diff --git a/.semaphore/semaphore.yml b/.semaphore/semaphore.yml
index b0f4994d7a..40a8b0384b 100644
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@@ -88,6 +88,54 @@ blocks:
           commands:
             - test-results publish . -N "windows/amd64"
 
+  - name: "Muckrake Check linux/amd64"
+    dependencies: []
+    task:
+      agent:
+        machine:
+          type: s1-prod-ubuntu24-04-amd64-1
+      jobs:
+        - name: "Build & Upload linux/amd64"
+          commands:
+            - checkout
+            - "export SHORT_SHA=$(echo $SEMAPHORE_GIT_SHA | cut -c1-8)"
+            - "export TIMESTAMP=$(date -u +%Y%m%d-%H%M%S)"
+            - |
+              if [ "$SEMAPHORE_GIT_BRANCH" = "main" ]; then
+                export BUILD_ID="main/${TIMESTAMP}-${SHORT_SHA}"
+              else
+                export BUILD_ID="branches/${SEMAPHORE_GIT_BRANCH}/${TIMESTAMP}-${SHORT_SHA}"
+              fi
+            - "echo Build ID: $BUILD_ID"
+            - "GOOS=linux GOARCH=amd64 make muckrake-build-docker"
+            - "source assume-iam-role arn:aws:iam::050879227952:role/cli-release-semaphore"
+            - "BUILD_ID=$BUILD_ID BINARY_PATH=dist/confluent_linux_amd64/confluent S3_KEY=confluent_linux_amd64 make muckrake-upload-s3"
+            - "echo ✅ linux/amd64 binary uploaded to s3://confluent.cloud/confluent-cli/development-builds/$BUILD_ID/"
+
+  - name: "Muckrake Check linux/arm64"
+    dependencies: []
+    task:
+      agent:
+        machine:
+          type: s1-prod-ubuntu24-04-arm64-1
+      jobs:
+        - name: "Build & Upload linux/arm64"
+          commands:
+            - checkout
+            - "export SHORT_SHA=$(echo $SEMAPHORE_GIT_SHA | cut -c1-8)"
+            - "export TIMESTAMP=$(date -u +%Y%m%d-%H%M%S)"
+            - |
+              if [ "$SEMAPHORE_GIT_BRANCH" = "main" ]; then
+                export BUILD_ID="main/${TIMESTAMP}-${SHORT_SHA}"
+              else
+                export BUILD_ID="branches/${SEMAPHORE_GIT_BRANCH}/${TIMESTAMP}-${SHORT_SHA}"
+              fi
+            - "echo Build ID: $BUILD_ID"
+            - "GOOS=linux GOARCH=arm64 make muckrake-build-docker"
+            - "source assume-iam-role arn:aws:iam::050879227952:role/cli-release-semaphore"
+            - "BUILD_ID=$BUILD_ID BINARY_PATH=dist/confluent_linux_arm64/confluent S3_KEY=confluent_linux_arm64 make muckrake-upload-s3"
+            - "echo ✅ linux/arm64 binary uploaded to s3://confluent.cloud/confluent-cli/development-builds/$BUILD_ID/"
+
 after_pipeline:
   task:
     jobs:
diff --git a/Makefile b/Makefile
index b16f43a27d..e96c25e8a9 100644
--- a/Makefile
+++ b/Makefile
@@ -140,4 +140,56 @@ coverage: ## Merge coverage data from unit and integration tests into coverage.t
 	@tail -n +2 coverage.unit.out >> coverage.txt
 	@tail -n +2 coverage.integration.out >> coverage.txt
 	@echo "Coverage data saved to: coverage.txt"
-	@artifact push workflow coverage.txt
\ No newline at end of file
+	@artifact push workflow coverage.txt
+
+.PHONY: muckrake-build-docker
+muckrake-build-docker:
+	@echo "Building CLI binary with Docker image for Muckrake Check..."
+	@echo "Target: $(GOOS)/$(GOARCH)"
+	@echo "Clean up any possible existing containers under same name..."
+	@docker rm -f confluent-muckrake-builder-container 2>/dev/null || true
+	@echo "Building Docker image..."
+	docker build -f docker/Dockerfile_muckrake \
+		--build-arg GOOS=$(GOOS) \
+		--build-arg GOARCH=$(GOARCH) \
+		-t confluent-muckrake-builder .
+	@echo "Creating a container from the image..."
+	docker create --name confluent-muckrake-builder-container confluent-muckrake-builder
+	@echo "Copy built binary from the container"
+	docker cp confluent-muckrake-builder-container:/workspace/dist/. dist/
+	@echo "Clean up container"
+	docker rm confluent-muckrake-builder-container
+	@echo "✅  Binary built successfully at dist/confluent_$(GOOS)_$(GOARCH)/confluent"
+
+.PHONY: muckrake-upload-s3
+muckrake-upload-s3:
+	@echo "Uploading CLI binary to S3..."
+	@if [ -z "$(BUILD_ID)" ]; then \
+		echo "❌  Error: BUILD_ID is not set"; \
+		exit 1; \
+	fi
+	@if [ -z "$(BINARY_PATH)" ]; then \
+		echo "❌  Error: BINARY_PATH is not set"; \
+		exit 1; \
+	fi
+	@if [ -z "$(S3_KEY)" ]; then \
+		echo "❌  Error: S3_KEY is not set"; \
+		exit 1; \
+	fi
+	@if [ ! -f "$(BINARY_PATH)" ]; then \
+		echo "❌  Error: Binary not found at $(BINARY_PATH)"; \
+		exit 1; \
+	fi
+	@echo "Build ID: $(BUILD_ID)"
+	@echo "Binary: $(BINARY_PATH)"
+	@echo "S3 Key: $(S3_KEY)"
+	@aws s3 cp $(BINARY_PATH) s3://confluent.cloud/confluent-cli/development-builds/$(BUILD_ID)/$(S3_KEY) \
+		--acl public-read --region us-west-2
+	@echo "✅  Binary uploaded to s3://confluent.cloud/confluent-cli/development-builds/$(BUILD_ID)/$(S3_KEY)"
+
+.PHONY: muckrake-clean
+muckrake-clean:
+	@echo "Cleaning up Muckrake Check artifacts..."
+	@docker rm -f confluent-muckrake-builder-container 2>/dev/null || true
+	@docker rmi -f confluent-muckrake-builder 2>/dev/null || true
+	@echo "✅  Cleanup complete"
\ No newline at end of file
diff --git a/debian/patches/standard_build_layout.patch b/debian/patches/standard_build_layout.patch
index 75ef6fd07e..d9ce2f5e91 100644
--- a/debian/patches/standard_build_layout.patch
+++ b/debian/patches/standard_build_layout.patch
@@ -1,6 +1,6 @@
---- cli/Makefile	2026-01-12 14:36:34.668189995 -0500
-+++ debian/Makefile	2025-09-19 13:34:24.112882728 -0400
-@@ -1,143 +1,163 @@
+--- cli/Makefile	2026-02-05 20:49:51
++++ debian/Makefile	2025-09-23 10:17:30
+@@ -1,195 +1,163 @@
 -SHELL := /bin/bash
 -GORELEASER_VERSION := v2.13.3
 +SHELL=/bin/bash
@@ -19,8 +19,10 @@
 -    endif
 -else # darwin
 -	$(MAKE) cli-builder
--endif
--
++ifndef VERSION
++	VERSION=$(CLI_VERSION)
+ endif
+ 
 -# Cross-compile from darwin to any of the OS/Arch pairs below
 -.PHONY: cross-build
 -cross-build:
@@ -30,7 +32,25 @@
 -    else # darwin/arm64
 -		$(MAKE) cli-builder
 -    endif
--else
++export PACKAGE_TITLE=cli
++export FULL_PACKAGE_TITLE=confluent-$(PACKAGE_TITLE)
++export PACKAGE_NAME=$(FULL_PACKAGE_TITLE)-$(VERSION)
++
++# Defaults that are likely to vary by platform. These are cleanly separated so
++# it should be easy to maintain altered values on platform-specific branches
++# when the values aren't overridden by the script invoking the Makefile
++
++APPLY_PATCHES?=yes
++
++# DESTDIR may be overridden by e.g. debian packaging
++ifeq ($(DESTDIR),)
++DESTDIR=$(CURDIR)/BUILD/
++endif
++
++ifeq ($(PACKAGE_TYPE),archive)
++PREFIX=$(PACKAGE_NAME)
++SYSCONFDIR=$(PREFIX)/etc/$(PACKAGE_TITLE)
+ else
 -    ifeq ($(GOOS),windows) # windows/amd64
 -		CC=x86_64-w64-mingw32-gcc CXX=x86_64-w64-mingw32-g++ CGO_LDFLAGS="-fstack-protector -static" $(MAKE) cli-builder
 -    else ifeq ($(GOOS),linux) # linux/amd64
@@ -38,12 +58,17 @@
 -    else # darwin/amd64
 -		$(MAKE) cli-builder
 -    endif
--endif
--
++PREFIX=/usr
++SYSCONFDIR=/etc/$(PACKAGE_TITLE)
+ endif
+ 
 -.PHONY: cli-builder
 -cli-builder:
 -	GOOS="" GOARCH="" CC="" CXX="" CGO_LDFLAGS="" go install github.com/goreleaser/goreleaser/v2@$(GORELEASER_VERSION)
--
++_empty :=
++_space := $(_empty) $(empty)
++split_version := $(subst .,$(_space),$(CLI_VERSION))
+ 
 -ifeq ($(GOLANG_FIPS),1)
 -	wget "https://go.dev/dl/go$$(cat .go-version).src.tar.gz" && \
 -	tar -xf go$$(cat .go-version).src.tar.gz && \
@@ -60,37 +85,6 @@
 -	rm -rf go go-openssl go$$(cat .go-version).src.tar.gz
 -else
 -	TAGS=$(TAGS) CC=$(CC) CXX=$(CXX) CGO_LDFLAGS=$(CGO_LDFLAGS) goreleaser build --clean --single-target --snapshot
-+ifndef VERSION
-+	VERSION=$(CLI_VERSION)
- endif
- 
-+export PACKAGE_TITLE=cli
-+export FULL_PACKAGE_TITLE=confluent-$(PACKAGE_TITLE)
-+export PACKAGE_NAME=$(FULL_PACKAGE_TITLE)-$(VERSION)
-+
-+# Defaults that are likely to vary by platform. These are cleanly separated so
-+# it should be easy to maintain altered values on platform-specific branches
-+# when the values aren't overridden by the script invoking the Makefile
-+
-+APPLY_PATCHES?=yes
-+
-+# DESTDIR may be overridden by e.g. debian packaging
-+ifeq ($(DESTDIR),)
-+DESTDIR=$(CURDIR)/BUILD/
-+endif
-+
-+ifeq ($(PACKAGE_TYPE),archive)
-+PREFIX=$(PACKAGE_NAME)
-+SYSCONFDIR=$(PREFIX)/etc/$(PACKAGE_TITLE)
-+else
-+PREFIX=/usr
-+SYSCONFDIR=/etc/$(PACKAGE_TITLE)
-+endif
-+
-+_empty :=
-+_space := $(_empty) $(empty)
-+split_version := $(subst .,$(_space),$(CLI_VERSION))
-+
 +all: install
 +
 +archive: install
@@ -101,12 +95,12 @@
 +ifeq ($(APPLY_PATCHES),yes)
 +	git reset --hard HEAD
 +	cat debian/patches/series | xargs -iPATCH bash -c 'patch -p1 < debian/patches/PATCH'
-+endif
-+
+ endif
+ 
 +BINPATH=$(PREFIX)/bin
 +LIBPATH=$(PREFIX)/libexec/$(PACKAGE_TITLE)
 +DOCPATH=$(PREFIX)/share/doc/$(PACKAGE_TITLE)
-+
+ 
 +# Notes on the archive download links:
 +# As of v3.0.0, the version number no longer has the 'v' prefix
 +# As of v3.43.0, we download the '_disableupdates' variant
@@ -114,15 +108,27 @@
 +install: apply-patches
 +	rm -rf $(DESTDIR)$(PREFIX)
 +	mkdir -p $(DESTDIR)$(PREFIX)
-+
+ 
+-.PHONY: clean
+-clean:
+-	for dir in bin dist docs legal prebuilt release-notes; do \
+-		[ -d $$dir ] && rm -r $$dir || true; \
+-	done
 +	mkdir -p $(DESTDIR)$(BINPATH)
 +	mkdir -p $(DESTDIR)$(LIBPATH)
 +	mkdir -p $(DESTDIR)$(DOCPATH)
 +	mkdir -p $(DESTDIR)$(SYSCONFDIR)
-+
+ 
+-.PHONY: lint
+-lint: lint-go lint-cli
 +	cp packaging/confluent.sh $(DESTDIR)$(BINPATH)/confluent
 +	chmod 755 $(DESTDIR)$(BINPATH)/confluent
-+
+ 
+-.PHONY: lint-go
+-lint-go:
+-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 && \
+-	golangci-lint run --timeout 10m
+-	@echo "✅  golangci-lint"
 +	cd $(DESTDIR)$(LIBPATH); \
 +	v=""; if [[ $(word 1,$(split_version)) -eq 2 ]]; then v="v"; fi; \
 +	disableupdates=""; if [[ $(word 1,$(split_version)) -ge 3 && $(word 2,$(split_version)) -ge 43 ]]; then disableupdates="_disableupdates"; fi; \
@@ -142,38 +148,25 @@
 +	filepath=windows_amd64/confluent.exe; \
 +	curl -fs https://$${baseurl}/confluent-cli/binaries/$(CLI_VERSION)/confluent$${version}_windows_amd64.exe -o $${filepath}; \
 +	chmod 755 $${filepath}
-+
-+	cp LICENSE $(DESTDIR)$(DOCPATH)/LICENSE
-+	$(DESTDIR)$(BINPATH)/confluent --version | awk -F' ' '{ print $3 }' > $(DESTDIR)$(DOCPATH)/version.txt
  
-+	chown -R root:root $(DESTDIR)$(PREFIX)
- 
--.PHONY: clean
- clean:
--	for dir in bin dist docs legal prebuilt release-notes; do \
--		[ -d $$dir ] && rm -r $$dir || true; \
--	done
--
--.PHONY: lint
--lint: lint-go lint-cli
--
--.PHONY: lint-go
--lint-go:
--	go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 && \
--	golangci-lint run --timeout 10m
--	@echo "✅  golangci-lint"
--
 -.PHONY: lint-cli
 -lint-cli: cmd/lint/en_US.aff cmd/lint/en_US.dic
 -	go run cmd/lint/main.go -aff-file $(word 1,$^) -dic-file $(word 2,$^) $(ARGS)
 -	@echo "✅  cmd/lint/main.go"
--
++	cp LICENSE $(DESTDIR)$(DOCPATH)/LICENSE
++	$(DESTDIR)$(BINPATH)/confluent --version | awk -F' ' '{ print $3 }' > $(DESTDIR)$(DOCPATH)/version.txt
+ 
 -cmd/lint/en_US.aff:
 -	curl -s "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries/+/master/en_US.aff?format=TEXT" | base64 -D > $@
--
++	chown -R root:root $(DESTDIR)$(PREFIX)
+ 
 -cmd/lint/en_US.dic:
 -	curl -s "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries/+/master/en_US.dic?format=TEXT" | base64 -D > $@
--
++clean:
++	rm -rf $(CURDIR)/$(PACKAGE_NAME)*
++	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)*rpm
++	rm -rf RPM_BUILDING
+ 
 -.PHONY: unit-test
 -unit-test:
 -ifdef CI
@@ -181,19 +174,25 @@
 -	gotestsum --junitfile unit-test-report.xml -- -timeout 0 -v -race -coverprofile=coverage.unit.out -covermode=atomic $$(go list ./... | grep -v github.com/confluentinc/cli/v4/test)
 -else
 -	go test -timeout 0 -v -coverprofile=coverage.unit.out -covermode=atomic $$(go list ./... | grep -v github.com/confluentinc/cli/v4/test) $(UNIT_TEST_ARGS)
--endif
-+	rm -rf $(CURDIR)/$(PACKAGE_NAME)*
-+	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)*rpm
-+	rm -rf RPM_BUILDING
-+
 +distclean: clean
 +ifneq ($(PACKAGE_TYPE),deb)
 +	git reset --hard HEAD
 +	git status --ignored --porcelain | cut -d ' ' -f 2 | xargs rm -rf
-+endif
-+
+ endif
+ 
+-.PHONY: build-for-integration-test
+-build-for-integration-test:
+-ifdef CI
+-	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent ./cmd/confluent
+-else
+-	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent ./cmd/confluent
+-endif
 +RPM_VERSION=$(shell echo $(VERSION) | sed -e 's/-alpha[0-9]*//' -e 's/-beta[0-9]*//' -e 's/-rc[0-9]*//' -e 's/-SNAPSHOT//' -e 's/-cp[0-9]*//' -e 's/-hotfix[0-9]*//' -e 's/-[0-9]*//')
-+
+ 
+-.PHONY: build-for-integration-test-windows
+-build-for-integration-test-windows:
+-ifdef CI
+-	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent.exe ./cmd/confluent
 +# Get any -alpha, -beta (preview), -rc (release candidate), -SNAPSHOT (nightly), -cp (confluent patch), -hotfix piece that we need to put into the Release part of
 +# the version since RPM versions don't support non-numeric
 +# characters. Ultimately, for something like 0.8.2-beta, we want to end up with
@@ -205,16 +204,36 @@
 +ifneq ($(RPM_RELEASE_POSTFIX),)
 +	RPM_RELEASE_POSTFIX_UNDERSCORE=_$(RPM_RELEASE_POSTFIX)
 +	RPM_RELEASE_ID=0.$(REVISION).$(RPM_RELEASE_POSTFIX)
-+else
+ else
+-	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent.exe ./cmd/confluent
 +	RPM_RELEASE_ID=$(REVISION)
-+endif
-+
+ endif
+ 
+-.PHONY: integration-test
+-integration-test:
+-ifdef CI
+-	go install gotest.tools/gotestsum@v1.13.0 && \
+-	export GOCOVERDIR=test/coverage && \
+-	rm -rf $${GOCOVERDIR} && mkdir $${GOCOVERDIR} && \
+-	gotestsum --junitfile integration-test-report.xml -- -timeout 0 -v -race $$(go list ./... | grep github.com/confluentinc/cli/v4/test) && \
+-	go tool covdata textfmt -i $${GOCOVERDIR} -o coverage.integration.out
+-else
+-	export GOCOVERDIR=test/coverage && \
+-	rm -rf $${GOCOVERDIR} && mkdir $${GOCOVERDIR} && \
+-	go test -timeout 0 -v $$(go list ./... | grep github.com/confluentinc/cli/v4/test) $(INTEGRATION_TEST_ARGS) && \
+-	go tool covdata textfmt -i $${GOCOVERDIR} -o coverage.integration.out
+-endif
 +rpm: rpm-amd64-build rpm-arm64-build
-+
+ 
+-.PHONY: test
+-test: unit-test integration-test
 +rpm-amd64-build: rpm-amd64-spec
 +	echo "Building the amd64 RPM"
 +	rpmbuild --define="_topdir `pwd`/RPM_BUILDING" --nodebuginfo -tb RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz || rpmbuild --define="_topdir `pwd`/RPM_BUILDING" -tb RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz
-+
+ 
+-.PHONY: generate-packaging-patch
+-generate-packaging-patch:
+-	diff -u Makefile debian/Makefile | sed "1 s_Makefile_cli/Makefile_" > debian/patches/standard_build_layout.patch
 +rpm-arm64-build: rpm-arm64-spec
 +	echo "Building the arm64 RPM"
 +	rpmbuild --target=aarch64 --define="_topdir `pwd`/RPM_BUILDING" --nodebuginfo -tb RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz || rpmbuild --target=aarch64 --define="_topdir `pwd`/RPM_BUILDING" -tb RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz
@@ -224,7 +243,15 @@
 +	echo "The RPMs have been created and can be found here:"
 +	@ls -laF $(FULL_PACKAGE_TITLE)*rpm
 +	echo "================================================="
-+
+ 
+-.PHONY: coverage
+-coverage: ## Merge coverage data from unit and integration tests into coverage.txt
+-	@echo "Merging coverage data..."
+-	@echo "mode: atomic" > coverage.txt
+-	@tail -n +2 coverage.unit.out >> coverage.txt
+-	@tail -n +2 coverage.integration.out >> coverage.txt
+-	@echo "Coverage data saved to: coverage.txt"
+-	@artifact push workflow coverage.txt
 +# Unfortunately, because of version naming issues and the way rpmbuild expects
 +# the paths in the tar file to be named, we need to rearchive the package. So
 +# instead of depending on archive, this target just uses the unarchived,
@@ -238,7 +265,25 @@
 +	sed "s/##RPMVERSION##/$(RPM_VERSION)/g; s/##RPMRELEASE##/$(RPM_RELEASE_ID)/g; s/##EXCLUDEARCH##/arm64/g" < debian/$(FULL_PACKAGE_TITLE).spec.in > $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)/$(FULL_PACKAGE_TITLE).spec
 +	rm -f $@ && tar -czf RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
 +	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
-+
+ 
+-.PHONY: muckrake-build-docker
+-muckrake-build-docker:
+-	@echo "Building CLI binary with Docker image for Muckrake Check..."
+-	@echo "Target: $(GOOS)/$(GOARCH)"
+-	@echo "Clean up any possible existing containers under same name..."
+-	@docker rm -f confluent-muckrake-builder-container 2>/dev/null || true
+-	@echo "Building Docker image..."
+-	docker build -f docker/Dockerfile_muckrake \
+-		--build-arg GOOS=$(GOOS) \
+-		--build-arg GOARCH=$(GOARCH) \
+-		-t confluent-muckrake-builder .
+-	@echo "Creating a container from the image..."
+-	docker create --name confluent-muckrake-builder-container confluent-muckrake-builder
+-	@echo "Copy built binary from the container"
+-	docker cp confluent-muckrake-builder-container:/workspace/dist/. dist/
+-	@echo "Clean up container"
+-	docker rm confluent-muckrake-builder-container
+-	@echo "✅  Binary built successfully at dist/confluent_$(GOOS)_$(GOARCH)/confluent"
 +rpm-arm64-spec:
 +	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
 +	mkdir $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
@@ -247,55 +292,42 @@
 +	rm -f $@ && tar -czf RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
 +	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
  
--.PHONY: build-for-integration-test
--build-for-integration-test:
--ifdef CI
--	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent ./cmd/confluent
--else
--	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent ./cmd/confluent
--endif
+-.PHONY: muckrake-upload-s3
+-muckrake-upload-s3:
+-	@echo "Uploading CLI binary to S3..."
+-	@if [ -z "$(BUILD_ID)" ]; then \
+-		echo "❌  Error: BUILD_ID is not set"; \
+-		exit 1; \
+-	fi
+-	@if [ -z "$(BINARY_PATH)" ]; then \
+-		echo "❌  Error: BINARY_PATH is not set"; \
+-		exit 1; \
+-	fi
+-	@if [ -z "$(S3_KEY)" ]; then \
+-		echo "❌  Error: S3_KEY is not set"; \
+-		exit 1; \
+-	fi
+-	@if [ ! -f "$(BINARY_PATH)" ]; then \
+-		echo "❌  Error: Binary not found at $(BINARY_PATH)"; \
+-		exit 1; \
+-	fi
+-	@echo "Build ID: $(BUILD_ID)"
+-	@echo "Binary: $(BINARY_PATH)"
+-	@echo "S3 Key: $(S3_KEY)"
+-	@aws s3 cp $(BINARY_PATH) s3://confluent.cloud/confluent-cli/development-builds/$(BUILD_ID)/$(S3_KEY) \
+-		--acl public-read --region us-west-2
+-	@echo "✅  Binary uploaded to s3://confluent.cloud/confluent-cli/development-builds/$(BUILD_ID)/$(S3_KEY)"
 +rpm-build-area: RPM_BUILDING/BUILD RPM_BUILDING/RPMS RPM_BUILDING/SOURCES RPM_BUILDING/SPECS RPM_BUILDING/SRPMS
  
--.PHONY: build-for-integration-test-windows
--build-for-integration-test-windows:
--ifdef CI
--	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent.exe ./cmd/confluent
--else
--	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent.exe ./cmd/confluent
--endif
+-.PHONY: muckrake-clean
+-muckrake-clean:
+-	@echo "Cleaning up Muckrake Check artifacts..."
+-	@docker rm -f confluent-muckrake-builder-container 2>/dev/null || true
+-	@docker rmi -f confluent-muckrake-builder 2>/dev/null || true
+-	@echo "✅  Cleanup complete"
+\ No newline at end of file
 +RPM_BUILDING/%:
 +	mkdir -p $@
- 
--.PHONY: integration-test
--integration-test:
--ifdef CI
--	go install gotest.tools/gotestsum@v1.13.0 && \
--	export GOCOVERDIR=test/coverage && \
--	rm -rf $${GOCOVERDIR} && mkdir $${GOCOVERDIR} && \
--	gotestsum --junitfile integration-test-report.xml -- -timeout 0 -v -race $$(go list ./... | grep github.com/confluentinc/cli/v4/test) && \
--	go tool covdata textfmt -i $${GOCOVERDIR} -o coverage.integration.out
--else
--	export GOCOVERDIR=test/coverage && \
--	rm -rf $${GOCOVERDIR} && mkdir $${GOCOVERDIR} && \
--	go test -timeout 0 -v $$(go list ./... | grep github.com/confluentinc/cli/v4/test) $(INTEGRATION_TEST_ARGS) && \
--	go tool covdata textfmt -i $${GOCOVERDIR} -o coverage.integration.out
--endif
--
--.PHONY: test
--test: unit-test integration-test
--
--.PHONY: generate-packaging-patch
--generate-packaging-patch:
--	diff -u Makefile debian/Makefile | sed "1 s_Makefile_cli/Makefile_" > debian/patches/standard_build_layout.patch
--
--.PHONY: coverage
--coverage: ## Merge coverage data from unit and integration tests into coverage.txt
--	@echo "Merging coverage data..."
--	@echo "mode: atomic" > coverage.txt
--	@tail -n +2 coverage.unit.out >> coverage.txt
--	@tail -n +2 coverage.integration.out >> coverage.txt
--	@echo "Coverage data saved to: coverage.txt"
--	@artifact push workflow coverage.txt
-\ No newline at end of file
++
 +RELEASE_%:
 +	echo 0 > $@
diff --git a/docker/Dockerfile_muckrake b/docker/Dockerfile_muckrake
new file mode 100644
index 0000000000..7ef84d4880
--- /dev/null
+++ b/docker/Dockerfile_muckrake
@@ -0,0 +1,44 @@
+ARG GOOS=linux
+ARG GOARCH=amd64
+
+FROM almalinux:8.10
+
+ARG GOOS
+ARG GOARCH
+
+SHELL ["/bin/bash", "-c"]
+
+RUN yum -y update && \
+    yum -y install make git wget gcc-toolset-9 && \
+    scl enable gcc-toolset-9 bash
+
+COPY . /workspace/
+
+RUN cd /workspace/ && \
+    set -ex && \
+    export GO_VERSION=$(cat .go-version) && \
+    if [ "${GOARCH}" = "amd64" ]; then \
+        wget "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" && \
+        tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"; \
+    elif [ "${GOARCH}" = "arm64" ]; then \
+        wget "https://go.dev/dl/go${GO_VERSION}.linux-arm64.tar.gz" && \
+        tar -C /usr/local -xzf "go${GO_VERSION}.linux-arm64.tar.gz"; \
+    fi && \
+    export PATH=${PATH}:/usr/local/go/bin:/root/go/bin && \
+    go mod download && \
+    go mod verify && \
+    mkdir -p dist/confluent_${GOOS}_${GOARCH} && \
+    COMMIT_SHA=$(git rev-parse --short HEAD 2>/dev/null || echo "dev") && \
+    BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) && \
+    echo "Building Confluent Development CLI for ${GOOS}/${GOARCH}" && \
+    echo "  Commit: ${COMMIT_SHA}" && \
+    echo "  Date: ${BUILD_DATE}" && \
+    CGO_ENABLED=1 GOEXPERIMENT=boringcrypto go build \
+    -ldflags="-s -w -X main.commit=${COMMIT_SHA} -X main.date=${BUILD_DATE}" \
+    -o dist/confluent_${GOOS}_${GOARCH}/confluent \
+    ./cmd/confluent && \
+    ls -lh dist/confluent_${GOOS}_${GOARCH}/confluent && \
+    echo "✅ Build completed successfully"
+
+WORKDIR /workspace
+