diff --git a/.github/workflows/conda-upload-packages.yaml b/.github/workflows/conda-upload-packages.yaml
index acf9d435..66fa9465 100644
--- a/.github/workflows/conda-upload-packages.yaml
+++ b/.github/workflows/conda-upload-packages.yaml
@@ -67,11 +67,46 @@ jobs:
   upload:
     runs-on: linux-amd64-cpu4
     container:
-      image: rapidsai/ci-conda:26.08-latest # zizmor: ignore[unpinned-images]
+      image: "python:3.14-slim"
       env:
         RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
     steps:
 
+      - name: Setup proxy cache
+        uses: nv-gha-runners/setup-proxy-cache@main
+        continue-on-error: true
+        with:
+          enable-apt: true
+
+      - name: Install tools
+        run: |
+          # install tools needed to bootstrap others
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            curl \
+            git
+
+          # install gha-tools
+          git clone --depth 1 https://github.com/rapidsai/gha-tools /tmp/gha-tools
+          echo "/tmp/gha-tools/tools" >> "${GITHUB_PATH}"
+          export PATH="/tmp/gha-tools/tools:${PATH}"
+
+          # set up source for latest 'gh' releases
+          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+          chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list
+
+          # install tools with system package manager
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            gh \
+            jq
+
+          # anaconda client (for 'rapids-upload-to-anaconda-github')
+          rapids-pip-retry install \
+            --prefer-binary \
+            'anaconda-client>=1.13.1'
+
       - name: Standardize repository information
         uses: rapidsai/shared-actions/rapids-github-info@main
         with:
@@ -87,11 +122,7 @@ jobs:
       # checking '/rate_limit | jq .' should not itself count against any rate limits.
       - name: Check GitHub API rate limits
         run: |
-          if ! type gh >/dev/null; then
-              echo "'gh' CLI is not installed... skipping rate-limits check"
-          else
-              gh api /rate_limit | jq .
-          fi
+          gh api /rate_limit | jq .
         env:
           GH_TOKEN: ${{ github.token }}
       - name: Set Proper Conda Upload Token
diff --git a/.github/workflows/wheels-publish.yaml b/.github/workflows/wheels-publish.yaml
index 4b156eb3..a6aa5b67 100644
--- a/.github/workflows/wheels-publish.yaml
+++ b/.github/workflows/wheels-publish.yaml
@@ -79,11 +79,46 @@ jobs:
     container:
       # CUDA toolkit version of the container is irrelevant in the publish step.
       # This just uploads already-built wheels to remote storage.
-      image: "rapidsai/ci-wheel:26.08-latest" # zizmor: ignore[unpinned-images]
+      image: "python:3.14-slim"
       env:
         RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
     steps:
 
+    - name: Setup proxy cache
+      uses: nv-gha-runners/setup-proxy-cache@main
+      continue-on-error: true
+      with:
+        enable-apt: true
+
+    - name: Install tools
+      run: |
+        # install tools needed to bootstrap others
+        apt-get update
+        apt-get install -y --no-install-recommends \
+          curl \
+          git
+
+        # install gha-tools
+        git clone --depth 1 https://github.com/rapidsai/gha-tools /tmp/gha-tools
+        echo "/tmp/gha-tools/tools" >> "${GITHUB_PATH}"
+        export PATH="/tmp/gha-tools/tools:${PATH}"
+
+        # set up source for latest 'gh' releases
+        curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+        chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
+        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list
+
+        # install tools with system package manager
+        apt-get update
+        apt-get install -y --no-install-recommends \
+          gh \
+          jq
+
+        # anaconda client (for 'rapids-upload-to-anaconda-github')
+        rapids-pip-retry install \
+          --prefer-binary \
+          'anaconda-client>=1.13.1'
+
     - name: Standardize repository information
       uses: rapidsai/shared-actions/rapids-github-info@main
       with:
@@ -99,11 +134,7 @@ jobs:
     # checking '/rate_limit | jq .' should not itself count against any rate limits.
     - name: Check GitHub API rate limits
       run: |
-        if ! type gh >/dev/null; then
-            echo "'gh' CLI is not installed... skipping rate-limits check"
-        else
-            gh api /rate_limit | jq .
-        fi
+        gh api /rate_limit | jq .
       env:
         GH_TOKEN: ${{ github.token }}
 
@@ -140,7 +171,7 @@ jobs:
     - name: Publish the downloaded wheels to PyPI
       if: ${{ inputs.publish_to_pypi && steps.check_if_release.outputs.is_release_build == 'true' }}
       run: |
-        python3 -m pip install twine
+        python3 -m pip install 'twine>=6.2.0'
         python3 -m twine upload -u __token__ "${UPLOAD_DIR}"/*
       env:
         UPLOAD_DIR: ${{ steps.download_wheels.outputs.package_upload_dir }}