diff --git a/.github/ISSUE_TEMPLATE/maintainer_change.yml b/.github/ISSUE_TEMPLATE/maintainer_change.yml
deleted file mode 100644
index 29dd62c090..0000000000
--- a/.github/ISSUE_TEMPLATE/maintainer_change.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Add or remove maintainer
-description: To be used when making changes to project maintainers.
-labels: ["kind/support"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Use this form to make changes to the maintainers of CAPA
-  - type: input
-    id: github_handle
-    attributes:
-      label: GitHub handle
-      description: The GitHub handle of the maintainer that changes will be made to.
-    validations:
-      required: true
-  - type: dropdown
-    id: action
-    attributes:
-      label: Action
-      description: What action is being performed to the maintainers
-      options:
-        - Add
-        - Remove
-    validations:
-      required: true
-  - type: input
-    id: merge_date
-    attributes:
-      label: Merge date
-      description: Enter the date when the changes can merge. The date should be 7 days or after the next CAPA office hours (whichever is longer)
-    validations:
-      required: true
-  - type: textarea
-    id: reason
-    attributes:
-      label: Reason for change
-      description: What is the reason this change is being made
-    validations:
-      required: true
-  - type: textarea
-    id: tasks
-    attributes:
-      label: 🖱️Tasks
-      value: |
-        ```[tasklist]
-        ## Tasks to be done
-        - [ ] Update **cluster-api-aws-maintainers** section in [OWNER_ALIASES](https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/OWNERS_ALIASES) in CAPA repo
-        - [ ] Create a PR with the change and add `/hold`
-        - [ ] Announce the change in the CAPA slack channel
-        - [ ] Add PSA in the notes doc for the next CAPA office hours
-        - [ ] After the lazy consensus review period remove the hold
-        - [ ] Update **cluster-api-provider-aws-maintainers** team in [this file](https://github.com/kubernetes/org/blob/main/config/kubernetes-sigs/sig-cluster-lifecycle/teams.yaml)
-        - [ ] Update **approvers** for CAPA jobs [here](https://github.com/kubernetes/test-infra/blob/master/config/jobs/kubernetes-sigs/cluster-api-provider-aws/OWNERS)
-        - [ ] Update **approvers** from CAPA image promotion [here](https://github.com/kubernetes/k8s.io/blob/main/registry.k8s.io/images/k8s-staging-cluster-api-aws/OWNERS)
-        - [ ] Update **k8s-infra-staging-cluster-api-aws@kubernetes.io** [here](https://github.com/kubernetes/k8s.io/blob/main/groups/sig-cluster-lifecycle/groups.yaml)
-        - [ ] Update **sig-cluster-lifecycle-cluster-api-aws-alerts@kubernetes.io** [here](https://github.com/kubernetes/k8s.io/blob/main/groups/sig-cluster-lifecycle/groups.yaml)
-        ```
diff --git a/.github/ISSUE_TEMPLATE/reviewer_change.yml b/.github/ISSUE_TEMPLATE/reviewer_change.yml
deleted file mode 100644
index 7a44377d48..0000000000
--- a/.github/ISSUE_TEMPLATE/reviewer_change.yml
+++ /dev/null
@@ -1,53 +0,0 @@
-name: Add or remove reviewer
-description: To be used when making changes to project reviewers. See [contributing guide(https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/CONTRIBUTING.md)] for details of the projects ladder.
-labels: ["kind/support"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Use this form to make changes to the reviewers of CAPA
-  - type: input
-    id: github_handle
-    attributes:
-      label: GitHub handle
-      description: The GitHub handle of the reviewer that changes will be made to.
-    validations:
-      required: true
-  - type: dropdown
-    id: action
-    attributes:
-      label: Action
-      description: What action is being performed to the reviewers
-      options:
-        - Add
-        - Remove
-    validations:
-      required: true
-  - type: input
-    id: merge_date
-    attributes:
-      label: Merge date
-      description: Enter the date when the changes can merge. The date should be 7 days or after the next CAPA office hours (whichever is longer)
-    validations:
-      required: true
-  - type: textarea
-    id: reason
-    attributes:
-      label: Reason for change
-      description: What is the reason this change is being made
-    validations:
-      required: true
-  - type: textarea
-    id: tasks
-    attributes:
-      label: 🖱️Tasks
-      value: |
-        ```[tasklist]
-        ## Tasks to be done
-        - [ ] Update **cluster-api-aws-reviewers** section in [OWNER_ALIASES](https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/OWNERS_ALIASES) in CAPA repo
-        - [ ] Create a PR with the change and add `/hold`
-        - [ ] Announce the change in the CAPA slack channel
-        - [ ] Add PSA in the notes doc for the next CAPA office hours
-        - [ ] After the lazy consensus review period remove the hold
-        - [ ] Update **reviewers** for CAPA jobs [here](https://github.com/kubernetes/test-infra/blob/master/config/jobs/kubernetes-sigs/cluster-api-provider-aws/OWNERS)
-        ```
\ No newline at end of file
diff --git a/.github/workflows/ami-housekeeping-delete.yml b/.github/workflows/ami-housekeeping-delete.yml
deleted file mode 100644
index 403ae80ef7..0000000000
--- a/.github/workflows/ami-housekeeping-delete.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-name: Delete AMIs by kubernetes_version
-
-on:
-    workflow_dispatch:
-        inputs:
-            kubernetes_version:
-                description: "Substring to match against the kubernetes_version tag (e.g. 1.28)"
-                required: true
-                type: string
-            execute:
-                description: "Apply deletions? (leave unchecked for dry-run preview)"
-                required: true
-                type: boolean
-                default: false
-            regions:
-                description: "Comma-separated list of AWS regions (overrides default)"
-                required: false
-                type: string
-                default: 'ap-south-1,eu-west-3,eu-west-2,eu-west-1,ap-northeast-2,ap-northeast-1,sa-east-1,ca-central-1,ap-southeast-1,ap-southeast-2,eu-central-1,us-east-1,us-east-2,us-west-1,us-west-2'
-
-permissions:
-    id-token: write
-    contents: read
-
-jobs:
-    delete-amis:
-        runs-on: ubuntu-latest
-        defaults:
-            run:
-                working-directory: ./hack/tools/ami
-        steps:
-            - name: Checkout
-              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-            - name: Set up uv
-              uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-
-            - name: Install dependencies
-              run: uv sync --frozen
-
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-              with:
-                aws-region: us-east-2
-                role-to-assume: arn:aws:iam::819546954734:role/gh-image-builder
-
-            - name: Run delete-amis
-              env:
-                  REGIONS: ${{ inputs.regions }}
-                  K8S_VERSION: ${{ inputs.kubernetes_version }}
-              run: |
-                  EXECUTE_FLAG=""
-                  if [ "${{ inputs.execute }}" = "true" ]; then
-                    EXECUTE_FLAG="--execute"
-                  fi
-                  uv run python3 delete_amis.py \
-                    --regions "$REGIONS" \
-                    --version-contains "$K8S_VERSION" \
-                    $EXECUTE_FLAG
diff --git a/.github/workflows/ami-housekeeping-list.yml b/.github/workflows/ami-housekeeping-list.yml
deleted file mode 100644
index 753b34cb57..0000000000
--- a/.github/workflows/ami-housekeeping-list.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: List AMIs by kubernetes_version
-
-on:
-    workflow_dispatch:
-        inputs:
-            kubernetes_version:
-                description: "Substring to match against the kubernetes_version tag (e.g. 1.28)"
-                required: true
-                type: string
-            regions:
-                description: "Comma-separated list of AWS regions (overrides default)"
-                required: true
-                type: string
-                default: 'ap-south-1,eu-west-3,eu-west-2,eu-west-1,ap-northeast-2,ap-northeast-1,sa-east-1,ca-central-1,ap-southeast-1,ap-southeast-2,eu-central-1,us-east-1,us-east-2,us-west-1,us-west-2'
-
-permissions:
-    id-token: write
-    contents: read
-
-jobs:
-    list-amis:
-        runs-on: ubuntu-latest
-        defaults:
-            run:
-                working-directory: ./hack/tools/ami
-        steps:
-            - name: Checkout
-              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-            - name: Set up uv
-              uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-
-            - name: Install dependencies
-              run: uv sync --frozen
-
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-              with:
-                aws-region: us-east-2
-                role-to-assume: arn:aws:iam::819546954734:role/gh-image-builder
-
-            - name: Run list-amis
-              env:
-                  REGIONS: ${{ inputs.regions }}
-                  K8S_VERSION: ${{ inputs.kubernetes_version }}
-              run: |
-                  uv run python3 list_amis.py \
-                    --regions "$REGIONS" \
-                    --version-contains "$K8S_VERSION"
diff --git a/.github/workflows/auto-publish-ami.yml b/.github/workflows/auto-publish-ami.yml
deleted file mode 100644
index 62e44c97c2..0000000000
--- a/.github/workflows/auto-publish-ami.yml
+++ /dev/null
@@ -1,271 +0,0 @@
-name: auto-publish-ami
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - hack/tools/release-tools/internal/ami/k8srelease/data/AMIK8sBuildConfig.json
-
-  workflow_dispatch:
-    inputs:
-      versions:
-        description: >-
-          Optional comma-separated list of K8s patch versions to force-build
-          (e.g. v1.36.0,v1.35.4). When empty, the workflow auto-detects target
-          versions by comparing AMIBuildConfig.json against AMIs already
-          published in the configured AWS account/region/OS via
-          `clusterawsadm ami list`.
-        required: false
-        default: ""
-
-jobs:
-  derive:
-    name: Derive packer inputs
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    outputs:
-      count: ${{ steps.matrix.outputs.count }}
-      matrix: ${{ steps.matrix.outputs.matrix }}
-      failures: ${{ steps.matrix.outputs.failures }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-
-      - name: Build clusterawsadm
-        run: go build -o bin/clusterawsadm ./cmd/clusterawsadm
-
-      - name: Build release-tool
-        # release-tools is a separate Go module, so it must be built from its
-        # own directory. The output path is relative to that directory.
-        run: go build -C hack/tools/release-tools -o ../../../bin/release-tool .
-
-      - name: Configure AWS credentials
-        # Required for `clusterawsadm ami list` to call ec2:DescribeImages.
-        # Reuses the same role as the build job; that role must have
-        # ec2:DescribeImages on AMIs owned by ${OWNER_ID} (CAPA AMIs are public,
-        # so DescribeImages on any role with the action allowed is sufficient).
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          aws-region: us-east-2
-          role-to-assume: arn:aws:iam::819546954734:role/gh-image-builder
-
-      - name: Determine target K8s versions
-        id: versions
-        env:
-          # Used by find-missing-ami to query the Kubernetes release API;
-          # unauthenticated requests share a per-IP rate limit across all
-          # jobs on the runner and get throttled with 403s.
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          MANUAL_VERSIONS: ${{ inputs.versions }}
-          OWNER_ID: '819546954734'
-          REGION: us-east-2
-          # clusterawsadm uses dotted OS slugs (ubuntu-22.04, ubuntu-24.04),
-          # image-builder uses hyphenated ones (ubuntu-2204, ubuntu-2404).
-          # flatcar is identical in both conventions.
-          # Keep this list aligned with the target matrix in build-ami-v2.yml.
-          OS_LIST: "ubuntu-22.04,ubuntu-24.04,flatcar"
-          # Region used to query already-published AMIs. image-builder publishes
-          # to every region in REGION_LIST atomically, so checking a single
-          # region is sufficient to determine whether an AMI was ever built.
-          CHECK_REGION: us-east-2
-          # Regions the AMIs must be published to. Aligned with the default
-          # `regions` input of build-ami-v2.yml.
-          REGION_LIST: "ap-south-1,eu-west-3,eu-west-2,eu-west-1,ap-northeast-2,ap-northeast-1,sa-east-1,ca-central-1,ap-southeast-1,ap-southeast-2,eu-central-1,us-east-1,us-east-2,us-west-1,us-west-2"
-        run: |
-          set -euo pipefail
-          if [ -n "${MANUAL_VERSIONS}" ]; then
-            # Manual override: build exactly these versions, skip the
-            # already-published check entirely.
-            tr ',' '\n' <<< "${MANUAL_VERSIONS}" \
-              | sed -E 's/^[[:space:]]+|[[:space:]]+$//g; /^$/d; s/^([0-9])/v\1/' \
-              | sort -u > /tmp/target-versions.txt
-          else
-            # Pipe published AMIs directly into find-missing-ami to compute
-            # which (k8s version × OS × region) combinations are absent.
-            # find-missing-ami authenticates to the Kubernetes release API
-            # with the GITHUB_TOKEN set in this step's env.
-            ./bin/clusterawsadm ami list \
-              --owner-id "${OWNER_ID}" \
-              --region "${CHECK_REGION}" \
-              --os "${OS_LIST}" \
-              -o json \
-            | ./bin/release-tool ami find-missing-ami \
-              --os "${OS_LIST}" \
-              --region "${CHECK_REGION}" \
-              -o json > /tmp/missing-amis.json
-
-            echo "Missing AMIs:"
-            cat /tmp/missing-amis.json
-
-            # Extract unique Kubernetes versions from the missing AMIs report.
-            jq -r '.items[].kubernetesVersion' /tmp/missing-amis.json \
-              | sort -u > /tmp/target-versions.txt
-          fi
-          count=$(wc -l < /tmp/target-versions.txt | tr -d ' ')
-          echo "count=${count}" >> "${GITHUB_OUTPUT}"
-          echo "Target versions to build (${count}):"
-          cat /tmp/target-versions.txt || true
-
-      - name: Build matrix from packer inputs
-        id: matrix
-        if: steps.versions.outputs.count != '0'
-        env:
-          # find-ami-publishing-inputs.sh uses this to authenticate its
-          # GitHub API lookup of crictl release tags.
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          # parse_inputs reads the trailing 'Key : Value' block printed by
-          # find-ami-publishing-inputs.sh and emits KEY=value pairs suitable
-          # for `export`. Matching is anchored on the script's exact labels.
-          parse_inputs() {
-            awk -F' *: *' '
-              /^K8s Semver/               { print "K8S_SEMVER="      $2 }
-              /^K8s Release Series/       { print "K8S_SERIES="      $2 }
-              /^K8s RPM Package Version/  { print "K8S_RPM_VERSION=" $2 }
-              /^K8s Deb Package Version/  { print "K8S_DEB_VERSION=" $2 }
-              /^CNI Semver/               { print "CNI_SEMVER="      $2 }
-              /^CNI Deb Package Version/  { print "CNI_DEB_VERSION=" $2 }
-              /^CRICTL Version/           { print "CRICTL_VERSION="  $2 }
-            ' <<< "$1"
-          }
-
-          entries=()
-          failures=()
-          while IFS= read -r v; do
-            [ -z "$v" ] && continue
-
-            echo "::group::Derive inputs for ${v}"
-            if ! out=$(./scripts/find-ami-publishing-inputs.sh "${v}" 2>&1); then
-              echo "${out}"
-              echo "::endgroup::"
-              echo "::error::find-ami-publishing-inputs.sh failed for ${v}"
-              failures+=("${v}")
-              continue
-            fi
-            echo "${out}"
-            echo "::endgroup::"
-
-            # Reset before each iteration so a partial parse can't leak
-            # values from the previous version into the dispatch call.
-            unset K8S_SEMVER K8S_SERIES K8S_RPM_VERSION K8S_DEB_VERSION \
-                  CNI_SEMVER CNI_DEB_VERSION CRICTL_VERSION
-            while IFS= read -r line; do
-              # shellcheck disable=SC2163
-              export "$line"
-            done < <(parse_inputs "${out}")
-
-            missing=0
-            for var in K8S_SEMVER K8S_SERIES K8S_RPM_VERSION K8S_DEB_VERSION \
-                       CNI_SEMVER CNI_DEB_VERSION CRICTL_VERSION; do
-              if [ -z "${!var:-}" ]; then
-                echo "::error::missing ${var} after parsing script output for ${v}"
-                missing=1
-              fi
-            done
-            if [ "${missing}" -ne 0 ]; then
-              failures+=("${v}")
-              continue
-            fi
-
-            entries+=("$(jq -nc \
-              --arg k8s_semver       "${K8S_SEMVER}" \
-              --arg k8s_series       "${K8S_SERIES}" \
-              --arg k8s_rpm_version  "${K8S_RPM_VERSION}" \
-              --arg k8s_deb_version  "${K8S_DEB_VERSION}" \
-              --arg cni_semver       "${CNI_SEMVER}" \
-              --arg cni_deb_version  "${CNI_DEB_VERSION}" \
-              --arg crictl_version   "${CRICTL_VERSION}" \
-              '{k8s_semver:$k8s_semver, k8s_series:$k8s_series, k8s_rpm_version:$k8s_rpm_version, k8s_deb_version:$k8s_deb_version, cni_semver:$cni_semver, cni_deb_version:$cni_deb_version, crictl_version:$crictl_version}')")
-          done < /tmp/target-versions.txt
-
-          if [ "${#entries[@]}" -eq 0 ]; then
-            matrix='[]'
-          else
-            matrix=$(printf '%s\n' "${entries[@]}" | jq -cs '.')
-          fi
-          if [ "${#failures[@]}" -eq 0 ]; then
-            failures_json='[]'
-          else
-            failures_json=$(printf '%s\n' "${failures[@]}" | jq -Rcs 'split("\n") | map(select(length > 0))')
-          fi
-          echo "matrix=${matrix}" >> "${GITHUB_OUTPUT}"
-          echo "count=${#entries[@]}" >> "${GITHUB_OUTPUT}"
-          echo "failures=${failures_json}" >> "${GITHUB_OUTPUT}"
-          echo "matrix: ${matrix}"
-          echo "failures: ${failures_json}"
-
-          # Best-effort: never fail this step on individual derivation errors.
-          # The 'report' job downstream fails the workflow if any version
-          # could not be derived, after successful versions have built.
-
-      - name: Summary
-        if: always()
-        run: |
-          {
-            echo "### auto-publish-ami summary"
-            echo
-            echo "- Target versions detected: ${{ steps.versions.outputs.count }}"
-            echo "- Versions queued for build: ${{ steps.matrix.outputs.count || '0' }}"
-            if [ -f /tmp/target-versions.txt ]; then
-              echo
-              echo '```'
-              cat /tmp/target-versions.txt
-              echo '```'
-            fi
-          } >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Clean up temporary files
-        if: always()
-        run: rm -f /tmp/missing-amis.json /tmp/target-versions.txt
-
-  build:
-    name: Build AMI (${{ matrix.version.k8s_semver }})
-    needs: derive
-    if: ${{ needs.derive.outputs.count != '' && needs.derive.outputs.count != '0' }}
-    permissions:
-      contents: read
-      id-token: write
-    strategy:
-      fail-fast: false
-      matrix:
-        version: ${{ fromJson(needs.derive.outputs.matrix) }}
-    uses: ./.github/workflows/build-ami-v2.yml
-    with:
-      k8s_semver:      ${{ matrix.version.k8s_semver }}
-      k8s_series:      ${{ matrix.version.k8s_series }}
-      k8s_rpm_version: ${{ matrix.version.k8s_rpm_version }}
-      k8s_deb_version: ${{ matrix.version.k8s_deb_version }}
-      cni_semver:      ${{ matrix.version.cni_semver }}
-      cni_deb_version: ${{ matrix.version.cni_deb_version }}
-      crictl_version:  ${{ matrix.version.crictl_version }}
-      regions:         "ap-south-1,eu-west-3,eu-west-2,eu-west-1,ap-northeast-2,ap-northeast-1,sa-east-1,ca-central-1,ap-southeast-1,ap-southeast-2,eu-central-1,us-east-1,us-east-2,us-west-1,us-west-2"
-    secrets: inherit
-
-  report:
-    name: Report derivation failures
-    needs: [derive, build]
-    if: always() && needs.derive.result == 'success'
-    runs-on: ubuntu-latest
-    permissions: {}
-    steps:
-      - name: Fail if any version failed to derive packer inputs
-        env:
-          FAILURES: ${{ needs.derive.outputs.failures }}
-        run: |
-          set -euo pipefail
-          if [ -z "${FAILURES}" ] || [ "${FAILURES}" = "[]" ]; then
-            echo "All target versions derived successfully."
-            exit 0
-          fi
-          echo "::error::failed to derive packer inputs for: ${FAILURES}"
-          exit 1
diff --git a/.github/workflows/build-ami-v2.yml b/.github/workflows/build-ami-v2.yml
deleted file mode 100644
index 2640bbb293..0000000000
--- a/.github/workflows/build-ami-v2.yml
+++ /dev/null
@@ -1,103 +0,0 @@
-name: build-ami-v2
-
-on:
-  workflow_call:
-    inputs:
-      image_builder_repo:
-        type: string
-        required: false
-        default: "kubernetes-sigs/image-builder"
-      image_builder_version:
-        type: string
-        required: false
-        default: "7ffb9b7f1f26cd66891874463cc9411e3633325f" # v0.1.55
-      regions:
-        type: string
-        required: false
-        default: "ap-south-1,eu-west-3,eu-west-2,eu-west-1,ap-northeast-2,ap-northeast-1,sa-east-1,ca-central-1,ap-southeast-1,ap-southeast-2,eu-central-1,us-east-1,us-east-2,us-west-1,us-west-2"
-      k8s_semver:
-        type: string
-        required: true
-      k8s_series:
-        type: string
-        required: true
-      k8s_rpm_version:
-        type: string
-        required: true
-      k8s_deb_version:
-        type: string
-        required: true
-      cni_semver:
-        type: string
-        required: true
-      cni_deb_version:
-        type: string
-        required: true
-      crictl_version:
-        type: string
-        required: true
-
-permissions:
-  id-token: write
-  contents: read
-
-env:
-  DEFAULT_REGIONS: "us-east-2"
-  AWS_ACCOUNT_ID: "819546954734"
-
-jobs:
-  buildandpublish:
-    strategy:
-      matrix:
-        target: ["ubuntu-2204", "ubuntu-2404", "flatcar"]
-      max-parallel: 1
-      fail-fast: false
-    name: Build and publish CAPA AMIs
-    runs-on: ubuntu-latest
-    steps:
-      - name: checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: ${{ inputs.image_builder_repo }}
-          ref: ${{ inputs.image_builder_version }}
-          fetch-depth: 0
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          aws-region: ${{ env.DEFAULT_REGIONS }}
-          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/gh-image-builder
-      - name: Install deps
-        run: make deps-ami
-        working-directory: ./images/capi
-      - name: Install Amazon EBS Plugin
-        working-directory: ./images/capi
-        run: ./.local/bin/packer plugins install github.com/hashicorp/amazon
-      - name: Create Packer Args
-        env:
-          K8S_RPM_VERSION: ${{ inputs.k8s_rpm_version }}
-          K8S_SEMVER: ${{ inputs.k8s_semver }}
-          K8S_SERIES: ${{ inputs.k8s_series }}
-          K8S_DEB_VERSION: ${{ inputs.k8s_deb_version }}
-          CNI_SEMVER: ${{ inputs.cni_semver }}
-          CNI_DEB_VERSION: ${{ inputs.cni_deb_version }}
-          CRICTL_VERSION: ${{ inputs.crictl_version }}
-          AMI_REGIONS: ${{ inputs.regions }}
-        run: |
-          cat > ./images/capi/vars.json << EOF
-          {
-            "kubernetes_rpm_version": "$K8S_RPM_VERSION",
-            "kubernetes_semver": "$K8S_SEMVER",
-            "kubernetes_series": "$K8S_SERIES",
-            "kubernetes_deb_version": "$K8S_DEB_VERSION",
-            "kubernetes_cni_semver": "$CNI_SEMVER",
-            "kubernetes_cni_deb_version": "$CNI_DEB_VERSION",
-            "crictl_version": "$CRICTL_VERSION",
-            "aws_region": "$DEFAULT_REGIONS",
-            "ami_regions": "$AMI_REGIONS"
-          }
-          EOF
-      - name: Show vars
-        run: cat ./images/capi/vars.json
-      - name: Build AMI
-        working-directory: ./images/capi
-        run: PACKER_VAR_FILES=vars.json make build-ami-${{ matrix.target }}
diff --git a/.github/workflows/build-ami-varsfile.yml b/.github/workflows/build-ami-varsfile.yml
deleted file mode 100644
index 034a2f781e..0000000000
--- a/.github/workflows/build-ami-varsfile.yml
+++ /dev/null
@@ -1,66 +0,0 @@
-name: build-and-publish-ami-with-vars
-
-on:
-  workflow_dispatch:
-    inputs:
-      image_builder_repo:
-        description: "Image builder repository (format: user/repo-name)"
-        required: true
-        default: "kubernetes-sigs/image-builder"
-      image_builder_version:
-        description: "Image builder version"
-        required: true
-        default: "v0.1.55"
-      target:
-        description: "target os"
-        required: true
-        type: choice
-        options:
-          - ubuntu-2204
-          - ubuntu-2404
-          - flatcar
-      packer_vars:
-        description: "Packer vars (json)"
-        type: string
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  buildandpublish:
-    name: Build and publish CAPA AMIs
-    runs-on: ubuntu-latest
-    steps:
-      - name: checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: ${{ inputs.image_builder_repo }}
-          ref: ${{ inputs.image_builder_version }}
-          fetch-depth: 0
-      - name: Create packer vars file
-        if: inputs.packer_vars != ''
-        env:
-          PACKER_VARS: ${{ inputs.packer_vars }}
-        run: |
-          echo "$PACKER_VARS" | jq -r > ./images/capi/vars.json
-          cat ./images/capi/vars.json
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          aws-region: us-east-2
-          role-to-assume: arn:aws:iam::819546954734:role/gh-image-builder
-      - name: Install deps
-        run: make deps-ami
-        working-directory: ./images/capi
-      - name: Install Amazon EBS Plugin
-        working-directory: ./images/capi
-        run: ./.local/bin/packer plugins install github.com/hashicorp/amazon
-      - name: Build AMI with vars
-        if: inputs.packer_vars != ''
-        working-directory: ./images/capi
-        run: PACKER_VAR_FILES=vars.json make build-ami-${{ inputs.target }}
-      - name: Build AMI without vars
-        if: inputs.packer_vars == ''
-        working-directory: ./images/capi
-        run: make build-ami-${{ inputs.target }}
diff --git a/.github/workflows/build-ami.yml b/.github/workflows/build-ami.yml
deleted file mode 100644
index 5d2eca173e..0000000000
--- a/.github/workflows/build-ami.yml
+++ /dev/null
@@ -1,98 +0,0 @@
-name: build-and-publish-ami
-
-on:
-  workflow_dispatch:
-    inputs:
-      image_builder_repo:
-        description: "Image builder repository (format: user/repo-name)"
-        required: true
-        default: "kubernetes-sigs/image-builder"
-      image_builder_version:
-        description: "Image builder version"
-        required: true
-        default: "v0.1.55"
-      regions:
-        description: "Publication regions"
-        required: true
-        default: "ap-south-1,eu-west-3,eu-west-2,eu-west-1,ap-northeast-2,ap-northeast-1,sa-east-1,ca-central-1,ap-southeast-1,ap-southeast-2,eu-central-1,us-east-1,us-east-2,us-west-1,us-west-2"
-      k8s_semver:
-        description: "K8s Semver"
-        required: true
-      k8s_series:
-        description: "K8s Release Series (major.minor version)"
-        required: true
-      k8s_rpm_version:
-        description: "K8s rpm package version"
-        required: true
-      k8s_deb_version:
-        description: "K8s deb package version"
-        required: true
-      cni_semver:
-        description: "CNI Semver"
-        required: true
-      cni_deb_version:
-        description: "CNI deb package version"
-        required: true
-      crictl_version:
-        description: "Crictl version"
-        required: true
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  buildandpublish:
-    strategy:
-      matrix:
-        target: ["ubuntu-2204", "ubuntu-2404", "flatcar"]
-      max-parallel: 1
-      fail-fast: false
-    name: Build and publish CAPA AMIs
-    runs-on: ubuntu-latest
-    steps:
-      - name: checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: ${{ inputs.image_builder_repo }}
-          ref: ${{ inputs.image_builder_version }}
-          fetch-depth: 0
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          aws-region: us-east-2
-          role-to-assume: arn:aws:iam::819546954734:role/gh-image-builder
-      - name: Install deps
-        run: make deps-ami
-        working-directory: ./images/capi
-      - name: Install Amazon EBS Plugin
-        working-directory: ./images/capi
-        run: ./.local/bin/packer plugins install github.com/hashicorp/amazon
-      - name: Create Packer Args
-        env:
-          K8S_RPM_VERSION: ${{ inputs.k8s_rpm_version }}
-          K8S_SEMVER: ${{ inputs.k8s_semver }}
-          K8S_SERIES: ${{ inputs.k8s_series }}
-          K8S_DEB_VERSION: ${{ inputs.k8s_deb_version }}
-          CNI_SEMVER: ${{ inputs.cni_semver }}
-          CNI_DEB_VERSION: ${{ inputs.cni_deb_version }}
-          CRICTL_VERSION: ${{ inputs.crictl_version }}
-          AMI_REGIONS: ${{ inputs.regions }}
-        run: |
-          cat > ./images/capi/vars.json << EOF
-          {
-            "kubernetes_rpm_version": "$K8S_RPM_VERSION",
-            "kubernetes_semver": "$K8S_SEMVER",
-            "kubernetes_series": "$K8S_SERIES",
-            "kubernetes_deb_version": "$K8S_DEB_VERSION",
-            "kubernetes_cni_semver": "$CNI_SEMVER",
-            "kubernetes_cni_deb_version": "$CNI_DEB_VERSION",
-            "crictl_version": "$CRICTL_VERSION",
-            "ami_regions": "$AMI_REGIONS"
-          }
-          EOF
-      - name: Show vars
-        run: cat ./images/capi/vars.json
-      - name: Build AMI
-        working-directory: ./images/capi
-        run: PACKER_VAR_FILES=vars.json make build-ami-${{ matrix.target }}
diff --git a/.github/workflows/detect-k8s-releases.yml b/.github/workflows/detect-k8s-releases.yml
deleted file mode 100644
index 2b3efbffc6..0000000000
--- a/.github/workflows/detect-k8s-releases.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: detect-k8s-releases
-
-on:
-  schedule:
-    # Runs at midnight UTC on the 1st and 15th of each month,
-    # aligned with the Kubernetes monthly patch release cadence.
-    - cron: '0 0 1,15 * *'
-  workflow_dispatch: {}
-
-env:
-  AWS_ACCOUNT_ID: "819546954734"
-  AWS_REGION: "us-east-2" # single region used for OIDC authentication
-
-jobs:
-  detect:
-    name: Detect latest K8s releases
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      id-token: write # required for OIDC authentication to AWS
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-          cache-dependency-path: hack/tools/release-tools/go.sum
-
-      - name: Build release-tool
-        working-directory: hack/tools/release-tools
-        run: go build -o ../../../bin/release-tool .
-
-      - name: Detect latest K8s release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          mkdir -p hack/tools/release-tools/internal/ami/k8srelease/data
-          ./bin/release-tool ami detect-k8s-release --token "$GITHUB_TOKEN" --latest-version-count 1 --output json > hack/tools/release-tools/internal/ami/k8srelease/data/AMIK8sBuildConfig.json
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          aws-region: ${{ env.AWS_REGION }}
-          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/gh-image-builder
-
-      - name: Generate AMI inventory report
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          K8S_CONFIG_PATH: hack/tools/release-tools/internal/ami/k8srelease/data/AMIK8sBuildConfig.json
-        run: bash scripts/generate-ami-inventory-report.sh
-
-      - name: Open PR if versions changed
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: automation/update-k8s-supported-versions
-          delete-branch: true
-          commit-message: "feat: update latest K8s version for CAPA AMIs build"
-          title: "🤖 feat: Update latest K8s version for CAPA AMIs build"
-          body: |
-            This is an automated pull request to update the latest K8s version for CAPA AMIs build.
-            - [Kubernetes latest release](https://github.com/kubernetes/kubernetes/releases)
-            - Automated update of `hack/tools/release-tools/internal/ami/k8srelease/data/AMIK8sBuildConfig.json` with the latest minor Kubernetes version and its patch releases.
-            - The update is generated by the Github Action workflow `detect-k8s-releases` using command: `release-tool ami detect-k8s-release`.
-          add-paths: |
-            hack/tools/release-tools/internal/ami/k8srelease/data/AMIK8sBuildConfig.json
-            docs/book/src/development/ami-inventory.md
diff --git a/.github/workflows/md-link-checker.yml b/.github/workflows/md-link-checker.yml
deleted file mode 100644
index 50ba9eba19..0000000000
--- a/.github/workflows/md-link-checker.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-on:
-  pull_request:
-    branches: [ main ]
-
-permissions: {}
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: artyom/mdlinks@3d49483ce078798ed3aee5abc1c65476040654dd # v0.4.2
-        with:
-          dir: 'docs/book'
diff --git a/.github/workflows/pr-gh-workflow-approve.yaml b/.github/workflows/pr-gh-workflow-approve.yaml
deleted file mode 100644
index 87b6765999..0000000000
--- a/.github/workflows/pr-gh-workflow-approve.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: PR approve GH Workflows
-
-on:
-  pull_request_target:
-    types:
-      - edited
-      - labeled
-      - reopened
-      - synchronize
-
-jobs:
-  approve:
-    name: Approve ok-to-test
-    if: contains(github.event.pull_request.labels.*.name, 'ok-to-test')
-    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-    steps:
-      - name: Update PR
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        continue-on-error: true
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const result = await github.rest.actions.listWorkflowRunsForRepo({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              event: "pull_request",
-              status: "action_required",
-              head_sha: context.payload.pull_request.head.sha,
-              per_page: 100
-            });
-
-            for (var run of result.data.workflow_runs) {
-              await github.rest.actions.approveWorkflowRun({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                run_id: run.id
-              });
-            }
diff --git a/.github/workflows/pr-golangci-lint.yaml b/.github/workflows/pr-golangci-lint.yaml
index 7cf34f6b35..3b95612595 100644
--- a/.github/workflows/pr-golangci-lint.yaml
+++ b/.github/workflows/pr-golangci-lint.yaml
@@ -1,8 +1,7 @@
 name: PR golangci-lint
 
 on:
-  pull_request:
-    types: [opened, edited, synchronize, reopened]
+  workflow_dispatch: {}
 
 # Remove all permissions from GITHUB_TOKEN except metadata.
 permissions: {}
diff --git a/.github/workflows/pr-verify.yml b/.github/workflows/pr-verify.yml
deleted file mode 100644
index 38fd4a67c2..0000000000
--- a/.github/workflows/pr-verify.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: PR verify
-
-on:
-  pull_request_target:
-    types: [opened, edited, synchronize, reopened]
-
-jobs:
-  verify:
-    runs-on: ubuntu-latest
-    name: verify PR contents
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v4.2.2
-
-    - name: Check if PR title is valid
-      env:
-        PR_TITLE: ${{ github.event.pull_request.title }}
-      run: |
-        ./hack/verify-pr-title.sh "${PR_TITLE}"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
deleted file mode 100644
index 1a05e4b2cb..0000000000
--- a/.github/workflows/release.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: release
-
-on:
-  push:
-    tags:
-    - 'v*'
-
-permissions:
-  contents: write # required to write to github release.
-
-jobs:
-  release:
-    name: Create draft release
-    runs-on: ubuntu-latest
-    steps:
-      - name: checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: '1.26'
-      - name: Set version info
-        run: |
-          echo "VERSION=${GITHUB_REF_NAME}" >> $GITHUB_ENV
-          # NB: this gets the closest tag cut from the same branch; for new minor tags, it will find the previous minor, not the previous patch release
-          # (for example v2.7.0, not v2.7.3). For new patch releases, it should fetch the previous patch (e.g. 2.7.3, not v2.7.0)
-          echo "PREVIOUS_VERSION=$(git describe --abbrev=0 2> /dev/null)" >> $GITHUB_ENV 
-          echo "RELEASE_BRANCH=release-$(echo ${GITHUB_REF_NAME} | grep -Eo '[0-9]\.[0-9]+')" >> $GITHUB_ENV
-          echo "RELEASE_TAG=${GITHUB_REF_NAME}" >> $GITHUB_ENV
-      - name: Run release
-        run: |
-          echo "Version is: $VERSION"
-          echo "Previous version is: $PREVIOUS_VERSION"
-          echo "Release branch is: $RELEASE_BRANCH"
-          echo "Release tag is: $RELEASE_TAG"
-          make release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
deleted file mode 100644
index b6622fbaf4..0000000000
--- a/.github/workflows/scan.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: scan-images
-
-on:
-  schedule:
-    # every Monday at 12:00AM
-    - cron: "0 12 * * 1"
-
-# Remove all permissions from GITHUB_TOKEN except metadata.
-permissions: {}
-
-jobs:
-  scan:
-    strategy:
-      fail-fast: false
-      matrix:
-        branch: [ main, release-2.2, release-2.1, release-2.0 ]
-    name: Trivy
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ matrix.branch }}
-      - name: Setup go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: '${{ github.workspace }}/go.mod'
-      - name: Run verify container script
-        run: make verify-container-images