diff --git a/.github/workflows/camkes-vm-hw.yml b/.github/workflows/camkes-vm-hw.yml
new file mode 100644
index 0000000..4cc101d
--- /dev/null
+++ b/.github/workflows/camkes-vm-hw.yml
@@ -0,0 +1,107 @@
+# Copyright 2021, Proofcraft Pty Ltd
+#
+# SPDX-License-Identifier: BSD-2-Clause
+
+# camkes-vm-examples hardware builds and runs
+#
+# See camkes-vm-hw/builds.yml in the repo seL4/ci-actions for configs.
+
+name: CAmkES VM (HW)
+
+on:
+  # needs PR target for secrets access; guard by requiring label
+  pull_request_target:
+    types: [opened, reopened, synchronize, labeled]
+
+# downgrade permissions to read-only as you would have in a standard PR action
+permissions:
+  contents: read
+
+# To reduce the load (especiually on the machine queue) we cancel any older runs
+# of this workflow for the current PR. Such runs exist, if there were new pushes
+# to the PR's branch without waiting for the workflow to finish. As a side
+# effect, pushing new commits now becomes a convenient way to cancel all the
+# older runs, e.g. if they are stuck and would only be stopped by the timeout
+# eventually.
+# Note that we could do the concurrency handling at a finer level, and only wrap
+# the actual run on the hardware. But there seems not much gain in letting the
+# older builds run, as these are usually obsolete with new pushes also.
+concurrency:
+  group: ${{ github.workflow }}-pr-${{ github.event.number }}
+  cancel-in-progress: true
+
+jobs:
+  code:
+    name: Freeze Code
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'push' ||
+            github.event_name == 'pull_request_target' &&
+              github.event.action != 'labeled' &&
+              (contains(github.event.pull_request.labels.*.name, 'hw-build') ||
+               contains(github.event.pull_request.labels.*.name, 'hw-test')) ||
+            github.event_name == 'pull_request_target' &&
+              github.event.action == 'labeled' &&
+              (github.event.label.name == 'hw-build' ||
+               github.event.label.name == 'hw-test') }}
+    outputs:
+      xml: ${{ steps.repo.outputs.xml }}
+    steps:
+    - id: repo
+      uses: seL4/ci-actions/repo-checkout@master
+      with:
+        manifest_repo: camkes-vm-examples-manifest
+        manifest: master.xml
+        sha: ${{ github.event.pull_request.head.sha }}
+
+  build:
+    name: Build
+    needs: code
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        march: [nehalem, armv7a, armv8a]
+    steps:
+    - uses: seL4/ci-actions/camkes-vm@master
+      with:
+        xml: ${{ needs.code.outputs.xml }}
+        march: ${{ matrix.march }}
+    - name: Upload images
+      uses: actions/upload-artifact@v7
+      with:
+        name: images-${{ matrix.march }}
+        path: '*-images.tar.gz'
+
+  run:
+    name: Hardware
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: ${{ github.repository_owner == 'seL4' &&
+            (github.event_name == 'push' ||
+             github.event_name == 'pull_request_target' &&
+               github.event.action != 'labeled' &&
+               contains(github.event.pull_request.labels.*.name, 'hw-test') ||
+             github.event_name == 'pull_request_target' &&
+               github.event.action == 'labeled' &&
+               github.event.label.name == 'hw-test') }}
+    strategy:
+      fail-fast: true
+      matrix:
+        march: [nehalem, armv7a, armv8a]
+    steps:
+      - name: Get machine queue
+        uses: actions/checkout@v6
+        with:
+          repository: seL4/machine_queue
+          path: machine_queue
+      - name: Download image
+        uses: actions/download-artifact@v8
+        with:
+          name: images-${{ matrix.march }}
+      - name: Run
+        uses: seL4/ci-actions/camkes-vm-hw@master
+        with:
+          march: ${{ matrix.march }}
+          index: ${{ strategy.job-index }}
+        env:
+          HW_SSH: ${{ secrets.HW_SSH }}
diff --git a/.github/workflows/camkes-vm-sim.yml b/.github/workflows/camkes-vm-sim.yml
new file mode 100644
index 0000000..f8850d9
--- /dev/null
+++ b/.github/workflows/camkes-vm-sim.yml
@@ -0,0 +1,23 @@
+# Copyright 2021, Proofcraft Pty Ltd
+#
+# SPDX-License-Identifier: BSD-2-Clause
+
+# Actions to run on pull requests
+
+name: Camkes VM (Simulation)
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        march: [nehalem, armv7a, armv8a]
+    steps:
+    - uses: seL4/ci-actions/camkes-vm@master
+      with:
+        march: ${{ matrix.march }}
diff --git a/.github/workflows/hw-tests.yml b/.github/workflows/hw-tests.yml
deleted file mode 100644
index 79673b7..0000000
--- a/.github/workflows/hw-tests.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2024, Proofcraft Pty Ltd
-#
-# SPDX-License-Identifier: BSD-2-Clause
-
-# sel4test and sel4bench hardware builds and runs
-#
-# See sel4test-hw/builds.yml and sel4bench-hw/builds.yml in the repo
-# seL4/ci-actions for configs.
-
-name: HW
-
-on:
-  # needs PR target for secrets access; guard by requiring label
-  pull_request_target:
-    types: [synchronize, labeled]
-
-jobs:
-  sel4test:
-    name: seL4Test
-    uses: seL4/ci-actions/.github/workflows/sel4test-hw.yml@master
-    secrets: inherit
-
-  sel4bench:
-    name: seL4Bench
-    uses: seL4/ci-actions/.github/workflows/sel4bench-hw.yml@master
-    secrets: inherit
diff --git a/.github/workflows/sel4test-sim.yml b/.github/workflows/sel4test-sim.yml
deleted file mode 100644
index aa431b9..0000000
--- a/.github/workflows/sel4test-sim.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Copyright 2021, Proofcraft Pty Ltd
-#
-# SPDX-License-Identifier: BSD-2-Clause
-
-# sel4test simulation runs
-#
-# See sel4test-sim/builds.yml in the repo seL4/ci-actions for configs.
-
-name: seL4Test
-
-on:
-  pull_request:
-    paths-ignore:
-      - 'LICENSES/**'
-      - '*.md'
-  workflow_dispatch:
-
-jobs:
-  sim:
-    name: Sim
-    uses: seL4/ci-actions/.github/workflows/sel4test-sim.yml@master