diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
deleted file mode 100644
index c28d558fab..0000000000
--- a/.github/workflows/benchmarks.yml
+++ /dev/null
@@ -1,60 +0,0 @@
-name: benchmarks
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-jobs:
-  benchmarks_with_bencher:
-    name: rust
-    permissions:
-      pull-requests: write
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        rust_bench: [ "commit", "encryption", "key_package", "create_group", "transaction" ]
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-      - uses: actions/checkout@v6
-      - name: run bencher cli
-        uses: ./.github/actions/run-bencher
-        with:
-          bencher-api-token: ${{ secrets.BENCHER_API_TOKEN }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          adapter: rust_criterion
-          bench-command: cargo bench --locked --bench ${{ matrix.rust_bench }} -- --quick
-
-  web_benchmarks_with_bencher:
-    name: web
-    permissions:
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-        with:
-          target: "wasm32-unknown-unknown"
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-      - name: Install wasm-bindgen-cli
-        uses: jetli/wasm-bindgen-action@v0.2.0
-      - name: bench wasm/js
-        run: |
-          make ts-bench RELEASE=1
-      - uses: actions/checkout@v6
-        with:
-          # Keep result file
-          clean: 'false'
-      - name: run bencher cli
-        uses: ./.github/actions/run-bencher
-        with:
-          bencher-api-token: ${{ secrets.BENCHER_API_TOKEN }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          directory: ${{ github.workspace }}/crypto-ffi/bindings/js
-          adapter: json
-          # No bench command, as we run the bench before calling bencher CLI.
-          bench-command:
-          bench-results-file-name: web_benchmark_results.json
diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
deleted file mode 100644
index 94a703766b..0000000000
--- a/.github/workflows/build-android.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-build-android"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_NET_GIT_FETCH_WITH_CLI: true
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
-  RELEASE: 1
-
-jobs:
-  build-android:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        include:
-          - task: android-armv7
-          - task: android-armv8
-          - task: android-x86
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: setup android sdk
-        uses: android-actions/setup-android@v3
-        with:
-          # Don't download unnecessary packages.
-          # We only need sdkmanager for the next step.
-          packages: ''
-
-      - name: install ndk and set up environment
-        run: |
-          ndk_version=$(cat crypto-ffi/bindings/android/ndk.version)
-          echo "y" | sdkmanager --install "ndk;$ndk_version"
-          echo ANDROID_NDK_HOME=$ANDROID_HOME/ndk/$ndk_version >> $GITHUB_ENV
-
-      - name: build android lib
-        uses: ./.github/actions/make/android/lib
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-          task: ${{ matrix.task }}
diff --git a/.github/workflows/build-ios.yml b/.github/workflows/build-ios.yml
deleted file mode 100644
index 6e1a753e91..0000000000
--- a/.github/workflows/build-ios.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-build-ios"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-
-defaults:
-  run:
-    shell: bash -euo pipefail {0}
-
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_NET_GIT_FETCH_WITH_CLI: true
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
-  RELEASE: 1
-
-jobs:
-  build-ios:
-    if: github.repository == 'wireapp/core-crypto'
-    runs-on: self-hosted
-    strategy:
-      matrix:
-        include:
-          - task: ios-device
-          - task: ios-simulator-arm
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: build ${{ matrix.task }}
-        uses: ./.github/actions/make/ios/build
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-          task: ${{ matrix.task }}
diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
deleted file mode 100644
index 0a38288499..0000000000
--- a/.github/workflows/deny.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: check license, sources
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: true
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_NET_GIT_FETCH_WITH_CLI: true
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
-
-jobs:
-  cargo-deny:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-        with:
-          rustflags: ''
-      - uses: taiki-e/install-action@v2
-        with:
-          tool: cargo-deny@0.18.6
-      - name: "check licenses / supply chain"
-        run: |
-          cargo deny --all-features check >> $GITHUB_STEP_SUMMARY
-      - name: "build a dependency licenses inventory and post it to summary"
-        run: |
-          cargo deny --all-features list --layout crate --format json | jq -r 'to_entries[] | "* \(.key)", "    * \(.value.licenses[])"' >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/deploy-changelog.yml b/.github/workflows/deploy-changelog.yml
deleted file mode 100644
index 459f7f5530..0000000000
--- a/.github/workflows/deploy-changelog.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: document changes
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  deploy:
-    name: document changes
-    runs-on: ubuntu-latest
-    env:
-      CHANGELOG: CHANGELOG.md
-
-    steps:
-    - name: checkout repository
-      uses: actions/checkout@v6
-
-    - name: move changelog
-      run: |
-        mkdir -p target/doc
-        mv "$CHANGELOG" target/doc/"$CHANGELOG"
-
-    - name: deploy
-      uses: peaceiris/actions-gh-pages@v4
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-        publish_branch: gh-pages
-        publish_dir: target/doc
-        keep_files: true
-        force_orphan: false
-        enable_jekyll: true
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
deleted file mode 100644
index 25c5637ad9..0000000000
--- a/.github/workflows/deploy-docs.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-deploy-docs"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-
-env:
-  RELEASE: 1
-
-jobs:
-  deploy-docs:
-    if: github.repository == 'wireapp/core-crypto' && (github.ref == 'refs/heads/main' || (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')))
-    runs-on: ubuntu-latest
-
-    env:
-      GIT_TAG: ${{ github.ref_type == 'tag' && github.ref_name || 'main' }}
-
-    steps:
-    - name: checkout repository
-      uses: actions/checkout@v6
-
-    - name: download pre-rendered docs
-      uses: actions/download-artifact@v7
-      with:
-        pattern: '{typescript,swift,kotlin,rust}'
-        path: "./target/doc/${{ env.GIT_TAG }}"
-        merge-multiple: false
-
-    - name: copy static files
-      run: |
-        cp docs/*.md target/doc/
-
-    - name: deploy docs
-      uses: peaceiris/actions-gh-pages@v4
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-        publish_branch: gh-pages
-        publish_dir: target/doc
-        keep_files: true
-        force_orphan: false
-        enable_jekyll: true
diff --git a/.github/workflows/docs-jvm.yml b/.github/workflows/docs-jvm.yml
deleted file mode 100644
index 8f2c37b671..0000000000
--- a/.github/workflows/docs-jvm.yml
+++ /dev/null
@@ -1,53 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-docs-jvm"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-
-env:
-  RELEASE: 1
-
-jobs:
-  docs-jvm:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-      - name: set up jdk 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: "17"
-          distribution: "adopt"
-      - name: gradle setup
-        uses: gradle/actions/setup-gradle@v5
-      - name: validate gradle wrapper
-        uses: gradle/actions/wrapper-validation@v5
-
-      - name: download linux library
-        uses: ./.github/actions/make/jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: download linux bindings
-        uses: ./.github/actions/make/bindings-kotlin-jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: generate Kotlin docs
-        uses: ./.github/actions/make
-        with:
-          key: docs-kotlin
-          make-rule: docs-kotlin
-          target-path: target/kotlin/doc/html
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: upload kotlin docs
-        uses: actions/upload-artifact@v6.0.0
-        with:
-          name: kotlin
-          path: target/kotlin/doc/html
-          retention-days: 1
-          overwrite: true
-          include-hidden-files: true
-          if-no-files-found: error
diff --git a/.github/workflows/docs-swift.yml b/.github/workflows/docs-swift.yml
deleted file mode 100644
index e1140a0b54..0000000000
--- a/.github/workflows/docs-swift.yml
+++ /dev/null
@@ -1,75 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-docs-swift"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-
-defaults:
-  run:
-    shell: bash -euo pipefail {0}
-
-env:
-  RELEASE: 1
-
-jobs:
-  docs-swift:
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      # This is only needed because of our composite actions calling gmake on ios
-      # to support our local runners without bash configs.
-      - name: Install gmake
-        run: brew install make
-
-      - name: download swift bindings
-        uses: ./.github/actions/make/bindings-swift
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: download artifacts for ios device
-        uses: ./.github/actions/make/ios/build
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-          task: ios-device
-      - name: download artifacts for ios simulator
-        uses: ./.github/actions/make/ios/build
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-          task: ios-simulator-arm
-
-      - name: setup Xcode
-        uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: '16.4.0'
-      - name: Set up Ruby environment
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: '3.3'
-
-      - name: install jazzy
-        run: gem install jazzy
-
-      - uses: swift-actions/setup-swift@v3
-        with:
-          swift-version: "6.0"
-
-      - name: swift docs
-        run: |
-          mkdir -p target/doc/core_crypto_ffi/bindings/swift
-          cd crypto-ffi/bindings/swift/WireCoreCrypto
-          jazzy \
-          	  --modules WireCoreCrypto,WireCoreCryptoUniffi \
-          	  --build-tool-arguments -project,WireCoreCrypto.xcodeproj,-scheme,WireCoreCrypto,-configuration,Release \
-          	  -o ../../../../target/swift/doc
-
-      - uses: actions/upload-artifact@v6.0.0
-        with:
-          name: swift
-          path: target/swift/doc
-          retention-days: 1
-          overwrite: true
-          include-hidden-files: true
-          if-no-files-found: error
diff --git a/.github/workflows/docs-ts.yml b/.github/workflows/docs-ts.yml
deleted file mode 100644
index 582b24d5a3..0000000000
--- a/.github/workflows/docs-ts.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-docs-ts"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-
-env:
-  RELEASE: 1
-
-jobs:
-  docs-ts:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: checkout repository
-      uses: actions/checkout@v6
-
-    - name: setup bun
-      uses: oven-sh/setup-bun@v2
-      with:
-        bun-version: latest
-
-    - name: download web files
-      uses: ./.github/actions/make/web/ts
-      with:
-        gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: make ts docs
-      run: make docs-ts
-
-    - uses: actions/upload-artifact@v6.0.0
-      with:
-        name: typescript
-        path: target/typescript/doc
-        retention-days: 1
-        overwrite: true
-        include-hidden-files: true
-        if-no-files-found: error
diff --git a/.github/workflows/foo.yml b/.github/workflows/foo.yml
new file mode 100644
index 0000000000..e56aae5aff
--- /dev/null
+++ b/.github/workflows/foo.yml
@@ -0,0 +1,29 @@
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}-foo"
+  cancel-in-progress: true
+
+on:
+  workflow_call:
+  workflow_dispatch:
+  push:
+
+env:
+  RELEASE: 1
+
+jobs:
+  foo:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: set up jdk 17
+        uses: actions/setup-java@v5
+        with:
+          java-version: "17"
+          distribution: "adopt"
+
+      - run: |
+          bash scripts/setup-android-emulator.sh
+          echo Setup DONE
+          bash scripts/start-android-emulator.sh
+
diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml
deleted file mode 100644
index dfac630770..0000000000
--- a/.github/workflows/interop.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-interop"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-  workflow_dispatch:
-
-env:
-  RELEASE: 1
-
-jobs:
-  e2e-interop-test:
-    runs-on: self-hosted
-
-    steps:
-      - uses: actions/checkout@v6
-      - name: set up jdk 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: "17"
-          distribution: "adopt"
-      - name: gradle setup
-        uses: gradle/actions/setup-gradle@v5
-      - name: validate gradle wrapper
-        uses: gradle/actions/wrapper-validation@v5
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
-      - name: setup Xcode
-        uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: '16.4.0'
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-      - name: Install chrome-headless-shell
-        run: |
-          bun x @puppeteer/browsers install chrome-headless-shell@latest --path $PWD
-          echo "CHROME_PATH=$(echo $PWD/chrome-headless-shell/*/*/chrome-headless-shell)" >> $GITHUB_ENV
-
-      - name: Install chromedriver
-        run: |
-          bun x @puppeteer/browsers install chromedriver@latest --path $PWD
-          echo "CHROMEDRIVER_PATH=$(echo $PWD/chromedriver/*/*/chromedriver)" >> $GITHUB_ENV
-
-      - name: Run e2e interop test
-        uses: ./.github/actions/make/interop/test
-        with:
-          always-run: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'main' }}
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-        # we separate shutdown from deletion to make sure the device is always removed, even when shutdown failed
-      - name: delete ios simulator and kill android emulator
-        if: always()
-        run: |
-          ./scripts/delete-ios-sim-device.sh ${{ env.SIMULATOR }}
-          if adb devices | grep -q '^emulator-'; then
-            adb emu kill
-          fi
diff --git a/.github/workflows/kotlin.yml b/.github/workflows/kotlin.yml
deleted file mode 100644
index c302f4f9fd..0000000000
--- a/.github/workflows/kotlin.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: kotlin
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: true
-
-on:
-  push:
-    tags:
-      - '*'
-  pull_request:
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: install ktlint
-        run: |
-          curl -sSLO https://github.com/pinterest/ktlint/releases/download/1.7.0/ktlint
-          chmod a+x ktlint
-          echo "$PWD" >> $GITHUB_PATH
-      - name: lint
-        run: |
-          make kotlin-check
diff --git a/.github/workflows/markdown.yml b/.github/workflows/markdown.yml
deleted file mode 100644
index 7add758c0d..0000000000
--- a/.github/workflows/markdown.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: markdown
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: wireapp/setup-fd@v0.1.0
-      - name: install mdformat
-        run: |
-          pip3 install mdformat mdformat-gfm mdformat-frontmatter mdformat-footnote mdformat-gfm-alerts mdformat-toc
-      - run: fd --glob '*.md' -X mdformat --check
diff --git a/.github/workflows/package-android.yml b/.github/workflows/package-android.yml
deleted file mode 100644
index bf132be96e..0000000000
--- a/.github/workflows/package-android.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-package-android"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-
-env:
-  RELEASE: 1
-
-jobs:
-  package-android:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: set up jdk 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: "17"
-          distribution: "adopt"
-      - name: gradle setup
-        uses: gradle/actions/setup-gradle@v5
-      - name: validate gradle wrapper
-        uses: gradle/actions/wrapper-validation@v5
-      - name: setup android sdk
-        uses: android-actions/setup-android@v3
-      - name: install ndk and set up environment
-        run: |
-          ndk_version=$(cat crypto-ffi/bindings/android/ndk.version)
-          echo "y" | sdkmanager --install "ndk;$ndk_version"
-          echo ANDROID_NDK_HOME=$ANDROID_HOME/ndk/$ndk_version >> $GITHUB_ENV
-      - uses: ./.github/actions/make/android/package
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/package-ios.yml b/.github/workflows/package-ios.yml
deleted file mode 100644
index fe384e55cc..0000000000
--- a/.github/workflows/package-ios.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-package-ios"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-
-defaults:
-  run:
-    shell: bash -euo pipefail {0}
-
-env:
-  RELEASE: 1
-
-jobs:
-  package-ios:
-    if: github.repository == 'wireapp/core-crypto'
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: download artifacts for ios device
-        uses: ./.github/actions/make/ios/build
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-          task: ios-device
-
-      - name: download artifacts for ios simulator
-        uses: ./.github/actions/make/ios/build
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-          task: ios-simulator-arm
-
-      - name: download swift bindings
-        uses: ./.github/actions/make/bindings-swift
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: setup Xcode
-        uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: '16.4.0'
-
-      - name: create xcframework
-        uses: ./.github/actions/make
-        with:
-          key: ios-create-xcframework
-          make-rule: ios-create-xcframework
-          target-path: |
-              crypto-ffi/bindings/swift/WireCoreCrypto.xcframework.zip
-              crypto-ffi/bindings/swift/WireCoreCryptoUniffi.xcframework.zip
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
deleted file mode 100644
index 9e06e651d6..0000000000
--- a/.github/workflows/pipeline.yml
+++ /dev/null
@@ -1,280 +0,0 @@
-name: 🚀 pipeline
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: true
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - "v*"
-  pull_request:
-
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_NET_GIT_FETCH_WITH_CLI: true
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
-  RELEASE: 1
-
-jobs:
-  #################
-  # Shared between JVM Linux and Android
-
-  uniffi-bindgen-linux:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/make/uniffi-bindgen
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-  ffi-library-linux:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/make/ffi-library
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-  #################
-  # Android
-
-  build-android:
-    uses: ./.github/workflows/build-android.yml
-
-  bindings-android:
-    runs-on: ubuntu-latest
-    needs:
-      - uniffi-bindgen-linux
-      - ffi-library-linux
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/make/android/bindings
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-  package-android:
-    needs:
-      - bindings-android
-      - build-android
-    uses: ./.github/workflows/package-android.yml
-
-  test-android:
-    needs:
-      - bindings-android
-      - build-android
-    uses: ./.github/workflows/test-android.yml
-
-  #################
-  # JVM Darwin
-
-  build-jvm-darwin:
-    if: github.repository == 'wireapp/core-crypto'
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/make/jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-  #################
-  # JVM Linux
-
-  build-jvm-linux:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/make/jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-  bindings-jvm:
-    needs:
-      - uniffi-bindgen-linux
-      - ffi-library-linux
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/make/bindings-kotlin-jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-  test-jvm:
-    needs:
-      - bindings-jvm
-      - build-jvm-linux
-      - build-jvm-darwin
-    uses: ./.github/workflows/test-jvm.yml
-
-  docs-jvm:
-    needs:
-      - bindings-jvm
-      - build-jvm-linux
-    uses: ./.github/workflows/docs-jvm.yml
-
-  #################
-  # iOS/Swift
-
-  build-ios:
-    uses: ./.github/workflows/build-ios.yml
-
-  bindings-swift:
-    if: github.repository == 'wireapp/core-crypto'
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/make/bindings-swift
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-  package-ios:
-    needs:
-      - build-ios
-      - bindings-swift
-    uses: ./.github/workflows/package-ios.yml
-
-  test-ios:
-    needs:
-      - build-ios
-      - bindings-swift
-    uses: ./.github/workflows/test-ios.yml
-
-  docs-swift:
-    needs:
-      - build-ios
-      - bindings-swift
-    uses: ./.github/workflows/docs-swift.yml
-
-  #################
-  # Web
-
-  bindings-ts:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-      - name: build ts
-        uses: ./.github/actions/make/web/ts
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-  test-ts:
-    needs: bindings-ts
-    uses: ./.github/workflows/test-ts.yml
-
-  docs-ts:
-    needs: bindings-ts
-    uses: ./.github/workflows/docs-ts.yml
-
-  #################
-  # Rust
-
-  docs-rust:
-    runs-on: ubuntu-latest
-    env:
-      RUSTDOCFLAGS: "-D warnings"
-
-    steps:
-      - name: checkout repository
-        uses: actions/checkout@v6
-
-      - uses: ./.github/actions/setup-and-cache-rust
-        with:
-          rustflags: "-D warnings -W unreachable-pub"
-      - run: cargo doc --all --no-deps --locked
-
-      - uses: actions/upload-artifact@v6.0.0
-        with:
-          name: rust
-          path: target/doc
-          retention-days: 1
-          overwrite: true
-          include-hidden-files: true
-          if-no-files-found: error
-
-  #################
-  # Cross-platform jobs
-
-  build-interop:
-    if: github.repository == 'wireapp/core-crypto'
-    runs-on: macos-latest
-    steps:
-      # Needed for parity between github and self-hosted runner
-      - run: brew install make
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/make/interop/build
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-  e2e-interop-test:
-    needs:
-      - build-ios
-      - bindings-swift
-      - bindings-ts
-      - package-android
-      - build-interop
-    uses: ./.github/workflows/interop.yml
-
-  deploy-docs:
-    needs:
-      - docs-rust
-      - docs-ts
-      - docs-jvm
-      - docs-swift
-    uses: ./.github/workflows/deploy-docs.yml
-
-  #################
-  # Publish
-
-  prepare-publish:
-    needs:
-      - package-ios
-      - package-android
-      - bindings-ts
-      - build-jvm-linux
-      - build-jvm-darwin
-      - bindings-jvm
-    runs-on: ubuntu-latest
-    if: github.ref_type == 'tag'
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: force-fetch the tag to work around actions/checkout#290
-        run: git fetch -f origin ${{ github.ref }}:${{ github.ref }}
-
-      - name: ensure the tag is signed
-        run: git cat-file tag ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
-
-  publish-jvm:
-    needs: prepare-publish
-    uses: ./.github/workflows/publish-jvm.yml
-    secrets:
-      SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
-      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
-      PGP_KEY_ID: ${{ secrets.PGP_KEY_ID }}
-      PGP_SIGNING_KEY: ${{ secrets.PGP_SIGNING_KEY }}
-      PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
-
-  publish-android:
-    needs: prepare-publish
-    uses: ./.github/workflows/publish-android.yml
-    secrets:
-      SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
-      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
-      PGP_KEY_ID: ${{ secrets.PGP_KEY_ID }}
-      PGP_SIGNING_KEY: ${{ secrets.PGP_SIGNING_KEY }}
-      PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
-
-  publish-ios:
-    needs: prepare-publish
-    uses: ./.github/workflows/publish-swift.yml
-
-  publish-web:
-    needs: prepare-publish
-    uses: ./.github/workflows/publish-wasm.yml
-    permissions:
-      id-token: write
diff --git a/.github/workflows/publish-android.yml b/.github/workflows/publish-android.yml
deleted file mode 100644
index 4f08ac3097..0000000000
--- a/.github/workflows/publish-android.yml
+++ /dev/null
@@ -1,73 +0,0 @@
-name: publish android packages
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-publish-android"
-
-on:
-  workflow_call:
-    secrets:
-      SONATYPE_USERNAME:
-        required: true
-      SONATYPE_PASSWORD:
-        required: true
-      PGP_KEY_ID:
-        required: true
-      PGP_SIGNING_KEY:
-        required: true
-      PGP_PASSPHRASE:
-        required: true
-
-env:
-  RELEASE: 1
-
-jobs:
-  publish-android:
-    if: github.repository == 'wireapp/core-crypto'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: set up jdk 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: "17"
-          distribution: "adopt"
-      - name: gradle setup
-        uses: gradle/actions/setup-gradle@v5
-      - name: validate gradle wrapper
-        uses: gradle/actions/wrapper-validation@v5
-      - name: setup android sdk
-        uses: android-actions/setup-android@v3
-      - uses: ./.github/actions/make/android/package
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: zip package and bindings
-        run: |
-          zip -r android.zip \
-          target/armv7-linux-androideabi/release/libcore_crypto_ffi.a \
-          target/armv7-linux-androideabi/release/libcore_crypto_ffi.so \
-          target/aarch64-linux-android/release/libcore_crypto_ffi.a \
-          target/aarch64-linux-android/release/libcore_crypto_ffi.so \
-          target/x86_64-linux-android/release/libcore_crypto_ffi.a \
-          target/x86_64-linux-android/release/libcore_crypto_ffi.so \
-          crypto-ffi/bindings/android/build/outputs/aar/android-release.aar \
-          crypto-ffi/bindings/android/src/main/uniffi/com/wire/crypto/core_crypto_ffi.kt
-
-      - name: upload package
-        uses: softprops/action-gh-release@v2
-        with:
-            files: android.zip
-            fail_on_unmatched_files: true
-
-      # For Android, we're not deleting the release artifacts after this step succeds,
-      # because publishing may still fail later.
-      - name: publish package
-        run: |
-          cd crypto-ffi/bindings
-          ./gradlew android:publishAllPublicationsToMavenCentralRepository --no-configuration-cache
-        env:
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.PGP_KEY_ID }}
-          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.PGP_SIGNING_KEY }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.PGP_PASSPHRASE }}
diff --git a/.github/workflows/publish-jvm.yml b/.github/workflows/publish-jvm.yml
deleted file mode 100644
index c2b469ce85..0000000000
--- a/.github/workflows/publish-jvm.yml
+++ /dev/null
@@ -1,91 +0,0 @@
-name: publish jvm packages
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-publish-jvm"
-
-on:
-  workflow_call:
-    secrets:
-      SONATYPE_USERNAME:
-        required: true
-      SONATYPE_PASSWORD:
-        required: true
-      PGP_KEY_ID:
-        required: true
-      PGP_SIGNING_KEY:
-        required: true
-      PGP_PASSPHRASE:
-        required: true
-
-env:
-  RELEASE: 1
-
-jobs:
-  publish-jvm:
-    if: github.repository == 'wireapp/core-crypto'
-    name: publish jvm package
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: set up jdk 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: "17"
-          distribution: "adopt"
-
-      - name: download bindings artifact
-        uses: ./.github/actions/make/bindings-kotlin-jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: gradle setup
-        uses: gradle/actions/setup-gradle@v5
-
-      - name: validate gradle wrapper
-        uses: gradle/actions/wrapper-validation@v5
-
-      - name: download jvm bindings
-        uses: ./.github/actions/make/bindings-kotlin-jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: download x86_64 linux artifact
-        uses: ./.github/actions/make/jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      # The specific jvm action uses `uname -s` to determine which `jvm` make rule to call.
-      # Because this workflow runs on ubuntu, we're using the generic action
-      - name: download aarch64 apple darwin artifact
-        uses: ./.github/actions/make
-        with:
-          key: jvm-darwin
-          make-rule: jvm-darwin
-          target-path: target/aarch64-apple-darwin/release/libcore_crypto_ffi.dylib
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: zip package
-        run: |
-          zip -r jvm.zip \
-          crypto-ffi/bindings/jvm/src/main/uniffi/com/wire/crypto/core_crypto_ffi.kt \
-          target/aarch64-apple-darwin/release/libcore_crypto_ffi.dylib \
-          target/x86_64-unknown-linux-gnu/release/libcore_crypto_ffi.so
-
-      - name: upload package
-        uses: softprops/action-gh-release@v2
-        with:
-            files: jvm.zip
-            fail_on_unmatched_files: true
-
-      # For JVM, we're not deleting the release artifacts after this step succeds,
-      # because publishing may still fail later.
-      - name: publish package
-        run: |
-          cd crypto-ffi/bindings
-          ./gradlew :jvm:publishAllPublicationsToMavenCentralRepository --no-configuration-cache
-        env:
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.PGP_KEY_ID }}
-          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.PGP_SIGNING_KEY }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.PGP_PASSPHRASE }}
diff --git a/.github/workflows/publish-swift.yml b/.github/workflows/publish-swift.yml
deleted file mode 100644
index c82c0da46a..0000000000
--- a/.github/workflows/publish-swift.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: publish swift package
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-publish-swift"
-
-on:
-  workflow_call:
-
-env:
-  RELEASE: 1
-
-jobs:
-  publish-swift:
-    if: github.repository == 'wireapp/core-crypto'
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: download artifacts for ios device
-        uses: ./.github/actions/make/ios/build
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-          task: ios-device
-
-      - name: download artifacts for ios simulator
-        uses: ./.github/actions/make/ios/build
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-          task: ios-simulator-arm
-
-      - name: download swift bindings
-        uses: ./.github/actions/make/bindings-swift
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: download xcframework
-        uses: ./.github/actions/make
-        with:
-          key: ios-create-xcframework
-          make-rule: ios-create-xcframework
-          target-path: |
-              crypto-ffi/bindings/swift/WireCoreCrypto.xcframework.zip
-              crypto-ffi/bindings/swift/WireCoreCryptoUniffi.xcframework.zip
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: upload xcframework
-        uses: softprops/action-gh-release@v2
-        with:
-            files: |
-              crypto-ffi/bindings/swift/WireCoreCrypto.xcframework.zip
-              crypto-ffi/bindings/swift/WireCoreCryptoUniffi.xcframework.zip
-            fail_on_unmatched_files: true
diff --git a/.github/workflows/publish-wasm.yml b/.github/workflows/publish-wasm.yml
deleted file mode 100644
index aebb54038d..0000000000
--- a/.github/workflows/publish-wasm.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: publish node packages
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-publish-wasm"
-
-on:
-  workflow_call:
-
-env:
-  RELEASE: 1
-
-jobs:
-  publish-wasm:
-    if: github.repository == 'wireapp/core-crypto'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - name: Setup Node for npm publish
-        uses: actions/setup-node@v6
-
-      - name: download ts artifacts
-        uses: ./.github/actions/make/web/ts
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: package tarball
-        id: package
-        run: |
-          filename=$(make web-package | tail -n 1)
-          echo "filename=$filename" >> "$GITHUB_OUTPUT"
-          echo "path=crypto-ffi/bindings/js/$filename" >> "$GITHUB_OUTPUT"
-
-      - name: upload artifacts
-        uses: softprops/action-gh-release@v2
-        with:
-          files: "${{ steps.package.outputs.path }}"
-          fail_on_unmatched_files: true
-
-      - name: publish package to npm (Trusted Publishers)
-        run: |
-          cd crypto-ffi/bindings/js
-          npm publish "./${{ steps.package.outputs.filename }}"
-
-      - name: delete package from gh release
-        run: gh release delete-asset $GITHUB_REF_NAME "${{ steps.package.outputs.filename }}" --yes
-        env:
-          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
deleted file mode 100644
index fb81ce5794..0000000000
--- a/.github/workflows/rust.yml
+++ /dev/null
@@ -1,133 +0,0 @@
-name: rust
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: true
-
-on:
-  push:
-    tags:
-      - '*'
-  pull_request:
-
-env:
-  RUST_BACKTRACE: 1
-  CARGO_TERM_COLOR: always
-  CARGO_NET_GIT_FETCH_WITH_CLI: true
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        command:
-          - cargo check --workspace --locked --all-targets
-          - cargo check --workspace --locked --target wasm32-unknown-unknown --exclude test-wire-server
-          - cargo clippy --workspace --locked --all-targets
-          - cargo clippy --workspace --locked --target wasm32-unknown-unknown --exclude test-wire-server
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-        with:
-          components: clippy
-          target: wasm32-unknown-unknown
-          rustflags: ${{ contains(matrix.command, 'wasm32-unknown-unknown') && '--cfg getrandom_backend="wasm_js" -D warnings' || '-D warnings' }}
-      - run: ${{ matrix.command }}
-
-  fmt-check:
-     runs-on: ubuntu-latest
-     steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-        with:
-          components: rustfmt
-          toolchain: nightly
-      - run: cargo +nightly fmt --all -- --check
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-      - uses: taiki-e/install-action@nextest
-      - name: "test corecrypto"
-        run: cargo nextest run --verbose --locked
-      - name: "test corecrypto documentation"
-        run: cargo test --doc --locked
-      - name: "upload test results"
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
-        with:
-          files: target/nextest/default/junit.xml
-          fail_on_unmatched_files: true
-
-  proteus-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-      - uses: taiki-e/install-action@nextest
-      - name: "test corecrypto's proteus implementation"
-        run: cargo nextest run --locked --verbose --features proteus,proteus-keystore proteus
-
-  keystore-wasm-test:
-    runs-on: ubuntu-latest
-    env:
-      WASM_BINDGEN_TEST_TIMEOUT: "1200" # if our test takes over 20m, it probably _should_ fail
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-        with:
-          target: wasm32-unknown-unknown
-      - uses: wireapp/setup-chrome@master
-        id: setup-chrome
-        with:
-          chrome-version: stable
-      - run: echo "CHROME_PATH=${{ steps.setup-chrome.outputs.chrome-path }}" >> $GITHUB_ENV
-      - name: install wasm-bindgen-cli (for test runner)
-        run: |
-          wasm_bindgen_version="$(
-            cargo metadata --format-version 1 |
-            jq -r '.packages[] | select (.name == "wasm-bindgen") | .version'
-          )"
-          cargo install wasm-bindgen-cli --version $wasm_bindgen_version
-      - run: cargo test --target wasm32-unknown-unknown -p core-crypto-keystore
-
-  keystore-proteus-wasm-test:
-    runs-on: ubuntu-latest
-    env:
-      WASM_BINDGEN_TEST_TIMEOUT: "1200" # if our test takes over 20m, it probably _should_ fail
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-        with:
-          target: wasm32-unknown-unknown
-      - uses: wireapp/setup-chrome@master
-        id: setup-chrome
-        with:
-          chrome-version: stable
-      - run: echo "CHROME_PATH=${{ steps.setup-chrome.outputs.chrome-path }}" >> $GITHUB_ENV
-      - name: install wasm-bindgen-cli (for test runner)
-        run: |
-          wasm_bindgen_version="$(
-            cargo metadata --format-version 1 |
-            jq -r '.packages[] | select (.name == "wasm-bindgen") | .version'
-          )"
-          cargo install wasm-bindgen-cli --version $wasm_bindgen_version
-      - run: cargo test --target wasm32-unknown-unknown -p core-crypto-keystore --features proteus-keystore -- proteus
-
-  hack:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-        # Per default, we're using "-D warnings" for rustflags. However, it's a lot of (unnecessary) effort to fix all "unused import"
-        # issue for every possible feature set, that's why we don't want to fail on warnings here. For this, we're passing
-        # an empty set of rustflags.
-        with:
-          rustflags: ''
-      - uses: taiki-e/install-action@cargo-hack
-      - name: cargo/hack (verify features compile in isolation)
-        run: cargo hack check --each-feature --no-dev-deps
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
deleted file mode 100644
index dfdd80d682..0000000000
--- a/.github/workflows/scheduled.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: scheduled
-
-
-on:
-  schedule:
-    # runs these jobs on the default branch (main) at 0132 daily UTC (0332 Berlin time)
-    - cron: "32 1 * * *"
-  workflow_dispatch:
-    # runs these jobs when triggered manually
-
-env:
-  RUST_BACKTRACE: 1
-  CARGO_TERM_COLOR: always
-  CARGO_NET_GIT_FETCH_WITH_CLI: true
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
-
-jobs:
-  all-features:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-and-cache-rust
-      - uses: taiki-e/install-action@nextest
-      - run: cargo nextest run --locked --all-features --no-fail-fast --retries 5
-        # certain tests are flaky when run in parallel like this, but
-        # experiments suggest 5 is enough retries that they'll generally pass eventually
diff --git a/.github/workflows/test-android.yml b/.github/workflows/test-android.yml
deleted file mode 100644
index 6ff3ca0e5b..0000000000
--- a/.github/workflows/test-android.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-test-android"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-  workflow_dispatch:
-
-env:
-  RELEASE: 1
-
-jobs:
-  test-android:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-      - name: set up jdk 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: "17"
-          distribution: "adopt"
-      - name: gradle setup
-        uses: gradle/actions/setup-gradle@v5
-      - name: validate gradle wrapper
-        uses: gradle/actions/wrapper-validation@v5
-      - name: enable kvm group perms
-        run: |
-          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
-          sudo udevadm control --reload-rules
-          sudo udevadm trigger --name-match=kvm
-
-      - name: android instrumentation tests
-        uses: ./.github/actions/make/android/test
-        with:
-          always-run: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'main' }}
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test-e2ei.yml b/.github/workflows/test-e2ei.yml
deleted file mode 100644
index 624ce02e2c..0000000000
--- a/.github/workflows/test-e2ei.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: test-e2ei
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: true
-
-on:
-  push:
-    tags:
-      - '*'
-  pull_request:
-
-env:
-  RELEASE: 1
-  RUST_BACKTRACE: 1
-  CARGO_TERM_COLOR: always
-  CARGO_NET_GIT_FETCH_WITH_CLI: true
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
-
-jobs:
-  test-e2ei:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        idp:
-          - authelia
-          - keycloak
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-        with:
-          rustflags: ''
-          toolchain: 'stable'
-      - uses: taiki-e/install-action@nextest
-      - run: TEST_IDP=${{ matrix.idp }} sh scripts/run-e2ei-tests.sh
diff --git a/.github/workflows/test-ios.yml b/.github/workflows/test-ios.yml
deleted file mode 100644
index 2a1bedab06..0000000000
--- a/.github/workflows/test-ios.yml
+++ /dev/null
@@ -1,53 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-test-ios"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-  workflow_dispatch:
-
-defaults:
-  run:
-    shell: bash -euo pipefail {0}
-
-env:
-  RELEASE: 1
-
-jobs:
-  test-ios:
-    if: github.repository == 'wireapp/core-crypto'
-    runs-on: self-hosted
-    steps:
-      - name: Cleanup on post
-        uses: gacts/run-and-post-run@v1
-        with:
-            post: |
-              sh ./scripts/clean.sh
-      - uses: actions/checkout@v6
-
-      - name: setup Xcode
-        uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: '16.4.0'
-
-      - name: Install swiftlint
-        env:
-          HOMEBREW_NO_AUTO_UPDATE: 1
-          HOMEBREW_NO_INSTALL_UPGRADE: 1
-        run: |
-          brew install swiftlint
-
-      - name: Format-check and lint
-        run: |
-          make swift-check
-
-      - name: ios tests
-        uses: ./.github/actions/make/ios/test
-        with:
-          always-run: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'main' }}
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Delete simulator
-        if: always()
-        run: |
-          ./scripts/delete-ios-sim-device.sh ${{ env.SIMULATOR }}
diff --git a/.github/workflows/test-jvm.yml b/.github/workflows/test-jvm.yml
deleted file mode 100644
index dd9fb66cef..0000000000
--- a/.github/workflows/test-jvm.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-test-jvm"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-  workflow_dispatch:
-
-env:
-  RELEASE: 1
-
-jobs:
-  test-jvm:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-      - name: set up jdk 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: "17"
-          distribution: "adopt"
-      - name: gradle setup
-        uses: gradle/actions/setup-gradle@v5
-      - name: validate gradle wrapper
-        uses: gradle/actions/wrapper-validation@v5
-
-      - name: download linux library
-        uses: ./.github/actions/make/jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      # The specific jvm action uses `uname -s` to determine which `jvm` make rule to call.
-      # Because this workflow runs on ubuntu, we're using the generic action
-      - name: download aarch64 apple darwin artifact
-        uses: ./.github/actions/make
-        with:
-          key: jvm-darwin
-          make-rule: jvm-darwin
-          target-path: target/aarch64-apple-darwin/release/libcore_crypto_ffi.dylib
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: download kotlin bindings
-        uses: ./.github/actions/make/bindings-kotlin-jvm
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: run detekt
-        run: |
-          cd crypto-ffi/bindings
-          ./gradlew jvm:detekt
-
-      - name: build and test jvm package
-        uses: ./.github/actions/make
-        with:
-          key: jvm-test
-          make-rule: jvm-test
-          always-run: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'main' }}
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test-ts.yml b/.github/workflows/test-ts.yml
deleted file mode 100644
index b1690a02b8..0000000000
--- a/.github/workflows/test-ts.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}-test-ts"
-  cancel-in-progress: true
-
-on:
-  workflow_call:
-  workflow_dispatch:
-
-env:
-  RELEASE: 1
-
-jobs:
-  test-ts:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-      - uses: wireapp/setup-chrome@master
-        id: setup-chrome
-        with:
-          chrome-version: stable
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-      - name: download web files
-        uses: ./.github/actions/make/web/ts
-        with:
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: lint
-        run: make ts-check
-
-      - name: test
-        uses: ./.github/actions/make
-        with:
-          key: ts-test
-          make-rule: ts-test
-          always-run: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'main' }}
-          gh-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/toml.yml b/.github/workflows/toml.yml
deleted file mode 100644
index 53107be806..0000000000
--- a/.github/workflows/toml.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-name: toml
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: uncenter/setup-taplo@v1
-      - uses: wireapp/setup-fd@v0.1.0
-      - run: fd --glob --hidden '*.toml' -X taplo fmt --check
diff --git a/scripts/start-android-emulator.sh b/scripts/start-android-emulator.sh
index dea62a04c7..6d83ed88aa 100755
--- a/scripts/start-android-emulator.sh
+++ b/scripts/start-android-emulator.sh
@@ -22,6 +22,7 @@ if ! avdmanager list avd | grep -q "^Name: $AVD_NAME"; then
     echo "no" | avdmanager create avd -n $AVD_NAME --package "$package" --force
 fi
 
+avdmanager list avd
 # If there's an emulator instance running with our AVD, shut it down first.
 if [ "$(adb -s $ADB_DEVICE emu avd name | head -n1 | sed 's/[[:space:]]*$//')" = "$AVD_NAME" ]; then
     echo An emulator is already running. Going to shut it down.
@@ -29,10 +30,17 @@ if [ "$(adb -s $ADB_DEVICE emu avd name | head -n1 | sed 's/[[:space:]]*$//')" =
 fi
 
 # Launch the emulator
-echo "Launching emulator on $AVD_NAME..."
+echo "Launching emulator on $AVD_NAME, port $PORT..."
 logfile=$(mktemp)
-emulator -avd $AVD_NAME -port $PORT -no-window -gpu swiftshader_indirect \
-         -no-snapshot -noaudio -no-boot-anim -no-metrics >$logfile &
+if [ -n "$CI" ]; then
+    export ANDROID_AVD_HOME=~/.config/.android/avd
+    echo $HOME
+fi
+timeout 1m emulator -avd $AVD_NAME -port $PORT -no-window -gpu swiftshader_indirect \
+         -no-snapshot -noaudio -no-boot-anim -no-metrics
+
+adb devices
+
 EMULATOR_PID=$!
 
 echo Emulator log file: $logfile