diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 860d7584..403a39d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -77,6 +77,7 @@ jobs:
     strategy:
       matrix:
         arch: ["arm64", "amd64"]
+        variant: ["", "-nonroot"]
         include:
           - arch: amd64
             runner: ubuntu-24.04
@@ -104,34 +105,20 @@ jobs:
         uses: docker/setup-buildx-action@v3
         with:
           install: true
-      - name: Build
+      - name: Build ${{ env.PULUMI_VERSION }}${{ matrix.variant }}-${{ matrix.arch }}
         run: |
           docker build \
             -f docker/pulumi/Dockerfile \
             --platform linux/${{ matrix.arch }} \
-            -t ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }} \
-            --target base \
+            -t ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}${{ matrix.variant }}-${{ matrix.arch }} \
+            --target $(if [ "${{ matrix.variant }}" = "-nonroot" ]; then echo "nonroot"; else echo "base"; fi) \
             --build-arg PULUMI_VERSION=${{ env.PULUMI_VERSION }} \
             --load \
             docker/pulumi
       - name: Image Info
         run: |
-          docker image ls ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }}
-          docker history ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }}
-      - name: Build nonroot variant
-        run: |
-          docker build \
-            -f docker/pulumi/Dockerfile \
-            --platform linux/${{ matrix.arch }} \
-            -t ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-nonroot-${{ matrix.arch }} \
-            --target nonroot \
-            --build-arg PULUMI_VERSION=${{ env.PULUMI_VERSION }} \
-            --load \
-            docker/pulumi
-      - name: Image Info
-        run: |
-          docker image ls ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-nonroot-${{ matrix.arch }}
-          docker history ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-nonroot-${{ matrix.arch }}
+          docker image ls ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}${{ matrix.variant }}-${{ matrix.arch }}
+          docker history ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}${{ matrix.variant }}-${{ matrix.arch }}
       - name: Install go
         uses: actions/setup-go@v5
         with:
@@ -155,8 +142,8 @@ jobs:
         with:
           service_account: ${{ env.GCP_SERVICE_ACCOUNT_EMAIL }}
           workload_identity_provider: projects/${{ env.GCP_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GCP_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
-      - name: 'Set up Cloud SDK'
-        uses: 'google-github-actions/setup-gcloud@v2'
+      - name: "Set up Cloud SDK"
+        uses: "google-github-actions/setup-gcloud@v2"
       - name: Tests
         # Note we use /src/pulumi-test-containers as entrypoint and not bash to avoid bash
         # changing the environment in some way.
@@ -165,28 +152,7 @@ jobs:
           chmod o+r $GOOGLE_APPLICATION_CREDENTIALS
           docker run \
             -e RUN_CONTAINER_TESTS=true \
-            -e IMAGE_VARIANT=pulumi \
-            -e PULUMI_ACCESS_TOKEN=${PULUMI_ACCESS_TOKEN} \
-            -e PULUMI_ORG=${PULUMI_ORG} \
-            -e ARM_CLIENT_ID=${ARM_CLIENT_ID} \
-            -e ARM_CLIENT_SECRET=${ARM_CLIENT_SECRET} \
-            -e ARM_TENANT_ID=${ARM_TENANT_ID} \
-            -e ARM_SUBSCRIPTION_ID=${ARM_SUBSCRIPTION_ID} \
-            -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
-            -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
-            -e AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} \
-            -e AWS_REGION=${AWS_REGION} \
-            -e GCP_PROJECT_NAME=${GCP_PROJECT_NAME} \
-            -e GCP_PROJECT_NUMBER=${GCP_PROJECT_NUMBER} \
-            -e GOOGLE_APPLICATION_CREDENTIALS=/src/creds.json \
-            --mount type=bind,source=$GOOGLE_APPLICATION_CREDENTIALS,target=/src/creds.json \
-            --volume /tmp:/src \
-            --entrypoint /src/pulumi-test-containers \
-            ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }} \
-            -test.parallel=8 -test.timeout=1h -test.v | sed 's/.*/[root] &/' &
-          docker run \
-            -e RUN_CONTAINER_TESTS=true \
-            -e IMAGE_VARIANT=pulumi-nonroot \
+            -e IMAGE_VARIANT=pulumi${{ matrix.variant }} \
             -e PULUMI_ACCESS_TOKEN=${PULUMI_ACCESS_TOKEN} \
             -e PULUMI_ORG=${PULUMI_ORG} \
             -e ARM_CLIENT_ID=${ARM_CLIENT_ID} \
@@ -203,9 +169,8 @@ jobs:
             --mount type=bind,source=$GOOGLE_APPLICATION_CREDENTIALS,target=/src/creds.json \
             --volume /tmp:/src \
             --entrypoint /src/pulumi-test-containers \
-            ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}-${{ matrix.arch }}-nonroot \
-            -test.parallel=8 -test.timeout=1h -test.v | sed 's/.*/[nonroot] &/' &
-          wait
+            ${{ env.DOCKER_ORG }}/pulumi:${{ env.PULUMI_VERSION }}${{ matrix.variant }}-${{ matrix.arch }} \
+            -test.parallel=8 -test.timeout=1h -test.v
 
   provider-build-environment:
     name: Provider Build Environment image
@@ -276,8 +241,8 @@ jobs:
         with:
           service_account: ${{ env.GCP_SERVICE_ACCOUNT_EMAIL }}
           workload_identity_provider: projects/${{ env.GCP_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GCP_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
-      - name: 'Set up Cloud SDK'
-        uses: 'google-github-actions/setup-gcloud@v2'
+      - name: "Set up Cloud SDK"
+        uses: "google-github-actions/setup-gcloud@v2"
       - name: Tests
         run: |
           docker run \
@@ -419,8 +384,8 @@ jobs:
         with:
           service_account: ${{ env.GCP_SERVICE_ACCOUNT_EMAIL }}
           workload_identity_provider: projects/${{ env.GCP_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GCP_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
-      - name: 'Set up Cloud SDK'
-        uses: 'google-github-actions/setup-gcloud@v2'
+      - name: "Set up Cloud SDK"
+        uses: "google-github-actions/setup-gcloud@v2"
       - name: Tests
         run: |
           docker run \
@@ -538,8 +503,8 @@ jobs:
         with:
           service_account: ${{ env.GCP_SERVICE_ACCOUNT_EMAIL }}
           workload_identity_provider: projects/${{ env.GCP_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GCP_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
-      - name: 'Set up Cloud SDK'
-        uses: 'google-github-actions/setup-gcloud@v2'
+      - name: "Set up Cloud SDK"
+        uses: "google-github-actions/setup-gcloud@v2"
       - name: Tests
         run: |
           docker run \