diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f7e18dcc51edf5e7bff239307c97592d4b2cf875..173da5d2a38830d5f185f72d1c1a81130c41afd3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,7 +11,9 @@ updates:
       interval: "weekly"
 
   - package-ecosystem: "docker"
-    directory: "/tools/docker/Ubuntu"
+    directories:
+      - "/tools/docker/Ubuntu"
+      - "/tools/docker/ArchLinux"
     schedule:
       interval: "weekly"
     commit-message:
diff --git a/.github/workflows/full_cts.yml b/.github/workflows/build_full_cts.yml
similarity index 75%
rename from .github/workflows/full_cts.yml
rename to .github/workflows/build_full_cts.yml
index 50b1a9d7b20d55d6cb53e29c3f790dc7b6b75437..3cbefce6510697bb9d4cb611899a83965e025de6 100644
--- a/.github/workflows/full_cts.yml
+++ b/.github/workflows/build_full_cts.yml
@@ -1,6 +1,9 @@
 ---
 name: Weekly full CTS runs
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   schedule:
@@ -16,17 +19,17 @@ env:
   CCACHE_COMPRESS: "true"
   CCACHE_COMPRESSLEVEL: "1"
   CCACHE_MAXSIZE: "25000M"
-  CCACHE_BASEDIR: ${{ github.workspace }}
-  CCACHE_DIR: /home/github/ccache_storage
-#  CCACHE_BASEDIR: "${{ github.workspace }}"
-#  CCACHE_DIR: "${{ github.workspace }}/../../../../ccache_storage"
-#  EXAMPLES_DIR: "${{ github.workspace }}/../../../../examples"
 
 jobs:
   cpu_cts:
     name: LLVM ${{ matrix.llvm }} - CPU ${{ matrix.config }}
     runs-on: [self-hosted, linux, x64, full_cts_cpu, full_cts_spirv_cpu]
     timeout-minutes: 1600
+    # CPU runners have action runner directly in the home directory
+    env:
+      CCACHE_DIR: "${{ github.workspace }}/../../../ccache_storage"
+      EXAMPLES_DIR: "${{ github.workspace }}/../../../examples"
+      TSAN_OPTIONS: "second_deadlock_stack=1"
     strategy:
       fail-fast: false
       matrix:
@@ -34,19 +37,21 @@ jobs:
         config: [cts_full, cts_full_spirv]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Run CMake
         id: cmake
         run: |
           rm -rf ${{ github.workspace }}/build
           mkdir ${{ github.workspace }}/build
+          mkdir -p ${EXAMPLES_DIR}/build_${{ matrix.llvm }}_${{ matrix.config }}
+          mkdir -p ${EXAMPLES_DIR}/source
 
           BUILD_FLAGS="-O2 -march=native"
           cmake -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
           -DCMAKE_BUILD_TYPE=Release "-DCMAKE_C_FLAGS_RELEASE=$BUILD_FLAGS" "-DCMAKE_CXX_FLAGS_RELEASE=$BUILD_FLAGS" \
           -DWITH_LLVM_CONFIG=/usr/bin/llvm-config-${{ matrix.llvm }} -DLLVM_SPIRV=/usr/bin/llvm-spirv-${{ matrix.llvm }} \
-          -DTESTSUITE_SOURCE_BASEDIR=/home/github/examples/source -DTESTSUITE_BASEDIR=/home/github/examples/build_cts -DENABLE_TESTSUITES=conformance -DENABLE_CONFORMANCE=ON \
+          -DTESTSUITE_SOURCE_BASEDIR=${EXAMPLES_DIR}/source -DTESTSUITE_BASEDIR=${EXAMPLES_DIR}/build_${{ matrix.llvm }}_${{ matrix.config }} -DENABLE_TESTSUITES=conformance -DENABLE_CONFORMANCE=ON \
           -B ${{ github.workspace }}/build ${{ github.workspace }}
 
       - name: Run Build
@@ -76,6 +81,9 @@ jobs:
     name: LLVM ${{ matrix.llvm }} - LevelZero ${{ matrix.config }}
     runs-on: [self-hosted, linux, x64, full_cts_l0, full_cts_spirv_l0]
     timeout-minutes: 1600
+    env:
+      CCACHE_DIR: "${{ github.workspace }}/../../../../ccache_storage"
+      EXAMPLES_DIR: "${{ github.workspace }}/../../../../examples"
     strategy:
       fail-fast: false
       matrix:
@@ -83,26 +91,28 @@ jobs:
         config: [cts_full, cts_full_spirv]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
       - name: Run CMake
         id: cmake
         run: |
           rm -rf ${{ github.workspace }}/build
           mkdir ${{ github.workspace }}/build
+          mkdir -p ${EXAMPLES_DIR}/build_${{ matrix.llvm }}_${{ matrix.config }}
+          mkdir -p ${EXAMPLES_DIR}/source
 
           BUILD_FLAGS="-O2 -march=native"
           cmake -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
           -DCMAKE_BUILD_TYPE=Release "-DCMAKE_C_FLAGS_RELEASE=$BUILD_FLAGS" "-DCMAKE_CXX_FLAGS_RELEASE=$BUILD_FLAGS" \
           -DWITH_LLVM_CONFIG=/usr/bin/llvm-config-${{ matrix.llvm }} -DLLVM_SPIRV=/usr/bin/llvm-spirv-${{ matrix.llvm }} \
           -DENABLE_LEVEL0=1 -DENABLE_HOST_CPU_DEVICES=0 -DSTATIC_LLVM=1 \
-          -DTESTSUITE_SOURCE_BASEDIR=/home/github/examples/source -DTESTSUITE_BASEDIR=/home/github/examples/build_cts -DENABLE_TESTSUITES=conformance -DENABLE_CONFORMANCE=ON \
+          -DTESTSUITE_SOURCE_BASEDIR=${EXAMPLES_DIR}/source -DTESTSUITE_BASEDIR=${EXAMPLES_DIR}/build_${{ matrix.llvm }}_${{ matrix.config }} -DENABLE_TESTSUITES=conformance -DENABLE_CONFORMANCE=ON \
           -B ${{ github.workspace }}/build ${{ github.workspace }}
 
       - name: Run Build
         id: build
         run: |
-          cd ${{ github.workspace }}/build && make -j$(nproc) && make -j$(nproc) prepare_examples
+          cd ${{ github.workspace }}/build && make -j4 && make -j4 prepare_examples
 
       - name: Run Tests
         env:
diff --git a/.github/workflows/build_cmake.yml b/.github/workflows/build_linux.yml
similarity index 99%
rename from .github/workflows/build_cmake.yml
rename to .github/workflows/build_linux.yml
index 46886bbce18d5ec20dd8468ae305849481014af4..b4c7a9cccba2fc4a2723e5b494e162fbc684a62a 100644
--- a/.github/workflows/build_cmake.yml
+++ b/.github/workflows/build_linux.yml
@@ -1,5 +1,5 @@
 ---
-name: Main test matrix
+name: Linux test matrix
 
 permissions:
   contents: read
@@ -81,9 +81,9 @@ jobs:
             mkdir -p ${EXAMPLES_DIR}/build_tier1
             runCMake "-DENABLE_TESTSUITES=AMDSDK3.0;piglit;conformance;PyOpenCL;IntelSVM" -DENABLE_CONFORMANCE=ON -DTESTSUITE_SOURCE_BASEDIR=${EXAMPLES_DIR}/source -DTESTSUITE_BASEDIR=${EXAMPLES_DIR}/build_tier1
           elif [ "${{ matrix.config }}" == "chipstar" ]; then
-            mkdir -p ${EXAMPLES_DIR}/build_chipstar
+            mkdir -p ${EXAMPLES_DIR}/build_chipstar_${{ matrix.llvm }}
             mkdir -p ${EXAMPLES_DIR}/source
-            runCMake -DENABLE_TESTSUITES=chipStar -DTESTSUITE_SOURCE_BASEDIR=${EXAMPLES_DIR}/source -DTESTSUITE_BASEDIR=${EXAMPLES_DIR}/build_chipstar
+            runCMake -DENABLE_TESTSUITES=chipStar -DTESTSUITE_SOURCE_BASEDIR=${EXAMPLES_DIR}/source -DTESTSUITE_BASEDIR=${EXAMPLES_DIR}/build_chipstar_${{ matrix.llvm }}
           elif [ "${{ matrix.config }}" == "asan" ]; then
             runCMake -DENABLE_ASAN=1 -DENABLE_ICD=0 -DENABLE_LOADABLE_DRIVERS=0 -DDEVELOPER_MODE=OFF
           elif [ "${{ matrix.config }}" == "tsan" ]; then
@@ -135,7 +135,7 @@ jobs:
 
       - name: Cache CTest timings
         id: cache_ctest
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9
         with:
           path: ${{ github.workspace }}/build/Testing/Temporary/CTestCostData.txt
           key: ctest-cache-${{ steps.cmake_version.outputs.version }}-${{ runner.name }}-${{ matrix.config }}
diff --git a/.github/workflows/build_cmake_macos.yml b/.github/workflows/build_macos.yml
similarity index 97%
rename from .github/workflows/build_cmake_macos.yml
rename to .github/workflows/build_macos.yml
index aed0886a1e8fdee7c85cfa3feeccda14f4e05f3e..d5356cab06b9ecd7d977c0f207b2a04a82b5e6dc 100644
--- a/.github/workflows/build_cmake_macos.yml
+++ b/.github/workflows/build_macos.yml
@@ -1,5 +1,5 @@
 ---
-name: Main test matrix for macOS
+name: Mac OS X test matrix
 
 permissions:
   contents: read
@@ -43,7 +43,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
-      - uses: conda-incubator/setup-miniconda@v3
+      - uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca
         with:
           miniforge-version: latest
           mamba-version: "*"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 975cfb373dde2bc6e60d3480521f1a6d15db7621..92a1956c7c3b73e4f50489f0a0fcac71c73686c1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -11,6 +11,9 @@
 #
 name: "CodeQL Advanced"
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ "main", "release_*" ]
@@ -59,11 +62,11 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -91,6 +94,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0b7c3af62ae980abea99d05ba93fed45b206f710..6b60aa1abee366fa24f3a7e9931386f99b645fbc 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -15,7 +15,8 @@ on:
     branches: [ "main" ]
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
diff --git a/tools/docker/ArchLinux/default b/tools/docker/ArchLinux/default.dockerfile
similarity index 100%
rename from tools/docker/ArchLinux/default
rename to tools/docker/ArchLinux/default.dockerfile
diff --git a/tools/docker/ArchLinux/distro b/tools/docker/ArchLinux/distro.dockerfile
similarity index 100%
rename from tools/docker/ArchLinux/distro
rename to tools/docker/ArchLinux/distro.dockerfile
diff --git a/tools/docker/Ubuntu/22_04 b/tools/docker/Ubuntu/22_04.dockerfile
similarity index 100%
rename from tools/docker/Ubuntu/22_04
rename to tools/docker/Ubuntu/22_04.dockerfile
diff --git a/tools/docker/Ubuntu/24_04 b/tools/docker/Ubuntu/24_04.dockerfile
similarity index 100%
rename from tools/docker/Ubuntu/24_04
rename to tools/docker/Ubuntu/24_04.dockerfile
diff --git a/tools/docker/Ubuntu/conformance.64bit b/tools/docker/Ubuntu/conformance.dockerfile
similarity index 100%
rename from tools/docker/Ubuntu/conformance.64bit
rename to tools/docker/Ubuntu/conformance.dockerfile
diff --git a/tools/docker/Ubuntu/distro.64bit b/tools/docker/Ubuntu/distro.dockerfile
similarity index 100%
rename from tools/docker/Ubuntu/distro.64bit
rename to tools/docker/Ubuntu/distro.dockerfile