diff --git a/.github/workflows/root-ci-config/build_root.py b/.github/workflows/root-ci-config/build_root.py
index ed9303effd695..b0b9058367a63 100755
--- a/.github/workflows/root-ci-config/build_root.py
+++ b/.github/workflows/root-ci-config/build_root.py
@@ -30,7 +30,6 @@
     die,
     github_log_group,
     is_macos,
-    load_config,
     subprocess_with_capture,
     subprocess_with_log,
     upload_file,
@@ -70,10 +69,12 @@ def main():
     # Load CMake options from .github/workflows/root-ci-config/buildconfig/[platform].txt
     this_script_dir = os.path.dirname(os.path.abspath(__file__))
 
+    override_dict = dict(arg.split("=") for arg in args.overrides)
     options_dict = {
-        **load_config(f'{this_script_dir}/buildconfig/global.txt'),
+        **build_utils.load_config(f"{this_script_dir}/buildconfig/global.txt"),
         # file below overwrites values from above
-        **load_config(f'{this_script_dir}/buildconfig/{args.platform}.txt')
+        **build_utils.load_config(f"{this_script_dir}/buildconfig/{args.platform}.txt"),
+        **override_dict,
     }
 
     options = build_utils.cmake_options_from_dict(options_dict)
@@ -193,6 +194,7 @@ def parse_args():
     parser.add_argument("--architecture",    default=None,      help="Windows only, target arch")
     parser.add_argument("--repository",      default="https://github.com/root-project/root.git",
                         help="url to repository")
+    parser.add_argument("--overrides",       default=None,      help="Override build options with these key-value pairs", nargs="*")
 
     args = parser.parse_args()
 
@@ -255,7 +257,7 @@ def git_pull(directory: str, repository: str, branch: str):
             returncode = subprocess_with_log(f"""
                 git clone --branch {branch} --single-branch {repository} "{targetdir}"
             """)
-        
+
         if returncode == 0:
             return
 
diff --git a/.github/workflows/root-ci.yml b/.github/workflows/root-ci.yml
index c7b7a82168116..93de3b7a99d5f 100644
--- a/.github/workflows/root-ci.yml
+++ b/.github/workflows/root-ci.yml
@@ -92,6 +92,11 @@ jobs:
     permissions:
       contents: read
 
+    # Use login shells to have brew and java available
+    defaults:
+      run:
+        shell: bash -le {0}
+
     strategy:
       fail-fast: false
       matrix:
@@ -100,33 +105,57 @@ jobs:
         # Common configs: {Release,Debug,RelWithDebInfo)
         # Build options: https://root.cern/install/build_from_source/#all-build-options
         include:
-          - platform: mac14
-            arch: X64
-            overrides: ["CMAKE_CXX_STANDARD=20"]
+          # - platform: mac14
+          #   arch: X64
+          #   overrides: ["CMAKE_CXX_STANDARD=20"]
           - platform: mac15
             arch: ARM64
             overrides: ["CMAKE_CXX_STANDARD=23"]
-          - platform: mac26
-            arch: ARM64
+          - platform: experimental-brew-ci
+            # arch: ARM64
+            overrides: ["CMAKE_CXX_STANDARD=23", "builtin_unuran=On"]
+          # - platform: mac26
+          #   arch: ARM64
           - platform: mac-beta
             is_special: true
             arch: ARM64
 
     runs-on: # Using '[self-hosted, ..., ...]' does not work for some reason :)
       - self-hosted
-      - macOS
-      - ${{ matrix.arch }}
+      - ${{ matrix.arch == null && 'self-hosted' || matrix.arch }}
       - ${{ matrix.platform }}
 
     name: |
-      ${{ matrix.platform }} ${{ matrix.arch }} 
+      ${{ matrix.platform }} ${{ matrix.arch }}
       ${{ (github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' && join( matrix.overrides, ', ' )) || '' }}
 
     steps:
+      - name: Cleanup
+        run: rm -rf ${{ github.workspace }}/{src,build}
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref_name }}
+          path: src/
+
+      - name: Update brew packages
+        if: ${{ matrix.platform == 'experimental-brew-ci' }}
+        run: |
+            brew update
+            echo "Installing deps: $(brew deps --direct --include-build root)"
+            brew install ccache googletest pyenv $(brew deps --direct --include-build root)
+            brew upgrade
+
+      - name: Set up python venv
+        if: ${{ matrix.platform == 'experimental-brew-ci' }}
+        run: |
+          $(brew --prefix python)/bin/python3 -m venv ROOT_CI
+          source ROOT_CI/bin/activate
+          echo $(pwd)/ROOT_CI/bin >> $GITHUB_PATH
+          pip install --upgrade pip
+          grep -v '^#' ${{ github.workspace }}/src/requirements.txt | while read PACKAGE; do pip install -U "$PACKAGE"; done || true
+          pip install openstacksdk # TODO: Remove?
 
       - name: Apply option overrides from matrix for this job for non-release builds
         if: ${{ github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' && matrix.overrides != NaN }}
@@ -134,24 +163,7 @@ jobs:
           OVERRIDES: ${{ join( matrix.overrides, ' ') }}
           CONFIGFILE: '.github/workflows/root-ci-config/buildconfig/${{ matrix.platform }}.txt'
         shell: bash
-        run: |
-          set -x
-
-          echo '' >> "$CONFIGFILE"
-
-          for ENTRY in $GLOBAL_OVERRIDES $OVERRIDES; do
-              KEY=$( echo "$ENTRY" | cut -d '=' -f 1 )
-
-              # Add entry to file if not exists, otherwise replace
-
-              if grep -q "$KEY=" "$CONFIGFILE"; then
-                  sed -i "s/$KEY=.*\$/$ENTRY/" "$CONFIGFILE"
-              else
-                  echo "$ENTRY" >> "$CONFIGFILE"
-              fi
-          done
-
-          cat "$CONFIGFILE" || true
+        run: echo "Remember to set the following overrides GLOBAL=$GLOBAL_OVERRIDES LOCAL=$OVERRIDES"
 
       - uses: root-project/gcc-problem-matcher-improved@main
         with:
@@ -159,29 +171,32 @@ jobs:
 
       - name: Set up curl CA bundle for Davix to work with https
         run: 'echo SSL_CERT_FILE=/opt/local/share/curl/curl-ca-bundle.crt >> $GITHUB_ENV'
-        
+
       - name: Pull Request Build
-        shell: bash -leo pipefail {0}
         if: github.event_name == 'pull_request'
         env:
           HOME: /Users/sftnight
           INCREMENTAL: ${{ !contains(github.event.pull_request.labels.*.name, 'clean build') && !matrix.platform == 'mac15' && !matrix.platform == 'mac26'}}
           GITHUB_PR_ORIGIN: ${{ github.event.pull_request.head.repo.clone_url }}
-        run: ".github/workflows/root-ci-config/build_root.py 
-                    --buildtype       RelWithDebInfo
-                    --incremental     $INCREMENTAL
-                    --base_ref        ${{ github.base_ref }}
-                    --sha             ${{ github.sha }}
-                    --pull_repository ${{ github.event.pull_request.head.repo.clone_url }}
-                    --head_ref        refs/pull/${{ github.event.pull_request.number }}/head:${{ github.event.pull_request.head.ref }}
-                    --head_sha        ${{ github.event.pull_request.head.sha }}
-                    --repository      ${{ github.server_url }}/${{ github.repository }}
-                    --platform        ${{ matrix.platform }}"
+          OVERRIDES: ${{ join( matrix.overrides, ' ') }}
+        run: |
+          if [ -f ROOT_CI/bin/activate ]; then source ROOT_CI/bin/activate; fi
+          src/.github/workflows/root-ci-config/build_root.py  \
+                    --buildtype       RelWithDebInfo          \
+                    --incremental     $INCREMENTAL            \
+                    --base_ref        ${{ github.base_ref }}  \
+                    --sha             ${{ github.sha }}       \
+                    --pull_repository ${{ github.event.pull_request.head.repo.clone_url }}  \
+                    --head_ref        refs/pull/${{ github.event.pull_request.number }}/head:${{ github.event.pull_request.head.ref }}  \
+                    --head_sha        ${{ github.event.pull_request.head.sha }}         \
+                    --repository      ${{ github.server_url }}/${{ github.repository }} \
+                    --platform        ${{ matrix.platform }}                            \
+                    --overrides       $GLOBAL_OVERRIDES $OVERRIDES
 
       - name: Workflow dispatch
         shell: bash -leo pipefail {0}
         if: ${{ github.event_name == 'workflow_dispatch' && !matrix.is_special }}
-        run: ".github/workflows/root-ci-config/build_root.py 
+        run: ".github/workflows/root-ci-config/build_root.py
                     --buildtype      ${{ inputs.buildtype }}
                     --platform       ${{ matrix.platform }}
                     --incremental    ${{ inputs.incremental }}
@@ -193,7 +208,7 @@ jobs:
       - name: Nightly build
         shell: bash -leo pipefail {0}
         if:   github.event_name == 'schedule'
-        run: ".github/workflows/root-ci-config/build_root.py 
+        run: ".github/workflows/root-ci-config/build_root.py
                     --buildtype      Release
                     --platform       ${{ matrix.platform }}
                     --incremental    false
@@ -204,13 +219,16 @@ jobs:
       - name: Update build cache after push to release branch
         shell: bash -leo pipefail {0}
         if:   github.event_name == 'push'
-        run: ".github/workflows/root-ci-config/build_root.py 
+        env:
+          OVERRIDES: ${{ join( matrix.overrides, ' ') }}
+        run: ".github/workflows/root-ci-config/build_root.py
                     --buildtype      RelWithDebInfo
                     --platform       ${{ matrix.platform }}
                     --incremental    false
                     --base_ref       ${{ github.ref_name }}
                     --binaries       ${{ startsWith(github.ref, 'refs/tags/') }}
-                    --repository     ${{ github.server_url }}/${{ github.repository }}"
+                    --repository     ${{ github.server_url }}/${{ github.repository }}
+                    --overrides      $GLOBAL_OVERRIDES $OVERRIDES"
 
       - name: Upload test results
         if:   ${{ !cancelled() }}
@@ -231,13 +249,7 @@ jobs:
   build-windows:
     # For any event that is not a PR, the CI will always run. In PRs, the CI
     # can be skipped if the tag [skip-ci] or [skip ci] is written in the title.
-    if: |
-        (github.repository_owner == 'root-project' && github.event_name != 'pull_request') ||
-        (github.event_name == 'pull_request' && !(
-          contains(github.event.pull_request.title, '[skip-ci]') ||
-          contains(github.event.pull_request.title, '[skip ci]') ||
-          contains(github.event.pull_request.labels.*.name, 'skip ci')
-        ))
+    if: false
 
     permissions:
       contents: read
@@ -274,9 +286,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref_name }}
+        uses: actions/checkout@v5
 
       - name: Pull Request Build
         if: github.event_name == 'pull_request'
@@ -356,13 +366,7 @@ jobs:
   build-linux:
     # For any event that is not a PR, the CI will always run. In PRs, the CI
     # can be skipped if the tag [skip-ci] or [skip ci] is written in the title.
-    if: |
-        (github.repository_owner == 'root-project' && github.event_name != 'pull_request') ||
-        (github.event_name == 'pull_request' && !(
-          contains(github.event.pull_request.title, '[skip-ci]') ||
-          contains(github.event.pull_request.title, '[skip ci]') ||
-          contains(github.event.pull_request.labels.*.name, 'skip ci')
-        ))
+    if: false
 
     permissions:
       contents: read
@@ -422,7 +426,7 @@ jobs:
             is_special: true
             property: "Fedora pydebug"
             overrides: ["CMAKE_CXX_STANDARD=23"]
-          # Disable GPU builds until the DNS problem is solved  
+          # Disable GPU builds until the DNS problem is solved
           # - image: ubuntu2404-cuda
           #   is_special: true
           #   property: gpu