diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..fa3e5e5
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,188 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - release-*
+    tags:
+      - '*'
+  pull_request: {}
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Package version (e.g. v0.1.0)
+        required: false
+
+env:
+  # Common versions
+  GO_VERSION: '1.23.1'
+  GOLANGCI_VERSION: 'v1.63.2'
+  DOCKER_BUILDX_VERSION: 'v0.23.0'
+
+  # These environment variables are important to the Crossplane CLI install.sh
+  # script. They determine what version it installs.
+  XP_CHANNEL: master   # TODO(negz): Pin to stable once v1.14 is released.
+  XP_VERSION: current  # TODO(negz): Pin to a version once v1.14 is released.
+
+  # This CI job will automatically push new builds to xpkg.upbound.io if the
+  # XPKG_ACCESS_ID and XPKG_TOKEN secrets are set in the GitHub respository (or
+  # organization) settings. Create a token at https://accounts.upbound.io.
+  XPKG_ACCESS_ID: ${{ secrets.XPKG_ACCESS_ID }}
+
+  # The package to push, without a version tag. The default matches GitHub. For
+  # example xpkg.upbound.io/crossplane/function-template-go.
+  XPKG: xpkg.upbound.io/${{ github.repository}}
+  CROSSPLANE_REGORG: ghcr.io/${{ github.repository}} # xpkg.crossplane.io/crossplane-contrib
+
+  # The package version to push. The default is 0.0.0-gitsha.
+  XPKG_VERSION: ${{ inputs.version }}
+
+jobs:
+  lint:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: false  # The golangci-lint action does its own caching.
+
+      - name: Check go mod tidy
+        run: go mod tidy && git diff --exit-code go.mod go.sum
+
+      - name: Lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: ${{ env.GOLANGCI_VERSION }}
+
+  unit-test:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Run Unit Tests
+        run: go test -v -cover ./...
+
+  # We want to build most packages for the amd64 and arm64 architectures. To
+  # speed this up we build single-platform packages in parallel. We then upload
+  # those packages to GitHub as a build artifact. The push job downloads those
+  # artifacts and pushes them as a single multi-platform package.
+  build:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: true
+      matrix:
+        arch:
+          - amd64
+          - arm64
+    steps:
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: all
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ env.DOCKER_BUILDX_VERSION }}
+          install: true
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: setup LDFLAGS
+        run: |
+          LDFLAGS="$(make ci-print-ldflags)"
+          echo "LDFLAGS=${LDFLAGS}">>$GITHUB_ENV
+
+      # We ask Docker to use GitHub Action's native caching support to speed up
+      # the build, per https://docs.docker.com/build/cache/backends/gha/.
+      - name: Build Runtime
+        id: image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/${{ matrix.arch }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          target: image
+          build-args: |
+            GO_VERSION=${{ env.GO_VERSION }}
+            LDFLAGS=${{ env.LDFLAGS }}
+          outputs: type=docker,dest=runtime-${{ matrix.arch }}.tar
+
+      - name: Setup the Crossplane CLI
+        run: "curl -sL https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh | sh"
+
+      - name: remove examples from tree
+        run: rm -rf examples/
+
+      - name: Build Package
+        run: ./crossplane xpkg build --package-file=${{ matrix.arch }}.xpkg --package-root=package/ --embed-runtime-image-tarball=runtime-${{ matrix.arch }}.tar
+
+      - name: Upload Single-Platform Package
+        uses: actions/upload-artifact@v4
+        with:
+          name: package-${{ matrix.arch }}
+          path: "*.xpkg"
+          if-no-files-found: error
+          retention-days: 1
+
+  # This job downloads the single-platform packages built by the build job, and
+  # pushes them as a multi-platform package. We only push the package it the
+  # XPKG_ACCESS_ID and XPKG_TOKEN secrets were provided.
+  push:
+    runs-on: ubuntu-24.04
+    needs:
+      - lint
+      - unit-test
+      - build
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download Single-Platform Packages
+        uses: actions/download-artifact@v4
+        with:
+          path: .
+          merge-multiple: true
+          pattern: "!*.dockerbuild" # This gets uploaded by docker/build-push-action but must be skipped: https://github.com/actions/toolkit/pull/1874
+
+      - name: Setup the Crossplane CLI
+        run: "curl -sL https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh | sh"
+
+      - name: Set Multi-Platform Package Version
+        run: echo "XPKG_VERSION=$(make ci-print-version)" >> $GITHUB_ENV
+
+      - name: Login to Upbound
+        uses: docker/login-action@v3
+        if: env.XPKG_ACCESS_ID != ''
+        with:
+          registry: xpkg.upbound.io
+          username: ${{ secrets.XPKG_ACCESS_ID }}
+          password: ${{ secrets.XPKG_TOKEN }}
+
+      - name: Push Multi-Platform Package to Upbound
+        if: env.XPKG_ACCESS_ID != ''
+        run: "./crossplane --verbose xpkg push --package-files $(echo *.xpkg|tr ' ' ,) ${{ env.XPKG }}:${{ env.XPKG_VERSION }}"
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push Multi-Platform Package to GHCR
+        if: env.XPKG_ACCESS_ID != ''
+        run: "./crossplane --verbose xpkg push --package-files $(echo *.xpkg|tr ' ' ,) ${{ env.CROSSPLANE_REGORG }}:${{ env.XPKG_VERSION }}"
diff --git a/.github/workflows/docker-build-push.yaml b/.github/workflows/docker-build-push.yaml
deleted file mode 100644
index dbbeaa4..0000000
--- a/.github/workflows/docker-build-push.yaml
+++ /dev/null
@@ -1,114 +0,0 @@
-name: docker build and push
-on:
-  pull_request: {}
-  push:
-    branches:
-      - main
-    tags:
-      - '*'
-
-env:
-  GO_VERSION: '1.23.1'
-  DOCKER_BUILDX_VERSION: 'v0.22.0'
-  XP_CHANNEL: master
-  XP_VERSION: current
-  XPKG_ACCESS_ID: ${{ secrets.XPKG_ACCESS_ID }}
-  XPKG: xpkg.upbound.io/${{ github.repository}}
-
-jobs:
-  build:
-    name: build multi-arch packages
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: true
-      matrix:
-        arch:
-          - amd64
-          - arm64
-    steps:
-      - name: setup QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: all
-
-      - name: setup Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          version: ${{ env.DOCKER_BUILDX_VERSION }}
-          install: true
-
-      - name: checkout
-        uses: actions/checkout@v4
-
-      - name: setup LDFLAGS
-        run: |
-          LDFLAGS="$(make ci-print-ldflags)"
-          echo "LDFLAGS=${LDFLAGS}">>$GITHUB_ENV
-
-      # We ask Docker to use GitHub Action's native caching support to speed up
-      # the build, per https://docs.docker.com/build/cache/backends/gha/.
-      - name: build runtime
-        id: image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/${{ matrix.arch }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          target: image
-          build-args: |
-            GO_VERSION=${{ env.GO_VERSION }}
-            LDFLAGS=${{ env.LDFLAGS }}
-          outputs: type=docker,dest=runtime-${{ matrix.arch }}.tar
-
-      - name: setup the Crossplane CLI
-        run: "curl -sL https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh | sh"
-
-      - name: remove examples from tree
-        run: rm -rf examples/
-
-      - name: build Package
-        run: ./crossplane xpkg build --package-file=${{ matrix.arch }}.xpkg --package-root=package/ --embed-runtime-image-tarball=runtime-${{ matrix.arch }}.tar
-
-      - name: upload single-platform package
-        uses: actions/upload-artifact@v4
-        with:
-          name: package-${{ matrix.arch }}
-          path: "*.xpkg"
-          if-no-files-found: error
-          retention-days: 1
-
-  # This job downloads the single-platform packages built by the build job, and
-  # pushes them as a multi-platform package.
-  push:
-    runs-on: ubuntu-24.04
-    needs:
-      - build
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Download Single-Platform Packages
-        uses: actions/download-artifact@v4
-        with:
-          path: .
-          merge-multiple: true
-          pattern: "!*.dockerbuild" # This gets uploaded by docker/build-push-action but must be skipped: https://github.com/actions/toolkit/pull/1874
-
-      - name: Setup the Crossplane CLI
-        run: "curl -sL https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh | sh"
-
-      - name: Set Multi-Platform Package Version
-        run: echo "XPKG_VERSION=$(make ci-print-version)" >> $GITHUB_ENV
-
-      - name: Login to Upbound
-        uses: docker/login-action@v3
-        with:
-          registry: xpkg.upbound.io
-          username: ${{ secrets.XPKG_ACCESS_ID }}
-          password: ${{ secrets.XPKG_TOKEN }}
-        if: env.XPKG_ACCESS_ID != ''
-
-      - name: Push Multi-Platform Package to docker hub
-        if: env.XPKG_ACCESS_ID != ''
-        run: "./crossplane --verbose xpkg push --package-files $(echo *.xpkg|tr ' ' ,) ${{ env.XPKG }}:${{ env.XPKG_VERSION }}"
diff --git a/.github/workflows/go-build.yaml b/.github/workflows/go-build.yaml
deleted file mode 100644
index 661bd2e..0000000
--- a/.github/workflows/go-build.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: go build
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-jobs:
-  go-build:
-    name: build and test Go code
-    runs-on: ubuntu-latest
-    steps:
-      - id: checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: "0"
-      - id: go
-        uses: actions/setup-go@v5
-        with:
-          go-version: 1.23
-      - name: Build, test and lint
-        run: |
-          make ci
-      - name: check dirty files from go generate
-        run: |
-          make ci-check-dirty
diff --git a/.golangci.yml b/.golangci.yml
index 00d8a2c..ceb1dc6 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,7 +1,6 @@
 # Visit https://golangci-lint.run/ for usage documentation
 # and information on other useful linters
 issues:
-  max-per-linter: 0
   max-same-issues: 0
 
 linters: