diff --git a/.github/workflows/ci_codebuild-tests.yml b/.github/workflows/ci_codebuild-tests.yml
index 323a8ca48..5b11e8205 100644
--- a/.github/workflows/ci_codebuild-tests.yml
+++ b/.github/workflows/ci_codebuild-tests.yml
@@ -19,7 +19,7 @@ permissions:
 jobs:
   codebuild-tests:
     name: AWS CodeBuild CI
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       matrix:
         python:
diff --git a/.github/workflows/ci_codebuild_batch.yml b/.github/workflows/ci_codebuild_batch.yml
index 243638f65..8830cf5bc 100644
--- a/.github/workflows/ci_codebuild_batch.yml
+++ b/.github/workflows/ci_codebuild_batch.yml
@@ -15,7 +15,7 @@ jobs:
   # Python 3.8 jobs
   py38_integ:
     name: Python 3.8 Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: &codebuild-linux codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -33,7 +33,7 @@ jobs:
 
   py38_examples:
     name: Python 3.8 Examples
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -51,7 +51,7 @@ jobs:
 
   py38_decrypt_dafny_esdk_vectors:
     name: Python 3.8 Decrypt Dafny ESDK Vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -69,7 +69,7 @@ jobs:
 
   py38_decrypt_net_401_vectors:
     name: Python 3.8 Decrypt .NET 4.0.1 Vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -87,7 +87,7 @@ jobs:
 
   py38_encrypt_masterkey:
     name: Python 3.8 Encrypt Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -105,7 +105,7 @@ jobs:
 
   py38_generate_decrypt_vectors_masterkey:
     name: Python 3.8 Generate Decrypt Vectors Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -124,7 +124,7 @@ jobs:
   py38_decrypt_masterkey_with_masterkey:
     name: Python 3.8 Decrypt Masterkey with Masterkey
     needs: py38_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -143,7 +143,7 @@ jobs:
   py38_decrypt_masterkey_with_js:
     name: Python 3.8 Decrypt Masterkey with JS
     needs: py38_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -162,7 +162,7 @@ jobs:
   # Python 3.9 jobs
   py39_integ:
     name: Python 3.9 Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -180,7 +180,7 @@ jobs:
 
   py39_examples:
     name: Python 3.9 Examples
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -198,7 +198,7 @@ jobs:
 
   py39_decrypt_dafny_esdk_vectors:
     name: Python 3.9 Decrypt Dafny ESDK Vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -216,7 +216,7 @@ jobs:
 
   py39_decrypt_net_401_vectors:
     name: Python 3.9 Decrypt .NET 4.0.1 Vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -234,7 +234,7 @@ jobs:
 
   py39_encrypt_masterkey:
     name: Python 3.9 Encrypt Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -252,7 +252,7 @@ jobs:
 
   py39_generate_decrypt_vectors_masterkey:
     name: Python 3.9 Generate Decrypt Vectors Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -271,7 +271,7 @@ jobs:
   py39_decrypt_masterkey_with_masterkey:
     name: Python 3.9 Decrypt Masterkey with Masterkey
     needs: py39_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -290,7 +290,7 @@ jobs:
   py39_decrypt_masterkey_with_js:
     name: Python 3.9 Decrypt Masterkey with JS
     needs: py39_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -309,7 +309,7 @@ jobs:
   # Python 3.10 jobs
   py310_integ:
     name: Python 3.10 Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -327,7 +327,7 @@ jobs:
 
   py310_examples:
     name: Python 3.10 Examples
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -345,7 +345,7 @@ jobs:
 
   py310_decrypt_dafny_esdk_vectors:
     name: Python 3.10 Decrypt Dafny ESDK Vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -363,7 +363,7 @@ jobs:
 
   py310_decrypt_net_401_vectors:
     name: Python 3.10 Decrypt .NET 4.0.1 Vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -381,7 +381,7 @@ jobs:
 
   py310_encrypt_masterkey:
     name: Python 3.10 Encrypt Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -399,7 +399,7 @@ jobs:
 
   py310_generate_decrypt_vectors_masterkey:
     name: Python 3.10 Generate Decrypt Vectors Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -418,7 +418,7 @@ jobs:
   py310_decrypt_masterkey_with_masterkey:
     name: Python 3.10 Decrypt Masterkey with Masterkey
     needs: py310_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -437,7 +437,7 @@ jobs:
   py310_decrypt_masterkey_with_js:
     name: Python 3.10 Decrypt Masterkey with JS
     needs: py310_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -456,7 +456,7 @@ jobs:
   # Python 3.11 jobs
   py311_integ:
     name: Python 3.11 Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -474,7 +474,7 @@ jobs:
 
   py311_integ_mpl:
     name: Python 3.11 Integration MPL
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -492,7 +492,7 @@ jobs:
 
   py311_performance_tests_mpl:
     name: Python 3.11 Performance Tests MPL
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -510,7 +510,7 @@ jobs:
 
   py311_examples:
     name: Python 3.11 Examples
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -528,7 +528,7 @@ jobs:
 
   py311_examples_mpl:
     name: Python 3.11 Examples MPL
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -546,7 +546,7 @@ jobs:
 
   py311_decrypt_dafny_esdk_vectors_masterkey:
     name: Python 3.11 Decrypt Dafny ESDK Vectors Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -564,7 +564,7 @@ jobs:
 
   py311_decrypt_dafny_esdk_vectors_keyrings:
     name: Python 3.11 Decrypt Dafny ESDK Vectors Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -582,7 +582,7 @@ jobs:
 
   py311_decrypt_net_401_vectors_masterkey:
     name: Python 3.11 Decrypt .NET 4.0.1 Vectors Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -600,7 +600,7 @@ jobs:
 
   py311_decrypt_net_401_vectors_keyrings:
     name: Python 3.11 Decrypt .NET 4.0.1 Vectors Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -618,7 +618,7 @@ jobs:
 
   py311_encrypt_masterkey:
     name: Python 3.11 Encrypt Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -636,7 +636,7 @@ jobs:
 
   py311_encrypt_keyrings:
     name: Python 3.11 Encrypt Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -654,7 +654,7 @@ jobs:
 
   py311_generate_decrypt_vectors_masterkey:
     name: Python 3.11 Generate Decrypt Vectors Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -673,7 +673,7 @@ jobs:
   py311_decrypt_masterkey_with_masterkey:
     name: Python 3.11 Decrypt Masterkey with Masterkey
     needs: py311_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -692,7 +692,7 @@ jobs:
   py311_decrypt_masterkey_with_keyrings:
     name: Python 3.11 Decrypt Masterkey with Keyrings
     needs: py311_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -711,7 +711,7 @@ jobs:
   py311_decrypt_masterkey_with_js:
     name: Python 3.11 Decrypt Masterkey with JS
     needs: py311_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -729,7 +729,7 @@ jobs:
 
   py311_generate_decrypt_vectors_keyrings:
     name: Python 3.11 Generate Decrypt Vectors Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -748,7 +748,7 @@ jobs:
   py311_decrypt_keyrings_with_masterkey:
     name: Python 3.11 Decrypt Keyrings with Masterkey
     needs: py311_generate_decrypt_vectors_keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -767,7 +767,7 @@ jobs:
   py311_decrypt_keyrings_with_keyrings:
     name: Python 3.11 Decrypt Keyrings with Keyrings
     needs: py311_generate_decrypt_vectors_keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -786,7 +786,7 @@ jobs:
   py311_decrypt_keyrings_with_js:
     name: Python 3.11 Decrypt Keyrings with JS
     needs: py311_generate_decrypt_vectors_keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -804,7 +804,7 @@ jobs:
 
   py311_decrypt_golden_manifest_with_keyrings:
     name: Python 3.11 Decrypt Golden Manifest with Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -822,7 +822,7 @@ jobs:
 
   py311_decrypt_golden_manifest_with_masterkey:
     name: Python 3.11 Decrypt Golden Manifest with Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -841,7 +841,7 @@ jobs:
   # Python 3.12 jobs
   py312_integ:
     name: Python 3.12 Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -859,7 +859,7 @@ jobs:
 
   py312_integ_mpl:
     name: Python 3.12 Integration MPL
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -877,7 +877,7 @@ jobs:
 
   py312_performance_tests_mpl:
     name: Python 3.12 Performance Tests MPL
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -895,7 +895,7 @@ jobs:
 
   py312_examples:
     name: Python 3.12 Examples
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -913,7 +913,7 @@ jobs:
 
   py312_examples_mpl:
     name: Python 3.12 Examples MPL
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -931,7 +931,7 @@ jobs:
 
   py312_decrypt_dafny_esdk_vectors_masterkey:
     name: Python 3.12 Decrypt Dafny ESDK Vectors Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -949,7 +949,7 @@ jobs:
 
   py312_decrypt_dafny_esdk_vectors_keyrings:
     name: Python 3.12 Decrypt Dafny ESDK Vectors Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -967,7 +967,7 @@ jobs:
 
   py312_decrypt_net_401_vectors_masterkey:
     name: Python 3.12 Decrypt .NET 4.0.1 Vectors Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -985,7 +985,7 @@ jobs:
 
   py312_decrypt_net_401_vectors_keyrings:
     name: Python 3.12 Decrypt .NET 4.0.1 Vectors Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1003,7 +1003,7 @@ jobs:
 
   py312_encrypt_masterkey:
     name: Python 3.12 Encrypt Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1021,7 +1021,7 @@ jobs:
 
   py312_encrypt_keyrings:
     name: Python 3.12 Encrypt Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1039,7 +1039,7 @@ jobs:
 
   py312_generate_decrypt_vectors_masterkey:
     name: Python 3.12 Generate Decrypt Vectors Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1058,7 +1058,7 @@ jobs:
   py312_decrypt_masterkey_with_masterkey:
     name: Python 3.12 Decrypt Masterkey with Masterkey
     needs: py312_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1077,7 +1077,7 @@ jobs:
   py312_decrypt_masterkey_with_keyrings:
     name: Python 3.12 Decrypt Masterkey with Keyrings
     needs: py312_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1096,7 +1096,7 @@ jobs:
   py312_decrypt_masterkey_with_js:
     name: Python 3.12 Decrypt Masterkey with JS
     needs: py312_generate_decrypt_vectors_masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1114,7 +1114,7 @@ jobs:
 
   py312_generate_decrypt_vectors_keyrings:
     name: Python 3.12 Generate Decrypt Vectors Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1133,7 +1133,7 @@ jobs:
   py312_decrypt_keyrings_with_masterkey:
     name: Python 3.12 Decrypt Keyrings with Masterkey
     needs: py312_generate_decrypt_vectors_keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1152,7 +1152,7 @@ jobs:
   py312_decrypt_keyrings_with_keyrings:
     name: Python 3.12 Decrypt Keyrings with Keyrings
     needs: py312_generate_decrypt_vectors_keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1171,7 +1171,7 @@ jobs:
   py312_decrypt_keyrings_with_js:
     name: Python 3.12 Decrypt Keyrings with JS
     needs: py312_generate_decrypt_vectors_keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1189,7 +1189,7 @@ jobs:
 
   py312_generate_hkeyring_decrypt_vectors:
     name: Python 3.12 Generate HKeyring Decrypt Vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1208,7 +1208,7 @@ jobs:
   py312_decrypt_hkeyring_with_masterkey:
     name: Python 3.12 Decrypt HKeyring with Masterkey
     needs: py312_generate_hkeyring_decrypt_vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1227,7 +1227,7 @@ jobs:
   py312_decrypt_hkeyring_with_keyrings:
     name: Python 3.12 Decrypt HKeyring with Keyrings
     needs: py312_generate_hkeyring_decrypt_vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1246,7 +1246,7 @@ jobs:
   py312_decrypt_hkeyring_with_net:
     name: Python 3.12 Decrypt HKeyring with .NET
     needs: py312_generate_hkeyring_decrypt_vectors
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1264,7 +1264,7 @@ jobs:
 
   py312_decrypt_golden_manifest_with_keyrings:
     name: Python 3.12 Decrypt Golden Manifest with Keyrings
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1282,7 +1282,7 @@ jobs:
 
   py312_decrypt_golden_manifest_with_masterkey:
     name: Python 3.12 Decrypt Golden Manifest with Masterkey
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1301,7 +1301,7 @@ jobs:
   # Code Coverage and Compliance jobs
   code_coverage:
     name: Code Coverage
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1318,7 +1318,7 @@ jobs:
 
   code_coverage_mpl:
     name: Code Coverage MPL
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
@@ -1336,7 +1336,7 @@ jobs:
 
   compliance:
     name: Compliance
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
diff --git a/.github/workflows/ci_decrypt-oracle.yaml b/.github/workflows/ci_decrypt-oracle.yaml
index c56e43a63..6f79d67f7 100644
--- a/.github/workflows/ci_decrypt-oracle.yaml
+++ b/.github/workflows/ci_decrypt-oracle.yaml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   tests:
-    runs-on: ubuntu-latest
+    runs-on: &codebuild-linux codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
@@ -25,7 +25,7 @@ jobs:
           cd decrypt_oracle
           tox -- -vv
   static-analysis:
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml
index d8175396e..9b7dc1460 100644
--- a/.github/workflows/ci_static-analysis.yaml
+++ b/.github/workflows/ci_static-analysis.yaml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   analysis:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/ci_test-vector-handler.yaml b/.github/workflows/ci_test-vector-handler.yaml
index 340d4d5a9..3c6b69caf 100644
--- a/.github/workflows/ci_test-vector-handler.yaml
+++ b/.github/workflows/ci_test-vector-handler.yaml
@@ -8,6 +8,15 @@ on:
         required: true
       INTEG_AWS_SECRET_ACCESS_KEY:
         required: true
+    inputs:
+      platforms:
+        type: string
+        # runs on macos-15-intel as macos-latest does not work in all python versions. 
+        default: >-
+          [{"os": "ubuntu-latest", "runner": "codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}"},
+           {"os": "windows-latest", "runner": "windows-latest"},
+           {"os": "macos-latest", "runner": "macos-latest"},
+           {"os": "macos-15-intel", "runner": "macos-15-intel"}]
 
 permissions:
   contents: read
@@ -17,16 +26,11 @@ jobs:
     # Leaving this defined but disabled
     # until we address the credentials problem.
     if: 1 == 0
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.platform.runner }}
     strategy:
       fail-fast: true
       matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-          - macos-latest
-          # runs on macos-15-intel as macos-latest does not work in all python versions. 
-          - macos-15-intel
+        platform: ${{ fromJSON(inputs.platforms) }}
         python:
           - 3.8
           - 3.x
@@ -39,9 +43,11 @@ jobs:
           - awses_latest
         exclude:
           # x86 builds are only meaningful for Windows
-          - os: ubuntu-latest
+          - platform:
+              os: ubuntu-latest
             architecture: x86
-          - os: macos-latest
+          - platform:
+              os: macos-latest
             architecture: x86
     steps:
       - uses: aws-actions/configure-aws-credentials@v4
@@ -64,7 +70,8 @@ jobs:
           cd test_vector_handlers
           tox -- -vv
   static-analysis:
-    runs-on: ubuntu-latest
+    if: contains(fromJSON(inputs.platforms).*.os, 'ubuntu-latest')
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 607b5c9e1..18cf0afff 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -2,6 +2,13 @@ name: Continuous Integration tests
 
 on:
   workflow_call:
+    inputs:
+      platforms:
+        type: string
+        default: >-
+          [{"os": "ubuntu-latest", "runner": "codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}"},
+           {"os": "windows-latest", "runner": "windows-latest"},
+           {"os": "macos-latest", "runner": "macos-latest"}]
 
 env:
   AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: |
@@ -18,14 +25,11 @@ permissions:
 
 jobs:
   tests:
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.platform.runner }}
     strategy:
       fail-fast: true
       matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-          - macos-latest
+        platform: ${{ fromJSON(inputs.platforms) }}
         python:
           - 3.8
           - 3.9
@@ -53,18 +57,24 @@ jobs:
           # Python <3.11 incompatible with macOS ARM64 runners
           # https://github.com/actions/setup-python/issues/948
           - python: 3.7
-            os: macos-latest
+            platform:
+              os: macos-latest
           - python: 3.8
-            os: macos-latest
+            platform:
+              os: macos-latest
           - python: 3.9
-            os: macos-latest
+            platform:
+              os: macos-latest
           - python: 3.10
-            os: macos-latest
+            platform:
+              os: macos-latest
 
           # x86 builds are only meaningful for Windows
-          - os: ubuntu-latest
+          - platform:
+              os: ubuntu-latest
             architecture: x86
-          - os: macos-latest
+          - platform:
+              os: macos-latest
             architecture: x86
 
           # `cryptography` no longer publishes 32-bit Windows wheels for
@@ -77,7 +87,8 @@ jobs:
           # provisioning (i686 Rust target + 32-bit OpenSSL) per cell,
           # which isn't worth it for a configuration upstream no longer
           # supports.
-          - os: windows-latest
+          - platform:
+              os: windows-latest
             architecture: x86
 
           # MPL is not supported on <3.11
@@ -112,7 +123,8 @@ jobs:
           TOXENV: ${{ matrix.category }}${{ matrix.optional_mpl_dependency }}
         run: tox -- -vv
   upstream-py311:
-    runs-on: ubuntu-latest
+    if: contains(fromJSON(inputs.platforms).*.os, 'ubuntu-latest')
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: true
       matrix:
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 308bfbda2..e8bc3b093 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   dependabot:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}
     if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
       - name: Dependabot metadata
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 01caa4904..e07fc2a14 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -29,11 +29,35 @@ jobs:
     uses: ./.github/workflows/ci_static-analysis.yaml
   test_vector_handler:
     uses: ./.github/workflows/ci_test-vector-handler.yaml
+    with:
+      platforms: >-
+        [{"os": "ubuntu-latest", "runner": "codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}"}]
+    secrets:
+      INTEG_AWS_ACCESS_KEY_ID: ${{ secrets.INTEG_AWS_ACCESS_KEY_ID }}
+      INTEG_AWS_SECRET_ACCESS_KEY: ${{ secrets.INTEG_AWS_SECRET_ACCESS_KEY }}
+  test_vector_handler_macos_windows:
+    name: test_vector_handler (macOS, Windows)
+    uses: ./.github/workflows/ci_test-vector-handler.yaml
+    with:
+      platforms: >-
+        [{"os": "windows-latest", "runner": "windows-latest"},
+         {"os": "macos-latest", "runner": "macos-latest"},
+         {"os": "macos-15-intel", "runner": "macos-15-intel"}]
     secrets:
       INTEG_AWS_ACCESS_KEY_ID: ${{ secrets.INTEG_AWS_ACCESS_KEY_ID }}
       INTEG_AWS_SECRET_ACCESS_KEY: ${{ secrets.INTEG_AWS_SECRET_ACCESS_KEY }}
   tests:
     uses: ./.github/workflows/ci_tests.yaml
+    with:
+      platforms: >-
+        [{"os": "ubuntu-latest", "runner": "codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}"}]
+  tests_macos_windows:
+    name: tests (macOS, Windows)
+    uses: ./.github/workflows/ci_tests.yaml
+    with:
+      platforms: >-
+        [{"os": "windows-latest", "runner": "windows-latest"},
+         {"os": "macos-latest", "runner": "macos-latest"}]
   pr-ci-all-required:
     if: always()
     needs:
@@ -43,7 +67,7 @@ jobs:
       - static_analysis
       - test_vector_handler
       - tests
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Verify all required jobs passed
         uses: re-actors/alls-green@release/v1
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index cf250b944..b5b795101 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -11,7 +11,7 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-encryption-sdk-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
     - uses: actions/checkout@v4
     - uses: repo-sync/github-sync@v2