diff --git a/.github/BACKPORT_BRANCH b/.github/BACKPORT_BRANCH
deleted file mode 100644
index 1ba33f6ae..000000000
--- a/.github/BACKPORT_BRANCH
+++ /dev/null
@@ -1 +0,0 @@
-12.9.x
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index a050aa171..83413bf76 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Load branch name
         id: get-branch
         run: |
-          OLD_BRANCH=$(cat .github/BACKPORT_BRANCH)
+          OLD_BRANCH=$(yq '.backport_branch' ci/versions.yml)
           echo "OLD_BRANCH=${OLD_BRANCH}" >> $GITHUB_ENV
 
       - name: Create backport pull requests
diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml
index cc44f5557..c53ca8954 100644
--- a/.github/workflows/build-wheel.yml
+++ b/.github/workflows/build-wheel.yml
@@ -75,6 +75,23 @@ jobs:
         if: ${{ startsWith(inputs.host-platform, 'win') }}
         uses: ilammy/msvc-dev-cmd@v1  # TODO: ask admin to allow pinning commits
 
+      - name: Set up yq
+        # GitHub made an unprofessional decision to not provide it in their Windows VMs,
+        # see https://github.com/actions/runner-images/issues/7443.
+        if: ${{ startsWith(inputs.host-platform, 'win') }}
+        env:
+          # doesn't seem there's an easy way to avoid hard-coding it?
+          YQ_URL: https://github.com/mikefarah/yq/releases/latest/download/yq_windows_amd64.exe
+          YQ_DIR: yq_latest
+        shell: pwsh -command ". '{0}'"
+        run: |
+          mkdir -Force -ErrorAction SilentlyContinue "${env:YQ_DIR}" | Out-Null
+          Invoke-WebRequest -UseBasicParsing -OutFile "${env:YQ_DIR}/yq.exe" -Uri "$env:YQ_URL"
+          ls -l $env:YQ_DIR
+          echo "$((Get-Location).Path)\\$env:YQ_DIR" >> $env:GITHUB_PATH
+          $env:Path += ";$((Get-Location).Path)\\$env:YQ_DIR"
+          yq --version
+
       - name: Set environment variables
         env:
           CUDA_VER: ${{ inputs.cuda-version }}
@@ -275,8 +292,7 @@ jobs:
         id: setup-python2
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
-          # workaround for actions/runner-images#12377 (the cached 3.13.4 is buggy on Windows)
-          python-version: ${{ matrix.python-version == '3.13' && '3.13.5' || matrix.python-version }}
+          python-version: ${{ matrix.python-version }}
 
       - name: verify free-threaded build
         if: endsWith(matrix.python-version, 't')
@@ -334,7 +350,6 @@ jobs:
           cuda-path: "./cuda_toolkit_prev"
 
       - name: Download cuda.bindings build artifacts from the prior branch
-        if: startsWith(matrix.python-version, '3.14')
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -350,7 +365,7 @@ jobs:
             && apt install gh -y
           fi
 
-          OLD_BRANCH=$(cat .github/BACKPORT_BRANCH)
+          OLD_BRANCH=$(yq '.backport_branch' ci/versions.yml)
           OLD_BASENAME="cuda-bindings-python${PYTHON_VERSION_FORMATTED}-cuda*-${{ inputs.host-platform }}*"
           LATEST_PRIOR_RUN_ID=$(gh run list -b ${OLD_BRANCH} -L 1 -w "ci.yml" -s completed -R NVIDIA/cuda-python --json databaseId | jq '.[]| .databaseId')
           if [[ "$LATEST_PRIOR_RUN_ID" == "" ]]; then
diff --git a/.github/workflows/test-wheel-linux.yml b/.github/workflows/test-wheel-linux.yml
index ba3152f14..d5fc0dbc1 100644
--- a/.github/workflows/test-wheel-linux.yml
+++ b/.github/workflows/test-wheel-linux.yml
@@ -33,6 +33,7 @@ jobs:
                 (inputs.host-platform == 'linux-aarch64' && 'arm64') }}
     outputs:
       MATRIX: ${{ steps.compute-matrix.outputs.MATRIX }}
+      OLD_BRANCH: ${{ steps.compute-matrix.outputs.OLD_BRANCH }}
     steps:
       - name: Checkout ${{ github.event.repository.name }}
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
@@ -67,6 +68,10 @@ jobs:
 
           echo "MATRIX=${MATRIX}" | tee --append "${GITHUB_OUTPUT}"
 
+          # This job has yq already installed, so let's do it here
+          OLD_BRANCH=$(yq '.backport_branch' ci/versions.yml)
+          echo "OLD_BRANCH=${OLD_BRANCH}" >> "$GITHUB_OUTPUT"
+
   test:
     name: py${{ matrix.PY_VER }}, ${{ matrix.CUDA_VER }}, ${{ (matrix.LOCAL_CTK == '1' && 'local') || 'wheels' }}, ${{ matrix.GPU }}
     needs: compute-matrix
@@ -76,13 +81,6 @@ jobs:
     runs-on: "linux-${{ matrix.ARCH }}-gpu-${{ matrix.GPU }}-${{ matrix.DRIVER }}-1"
     # The build stage could fail but we want the CI to keep moving.
     if: ${{ github.repository_owner == 'nvidia' && !cancelled() }}
-    # Our self-hosted runners require a container
-    # TODO: use a different (nvidia?) container
-    container:
-      options: -u root --security-opt seccomp=unconfined --shm-size 16g
-      image: ubuntu:22.04
-      env:
-        NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }}
     steps:
       - name: Ensure GPU is working
         run: nvidia-smi
@@ -147,7 +145,7 @@ jobs:
           && apt update \
           && apt install gh -y
 
-          OLD_BRANCH=$(cat .github/BACKPORT_BRANCH)
+          OLD_BRANCH=${{ needs.compute-matrix.outputs.OLD_BRANCH }}
           OLD_BASENAME="cuda-bindings-python${PYTHON_VERSION_FORMATTED}-cuda*-${{ inputs.host-platform }}*"
           LATEST_PRIOR_RUN_ID=$(gh run list -b ${OLD_BRANCH} -L 1 -w "ci.yml" -s completed -R NVIDIA/cuda-python --json databaseId | jq '.[]| .databaseId')
           if [[ "$LATEST_PRIOR_RUN_ID" == "" ]]; then
@@ -219,8 +217,8 @@ jobs:
         with:
           python-version: ${{ matrix.PY_VER }}
         env:
-          # we use self-hosted runners on which setup-python behaves weirdly...
-          AGENT_TOOLSDIRECTORY: "/opt/hostedtoolcache"
+          # we use self-hosted runners on which setup-python behaves weirdly (Python include can't be found)...
+          AGENT_TOOLSDIRECTORY: ${{ runner.temp }}/setup_python
 
       - name: Set up mini CTK
         if: ${{ matrix.LOCAL_CTK == '1' }}
diff --git a/.github/workflows/test-wheel-windows.yml b/.github/workflows/test-wheel-windows.yml
index 340f418b2..b98e9ba2d 100644
--- a/.github/workflows/test-wheel-windows.yml
+++ b/.github/workflows/test-wheel-windows.yml
@@ -125,27 +125,12 @@ jobs:
           name: ${{ env.CUDA_BINDINGS_ARTIFACT_NAME }}
           path: ${{ env.CUDA_BINDINGS_ARTIFACTS_DIR }}
 
-      - name: Install zstd
-        # the GPU runner image does not have zstd pre-installed... and it's needed by actions/cache
-        if: ${{ matrix.LOCAL_CTK == '1' }}
-        env:
-          # doesn't seem there's an easy way to avoid hard-coding it?
-          ZSTD_URL: https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-v1.5.7-win64.zip
-          ZSTD_DIR: zstd-v1.5.7-win64
-        run: |
-          Invoke-WebRequest -Uri "$env:ZSTD_URL" -OutFile "zstd-win64.zip"
-          Expand-Archive -Path "zstd-win64.zip" -DestinationPath .
-          ls -l $env:ZSTD_DIR
-          echo "$((Get-Location).Path)\\$env:ZSTD_DIR" >> $env:GITHUB_PATH
-          $env:Path += ";$((Get-Location).Path)\\$env:ZSTD_DIR"
-          zstd --version
-
       - name: Download cuda-python & cuda.bindings build artifacts from the prior branch
         if: ${{ env.SKIP_CUDA_BINDINGS_TEST == '1'}}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          $OLD_BRANCH = Get-Content .github/BACKPORT_BRANCH
+          $OLD_BRANCH = yq '.backport_branch' ci/versions.yml
           $OLD_BASENAME = "cuda-bindings-python${env:PYTHON_VERSION_FORMATTED}-cuda*-${{ inputs.host-platform }}*"
           $runData = gh run list -b $OLD_BRANCH -L 1 -w "ci.yml" -s completed -R NVIDIA/cuda-python --json databaseId | ConvertFrom-Json
           if (-not $runData -or $runData.Length -eq 0 -or -not $runData[0].databaseId -or [string]::IsNullOrEmpty($runData[0].databaseId)) {
diff --git a/.spdx-ignore b/.spdx-ignore
index 84f051faf..ee658d255 100644
--- a/.spdx-ignore
+++ b/.spdx-ignore
@@ -5,7 +5,6 @@ LICENSE
 *.png
 .gitattributes
 .gitignore
-.github/BACKPORT_BRANCH
 requirements*.txt
 cuda_bindings/examples/*
 
diff --git a/ci/versions.yml b/ci/versions.yml
index 6ce7e3a32..5a5a9e586 100644
--- a/ci/versions.yml
+++ b/ci/versions.yml
@@ -1,6 +1,8 @@
 # SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
+backport_branch: "12.9.x"
+
 cuda:
   build:
     version: "13.0.2"