diff --git a/.github/actions/setup-restore-build/action.yml b/.github/actions/setup-restore-build/action.yml
index 6ef2cde0c..393c4c1fd 100644
--- a/.github/actions/setup-restore-build/action.yml
+++ b/.github/actions/setup-restore-build/action.yml
@@ -29,4 +29,4 @@ runs:
 
     - name: Build
       shell: pwsh
-      run: dotnet build --no-restore --configuration Release /p:Deterministic=true /p:UseSharedCompilation=false /p:BuildInParallel=false /nodeReuse:false /bl:./artifacts/logs/release/build.release.binlog
+      run: dotnet build --no-restore --configuration Release /p:Deterministic=true /p:ContinuousIntegrationBuild=true /p:UseSharedCompilation=false /p:BuildInParallel=false /nodeReuse:false /bl:./artifacts/logs/release/build.release.binlog
diff --git a/.github/workflows/devskim.yml b/.github/workflows/devskim.yml
index e7e07db22..7d99773d4 100644
--- a/.github/workflows/devskim.yml
+++ b/.github/workflows/devskim.yml
@@ -16,6 +16,7 @@ on:
 jobs:
   lint:
     name: DevSkim
+    # DevSkim requires x64 runner
     runs-on: ubuntu-latest
     permissions:
       actions: read
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
index f577fd554..686723369 100644
--- a/.github/workflows/linters.yml
+++ b/.github/workflows/linters.yml
@@ -2,6 +2,7 @@ name: Lint
 
 on:
   push:
+    branches: [main]
   pull_request:
 
 permissions: {}
@@ -9,6 +10,8 @@ permissions: {}
 jobs:
   build:
     name: Lint
+    # super-linter requires x86_64; ARM64 is not supported upstream
+    # https://github.com/super-linter/super-linter/issues/5070
     runs-on: ubuntu-latest
 
     permissions:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 57c504357..a9b540bd3 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -175,6 +175,7 @@ jobs:
   # is generated with correct local paths.
   test:
     needs: [check-paths]
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -281,6 +282,7 @@ jobs:
   #   2. msbuild.exe - csc runs on .NET Framework (VS), tested on Windows x64
   analyzer-load-test:
     needs: [check-paths, build]
+    timeout-minutes: 20
     runs-on: ${{ matrix.runs-on }}
     strategy:
       fail-fast: false
@@ -453,6 +455,7 @@ jobs:
   # Builds from source on Linux ARM to get consistent benchmark results.
   perf:
     needs: [check-paths, build, test]
+    timeout-minutes: 60
     runs-on: ubuntu-24.04-arm
 
     env:
diff --git a/.github/workflows/powershell.yml b/.github/workflows/powershell.yml
index d95d645ba..e404ee5fd 100644
--- a/.github/workflows/powershell.yml
+++ b/.github/workflows/powershell.yml
@@ -36,7 +36,7 @@ jobs:
         with:
           # Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options.
           # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules.
-          path: .\
+          path: ./
           recurse: true
           # Include your own basic security rules. Removing this option will run all the rules
           includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"'
diff --git a/.github/workflows/pr-labeler-current-milestone.yml b/.github/workflows/pr-labeler-current-milestone.yml
deleted file mode 100644
index f590abb5a..000000000
--- a/.github/workflows/pr-labeler-current-milestone.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: "Label Previous Pull Requests"
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 1 * * 1"
-
-jobs:
-  labeler:
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-24.04-arm
-    steps:
-
-      # Label PRs
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6
-        with:
-          pr-number: |
-            52
-            57
-            59
-            60
-            61
-            63
-            65
-            66
-            69
-            70
-            71
-            73
-            74
-            76
-            77
-            79
-            80
-            81
-            82
-            83
-            84
-            86
-            87
-            88
-            89
-            91
-            92
-            93
-            94
-            99
-            101
-            102
-            105
-            106
-            108
-            113
-            114
diff --git a/.github/workflows/semantic-pr-check.yml b/.github/workflows/semantic-pr-check.yml
index 0d2939149..bcaa401ba 100644
--- a/.github/workflows/semantic-pr-check.yml
+++ b/.github/workflows/semantic-pr-check.yml
@@ -7,10 +7,14 @@ on:
       - edited
       - synchronize
 
+permissions: {}
+
 jobs:
   main:
     name: Validate PR title
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
diff --git a/build/targets/compiler/Compiler.props b/build/targets/compiler/Compiler.props
index c02cb4c1a..e1b1dfdc4 100644
--- a/build/targets/compiler/Compiler.props
+++ b/build/targets/compiler/Compiler.props
@@ -1,6 +1,7 @@
 <Project>
   <PropertyGroup>
     <ImplicitUsings>enable</ImplicitUsings>
+    <!-- Use the default C# version for the SDK pinned in global.json -->
     <LangVersion>default</LangVersion>
     <Nullable>enable</Nullable>
   </PropertyGroup>