diff --git a/.github/workflows/add_docs_review_label.yml b/.github/workflows/add_docs_review_label.yml
index 399acf425..6ea87e614 100644
--- a/.github/workflows/add_docs_review_label.yml
+++ b/.github/workflows/add_docs_review_label.yml
@@ -36,7 +36,7 @@ env:
 
 jobs:
   add_label:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Check member approval
diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml
index 4a690a76c..35c007365 100644
--- a/.github/workflows/changelog.yaml
+++ b/.github/workflows/changelog.yaml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   validate-changelog:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     env:
       PR_HAS_LABEL: ${{ contains( github.event.pull_request.labels.*.name, 'no-changelog') }}
@@ -46,7 +46,7 @@ jobs:
 
   check-changelog:
     name: Changelog
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     needs: validate-changelog
     if: always()
     env:
diff --git a/.github/workflows/check_docs_review.yml b/.github/workflows/check_docs_review.yml
index 75806e798..c8039df82 100644
--- a/.github/workflows/check_docs_review.yml
+++ b/.github/workflows/check_docs_review.yml
@@ -30,7 +30,7 @@ env:
 
 jobs:
   check:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Check approval and label
@@ -63,6 +63,9 @@ jobs:
             require('fs').writeFileSync('pr-number', String(context.payload.pull_request.number));
 
       - name: Upload PR number
-        env:
-          S3_DEST: s3://stellaraf-public-ci-961341522852-us-west-1/actions/${{ github.repository }}/${{ github.run_id }}/${{ github.run_attempt }}/${{ github.event.pull_request.head.sha || github.sha }}/docs-review-pr/
-        run: if [ -f "pr-number" ]; then aws s3 cp "pr-number" "$S3_DEST" --only-show-errors; fi
+        uses: actions/upload-artifact@v4
+        with:
+          name: docs-review-pr-${{ github.run_attempt }}
+          path: pr-number
+          retention-days: 30
+          if-no-files-found: ignore
diff --git a/.github/workflows/check_generated_docs.yml b/.github/workflows/check_generated_docs.yml
index 32ffe5aec..181696f5d 100644
--- a/.github/workflows/check_generated_docs.yml
+++ b/.github/workflows/check_generated_docs.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   changes:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     outputs:
@@ -42,7 +42,7 @@ jobs:
   run-check-generated-docs:
     needs: changes
     if: needs.changes.outputs.docs == 'true'
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
@@ -91,7 +91,7 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git commit -m "$COMMIT_MESSAGE"
-          git push origin HEAD:refs/heads/$HEAD_REF
+          git push origin "HEAD:refs/heads/$HEAD_REF"
 
       - name: Save PR number for comment workflow
         if: >
@@ -109,9 +109,12 @@ jobs:
           && steps.last-commit.outputs.is-auto != 'true'
           && github.event_name == 'pull_request'
           && steps.push.outcome != 'success'
-        env:
-          S3_DEST: s3://stellaraf-public-ci-961341522852-us-west-1/actions/${{ github.repository }}/${{ github.run_id }}/${{ github.run_attempt }}/${{ github.event.pull_request.head.sha || github.sha }}/docs-check-pr/
-        run: aws s3 cp "/tmp/docs-check/pr-number" "$S3_DEST" --only-show-errors
+        uses: actions/upload-artifact@v4
+        with:
+          name: docs-check-pr-${{ github.run_attempt }}
+          path: /tmp/docs-check/pr-number
+          retention-days: 30
+          if-no-files-found: error
 
       - name: Fail if docs are out of date
         if: steps.check.outputs.changed == 'true' && steps.push.outcome != 'success'
@@ -121,7 +124,7 @@ jobs:
 
   check-generated-docs:
     if: always()
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     needs: run-check-generated-docs
     steps:
       - run: |
diff --git a/.github/workflows/check_generated_docs_comment.yml b/.github/workflows/check_generated_docs_comment.yml
index 33a1c015f..2484dc23d 100644
--- a/.github/workflows/check_generated_docs_comment.yml
+++ b/.github/workflows/check_generated_docs_comment.yml
@@ -11,18 +11,23 @@ permissions:
 
 jobs:
   comment:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     if: >
       github.event.workflow_run.conclusion == 'failure'
       && github.event.workflow_run.event == 'pull_request'
     permissions:
       pull-requests: write
+      actions: read
     steps:
       - name: Download PR metadata
-        env:
-          S3_SOURCE: s3://stellaraf-public-ci-961341522852-us-west-1/actions/${{ github.repository }}/${{ github.event.workflow_run.id }}/${{ github.event.workflow_run.run_attempt }}/${{ github.event.workflow_run.head_sha }}/docs-check-pr/pr-number
+        uses: actions/download-artifact@v4
+        with:
+          name: docs-check-pr-${{ github.event.workflow_run.run_attempt }}
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Validate artifact against trusted workflow metadata
         run: |
-          aws s3 cp "$S3_SOURCE" pr-number --only-show-errors
           python3 - <<'PYVALIDATE'
           import json, os, pathlib
           event = json.loads(pathlib.Path(os.environ["GITHUB_EVENT_PATH"]).read_text())
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index e9768df25..aa454eb44 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -18,7 +18,7 @@ env:
 
 jobs:
   coverage:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
@@ -45,7 +45,7 @@ jobs:
         run: npm ci --prefix scripts/npm-tools
 
       - name: "Add npm tools to PATH"
-        run: echo "${{ github.workspace }}/scripts/npm-tools/node_modules/.bin" >> $GITHUB_PATH
+        run: echo "${{ github.workspace }}/scripts/npm-tools/node_modules/.bin" >> "$GITHUB_PATH"
 
       - uses: ./.github/actions/dd-token
 
diff --git a/.github/workflows/merge-queue.yml b/.github/workflows/merge-queue.yml
index 807528a48..46e66c8a1 100644
--- a/.github/workflows/merge-queue.yml
+++ b/.github/workflows/merge-queue.yml
@@ -11,7 +11,7 @@ permissions:
 jobs:
   check-features:
     if: ${{ github.event_name == 'merge_group' }}
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -22,7 +22,7 @@ jobs:
     if: always()
     needs:
       - check-features
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - name: Check result
         run: |
diff --git a/.github/workflows/remove_docs_review_label.yml b/.github/workflows/remove_docs_review_label.yml
index 2081337be..cb7cce638 100644
--- a/.github/workflows/remove_docs_review_label.yml
+++ b/.github/workflows/remove_docs_review_label.yml
@@ -22,7 +22,7 @@ env:
 jobs:
   download:
     if: github.event.workflow_run.conclusion == 'success'
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
       actions: read
@@ -32,10 +32,15 @@ jobs:
       - name: Download PR number
         id: download
         continue-on-error: true
-        env:
-          S3_SOURCE: s3://stellaraf-public-ci-961341522852-us-west-1/actions/${{ github.repository }}/${{ github.event.workflow_run.id }}/${{ github.event.workflow_run.run_attempt }}/${{ github.event.workflow_run.head_sha }}/docs-review-pr/pr-number
+        uses: actions/download-artifact@v4
+        with:
+          name: docs-review-pr-${{ github.event.workflow_run.run_attempt }}
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Validate artifact against trusted workflow metadata
+        if: steps.download.outcome == 'success'
         run: |
-          aws s3 cp "$S3_SOURCE" pr-number --only-show-errors
           python3 - <<'PYVALIDATE'
           import json, os, pathlib
           event = json.loads(pathlib.Path(os.environ["GITHUB_EVENT_PATH"]).read_text())
@@ -49,12 +54,12 @@ jobs:
         if: steps.download.outcome == 'success'
         run: |
           pr_number=$(cat pr-number | tr -d '[:space:]')
-          echo "pr_number=${pr_number}" >> $GITHUB_OUTPUT
+          echo "pr_number=${pr_number}" >> "$GITHUB_OUTPUT"
 
   remove_label:
     needs: download
     if: needs.download.outputs.pr_number != ''
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     concurrency:
       group: pr-labels-${{ needs.download.outputs.pr_number }}
diff --git a/.github/workflows/remove_waiting_author.yml b/.github/workflows/remove_waiting_author.yml
index 3fbd22a04..3f5ac11b9 100644
--- a/.github/workflows/remove_waiting_author.yml
+++ b/.github/workflows/remove_waiting_author.yml
@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   remove_label:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ad6778515..d8b76dc77 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,7 +20,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
@@ -59,9 +59,12 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        env:
-          S3_DEST: s3://stellaraf-public-ci-961341522852-us-west-1/actions/${{ github.repository }}/${{ github.run_id }}/${{ github.run_attempt }}/${{ github.event.pull_request.head.sha || github.sha }}/SARIF file/
-        run: aws s3 cp "results.sarif" "$S3_DEST" --only-show-errors
+        uses: actions/upload-artifact@v4
+        with:
+          name: scorecard-sarif-${{ github.run_attempt }}
+          path: results.sarif
+          retention-days: 30
+          if-no-files-found: error
 
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 78b70da9a..a9b11be6c 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   spelling:
     name: Check Spelling
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     concurrency:
       group: spelling-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index b844fe902..233f77260 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   static-analysis:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6f591a05a..595a933b4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,7 +29,7 @@ env:
 
 jobs:
   clippy:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -37,7 +37,7 @@ jobs:
         run: make check-clippy
 
   fmt:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -45,7 +45,7 @@ jobs:
         run: make fmt-check
 
   test:
-    runs-on: ${{ matrix.os == 'ubuntu-latest' && format('codebuild-stellaraf-actions-public-{0}-{1}', github.run_id, github.run_attempt) || matrix.os }}
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
@@ -57,7 +57,7 @@ jobs:
         run: make test
 
   vrl:
-    runs-on: ${{ matrix.os == 'ubuntu-latest' && format('codebuild-stellaraf-actions-public-{0}-{1}', github.run_id, github.run_attempt) || matrix.os }}
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
@@ -69,7 +69,7 @@ jobs:
         run: make vrl-test
 
   check-licenses:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -77,7 +77,7 @@ jobs:
         run: make check-licenses
 
   check-msrv:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -85,7 +85,7 @@ jobs:
         run: make check-msrv
 
   check-deny:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -93,7 +93,7 @@ jobs:
         run: make check-deny
 
   check-docs:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -101,7 +101,7 @@ jobs:
         run: make check-docs
 
   check-lockfile:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -109,7 +109,7 @@ jobs:
         run: make check-lockfile
 
   wasm32-unknown-unknown:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - name: Install the WebAssembly C compiler
         run: |
diff --git a/.github/workflows/vector_integration_check.yaml b/.github/workflows/vector_integration_check.yaml
index a216551c6..893f2d7fb 100644
--- a/.github/workflows/vector_integration_check.yaml
+++ b/.github/workflows/vector_integration_check.yaml
@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   check-vector:
-    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout VRL
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1