.yml b/.github/workflows/comprehensive-tests.yml
index 42b28af..8fffdd2 100644
--- a/.github/workflows/comprehensive-tests.yml
+++ b/.github/workflows/comprehensive-tests.yml
@@ -11,6 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   discover:
     uses: ./.github/workflows/_resolve-wolfssl.yml
@@ -19,6 +23,8 @@ jobs:
     name: Algorithm Matrix Tests (wolfSSL ${{ matrix.wolfssl-version }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.discover.outputs.matrix) }}
@@ -26,10 +32,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version != 'master'
@@ -37,7 +42,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-comprehensive-${{ matrix.wolfssl-version }}-v1
+        key: wolfcose-ci-v1-wolfssl-comprehensive-${{ matrix.wolfssl-version }}-v1
 
     - name: Build wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/cose-hpke.yml b/.github/workflows/cose-hpke.yml
index 922324d..4a80779 100644
--- a/.github/workflows/cose-hpke.yml
+++ b/.github/workflows/cose-hpke.yml
@@ -14,6 +14,10 @@ concurrency:
 permissions:
   contents: read
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   discover:
     uses: ./.github/workflows/_resolve-wolfssl.yml
@@ -22,6 +26,8 @@ jobs:
     name: HPKE P0 (${{ matrix.wolfssl-ref }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix:
@@ -30,10 +36,9 @@ jobs:
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Build HPKE-enabled wolfSSL
       run: |
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 414ed05..5929715 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -11,17 +11,22 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   coverage:
     name: Line Coverage
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool lcov
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -35,7 +40,7 @@ jobs:
         # ubuntu-latest key but configure wolfSSL without aeskeywrap, and a
         # cache hit on such a build silently skips the KEY_WRAP tests. The
         # -lms suffix distinguishes the LMS-enabled coverage build.
-        key: wolfssl-coverage-fullcfg-lms-v1-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-coverage-fullcfg-lms-v1-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 7eecd5a..bdf12eb 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -9,10 +9,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   coverity:
     name: Coverity Scan
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     # Only run from the original repo, not forks
     if: github.repository == 'wolfSSL/wolfCOSE'
@@ -20,10 +26,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -33,7 +38,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-coverity-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-coverity-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL (latest stable + master, PQC-gated)
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/empty-brace-scan.yml b/.github/workflows/empty-brace-scan.yml
index 9ce5d2b..df07a43 100644
--- a/.github/workflows/empty-brace-scan.yml
+++ b/.github/workflows/empty-brace-scan.yml
@@ -11,14 +11,24 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   empty-brace-scan:
     name: Empty Brace Scope Scan
     runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
 
+      - name: Trust workspace
+        if: runner.os == 'Linux'
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Check for bare C scope blocks
         run: |
           # Bare scope blocks are disallowed. If one is truly required, document
diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml
index 4b85a06..f5c0d08 100644
--- a/.github/workflows/examples.yml
+++ b/.github/workflows/examples.yml
@@ -11,6 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   discover:
     uses: ./.github/workflows/_resolve-wolfssl.yml
@@ -19,6 +23,8 @@ jobs:
     name: Examples (wolfSSL ${{ matrix.wolfssl-version }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.discover.outputs.matrix) }}
@@ -26,10 +32,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version != 'master'
@@ -37,7 +42,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-examples-${{ matrix.wolfssl-version }}-v1
+        key: wolfcose-ci-v1-wolfssl-examples-${{ matrix.wolfssl-version }}-v1
 
     - name: Build wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/house-style.yml b/.github/workflows/house-style.yml
index 5d77bf7..20fa838 100644
--- a/.github/workflows/house-style.yml
+++ b/.github/workflows/house-style.yml
@@ -14,12 +14,23 @@ concurrency:
 permissions:
   contents: read
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   house-style:
     name: wolfCOSE house-style conventions
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
+
+      - name: Trust workspace
+        if: runner.os == 'Linux'
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Check conventions (no goto, C-style comments, banner style, no tabs/trailing space)
         run: sh scripts/check_house_style.sh
diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml
index 2790da9..0ca5260 100644
--- a/.github/workflows/interop.yml
+++ b/.github/workflows/interop.yml
@@ -18,6 +18,10 @@ env:
   TCOSE_SHA: ff4c5f7c6fbbe27bb582214ff1878bf58ebc6c43
   QCBOR_SHA: 930708bb86481e88879eb1d87fd4d664f1d69503
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   discover:
     uses: ./.github/workflows/_resolve-wolfssl.yml
@@ -26,6 +30,8 @@ jobs:
     name: COSE and PSA/EAT interoperability (OpenSSL, wolfSSL ${{ matrix.wolfssl-version }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     # All external peers share this job and its wolfSSL build. Keeping them
     # together avoids repeating the matrix setup for short interop commands.
     strategy:
@@ -35,31 +41,17 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Set up Go for go-cose interop
-      uses: actions/setup-go@v5
-      with:
-        go-version: '1.24.x'
-        cache-dependency-path: tests/interop/go_cose/go.sum
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
-    - name: Set up Python for python-cwt interop
-      uses: actions/setup-python@v5
+    - name: Cache Go interop dependencies
+      uses: actions/cache@v4
       with:
-        python-version: '3.12'
-        cache: pip
-        cache-dependency-path: tests/interop/python_cwt/requirements.txt
-
-    - name: Set up Rust for coset interop
-      uses: dtolnay/rust-toolchain@stable
-
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool libssl-dev
-
-    - name: Install python-cwt peer
-      run: |
-        python -m pip install --disable-pip-version-check \
-            --requirement tests/interop/python_cwt/requirements.txt
+        path: |
+          ~/go/pkg/mod
+          ~/.cache/go-build
+        key: wolfcose-ci-v1-go1.24-${{ hashFiles('tests/interop/go_cose/go.sum') }}
 
     - name: Cache wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version != 'master'
@@ -67,7 +59,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-interop-${{ matrix.wolfssl-version }}-v1
+        key: wolfcose-ci-v1-wolfssl-interop-${{ matrix.wolfssl-version }}-v1
 
     - name: Build wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/lean-build.yml b/.github/workflows/lean-build.yml
index c1f4a00..1976915 100644
--- a/.github/workflows/lean-build.yml
+++ b/.github/workflows/lean-build.yml
@@ -11,18 +11,23 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   lean-verify:
     name: Lean verify-only (WOLFCOSE_LEAN_VERIFY)
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -33,7 +38,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-lean
-        key: wolfssl-lean-tfm-verifyonly-v3-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-lean-tfm-verifyonly-v3-${{ steps.wolfssl-rev.outputs.sha }}
 
     # Verify-only full-#tfm backend: NO_ECC_SIGN compiles ECDSA signing out.
     # This catches a verification path that accidentally pulls in a signing
@@ -105,14 +110,15 @@ jobs:
   lean-compile-matrix:
     name: Lean configs compile clean (strict)
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -123,7 +129,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-ubuntu-latest-v3-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v3-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL (full features)
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
@@ -196,14 +202,15 @@ jobs:
   mldsa:
     name: Post-quantum ML-DSA lean sign+verify and verify-only
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -214,7 +221,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-mldsa
-        key: wolfssl-mldsa-v1-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-mldsa-v1-${{ steps.wolfssl-rev.outputs.sha }}
 
     # ML-DSA (FIPS 204) backend. Dilithium pulls in SHAKE/SHA-3; RNG stays for
     # key generation and signing in the sign+verify demo.
diff --git a/.github/workflows/minimal-build.yml b/.github/workflows/minimal-build.yml
index dd4977c..cbffd95 100644
--- a/.github/workflows/minimal-build.yml
+++ b/.github/workflows/minimal-build.yml
@@ -11,10 +11,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   minimal:
     name: ${{ matrix.name }}
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix:
@@ -73,10 +79,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -87,7 +92,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-minimal
-        key: ${{ matrix.cache_key }}-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-${{ matrix.cache_key }}-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL (${{ matrix.name }})
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/misra-2012.yml b/.github/workflows/misra-2012.yml
index 398b60c..07f4947 100644
--- a/.github/workflows/misra-2012.yml
+++ b/.github/workflows/misra-2012.yml
@@ -14,10 +14,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   misra-cppcheck:
     name: MISRA C 2012 (cppcheck)
     runs-on: ubuntu-24.04
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     env:
       WOLFSSL_REF: ac01707f552c611fbd135cc723b2682b3e7f80f2
@@ -28,10 +34,12 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install cppcheck
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+    - name: Check cppcheck version
       run: |
-        sudo apt-get update
-        sudo apt-get install -y cppcheck autoconf automake libtool
         CPPCHECK_VERSION=$(cppcheck --version)
         if [ "$CPPCHECK_VERSION" != "Cppcheck 2.13.0" ]; then
           echo "::error::expected Cppcheck 2.13.0, got $CPPCHECK_VERSION"
@@ -43,7 +51,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-ubuntu-24.04-v6-lms-hpke-${{ env.WOLFSSL_REF }}
+        key: wolfcose-ci-v1-wolfssl-ubuntu-24.04-v6-lms-hpke-${{ env.WOLFSSL_REF }}
 
     - name: Build wolfSSL
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/misra-2023.yml b/.github/workflows/misra-2023.yml
index 2df20b8..a1772a4 100644
--- a/.github/workflows/misra-2023.yml
+++ b/.github/workflows/misra-2023.yml
@@ -15,6 +15,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   # ---------------------------------------------------------------------------
   # Job 1: Strict compiler warnings for MISRA C 2023 essential type &
@@ -23,14 +27,15 @@ jobs:
   misra-compiler-warnings:
     name: MISRA C 2023 Compiler Warnings
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -40,7 +45,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
@@ -162,14 +167,15 @@ jobs:
   misra-clang-tidy:
     name: MISRA C 2023 (clang-tidy)
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y clang-tidy autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -179,7 +185,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/multi-compiler.yml b/.github/workflows/multi-compiler.yml
index 6bcfa43..5bffcd9 100644
--- a/.github/workflows/multi-compiler.yml
+++ b/.github/workflows/multi-compiler.yml
@@ -11,6 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   discover:
     uses: ./.github/workflows/_resolve-wolfssl.yml
@@ -19,6 +23,8 @@ jobs:
     name: ${{ matrix.cc }} (wolfSSL ${{ matrix.wolfssl-ref }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix:
@@ -28,10 +34,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install compiler
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool ${{ matrix.cc }}
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (${{ matrix.wolfssl-ref }})
       if: matrix.wolfssl-ref != 'master'
@@ -39,7 +44,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-multicompiler-${{ matrix.wolfssl-ref }}-v1
+        key: wolfcose-ci-v1-wolfssl-multicompiler-${{ matrix.wolfssl-ref }}-v1
 
     - name: Build wolfSSL (${{ matrix.wolfssl-ref }})
       if: matrix.wolfssl-ref == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index c0e8dbb..a5a7182 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -10,10 +10,16 @@ permissions:
   actions: write
   issues: write
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   trigger:
     name: Trigger All CI Workflows
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     if: github.repository == 'wolfSSL/wolfCOSE'
 
     steps:
diff --git a/.github/workflows/publish-ci-image.yml b/.github/workflows/publish-ci-image.yml
new file mode 100644
index 0000000..6deb8f0
--- /dev/null
+++ b/.github/workflows/publish-ci-image.yml
@@ -0,0 +1,74 @@
+name: Publish CI image
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '.github/docker/wolfcose-ci/**'
+      - '.github/workflows/publish-ci-image.yml'
+      - 'tests/interop/python_cwt/requirements.txt'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-ci-image
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish CI image
+    if: github.repository == 'wolfSSL/wolfCOSE' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build, smoke-test, and push image
+        id: build
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          file: .github/docker/wolfcose-ci/Dockerfile
+          platforms: linux/amd64
+          pull: true
+          push: true
+          tags: |
+            ghcr.io/wolfssl/wolfcose-ci:latest
+            ghcr.io/wolfssl/wolfcose-ci:sha-${{ github.sha }}
+          labels: org.opencontainers.image.revision=${{ github.sha }}
+          cache-from: type=registry,ref=ghcr.io/wolfssl/wolfcose-ci:latest
+          cache-to: type=inline
+
+  smoke:
+    name: Test published CI image
+    needs: publish
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@${{ needs.publish.outputs.digest }}
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: bash -e {0}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Exercise installed tools
+        run: wolfcose-ci-smoke
+      - name: Trust workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: Check wiki publishing dependencies
+        uses: Andrew-Chen-Wang/github-wiki-action@50650fccf3a10f741995523cf9708c53cec8912a # v4
+        with:
+          path: docs/
+          dry-run: true
diff --git a/.github/workflows/release-prep.yml b/.github/workflows/release-prep.yml
index 8dadf91..27261f4 100644
--- a/.github/workflows/release-prep.yml
+++ b/.github/workflows/release-prep.yml
@@ -20,6 +20,10 @@ permissions:
   checks: read
   pull-requests: read
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   metadata:
     name: Release metadata
@@ -27,6 +31,8 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       github.event.label.name == 'ci:release'
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     outputs:
       version: ${{ steps.release.outputs.version }}
       commit: ${{ steps.release.outputs.commit }}
@@ -37,6 +43,10 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
 
+      - name: Trust workspace
+        if: runner.os == 'Linux'
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Resolve release version and commit
         id: release
         env:
@@ -68,6 +78,8 @@ jobs:
     name: Release-specific qualification
     needs: metadata
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v4
@@ -75,11 +87,12 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
 
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y autoconf automake g++ lcov libtool \
-            unzip valgrind zip
+      - name: Trust workspace
+        if: runner.os == 'Linux'
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Set wolfSSL install path
+        run: echo "WOLFSSL_RELEASE_DIR=$HOME/wolfssl-release" >> "$GITHUB_ENV"
 
       - name: Resolve wolfSSL master commit
         id: wolfssl
@@ -91,7 +104,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ~/wolfssl-release
-          key: wolfssl-release-full-v1-${{ steps.wolfssl.outputs.commit }}
+          key: wolfcose-ci-v1-wolfssl-release-full-v1-${{ steps.wolfssl.outputs.commit }}
 
       - name: Build full wolfSSL backend
         if: steps.cache-wolfssl.outputs.cache-hit != 'true'
@@ -122,9 +135,9 @@ jobs:
 
       - name: Run baseline release commands
         env:
-          WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include
-          WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl
-          LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib
+          WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include
+          WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl
+          LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib
         run: |
           make clean
           make
@@ -137,38 +150,38 @@ jobs:
 
       - name: Run advanced feature scenarios
         env:
-          WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include
-          WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl
-          LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib
+          WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include
+          WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl
+          LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib
         run: make release-scenarios
 
       - name: Compile as C++
         env:
-          WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include
-          WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl
-          LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib
+          WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include
+          WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl
+          LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib
         run: make cxx-check
 
       - name: Run release scenarios under Valgrind
         env:
-          WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include
-          WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl
-          LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib
+          WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include
+          WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl
+          LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib
         run: make valgrind-check
 
       - name: Merge release coverage profiles
         env:
-          WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include
-          WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl
-          WOLFSSL_LDFLAGS: -L/home/runner/wolfssl-release/lib -lwolfssl
-          LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib
+          WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include
+          WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl
+          WOLFSSL_LDFLAGS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl
+          LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib
         run: make release-coverage
 
       - name: Build and smoke-test source archives
         env:
-          WOLFSSL_CFLAGS: -isystem /home/runner/wolfssl-release/include
-          WOLFSSL_LIBS: -L/home/runner/wolfssl-release/lib -lwolfssl
-          LD_LIBRARY_PATH: /home/runner/wolfssl-release/lib
+          WOLFSSL_CFLAGS: -isystem ${{ env.WOLFSSL_RELEASE_DIR }}/include
+          WOLFSSL_LIBS: -L${{ env.WOLFSSL_RELEASE_DIR }}/lib -lwolfssl
+          LD_LIBRARY_PATH: ${{ env.WOLFSSL_RELEASE_DIR }}/lib
         run: |
           make release-artifacts \
             VERSION="${{ needs.metadata.outputs.version }}" \
@@ -232,6 +245,8 @@ jobs:
     name: Required CI for candidate SHA
     needs: metadata
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     timeout-minutes: 125
     steps:
       - name: Wait for required workflows
@@ -338,6 +353,8 @@ jobs:
        github.event.label.name == 'ci:release')
     needs: [metadata, qualify, required-ci]
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     steps:
       - name: Enforce all release gates
         env:
diff --git a/.github/workflows/sanitizer.yml b/.github/workflows/sanitizer.yml
index 52cb363..87a949c 100644
--- a/.github/workflows/sanitizer.yml
+++ b/.github/workflows/sanitizer.yml
@@ -11,6 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   discover:
     uses: ./.github/workflows/_resolve-wolfssl.yml
@@ -19,6 +23,8 @@ jobs:
     name: AddressSanitizer (wolfSSL ${{ matrix.wolfssl-version }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.discover.outputs.matrix) }}
@@ -26,10 +32,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (ASan, ${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version != 'master'
@@ -37,7 +42,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-asan
-        key: wolfssl-asan-${{ matrix.wolfssl-version }}-v1
+        key: wolfcose-ci-v1-wolfssl-asan-${{ matrix.wolfssl-version }}-v1
 
     - name: Build wolfSSL (ASan, ${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/scenarios.yml b/.github/workflows/scenarios.yml
index 111b2bf..7b8b655 100644
--- a/.github/workflows/scenarios.yml
+++ b/.github/workflows/scenarios.yml
@@ -11,6 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   discover:
     uses: ./.github/workflows/_resolve-wolfssl.yml
@@ -19,6 +23,8 @@ jobs:
     name: Scenarios (wolfSSL ${{ matrix.wolfssl-version }})
     needs: discover
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.discover.outputs.matrix) }}
@@ -26,10 +32,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version != 'master'
@@ -37,7 +42,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-scenarios-${{ matrix.wolfssl-version }}-v1
+        key: wolfcose-ci-v1-wolfssl-scenarios-${{ matrix.wolfssl-version }}-v1
 
     - name: Build wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 6f08f83..a005a98 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -13,20 +13,23 @@ concurrency:
 permissions:
   contents: read
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   semgrep:
     name: Semgrep (wolfCOSE security rules)
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.x'
-
-      - name: Install Semgrep
-        run: pip install --quiet semgrep
+      - name: Trust workspace
+        if: runner.os == 'Linux'
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       # --error makes the job fail on any finding. The rules self-scope via
       # their `paths:` blocks, so scanning the whole tree is fine.
diff --git a/.github/workflows/stack-bounds.yml b/.github/workflows/stack-bounds.yml
index e6c5d47..69f6f7d 100644
--- a/.github/workflows/stack-bounds.yml
+++ b/.github/workflows/stack-bounds.yml
@@ -11,26 +11,31 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   frame-budget:
     name: Frame budget (full, worst case)
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     env:
       FRAME_BUDGET: 6144
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (full)
       id: cache-wolfssl
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-full
-        key: wolfssl-full-stack-v1
+        key: wolfcose-ci-v1-wolfssl-full-stack-v1
 
     - name: Build wolfSSL (full)
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
@@ -71,20 +76,21 @@ jobs:
   small-footprint:
     name: SMALL_FOOTPRINT (ECC-only)
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Cache wolfSSL (ECC-only)
       id: cache-wolfssl
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-ecc
-        key: wolfssl-ecc-smallfp-v2
+        key: wolfcose-ci-v1-wolfssl-ecc-smallfp-v2
 
     - name: Build wolfSSL (ECC-only, stripped)
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index c17b4e3..dd03151 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -7,22 +7,27 @@ on:
     branches: [ '*' ]
   workflow_dispatch:
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   cppcheck:
     name: cppcheck
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     steps:
     - uses: actions/checkout@v4
 
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
     - name: Enforce zero dynamic allocation
       run: make zero-alloc-check
 
-    - name: Install cppcheck
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y cppcheck autoconf automake libtool
-
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
       run: echo "sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git HEAD | cut -f1)" >> "$GITHUB_OUTPUT"
@@ -31,7 +36,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
@@ -94,14 +99,15 @@ jobs:
   clang-analyzer:
     name: Clang Static Analyzer
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y clang-tools autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -111,7 +117,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
@@ -149,14 +155,15 @@ jobs:
   gcc-analyzer:
     name: GCC -fanalyzer
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     - name: Resolve wolfSSL master commit
       id: wolfssl-rev
@@ -166,7 +173,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
+        key: wolfcose-ci-v1-wolfssl-ubuntu-latest-v4-lms-${{ steps.wolfssl-rev.outputs.sha }}
 
     - name: Build wolfSSL
       if: steps.cache-wolfssl.outputs.cache-hit != 'true'
diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml
index 9938adb..7785d7d 100644
--- a/.github/workflows/wiki-sync.yml
+++ b/.github/workflows/wiki-sync.yml
@@ -15,11 +15,22 @@ concurrency:
   group: wiki-sync
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   sync:
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     steps:
       - uses: actions/checkout@v4
+
+      - name: Trust workspace
+        if: runner.os == 'Linux'
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Publish docs/ to wiki
         uses: Andrew-Chen-Wang/github-wiki-action@50650fccf3a10f741995523cf9708c53cec8912a # v4
         with:
diff --git a/.github/workflows/wolfssl-versions.yml b/.github/workflows/wolfssl-versions.yml
index c3a8314..a3f8a17 100644
--- a/.github/workflows/wolfssl-versions.yml
+++ b/.github/workflows/wolfssl-versions.yml
@@ -14,6 +14,10 @@ concurrency:
 permissions:
   contents: read
 
+defaults:
+  run:
+    shell: bash -e {0}
+
 jobs:
   # Resolve the latest -stable wolfSSL tag at run time so we don't have to
   # bump this workflow every release. The base floor (v5.8.0), AES Key Wrap
@@ -27,6 +31,8 @@ jobs:
   discover-versions:
     name: Resolve wolfSSL version matrix
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
       latest-stable: ${{ steps.set-matrix.outputs.latest-stable }}
@@ -77,6 +83,8 @@ jobs:
     name: wolfSSL ${{ matrix.wolfssl-version }} ${{ matrix.pqc && '(+ML-DSA/PQC)' || '(classic)' }}
     needs: discover-versions
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
     timeout-minutes: 25
     strategy:
       fail-fast: false
@@ -85,10 +93,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y autoconf automake libtool
+    - name: Trust workspace
+      if: runner.os == 'Linux'
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
     # Cache stable versions only — master must always rebuild to catch regressions
     - name: Cache wolfSSL (${{ matrix.wolfssl-version }})
@@ -97,7 +104,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/wolfssl-install
-        key: ${{ matrix.cache-key }}
+        key: wolfcose-ci-v1-${{ matrix.cache-key }}
 
     - name: Build wolfSSL (${{ matrix.wolfssl-version }})
       if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'