diff --git a/.github/workflows/pr-test-suite.yml b/.github/workflows/pr-test-suite.yml
index d473e2748..760638b82 100644
--- a/.github/workflows/pr-test-suite.yml
+++ b/.github/workflows/pr-test-suite.yml
@@ -1,5 +1,4 @@
-# We run the test suite on commits to main so codecov gets coverage data
-# about the main branch and can use it to track coverage changes.
+# We run the test suite on commits to main to double check that everything is good after merging
 name: PR test suite
 on:
   push:
@@ -14,20 +13,13 @@ permissions:
   contents: read
 concurrency:
   # https://stackoverflow.com/questions/74117321/if-condition-in-concurrency-in-gha
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   standard_tests_jobs:
     name: Standard tests
     uses: "./.github/workflows/standard_tests_jobs.yml"
-    with:
-      # We set this here to avoid coverage data being uploaded from things like our
-      # nightly pipeline. This is done because codecov (helpfully) keeps track of
-      # the number of coverage uploads for a commit and displays a warning when
-      # comparing two commits with an unequal number of uploads. Only uploading
-      # coverage here should keep the number of uploads it sees consistent.
-      uploadCoverage: true
   all_success:
     name: PR test suite success
     needs: standard_tests_jobs
diff --git a/.github/workflows/sphinx_steps.yml b/.github/workflows/sphinx_steps.yml
index c65ee78d6..9b78f23e9 100644
--- a/.github/workflows/sphinx_steps.yml
+++ b/.github/workflows/sphinx_steps.yml
@@ -6,32 +6,37 @@ permissions:
 
 jobs:
   test_sphinx_builds:
-    name: Build Sphinx Documentation
+    name: build sphinx documentation
     runs-on: ubuntu-latest
     steps:
       - name: checkout
         uses: actions/checkout@v6.0.2
+        with:
+          persist-credentials: false
       - name: Build Sphinx Documentation
         run: |-
-          set -e
+          echo "::group::Install dependencies"
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends libaugeas-dev
+          echo "::endgroup::"
           FINAL_STATUS=0
           declare -a FAILED_BUILDS
+          echo "::group::Setup venv"
           tools/venv.py
           source venv/bin/activate
+          echo "::endgroup::"
           for doc_path in */docs
           do
             echo ""
-            echo "##[group]Building $doc_path"
+            echo "::group::Building $doc_path"
             if ! sphinx-build -W --keep-going -b html $doc_path $doc_path/_build/html; then
               FINAL_STATUS=1
               FAILED_BUILDS[${#FAILED_BUILDS[@]}]="${doc_path%/docs}"
             fi
-            echo "##[endgroup]"
+            echo "::endgroup::"
           done
           if [[ $FINAL_STATUS -ne 0 ]]; then
-            echo "##[error]The following builds failed: ${FAILED_BUILDS[*]}"
+            echo "::error::The following builds failed: ${FAILED_BUILDS[*]}"
             exit 1
           fi
         shell: bash
diff --git a/.github/workflows/standard_tests_jobs.yml b/.github/workflows/standard_tests_jobs.yml
index 4f7d4959e..676bacf76 100644
--- a/.github/workflows/standard_tests_jobs.yml
+++ b/.github/workflows/standard_tests_jobs.yml
@@ -1,12 +1,6 @@
-# Environment variables defined in a calling workflow are not accessible to this reusable workflow. Refer to the documentation for further details on this limitation.
 name: Standard tests jobs
 on:
   workflow_call:
-    inputs:
-      uploadCoverage:
-        description: 'Upload coverage to Codecov'
-        type: boolean
-        default: false
 permissions:
   contents: read
 
@@ -43,8 +37,7 @@ jobs:
       PYTHON_VERSION: "${{  matrix.PYTHON_VERSION  }}"
       PIP_USE_PEP517: "${{ matrix.PIP_USE_PEP517 }}"
       TOXENV: "${{ matrix.TOXENV }}"
-      uploadCoverage: "${{ inputs.uploadCoverage }}"
       IMAGE_NAME: "${{ matrix.IMAGE_NAME }}"
-      test_name: "test"
   test_sphinx_builds:
+    name: '-' # Makes results viewing cleaner
     uses: "./.github/workflows/sphinx_steps.yml"
diff --git a/.github/workflows/tox_steps.yml b/.github/workflows/tox_steps.yml
index 38dff477f..f9a3cfb1d 100644
--- a/.github/workflows/tox_steps.yml
+++ b/.github/workflows/tox_steps.yml
@@ -10,35 +10,19 @@ on:
         type: string
       PIP_USE_PEP517:
         type: string
-      uploadCoverage:
-        description: 'Upload coverage to Codecov'
-        type: boolean
-        default: false
-      AWS_ACCESS_KEY_ID:
-        description: 'access key ID for AWS'
-        type: string
-      AWS_SECRET_ACCESS_KEY:
-        description: 'access key for AWS'
-        type: string
-      AWS_TEST_FARM_PEM:
-        description: 'contents of AWS PEM file to be placed in $AWS_EC2_PEM_FILE from environment'
-        type: string
-      test_name:
-        type: string
 permissions:
   contents: read
 
-env:
-  uploadCoverage: ${{ inputs.uploadCoverage }}
-
 jobs:
   tox_all:
-    name: ${{ inputs.test_name }} ${{ inputs.IMAGE_NAME }}-${{ inputs.TOXENV }}
+    name: ${{ inputs.TOXENV }} ${{ inputs.IMAGE_NAME }}
     runs-on:
       - "${{ inputs.IMAGE_NAME }}"
     steps:
     - name: Checkout
       uses: actions/checkout@v6.0.2
+      with:
+        persist-credentials: false
     # We run brew update because we've seen attempts to install an older version
     # of a package fail. See
     # https://github.com/actions/virtual-environments/issues/3165.
@@ -48,9 +32,7 @@ jobs:
     # fail on git clones: https://github.com/orgs/Homebrew/discussions/4612.
     - name: Install MacOS dependencies
       if: runner.os == 'macOS'
-      id: mac_install
       run: |-
-        set -e
         unset HOMEBREW_NO_INSTALL_FROM_API
         brew untap homebrew/core homebrew/cask
         brew update
@@ -62,7 +44,6 @@ jobs:
     - name: Install Linux dependencies
       if: runner.os == 'Linux'
       run: |-
-        set -e
         sudo apt-get update
         sudo apt-get install -y --no-install-recommends \
           libaugeas-dev \
@@ -75,50 +56,23 @@ jobs:
         python-version: "${{ inputs.PYTHON_VERSION }}"
     - name: Install runtime dependencies
       run: |-
-        set -e
         python3 tools/pip_install.py tox
       shell: bash
     - name: Create test farm pem file
       if: contains(inputs.TOXENV, 'test-farm')
       env:
-        PEM_CONTENTS: "${{ inputs.AWS_TEST_FARM_PEM }}"
+        PEM_CONTENTS: "${{ secrets.AWS_TEST_FARM_PEM }}"
+        AWS_EC2_PEM_FILE: ${{ github.workspace }}/GHAKeyPair.pem
       run: |-
-        set -e
         echo "${PEM_CONTENTS}" >> $AWS_EC2_PEM_FILE
       shell: bash
     - name: Run tox
       env:
-        AWS_ACCESS_KEY_ID: "${{ inputs.AWS_ACCESS_KEY_ID }}"
-        AWS_SECRET_ACCESS_KEY: "${{ inputs.AWS_SECRET_ACCESS_KEY }}"
+        AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
+        AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
         PIP_USE_PEP517: "${{ inputs.PIP_USE_PEP517 }}"
         TOXENV: "${{ inputs.TOXENV }}"
       run: |-
-        set -e
-        export TARGET_BRANCH="`echo "${BUILD_SOURCEBRANCH}" | sed -E 's!refs/(heads|tags)/!!g'`"
-        [ -z "${SYSTEM_PULLREQUEST_TARGETBRANCH}" ] || export TARGET_BRANCH="${SYSTEM_PULLREQUEST_TARGETBRANCH}"
         env
         python3 -m tox run
       shell: bash
-    - name: Upload coverage data
-      if: env.uploadCoverage == true && (startsWith(matrix.TOXENV, 'cover') || startsWith(matrix.TOXENV, 'integration'))
-      run: |-
-        python3 tools/pip_install.py -I coverage
-        case "${{ runner.os }}" in
-          Darwin)
-            CODECOV_URL="https://uploader.codecov.io/latest/macos/codecov"
-            ;;
-          Linux)
-            CODECOV_URL="https://uploader.codecov.io/latest/linux/codecov"
-            ;;
-          Windows_NT)
-            CODECOV_URL="https://uploader.codecov.io/latest/windows/codecov.exe"
-            ;;
-          *)
-            echo "Unexpected OS"
-            exit 0
-        esac
-        curl --retry 3 -o codecov "$CODECOV_URL"
-        chmod +x codecov
-        coverage xml
-        ./codecov || echo "Uploading coverage data failed"
-      shell: bash