diff --git a/.github/workflows/ci_integration.yml b/.github/workflows/ci_integration.yml
index 38cab2b6..582e21bb 100644
--- a/.github/workflows/ci_integration.yml
+++ b/.github/workflows/ci_integration.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: &codebuild-linux codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: false
       matrix:
@@ -65,7 +65,7 @@ jobs:
         run: tox
 
   coverage:
-    runs-on: ubuntu-latest
+    runs-on: *codebuild-linux
     steps:
       - uses: actions/checkout@v4
       
diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml
index 1dd67a65..6d0b428e 100644
--- a/.github/workflows/ci_static-analysis.yaml
+++ b/.github/workflows/ci_static-analysis.yaml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   analysis:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 06e8ce5e..2ab8e87e 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -3,29 +3,29 @@ name: tests
 
 on:
   workflow_call:
-  # Keep the schedule to maintain daily runs
-  schedule:
-    - cron: '0 0 * * *'
+    inputs:
+      platforms:
+        type: string
+        required: false
+        default: >-
+          [{"os": "ubuntu-latest", "architecture": "x64", "runner": "codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}"},
+           {"os": "windows-latest", "architecture": "x64", "runner": "windows-latest"},
+           {"os": "macos-latest", "architecture": "x64", "runner": "macos-latest"}]
+      upstream:
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   contents: read
 
 jobs:
   tests:
-    runs-on: ${{ matrix.platform.os }}
+    runs-on: ${{ matrix.platform.runner }}
     strategy:
       fail-fast: true
       matrix:
-        platform:
-          - os: ubuntu-latest
-            architecture: x64
-          - os: windows-latest
-            architecture: x64
-          # x86 builds are only meaningful for Windows
-          - os: windows-latest
-            architecture: x86
-          - os: macos-latest
-            architecture: x64
+        platform: ${{ fromJSON(inputs.platforms) }}
         python:
           - 3.8
           - 3.9
@@ -63,10 +63,13 @@ jobs:
       - name: run test
         env:
           TOXENV: ${{ matrix.category }}
+          # tox reads pip's output as UTF-8; Windows writes it in the console code page otherwise.
+          PYTHONUTF8: "1"
         run: tox -- -vv
 
   upstream-py311:
-    runs-on: ubuntu-latest
+    if: inputs.upstream != false
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     strategy:
       fail-fast: true
       matrix:
@@ -85,4 +88,6 @@ jobs:
       - name: run test
         env:
           TOXENV: ${{ matrix.category }}
+          # tox reads pip's output as UTF-8; Windows writes it in the console code page otherwise.
+          PYTHONUTF8: "1"
         run: tox -- -vv
diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
new file mode 100644
index 00000000..bd91f8c1
--- /dev/null
+++ b/.github/workflows/daily_ci.yml
@@ -0,0 +1,14 @@
+name: Daily CI
+
+on:
+  # Keep the schedule to maintain daily runs
+  schedule:
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  call-tests:
+    name: Run Tests
+    uses: ./.github/workflows/ci_tests.yaml
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index f13598b9..4254ad7c 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -17,13 +17,24 @@ jobs:
   call-tests:
     name: Run Tests
     uses: ./.github/workflows/ci_tests.yaml
+    with:
+      platforms: >-
+        [{"os": "ubuntu-latest", "architecture": "x64", "runner": "codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}"}]
+  call-tests-macos-windows:
+    name: Run Tests (macOS, Windows)
+    uses: ./.github/workflows/ci_tests.yaml
+    with:
+      platforms: >-
+        [{"os": "windows-latest", "architecture": "x64", "runner": "windows-latest"},
+         {"os": "macos-latest", "architecture": "x64", "runner": "macos-latest"}]
+      upstream: false
   pr-ci-all-required:
     if: always()
     needs:
       - call-integration-tests
       - call-static-analysis
       - call-tests
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Verify all required jobs passed
         uses: re-actors/alls-green@release/v1
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index cf250b94..3c52486e 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -11,7 +11,7 @@ jobs:
   repo-sync:
     name: Repo Sync
     environment: repo-sync
-    runs-on: ubuntu-latest
+    runs-on: codebuild-CryptoToolsCI-linux-aws-dynamodb-encryption-python-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
     - uses: actions/checkout@v4
     - uses: repo-sync/github-sync@v2