diff --git a/.devcontainer/cuda12.9-conda/devcontainer.json b/.devcontainer/cuda12.9-conda/devcontainer.json
index d4f51422..e4cfd087 100644
--- a/.devcontainer/cuda12.9-conda/devcontainer.json
+++ b/.devcontainer/cuda12.9-conda/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "12.9",
       "PYTHON_PACKAGE_MANAGER": "conda",
       "BASE": "rapidsai/devcontainers:26.06-cpp-mambaforge"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.06-cuda12.9-conda"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.devcontainer/cuda12.9-pip/devcontainer.json b/.devcontainer/cuda12.9-pip/devcontainer.json
index 89797b63..11ae65ed 100644
--- a/.devcontainer/cuda12.9-pip/devcontainer.json
+++ b/.devcontainer/cuda12.9-pip/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "12.9",
       "PYTHON_PACKAGE_MANAGER": "pip",
       "BASE": "rapidsai/devcontainers:26.06-cpp-cuda12.9-ucx1.19.0-openmpi5.0.10"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.06-cuda12.9-pip"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.devcontainer/cuda13.0-conda/devcontainer.json b/.devcontainer/cuda13.0-conda/devcontainer.json
index 5d585146..e65e778f 100644
--- a/.devcontainer/cuda13.0-conda/devcontainer.json
+++ b/.devcontainer/cuda13.0-conda/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "13.0",
       "PYTHON_PACKAGE_MANAGER": "conda",
       "BASE": "rapidsai/devcontainers:26.06-cpp-mambaforge"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.06-cuda13.0-conda"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.devcontainer/cuda13.0-pip/devcontainer.json b/.devcontainer/cuda13.0-pip/devcontainer.json
index 94bf3f48..40916a51 100644
--- a/.devcontainer/cuda13.0-pip/devcontainer.json
+++ b/.devcontainer/cuda13.0-pip/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "13.0",
       "PYTHON_PACKAGE_MANAGER": "pip",
       "BASE": "rapidsai/devcontainers:26.06-cpp-cuda13.0-ucx1.19.0-openmpi5.0.10"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.06-cuda13.0-pip"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.devcontainer/cuda13.1-conda/devcontainer.json b/.devcontainer/cuda13.1-conda/devcontainer.json
index 9852ff2a..7377a334 100644
--- a/.devcontainer/cuda13.1-conda/devcontainer.json
+++ b/.devcontainer/cuda13.1-conda/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "13.1",
       "PYTHON_PACKAGE_MANAGER": "conda",
       "BASE": "rapidsai/devcontainers:26.06-cpp-mambaforge"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.06-cuda13.1-conda"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.devcontainer/cuda13.1-pip/devcontainer.json b/.devcontainer/cuda13.1-pip/devcontainer.json
index 414c9e00..a37c38cd 100644
--- a/.devcontainer/cuda13.1-pip/devcontainer.json
+++ b/.devcontainer/cuda13.1-pip/devcontainer.json
@@ -6,7 +6,10 @@
       "CUDA": "13.1",
       "PYTHON_PACKAGE_MANAGER": "pip",
       "BASE": "rapidsai/devcontainers:26.06-cpp-cuda13.1-ucx1.19.0-openmpi5.0.10"
-    }
+    },
+    "cacheFrom": [
+      "ghcr.io/rapidsai/devcontainers/devcontainer:26.06-cuda13.1-pip"
+    ]
   },
   "runArgs": [
     "--rm",
diff --git a/.github/actions/build-linux-image/action.yml b/.github/actions/build-linux-image/action.yml
index 5ed50528..865ba8e2 100644
--- a/.github/actions/build-linux-image/action.yml
+++ b/.github/actions/build-linux-image/action.yml
@@ -44,7 +44,7 @@ runs:
         if test "${push}" = true; then
           outputs+=(--output "type=image,compression=zstd,force-compression=true,oci-mediatypes=true,push=true,push-by-digest=true,name=${repo}");
           # HACK: remove the `-t` arg from the `docker buildx build` command generated by `devcontainer build`
-          sed -i 's/,t.map(v=>l.push("-t",v))//g' "$(npm list -g | head -n1)"/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js;
+          sed -i 's/,t.map(G=>l.push("-t",G))//g' "$(npm list -g | head -n1)"/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js;
         fi
 
         until devcontainer build \
diff --git a/.github/actions/install-devcontainers-cli/action.yml b/.github/actions/install-devcontainers-cli/action.yml
index 934c88ff..654cfa00 100644
--- a/.github/actions/install-devcontainers-cli/action.yml
+++ b/.github/actions/install-devcontainers-cli/action.yml
@@ -6,12 +6,12 @@ runs:
   using: composite
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
-        node-version: '20'
+        node-version: '24'
     - name: Install devcontainers CLI
       shell: bash
       run: |
         sudo apt update;
         sudo apt install -y --no-install-recommends build-essential;
-        npm install -g @devcontainers/cli@v0.80.2;
+        npm install -g @devcontainers/cli@v0.85.0;
diff --git a/.github/actions/setup-runner-env/action.yml b/.github/actions/setup-runner-env/action.yml
index 3d819c59..4cdc2891 100644
--- a/.github/actions/setup-runner-env/action.yml
+++ b/.github/actions/setup-runner-env/action.yml
@@ -26,13 +26,13 @@ runs:
 
     - if: runner.environment == 'self-hosted'
       name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
-        node-version: '20'
+        node-version: '24'
 
     - if: runner.environment != 'self-hosted'
       name: Set up QEMU
-      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
 
     - name: Create docker context
       shell: bash
@@ -40,14 +40,14 @@ runs:
 
     - if: runner.environment != 'self-hosted'
       name: Setup docker buildx on github-hosted runners
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
       with:
         buildkitd-flags: --debug
         endpoint: builder
 
     - if: runner.environment == 'self-hosted'
       name: Setup docker buildx on self-hosted runners
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
       with:
         buildkitd-flags: --debug --config /etc/buildkit/buildkitd.toml
         endpoint: builder
diff --git a/.github/workflows/build-and-test-feature.yml b/.github/workflows/build-and-test-feature.yml
index 1608e3f9..d97dd34c 100644
--- a/.github/workflows/build-and-test-feature.yml
+++ b/.github/workflows/build-and-test-feature.yml
@@ -22,12 +22,12 @@ jobs:
         arch: [amd64, arm64]
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER }}
           password: ${{ secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/build-devcontainers.yml b/.github/workflows/build-devcontainers.yml
new file mode 100644
index 00000000..f569b7dc
--- /dev/null
+++ b/.github/workflows/build-devcontainers.yml
@@ -0,0 +1,57 @@
+name: Build devcontainers
+
+concurrency:
+  group: build-from-${{ github.ref_name }}
+  cancel-in-progress: true
+
+on:
+  workflow_call:
+    inputs:
+      cuda:
+        description: |
+          Stringified JSON array of CUDA versions to run this workflow for.
+          This is used to select .devcontainer/ directories local to wherever this workflow is invoked from.
+          For example, if a repository has directories '.devcontainer/cuda12.9-pip/' and '.devcontainer/cuda13.1-pip/',
+          '["12.9", "13.1"]' could be passed here to build both of those devcontainers in CI.
+        type: string
+        default: '["12.9", "13.1"]'
+      python_package_manager:
+        description: |
+          Stringified JSON array of Python package managers to run devcontainer builds for.
+          One of: '["conda"]', '["pip"]', '["conda", "pip"]'.
+        type: string
+        default: '["conda", "pip"]'
+      push:
+        type: string
+        default: true
+  workflow_dispatch:
+    inputs:
+      cuda:
+        description: |
+          Stringified JSON array of CUDA versions to run this workflow for.
+          This is used to select .devcontainer/ directories local to wherever this workflow is invoked from.
+          For example, if a repository has directories '.devcontainer/cuda12.9-pip/' and '.devcontainer/cuda13.1-pip/',
+          '["12.9", "13.1"]' could be passed here to build both of those devcontainers in CI.
+        type: string
+        default: '["12.9", "13.1"]'
+      python_package_manager:
+        description: |
+          Stringified JSON array of Python package managers to run devcontainer builds for.
+          One of: '["conda"]', '["pip"]', '["conda", "pip"]'.
+        type: string
+        default: '["conda", "pip"]'
+      push:
+        type: string
+        default: true
+
+jobs:
+  build:
+    name: Build devcontainers
+    secrets: inherit
+    uses: rapidsai/shared-workflows/.github/workflows/build-devcontainers.yaml@fea/build-devcontainer
+    permissions:
+      packages: write
+    with:
+      cuda: "${{ inputs.cuda }}"
+      python_package_manager: "${{ inputs.python_package_manager }}"
+      push: "${{ inputs.push }}"
diff --git a/.github/workflows/build-test-and-push-linux-image.yml b/.github/workflows/build-test-and-push-linux-image.yml
index 8085db28..6216d117 100644
--- a/.github/workflows/build-test-and-push-linux-image.yml
+++ b/.github/workflows/build-test-and-push-linux-image.yml
@@ -41,7 +41,7 @@ jobs:
       version: ${{ steps.json.outputs.version }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -58,7 +58,7 @@ jobs:
           container_env: "${{ inputs.container_env }}"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER }}
           password: ${{ secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER }}
           password: ${{ secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/build-test-and-push-windows-image.yml b/.github/workflows/build-test-and-push-windows-image.yml
index 78beabcc..3ca5d7d5 100644
--- a/.github/workflows/build-test-and-push-windows-image.yml
+++ b/.github/workflows/build-test-and-push-windows-image.yml
@@ -37,7 +37,7 @@ jobs:
           - { edition: "2022", runner: "${{ github.repository != 'rapidsai/devcontainers' && 'windows-2022' || 'windows-amd64-cpu4' }}" }
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -68,7 +68,7 @@ jobs:
           EOF
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           username: ${{ secrets.GPUCIBOT_DOCKERHUB_USER || vars.DOCKERHUB_USER }}
           password: ${{ secrets.GPUCIBOT_DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index b833cdc6..a9293d58 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -20,7 +20,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release-features.yml b/.github/workflows/release-features.yml
index f4bbd1c6..ab874ab2 100644
--- a/.github/workflows/release-features.yml
+++ b/.github/workflows/release-features.yml
@@ -13,7 +13,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release-linux.yml b/.github/workflows/release-linux.yml
index e5dbd716..79623f45 100644
--- a/.github/workflows/release-linux.yml
+++ b/.github/workflows/release-linux.yml
@@ -21,7 +21,7 @@ jobs:
       scenarios: "${{ steps.matrix.outputs.scenarios }}"
     steps:
       - name: "Checkout ${{ github.repository }}"
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -45,7 +45,7 @@ jobs:
       linux: ${{ steps.matrix.outputs.linux }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/release-windows.yml b/.github/workflows/release-windows.yml
index f42e5328..f2cd3c63 100644
--- a/.github/workflows/release-windows.yml
+++ b/.github/workflows/release-windows.yml
@@ -20,7 +20,7 @@ jobs:
       windows: ${{ steps.matrix.outputs.windows }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2c43f1e7..483cf2a5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
       scenarios: "${{ steps.matrix.outputs.scenarios }}"
     steps:
       - name: "Checkout ${{ github.repository }}"
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -71,7 +71,7 @@ jobs:
       windows: ${{ steps.matrix.outputs.windows }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -129,3 +129,27 @@ jobs:
       packages: write
     secrets: inherit  # zizmor: ignore[secrets-inherit]
     uses: ./.github/workflows/release-features.yml
+
+  build-devcontainers-after-images-released:
+    if: needs.image-matrix.outputs.linux != '{"include":[]}'
+    needs: [image-matrix, release-linux]
+    name: Build devcontainers
+    secrets: inherit
+    uses: rapidsai/shared-workflows/.github/workflows/build-devcontainers.yaml@fea/build-devcontainer
+    permissions:
+      packages: write
+    with:
+      push: true
+      cuda: '["12.9", "13.0", "13.1"]'
+
+  build-devcontainers-after-features-released:
+    if: needs.image-matrix.outputs.linux == '{"include":[]}' && (needs.features-matrix.outputs.features != '[]' || needs.features-matrix.outputs.scenarios != '[]')
+    needs: [features-matrix, release-features]
+    name: Build devcontainers
+    secrets: inherit
+    uses: rapidsai/shared-workflows/.github/workflows/build-devcontainers.yaml@fea/build-devcontainer
+    permissions:
+      packages: write
+    with:
+      push: true
+      cuda: '["12.9", "13.0", "13.1"]'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9800a7b4..1f8957df 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -65,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
@@ -90,7 +90,7 @@ jobs:
       scenarios: ${{ steps.matrix.outputs.scenarios }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -171,7 +171,7 @@ jobs:
       windows: ${{ steps.matrix.outputs.windows }}
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false