diff --git a/.github/actions/cache/restore/action.yml b/.github/actions/cache/restore/action.yml
new file mode 100644
index 0000000000..a510bf29da
--- /dev/null
+++ b/.github/actions/cache/restore/action.yml
@@ -0,0 +1,18 @@
+name: "cache/restore"
+
+runs:
+  using: "composite"
+  steps:
+    - name: "Restore Cache"
+      uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
+      with:
+        # __SLANG_CI_CACHE_PATHS__ (keep in sync)
+        key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
+        path: |
+          ~/.cache/hermit/
+          ~/.local/share/virtualenvs/
+          .hermit/
+        restore-keys: |
+          cache-${{ github.ref_name }}-
+          cache-main-
+          cache-
diff --git a/.github/actions/cache/save/action.yml b/.github/actions/cache/save/action.yml
new file mode 100644
index 0000000000..c28d84cfc6
--- /dev/null
+++ b/.github/actions/cache/save/action.yml
@@ -0,0 +1,18 @@
+name: "cache/save"
+
+runs:
+  using: "composite"
+  steps:
+    - name: "Repossess files from devcontainer user"
+      shell: "bash"
+      run: "sudo chown -R $USER:$USER $GITHUB_WORKSPACE"
+
+    - name: "Save Cache"
+      uses: "actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
+      with:
+        # __SLANG_CI_CACHE_PATHS__ (keep in sync)
+        key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
+        path: |
+          ~/.cache/hermit/
+          ~/.local/share/virtualenvs/
+          .hermit/
diff --git a/.github/actions/devcontainer/run/action.yml b/.github/actions/devcontainer/run/action.yml
new file mode 100644
index 0000000000..59c281ee20
--- /dev/null
+++ b/.github/actions/devcontainer/run/action.yml
@@ -0,0 +1,25 @@
+name: "devcontainer/run"
+
+inputs:
+  runCmd:
+    type: "string"
+    required: true
+
+  # TODO: this is a workaround for https://github.com/devcontainers/ci/pull/295
+  # Will remove and replace with 'inheritEnv' once the fix is released
+  env:
+    type: "string"
+    default: ""
+
+runs:
+  using: "composite"
+  steps:
+    - name: "Run in devcontainer"
+      uses: "devcontainers/ci@a56d055efecd725e8cfe370543b6071b79989cc8"
+      with:
+        configFile: ".devcontainer/devcontainer.json"
+        env: |
+          CI
+          ${{ inputs.env }}
+        push: "never"
+        runCmd: "${{ inputs.runCmd }}"
diff --git a/.github/workflows/_jobs_ci.yml b/.github/workflows/_jobs_ci.yml
deleted file mode 100644
index 51dc600e33..0000000000
--- a/.github/workflows/_jobs_ci.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: "jobs/ci"
-
-on:
-  # Run when invoked from other workflows:
-  workflow_call: {}
-
-jobs:
-  run:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in this workflow, and reused in subsequent workflows.
-      # Note: always start with a fresh cache when running on the main branch.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        if: "${{ github.ref_name != 'main' }}"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Run all CI steps in order: _SLANG_INFRA_CI_STEPS_ORDERED_ (keep in sync)
-      #
-
-      - run: "scripts/bin/infra setup"
-      - run: "scripts/bin/infra check"
-      - run: "scripts/bin/infra test"
-      - run: "scripts/bin/infra lint"
-
-      #
-      # Update cache files:
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      #
-
-      - name: "Save cache"
-        uses: "actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
diff --git a/.github/workflows/_jobs_github_pages.yml b/.github/workflows/_jobs_github_pages.yml
deleted file mode 100644
index f9cb8da407..0000000000
--- a/.github/workflows/_jobs_github_pages.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: "jobs/github-pages"
-
-on:
-  # Run when invoked from other workflows:
-  workflow_call: {}
-
-jobs:
-  prepare:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in the "ci" workflow, then reused here.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Deploy to GitHub Pages:
-      #
-
-      - run: "scripts/bin/infra setup pipenv"
-      - run: "scripts/bin/infra check mkdocs"
-
-      - name: "Configure GitHub Pages"
-        uses: "actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d"
-
-      - name: "Upload artifacts"
-        uses: "actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa"
-        with:
-          path: "documentation/target/site" # _SLANG_MKDOCS_DOCUMENTATION_SITE_DIR_ (keep in sync)
-
-  deploy:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-    needs: "prepare"
-
-    permissions:
-      pages: "write" # to deploy to Pages
-      id-token: "write" # to verify the deployment originates from an appropriate source
-
-    steps:
-      - name: "Deploy to GitHub Pages"
-        id: "deployment"
-        uses: "actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e"
-
-    environment:
-      name: "github-pages"
-      url: "${{ steps.deployment.outputs.page_url }}"
diff --git a/.github/workflows/_jobs_publish.yml b/.github/workflows/_jobs_publish.yml
deleted file mode 100644
index 825c692fd3..0000000000
--- a/.github/workflows/_jobs_publish.yml
+++ /dev/null
@@ -1,100 +0,0 @@
-name: "jobs/publish"
-
-on:
-  # Run when invoked from other workflows:
-  workflow_call: {}
-
-jobs:
-  changesets:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    permissions:
-      contents: "write" # to create new branches and releases
-      pull-requests: "write" # to create new pull requests for changesets
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in the "ci" workflow, then reused here.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Publish Changesets:
-      #
-
-      - run: "scripts/bin/infra setup npm"
-
-      - id: "changesets"
-        uses: "changesets/action@aba318e9165b45b7948c60273e0b72fce0a64eb9"
-        with:
-          title: "Bump Slang Version"
-          commit: "Bump Slang Version"
-          createGithubReleases: false
-          version: "scripts/bin/infra publish changesets"
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-    outputs:
-      hasChangesets: "${{ steps.changesets.outputs.hasChangesets }}"
-
-  assets:
-    needs: "changesets"
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    if: "${{ needs.changesets.outputs.hasChangesets == 'false' }}"
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in the "ci" workflow, then reused here.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Build and Publish:
-      #
-
-      - run: "scripts/bin/infra setup cargo npm"
-
-      - run: "scripts/bin/infra publish npm"
-        env:
-          NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
-
-      - run: "scripts/bin/infra publish cargo"
-        env:
-          CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}"
-
-      - run: "scripts/bin/infra publish github-release"
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/_jobs_sanctuary.yml b/.github/workflows/_jobs_sanctuary.yml
deleted file mode 100644
index d71d1fb19f..0000000000
--- a/.github/workflows/_jobs_sanctuary.yml
+++ /dev/null
@@ -1,76 +0,0 @@
-name: "jobs/sanctuary"
-
-on:
-  # Run when invoked from other workflows:
-  workflow_call:
-    inputs:
-      chain:
-        description: "Name of the chain/sanctuary to run against, e.g. 'ethereum' or 'tron'."
-        required: true
-        type: "string"
-      network:
-        description: "Name of the sub-network to run against, e.g. 'mainnet' or 'testnet'."
-        required: true
-        type: "string"
-
-jobs:
-  sanctuary:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    strategy:
-      fail-fast: false # Continue running all shards even if some fail.
-      matrix:
-        shard_index:
-          - 0
-          - 1
-          - 2
-          - 3
-          - 4
-          - 5
-          - 6
-          - 7
-          - 8
-          - 9
-          - 10
-          - 11
-          - 12
-          - 13
-          - 14
-          - 15
-
-    env:
-      SHARDS_COUNT: 16 # Length of the 'shard_index' array above.
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in the "ci" workflow, then reused here.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Run Sanctuary Tests:
-      #
-
-      - run: "scripts/bin/infra setup cargo"
-
-      - run: |
-          scripts/bin/infra run --release --bin "solidity_testing_sanctuary" -- \
-            --shards-count ${{ env.SHARDS_COUNT }} \
-            --shard-index ${{ matrix.shard_index }} \
-            "${{ inputs.chain }}" "${{ inputs.network }}"
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
new file mode 100644
index 0000000000..3bb6091cdf
--- /dev/null
+++ b/.github/workflows/benchmark.yml
@@ -0,0 +1,58 @@
+name: "benchmark"
+
+on:
+  # Run using manual triggers from GitHub UI:
+  # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
+  workflow_dispatch: {}
+
+  # Run on pushes to any branch:
+  push: {}
+
+# Queue up benchmark workflows for the same branch, so that results are reported in order:
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref_name }}"
+  cancel-in-progress: false
+
+jobs:
+  benchmark:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+
+    # Only run on the main repo (not forks):
+    if: "${{ github.repository == 'NomicFoundation/slang' }}"
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+        # Docker privileged mode is required for running Valgrind in CI:
+      - name: "Add 'privileged: true' to 'devcontainer.json'"
+        uses: "actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea"
+        with:
+          script: |
+            const assert = require("assert");
+            const fs = require("fs/promises");
+
+            const devcontainerPath = "./.devcontainer/devcontainer.json";
+
+            const input = await fs.readFile(devcontainerPath, "utf8");
+            assert.equal(input[0], "{", "devcontainer file must start with a '{' character.");
+
+            const output = input.replace("{", "{ \"privileged\": true,");
+            await fs.writeFile(devcontainerPath, output);
+
+      - name: "infra perf benchmark"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra perf benchmark"
+          env: |
+            BENCHER_API_TOKEN=${{ secrets.BENCHER_API_TOKEN }}
+
+      - name: "Upload Benchmarking Data"
+        uses: "actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029"
+        with:
+          name: "benchmarking-data"
+          path: "target/iai"
+          if-no-files-found: "error"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6894a551b..48409544ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,24 +1,58 @@
 name: "ci"
 
 on:
+  # Run when invoked from other workflows:
+  workflow_call: {}
+
   # Run using manual triggers from GitHub UI:
   # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   workflow_dispatch: {}
 
-  # Run on every pull request (external branches):
+  # Run on every pull request:
   pull_request: {}
 
-  # Run on pushes to internal branches:
-  # Except 'main', which is handled by 'deploy.yml'.
+  # Run on pushes to any branch except 'main', which is handled by the 'publish' workflow:
   push:
     branches-ignore:
       - "main"
 
 # In the event that there is a new push to the ref, cancel any running jobs because they are now obsolete, wasting resources.
 concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
+  group: "${{ github.workflow }}-${{ github.ref_name }}"
   cancel-in-progress: true
 
 jobs:
   ci:
-    uses: "./.github/workflows/_jobs_ci.yml"
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      # Cache is updated in this workflow, and reused in subsequent workflows.
+      # Always start with a fresh cache when running on the main branch.
+      - name: "Restore Cache"
+        if: "${{ github.ref_name != 'main' }}"
+        uses: "./.github/actions/cache/restore"
+
+      #
+      # Run all CI steps in order: _SLANG_INFRA_CI_STEPS_ORDERED_ (keep in sync)
+      #
+
+      - name: "infra check"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra check"
+
+      - name: "infra test"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra test"
+
+      - name: "infra lint"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra lint"
+
+      - name: "Save Cache"
+        uses: "./.github/actions/cache/save"
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
deleted file mode 100644
index 535ee4028f..0000000000
--- a/.github/workflows/deploy.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: "deploy"
-
-on:
-  # Run using manual triggers from GitHub UI:
-  # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
-  workflow_dispatch: {}
-
-  # Run on pushes to 'main' branch':
-  push:
-    branches:
-      - "main"
-
-# We publish multiple packages for each version.
-# Wait for any deploys in-progress to complete, before starting a new one:
-concurrency:
-  group: "${{ github.workflow }}"
-  cancel-in-progress: false
-
-jobs:
-  ci:
-    uses: "./.github/workflows/_jobs_ci.yml"
-
-  github-pages:
-    uses: "./.github/workflows/_jobs_github_pages.yml"
-    if: "${{ github.repository == 'NomicFoundation/slang' }}" # skip running in forks
-    needs: "ci"
-
-    permissions:
-      pages: "write" # to deploy to Pages
-      id-token: "write" # to verify the deployment originates from an appropriate source
-
-  publish:
-    uses: "./.github/workflows/_jobs_publish.yml"
-    if: "${{ github.repository == 'NomicFoundation/slang' }}" # skip running in forks
-    needs: "ci"
-
-    secrets: "inherit"
-    permissions:
-      contents: "write" # to create new branches and releases
-      pull-requests: "write" # to create new pull requests for changesets
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000000..ca3bea3a7e
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,133 @@
+name: "publish"
+
+on:
+  # Run using manual triggers from GitHub UI:
+  # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
+  workflow_dispatch: {}
+
+  # Run on pushes to 'main' branch':
+  push:
+    branches:
+      - "main"
+
+# Wait for any other publish workflows in-progress to complete, before starting a new one:
+concurrency:
+  group: "${{ github.workflow }}"
+  cancel-in-progress: false
+
+jobs:
+  ci:
+    # Only run on the main repo (not forks), and only on the 'main' branch:
+    if: "${{ github.repository == 'NomicFoundation/slang' && github.ref_name == 'main' }}"
+    uses: "./.github/workflows/ci.yml"
+
+  buildDocs:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+    needs: "ci"
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+      - name: "infra check mkdocs"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra check mkdocs"
+
+      - name: "Configure Pages"
+        uses: "actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d"
+
+      - name: "Upload Artifacts"
+        uses: "actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa"
+        with:
+          path: "documentation/target/site" # _SLANG_MKDOCS_DOCUMENTATION_SITE_DIR_ (keep in sync)
+
+  deployDocs:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+    needs: "buildDocs"
+
+    permissions:
+      pages: "write" # to deploy to Pages
+      id-token: "write" # to verify the deployment originates from an appropriate source
+
+    steps:
+      - name: "Deploy Pages"
+        id: "deployment"
+        uses: "actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e"
+
+    environment:
+      name: "github-pages"
+      url: "${{ steps.deployment.outputs.page_url }}"
+
+  consumeChangesets:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+    needs: "ci"
+
+    permissions:
+      contents: "write" # to create new branches and releases
+      pull-requests: "write" # to create new pull requests for changesets
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+      - name: "infra publish changesets"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra publish changesets"
+          env: |
+            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+
+      - name: "Create/Update Changesets Pull Request"
+        id: "runChangesets"
+        uses: "changesets/action@aba318e9165b45b7948c60273e0b72fce0a64eb9"
+        with:
+          title: "Bump Slang Version"
+          commit: "Bump Slang Version"
+          createGithubReleases: false
+          version: "git stash pop" # Stash created by 'infra publish changesets'
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+    outputs:
+      hasChangesets: "${{ steps.runChangesets.outputs.hasChangesets }}"
+
+  artifacts:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+    needs: "consumeChangesets"
+
+    if: "${{ needs.consumeChangesets.outputs.hasChangesets == 'false' }}"
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+      - name: "infra publish npm"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra publish npm"
+          env: |
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
+
+      - name: "infra publish cargo"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra publish cargo"
+          env: |
+            CARGO_REGISTRY_TOKEN=${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+      - name: "infra publish github-release"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra publish github-release"
+          env: |
+            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/sanctuary.yml b/.github/workflows/sanctuary.yml
index 695de9c20c..9dc977951e 100644
--- a/.github/workflows/sanctuary.yml
+++ b/.github/workflows/sanctuary.yml
@@ -7,18 +7,51 @@ on:
     inputs:
       chain:
         description: "Name of the chain/sanctuary to run against, e.g. 'ethereum' or 'tron'."
-        default: "ethereum"
-        required: true
         type: "string"
+        required: true
+        default: "ethereum"
       network:
         description: "Name of the sub-network to run against, e.g. 'mainnet' or 'testnet'."
-        default: "mainnet"
-        required: true
         type: "string"
+        required: true
+        default: "mainnet"
 
 jobs:
-  ci:
-    uses: "./.github/workflows/_jobs_sanctuary.yml"
-    with:
-      chain: "${{ inputs.chain }}"
-      network: "${{ inputs.network }}"
+  sanctuary:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+
+    strategy:
+      fail-fast: false # Continue running all shards even if some fail.
+      matrix:
+        shard_index:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+          - 9
+          - 10
+          - 11
+          - 12
+          - 13
+          - 14
+          - 15
+
+    env:
+      SHARDS_COUNT: 16 # Length of the 'shard_index' array above.
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+      - name: "infra run solidity_testing_sanctuary"
+        uses: "./.github/actions/devcontainer/run"
+        with:
+          runCmd: "./scripts/bin/infra run solidity_testing_sanctuary run --release --bin solidity_testing_sanctuary -- --shards-count ${{ env.SHARDS_COUNT }} --shard-index ${{ matrix.shard_index }} ${{ inputs.chain }} ${{ inputs.network }}"
diff --git a/Cargo.toml b/Cargo.toml
index fdb552b872..8bb61afdec 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -102,7 +102,7 @@ console = { version = "0.15.8" }
 derive-new = { version = "0.6.0" }
 env_logger = { version = "0.11.5" }
 iai-callgrind = { version = "0.12.1" }
-iai-callgrind-runner = { version = "0.12.0" }
+iai-callgrind-runner = { version = "0.12.1" }
 ignore = { version = "0.4.22" }
 indexmap = { version = "2.3.0", features = ["serde"] }
 indicatif = { version = "0.17.8", features = ["in_memory"] }
diff --git a/crates/infra/cli/src/commands/ci/mod.rs b/crates/infra/cli/src/commands/ci/mod.rs
index 02a7c9a1f0..90e4b06234 100644
--- a/crates/infra/cli/src/commands/ci/mod.rs
+++ b/crates/infra/cli/src/commands/ci/mod.rs
@@ -12,9 +12,10 @@ pub struct CiController;
 impl CiController {
     #[allow(clippy::unused_self)] // For symmetry with other commands
     pub fn execute(&self) -> Result<()> {
-        // Run all CI steps in order: _SLANG_INFRA_CI_STEPS_ORDERED_ (keep in sync)
-
+        // Note: setup is ran implicitly during devcontainer initialization:
         SetupController::default().execute()?;
+
+        // Run all CI steps in order: _SLANG_INFRA_CI_STEPS_ORDERED_ (keep in sync)
         CheckController::default().execute()?;
         TestController::default().execute()?;
         LintController::default().execute()?;
diff --git a/crates/infra/cli/src/commands/perf/mod.rs b/crates/infra/cli/src/commands/perf/mod.rs
index 1442881f20..03d74ac726 100644
--- a/crates/infra/cli/src/commands/perf/mod.rs
+++ b/crates/infra/cli/src/commands/perf/mod.rs
@@ -80,7 +80,6 @@ fn run_iai_bench(package_name: &str, bench_name: &str) -> Result<()> {
         .property("--project", "slang")
         .property("--adapter", "rust_iai_callgrind")
         .property("--testbed", testbed)
-        .flag("--html")
         .arg(cargo_command)
         .run()?;
 
diff --git a/crates/infra/cli/src/commands/publish/changesets/mod.rs b/crates/infra/cli/src/commands/publish/changesets/mod.rs
index 9d9bf9a9db..4186f025aa 100644
--- a/crates/infra/cli/src/commands/publish/changesets/mod.rs
+++ b/crates/infra/cli/src/commands/publish/changesets/mod.rs
@@ -81,9 +81,15 @@ pub fn publish_changesets() -> Result<()> {
         }
     }
 
+    Command::new("git")
+        .args(["stash", "push"])
+        .flag("--include-untracked")
+        .property("--message", "applied changesets")
+        .run()?;
+
     println!();
-    println!("Source files are now updated.");
-    println!("The calling CI workflow will now publish them in a pull request.");
+    println!("Source files are now updated with the new version, and stored in a 'git stash'.");
+    println!("The calling CI workflow will now use this stash to create a PR if needed.");
     println!();
 
     Ok(())