diff --git a/.github/workflows/create-scratch-utils-tag.yml b/.github/workflows/create-scratch-utils-tag.yml
new file mode 100644
index 00000000..cee2ff2d
--- /dev/null
+++ b/.github/workflows/create-scratch-utils-tag.yml
@@ -0,0 +1,49 @@
+name: Create new Git tag on scratch-utils version change
+
+on:
+  # Tag a scratch-utils release when its version lands on master. The publish
+  # promotion fires on that tag, so an image tag cannot be republished with new
+  # contents -- doing so needs a new version here, which makes a new tag.
+  push:
+    branches:
+      - master
+    paths:
+      - images/calico-scratch-utils/versions.yaml
+
+jobs:
+  create-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Generate tag name
+        id: generate-tag-name
+        run: |
+          version=$(yq -r '.scratch-utils.version' images/calico-scratch-utils/versions.yaml)
+          if [ -z "$version" ] || [ "$version" = "null" ]; then
+            echo "scratch-utils.version is empty" >&2
+            exit 1
+          fi
+          # Prefixed: this repo's release tags live in the same namespace as
+          # 1.27.1-llvm21.1.8-k8s1.37.0, and a second binary here would need its own.
+          tag_name="scratch-utils-${version}"
+          echo "Git tag name: $tag_name"
+          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
+
+      - name: Create and push new tag (if not exists)
+        run: |
+          tag_name=${{ steps.generate-tag-name.outputs.tag_name }}
+          if git ls-remote --tags --refs origin "$tag_name" | grep -q "$tag_name"; then
+            echo "Git tag $tag_name already exists"
+            exit 0
+          fi
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
+          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git
+          git tag -a "$tag_name" -m "Release $tag_name"
+          git push origin "$tag_name"
+          echo "Created Git tag $tag_name"
diff --git a/.gitignore b/.gitignore
index bac9bc32..2a808d15 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 cmd/bin
 images/calico-binfmt/bin
 images/calico-go-build/bin
+images/calico-scratch-utils/bin
diff --git a/.semaphore/promotions/calico-base.yml b/.semaphore/promotions/calico-base.yml
index 5a12b8ab..708ee16d 100644
--- a/.semaphore/promotions/calico-base.yml
+++ b/.semaphore/promotions/calico-base.yml
@@ -23,7 +23,7 @@ blocks:
   - name: Publish calico/base multi-arch images
     dependencies: []
     run:
-      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+\\.\\d\\.\\d-k8s1\\.\\d+\\.\\d+'"
+      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
     task:
       env_vars:
         - name: BRANCH_NAME
diff --git a/.semaphore/promotions/calico-binfmt.yml b/.semaphore/promotions/calico-binfmt.yml
index 846d94bf..d1da08f3 100644
--- a/.semaphore/promotions/calico-binfmt.yml
+++ b/.semaphore/promotions/calico-binfmt.yml
@@ -23,7 +23,7 @@ blocks:
   - name: Publish calico/binfmt amd64 images
     dependencies: []
     run:
-      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+\\.\\d\\.\\d-k8s1\\.\\d+\\.\\d+'"
+      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
     task:
       jobs:
         - name: Linux amd64
diff --git a/.semaphore/promotions/calico-go-build.yml b/.semaphore/promotions/calico-go-build.yml
index d0c31d8d..f65c8870 100644
--- a/.semaphore/promotions/calico-go-build.yml
+++ b/.semaphore/promotions/calico-go-build.yml
@@ -28,11 +28,24 @@ global_job_config:
           export BRANCH_NAME=${SEMAPHORE_GIT_WORKING_BRANCH}
         fi
 
+# Both images cache or bake calico/go-build, so they are rebuilt once it is
+# published -- chained here rather than off the root pipeline so they cannot start
+# before the image they consume exists.
+promotions:
+  - name: Build ci-base VM image
+    pipeline_file: ci-base-vm-image.yml
+    auto_promote:
+      when: "result = 'passed' AND tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
+  - name: Build go-build preload disk image
+    pipeline_file: preload-disk-image.yml
+    auto_promote:
+      when: "result = 'passed' AND tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
+
 blocks:
   - name: Publish calico/go-build images
     dependencies: []
     run:
-      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+\\.\\d\\.\\d-k8s1\\.\\d+\\.\\d+'"
+      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
     task:
       jobs:
         - name: Linux multi-arch
@@ -45,7 +58,7 @@ blocks:
     dependencies:
       - Publish calico/go-build images
     run:
-      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+\\.\\d\\.\\d-k8s1\\.\\d+\\.\\d+'"
+      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
     task:
       jobs:
         - name: Linux multi-arch manifests
diff --git a/.semaphore/promotions/calico-scratch-utils.yml b/.semaphore/promotions/calico-scratch-utils.yml
new file mode 100644
index 00000000..b37317ec
--- /dev/null
+++ b/.semaphore/promotions/calico-scratch-utils.yml
@@ -0,0 +1,37 @@
+version: v1.0
+name: Publish calico/scratch-utils images
+agent:
+  machine:
+    type: f1-standard-2
+    os_image: ubuntu2204
+
+execution_time_limit:
+  minutes: 30
+
+global_job_config:
+  env_vars:
+    - name: DEV_REGISTRIES
+      value: calico
+  secrets:
+    - name: docker
+  prologue:
+    commands:
+      - echo $DOCKER_TOKEN | docker login --username "$DOCKER_USER" --password-stdin
+      - checkout
+      - |
+        if [ "${SEMAPHORE_GIT_REF_TYPE}" = "tag" ]; then
+          export BRANCH_NAME=${SEMAPHORE_GIT_TAG_NAME#scratch-utils-}
+        else
+          export BRANCH_NAME=${SEMAPHORE_GIT_WORKING_BRANCH}
+        fi
+
+blocks:
+  - name: Publish calico/scratch-utils amd64 images
+    dependencies: []
+    run:
+      when: "branch = 'master' OR tag =~ '^scratch-utils-v'"
+    task:
+      jobs:
+        - name: Linux amd64
+          commands:
+            - if [ -z "${SEMAPHORE_GIT_PR_NUMBER}" ]; then make -C images calico-scratch-utils-cd CONFIRM=true; fi
diff --git a/.semaphore/promotions/ci-base-vm-image.yml b/.semaphore/promotions/ci-base-vm-image.yml
new file mode 100644
index 00000000..300beae6
--- /dev/null
+++ b/.semaphore/promotions/ci-base-vm-image.yml
@@ -0,0 +1,39 @@
+version: v1.0
+name: Build ci-base VM image
+agent:
+  machine:
+    type: f1-standard-2
+    os_image: ubuntu2204
+
+execution_time_limit:
+  minutes: 30
+
+global_job_config:
+  env_vars:
+    - name: PROJECT
+      value: unique-caldron-775
+    - name: ZONE
+      value: us-central1-a
+    - name: FAMILY
+      value: ci-base
+  secrets:
+    - name: google-service-account-for-gce
+  prologue:
+    commands:
+      - export GOOGLE_APPLICATION_CREDENTIALS=$HOME/secrets/secret.google-service-account-key.json
+      - gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS
+      - gcloud config set project $PROJECT
+      - checkout
+      # build-image.sh reads the versions.yaml files with yq.
+      - which yq || (sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 && sudo chmod +x /usr/local/bin/yq)
+
+blocks:
+  - name: Build ci-base VM image
+    dependencies: []
+    run:
+      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
+    task:
+      jobs:
+        - name: build-image
+          commands:
+            - bash vm-images/ci-base/build-image.sh
diff --git a/.semaphore/promotions/preload-disk-image.yml b/.semaphore/promotions/preload-disk-image.yml
new file mode 100644
index 00000000..35fab142
--- /dev/null
+++ b/.semaphore/promotions/preload-disk-image.yml
@@ -0,0 +1,41 @@
+version: v1.0
+name: Build go-build preload disk image
+agent:
+  machine:
+    type: f1-standard-2
+    os_image: ubuntu2204
+
+execution_time_limit:
+  minutes: 30
+
+global_job_config:
+  env_vars:
+    - name: PROJECT
+      value: tigera-cc-dev
+    - name: ZONE
+      value: us-central1-a
+    - name: GCS_PATH
+      value: gs://gke-argo-disk-images-cc-dev
+  secrets:
+    - name: google-service-account-for-gce
+  prologue:
+    commands:
+      - export GOOGLE_APPLICATION_CREDENTIALS=$HOME/secrets/secret.google-service-account-key.json
+      - gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS
+      - gcloud config set project $PROJECT
+      # gke-disk-image-builder is `go run ./cli`; pick the Go the tool's go.mod needs.
+      - sem-version go 1.24
+      - checkout
+      # build-preload-disk.sh resolves the go-build tag from versions.yaml with yq.
+      - which yq || (sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 && sudo chmod +x /usr/local/bin/yq)
+
+blocks:
+  - name: Build preload disk image
+    dependencies: []
+    run:
+      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
+    task:
+      jobs:
+        - name: build-preload-disk
+          commands:
+            - bash preload-disks/ci-cache/build-preload-disk.sh
diff --git a/.semaphore/semaphore.yml b/.semaphore/semaphore.yml
index a4a7db92..f3bbdf81 100644
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@@ -29,15 +29,15 @@ promotions:
   - name: Publish calico/base images
     pipeline_file: promotions/calico-base.yml
     auto_promote:
-      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+\\.\\d\\.\\d-k8s1\\.\\d+\\.\\d+'"
+      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
   - name: Publish calico/binfmt images
     pipeline_file: promotions/calico-binfmt.yml
     auto_promote:
-      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+\\.\\d\\.\\d-k8s1\\.\\d+\\.\\d+'"
+      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
   - name: Publish calico/go-build images
     pipeline_file: promotions/calico-go-build.yml
     auto_promote:
-      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+\\.\\d\\.\\d-k8s1\\.\\d+\\.\\d+'"
+      when: "branch = 'master' OR tag =~ '^1\\.\\d+\\.\\d+-llvm\\d+(\\.\\d+){2}-k8s1\\.\\d+\\.\\d+'"
   # Publish rust-build images for master and files under images/calico-rust-build have changed.
   - name: Publish calico/rust-build images
     pipeline_file: promotions/calico-rust-build.yml
@@ -48,6 +48,13 @@ promotions:
     pipeline_file: promotions/calico-tinygo.yml
     auto_promote:
       when: "branch = 'master' AND change_in('/images/calico-tinygo/')"
+  # master publishes a moving :master, so any change ships -- including a bare
+  # go.mod bump, which no change_in path would have caught. A scratch-utils-v* tag
+  # publishes the immutable :vX.Y that workflows pin.
+  - name: Publish calico/scratch-utils images
+    pipeline_file: promotions/calico-scratch-utils.yml
+    auto_promote:
+      when: "branch = 'master' OR tag =~ '^scratch-utils-v'"
 
 blocks:
   - name: calico/go-build image
@@ -186,3 +193,22 @@ blocks:
           matrix:
             - env_var: ARCH
               values: ["amd64", "arm64"]
+
+  - name: calico/scratch-utils image
+    dependencies: []
+    task:
+      jobs:
+        - name: Build calico/scratch-utils amd64 image
+          commands:
+            - make -C images calico-scratch-utils-image ARCH=amd64
+
+  # Run in the golang image at the version versions.yaml pins, so the tests see the
+  # same Go the go-build image ships and the agent needs none of its own.
+  - name: Go unit tests
+    dependencies: []
+    task:
+      jobs:
+        - name: go test
+          commands:
+            - GO_VERSION=$(hack/generate-version-tag-name.sh -f images/calico-go-build/versions.yaml -g)
+            - docker run --rm -v "$PWD:/src" -w /src golang:${GO_VERSION} go test ./scratch-utils/... ./cmd/...
diff --git a/cmd/Makefile b/cmd/Makefile
index 5dc102a4..ff78bc69 100644
--- a/cmd/Makefile
+++ b/cmd/Makefile
@@ -9,6 +9,9 @@ QEMU_VERSION = $(shell yq -r '.qemu.version' ../images/calico-binfmt/versions.ya
 .PHONY: build
 build: bin/binfmt-$(ARCH) bin/semvalidator-$(ARCH)
 
+.PHONY: scratch-utils-build
+scratch-utils-build: bin/scratch-utils-$(ARCH)
+
 bin/binfmt-$(ARCH): binfmt/main.go
 	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) \
 		go build -o bin/binfmt-$(ARCH) -v -buildvcs=false -ldflags "-X main.revision=$(BINFMT_VERSION) -X main.qemuVersion=$(QEMU_VERSION) -s -w" binfmt/*.go
@@ -17,6 +20,15 @@ bin/semvalidator-$(ARCH): semvalidator/main.go
 	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) \
 		go build -o bin/semvalidator-$(ARCH) -v -buildvcs=false -ldflags "-s -w" semvalidator/main.go
 
+# Unlike the single-file binaries above, this one spans ../scratch-utils/, so list
+# every .go file it compiles -- otherwise an incremental build ships a stale binary.
+# := so the find runs once, not on every expansion of the prerequisite list.
+SCRATCH_UTILS_SRCS := $(shell find scratch-utils ../scratch-utils -name '*.go')
+
+bin/scratch-utils-$(ARCH): $(SCRATCH_UTILS_SRCS)
+	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) \
+		go build -o bin/scratch-utils-$(ARCH) -v -buildvcs=false -ldflags "-s -w" ./scratch-utils
+
 .PHONY: clean
 clean:
 	rm -fr bin/
diff --git a/cmd/scratch-utils/main.go b/cmd/scratch-utils/main.go
new file mode 100644
index 00000000..70e41db3
--- /dev/null
+++ b/cmd/scratch-utils/main.go
@@ -0,0 +1,53 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// Command scratch-utils bundles the CI VM helpers into one binary dispatched by
+// subcommand -- one image, different args, not four binaries:
+//
+//	scratch-utils createvm                       create the CI GCE VM (config from env)
+//	scratch-utils deletevm                       delete it by name, best-effort
+//	scratch-utils secret <ENV_VAR> <DEST_PATH>   env var -> file
+//	scratch-utils runonvm [flags] <script>       run a script on the VM over SSH
+//
+// No gcloud or bash dependency, so it runs from a distroless image. The ENTRYPOINT
+// is this binary, so a pod passes the subcommand as an ARGUMENT -- `args:
+// [createvm]`; a bare `command: [createvm]` replaces the entrypoint and fails.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/projectcalico/go-build/scratch-utils/subcmd/createvm"
+	"github.com/projectcalico/go-build/scratch-utils/subcmd/deletevm"
+	"github.com/projectcalico/go-build/scratch-utils/subcmd/runonvm"
+	"github.com/projectcalico/go-build/scratch-utils/subcmd/secret"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(2)
+	}
+	sub := os.Args[1]
+	// Each subcommand then sees its own args as os.Args[1:].
+	os.Args = append([]string{os.Args[0] + " " + sub}, os.Args[2:]...)
+
+	switch sub {
+	case "createvm":
+		os.Exit(createvm.Run())
+	case "deletevm":
+		os.Exit(deletevm.Run())
+	case "secret":
+		os.Exit(secret.Run())
+	case "runonvm":
+		os.Exit(runonvm.Run())
+	default:
+		fmt.Fprintf(os.Stderr, "scratch-utils: unknown subcommand %q\n", sub)
+		usage()
+		os.Exit(2)
+	}
+}
+
+func usage() {
+	fmt.Fprintln(os.Stderr, "usage: scratch-utils <createvm|deletevm|secret|runonvm> [args]")
+}
diff --git a/go.mod b/go.mod
index f25c486c..fcffaf40 100644
--- a/go.mod
+++ b/go.mod
@@ -8,14 +8,35 @@ require (
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.10.1
+	golang.org/x/crypto v0.55.0
+	google.golang.org/api v0.296.0
 )
 
 require (
+	cloud.google.com/go/auth v0.23.2 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
+	github.com/googleapis/gax-go/v2 v2.24.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/tonistiigi/go-archvariant v1.0.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
 	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
 	go.opentelemetry.io/otel/trace v1.45.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 )
diff --git a/go.sum b/go.sum
index bad28fbc..82902463 100644
--- a/go.sum
+++ b/go.sum
@@ -1,11 +1,34 @@
+cloud.google.com/go/auth v0.23.2 h1:pxSCpfiji41hpzpPdMCftEUCezpgpqmmDdYiAjCKXxo=
+cloud.google.com/go/auth v0.23.2/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
+cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
+cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v1.0.0-rc.5 h1:vXd569rDrz8LeMXzAnBsy6LADV5YtsD8oyaRarxdmSU=
 github.com/containerd/platforms v1.0.0-rc.5/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.20 h1:t/xL64VUoN69MuMRQuJETqYGOw4Z9mSRJK9epIEtwFk=
+github.com/googleapis/enterprise-certificate-proxy v0.3.20/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=
+github.com/googleapis/gax-go/v2 v2.24.0 h1:myMaPYyF9MecEmvQqMqomIwn9t/4KCZN9qnwsS76wlg=
+github.com/googleapis/gax-go/v2 v2.24.0/go.mod h1:IaTHBDd7NHxSCiu0vEs8pQZu4dGZrWwuSoxCnk16OFM=
 github.com/moby/buildkit v0.32.2 h1:Sfy7+u6dUv/2yuBc9KCoK70Re8atuV8aPZ5UOC068Vc=
 github.com/moby/buildkit v0.32.2/go.mod h1:0GB/EJ1d+4VIVqIAgy3asaoGkVXy7IrDfVy7mPhOvg8=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -20,11 +43,47 @@ github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8
 github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=
 github.com/tonistiigi/go-archvariant v1.0.0 h1:5LC1eDWiBNflnTF1prCiX09yfNHIxDC/aukdhCdTyb0=
 github.com/tonistiigi/go-archvariant v1.0.0/go.mod h1:TxFmO5VS6vMq2kvs3ht04iPXtu2rUT/erOnGFYfk5Ho=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
 go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
 go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
 go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
 go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/api v0.296.0 h1:Nn5EHeKdGx70MFClaV/II0gsWUm6xhEjb0xYLylVvaA=
+google.golang.org/api v0.296.0/go.mod h1:02qB8+Ox1ZFzcaKFMguy1nQLJmSIyvV6Ff4txJEXtl4=
+google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms=
+google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU=
+google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d h1:QwnJwPte4XXAkhPu26LTDIahnsMSUV0kK8HkxbC+Pc4=
+google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d/go.mod h1:WRrQ7/7N19PypuT0fxLOL5Lq0waoiRri4FbtHDEKrGE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/hack/generate-image-name.sh b/hack/generate-image-name.sh
new file mode 100755
index 00000000..74ab5933
--- /dev/null
+++ b/hack/generate-image-name.sh
@@ -0,0 +1,78 @@
+#!/bin/bash
+# Name a GCE image after the go-build release it corresponds to, so the two are
+# matchable by eye. Tag builds use the git tag, everything else the branch --
+# matching calico-go-build-cd, and the tag is the only place the re-release suffix
+# (-1, -2) lives.
+#
+#   tag 1.27.0-llvm21.1.8-k8s1.37.0-1  ->  ci-base-1-27-0-llvm21-1-8-k8s1-37-0-1
+#   branch go1.27                      ->  ci-base-go1-27
+#
+# Dots and other illegal characters become hyphens (GCE names are RFC1035, 63 max).
+# -m caps it lower: GKE allows 39 for a secondary boot disk and only enforces that
+# when a node pool attaches the image, long after it built.
+#
+#   generate-image-name.sh -p ci-base [-f versions.yaml] [-m 39]
+
+set -eu
+
+prefix=""
+ver_file=""
+max_len=63
+
+while getopts ":p:f:m:" opt; do
+    case $opt in
+    p) prefix="$OPTARG" ;;
+    f) ver_file="$OPTARG" ;;
+    m) max_len="$OPTARG" ;;
+    :)
+        echo "option: -$OPTARG requires an argument" >&2
+        exit 1
+        ;;
+    *)
+        echo "invalid option: -$OPTARG" >&2
+        exit 1
+        ;;
+    esac
+done
+
+if [[ -z $prefix ]]; then
+    echo "-p <prefix> is required" >&2
+    exit 1
+fi
+
+here="$(cd "$(dirname "$0")" && pwd)"
+: "${ver_file:=$here/../images/calico-go-build/versions.yaml}"
+
+# Same precedence as calico-go-build-cd's BRANCH_NAME.
+if [[ ${SEMAPHORE_GIT_REF_TYPE:-} == "tag" && -n ${SEMAPHORE_GIT_TAG_NAME:-} ]]; then
+    version="${SEMAPHORE_GIT_TAG_NAME}"
+elif [[ -n ${SEMAPHORE_GIT_WORKING_BRANCH:-} ]]; then
+    version="${SEMAPHORE_GIT_WORKING_BRANCH}"
+elif branch="$(git -C "$here" rev-parse --abbrev-ref HEAD 2>/dev/null)" && [[ -n $branch && $branch != "HEAD" ]]; then
+    version="$branch" # local run
+else
+    version="$("$here/generate-version-tag-name.sh" -f "$ver_file")" # detached HEAD
+fi
+
+# Fold to a legal RFC1035 tail: no runs of hyphens, none leading or trailing.
+version="$(echo "$version" |
+    tr '[:upper:]' '[:lower:]' |
+    sed -e 's/[^a-z0-9-]/-/g' -e 's/--*/-/g' -e 's/^-//' -e 's/-$//')"
+
+if [[ -z $version ]]; then
+    echo "version/branch reduced to an empty string" >&2
+    exit 1
+fi
+
+name="${prefix}-${version}"
+
+if [[ ${#name} -gt $max_len ]]; then
+    echo "image name is ${#name} characters, over the limit of ${max_len}: $name" >&2
+    exit 1
+fi
+if ! [[ $name =~ ^[a-z]([-a-z0-9]*[a-z0-9])?$ ]]; then
+    echo "not a valid GCE resource name: $name" >&2
+    exit 1
+fi
+
+echo "$name"
diff --git a/images/Makefile b/images/Makefile
index 1a54d6f5..cc21b0aa 100644
--- a/images/Makefile
+++ b/images/Makefile
@@ -6,6 +6,7 @@ CALICO_BINFMT ?= binfmt
 CALICO_GO_BUILD ?= go-build
 CALICO_RUST_BUILD ?= rust-build
 CALICO_TINYGO ?= tinygo
+CALICO_SCRATCH_UTILS ?= scratch-utils
 
 .PHONY: build
 build:
@@ -14,11 +15,19 @@ build:
 	cp ../cmd/bin/binfmt-$(ARCH) calico-binfmt/bin/binfmt-$(ARCH)
 	cp ../cmd/bin/semvalidator-$(ARCH) calico-go-build/bin/semvalidator-$(ARCH)
 
+# Separate so the go-build and binfmt images do not compile the GCP SDK to build
+# a binary they never contain.
+.PHONY: scratch-utils-build
+scratch-utils-build:
+	$(MAKE) -C ../cmd scratch-utils-build
+	mkdir -p calico-scratch-utils/bin/
+	cp ../cmd/bin/scratch-utils-$(ARCH) calico-scratch-utils/bin/scratch-utils-$(ARCH)
+
 .PHONY: image
-image: calico-base-image calico-binfmt-image calico-go-build-image calico-rust-build-image calico-tinygo-image
+image: calico-base-image calico-binfmt-image calico-go-build-image calico-rust-build-image calico-tinygo-image calico-scratch-utils-image
 
 .PHONY: image-all
-image-all: calico-base-image-all calico-binfmt-image calico-go-build-image-all calico-rust-build-image-all calico-tinygo-image-all
+image-all: calico-base-image-all calico-binfmt-image calico-go-build-image-all calico-rust-build-image-all calico-tinygo-image-all calico-scratch-utils-image
 
 ################################################################################
 # Base image for all Calico components.
@@ -103,6 +112,28 @@ calico-binfmt-image: build
 calico-binfmt-cd: calico-binfmt-image var-require-one-of-CONFIRM-DRYRUN
 	$(MAKE) BUILD_IMAGES=$(CALICO_BINFMT) retag-build-images-with-registries push-images-to-registries IMAGETAG=$(CALICO_BINFMT_IMAGETAG) LATEST_IMAGE_TAG=$(CALICO_BINFMT_IMAGETAG) VALIDARCHES=amd64 EXCLUDEARCH="$(EXCLUDEARCH)"
 
+################################################################################
+# Calico scratch-utils image: the CI VM lifecycle binary.
+################################################################################
+
+CALICO_SCRATCH_UTILS_IMAGETAG ?= $(shell yq -r '.scratch-utils.version' calico-scratch-utils/versions.yaml)
+
+# amd64 only, like binfmt: the runners and the GCE VMs are x86_64.
+.PHONY: calico-scratch-utils-image
+calico-scratch-utils-image: scratch-utils-build
+	$(DOCKER_BUILD) -t $(CALICO_SCRATCH_UTILS):$(CALICO_SCRATCH_UTILS_IMAGETAG)-amd64 -f calico-scratch-utils/Dockerfile calico-scratch-utils/
+	$(MAKE) BUILD_IMAGES=$(CALICO_SCRATCH_UTILS) retag-build-images-with-registries VALIDARCHES=amd64 LATEST_IMAGE_TAG=$(CALICO_SCRATCH_UTILS_IMAGETAG) IMAGETAG=$(CALICO_SCRATCH_UTILS_IMAGETAG)
+
+# IMAGETAG is the pushed tag, LATEST_IMAGE_TAG the local one built above. A tag
+# build pushes the immutable :vX.Y (BRANCH_NAME is the stripped git tag); master
+# pushes the moving :master and :latest.
+.PHONY: calico-scratch-utils-cd
+calico-scratch-utils-cd: calico-scratch-utils-image var-require-one-of-CONFIRM-DRYRUN var-require-all-BRANCH_NAME
+	$(MAKE) BUILD_IMAGES=$(CALICO_SCRATCH_UTILS) retag-build-images-with-registries push-images-to-registries IMAGETAG=$(BRANCH_NAME) LATEST_IMAGE_TAG=$(CALICO_SCRATCH_UTILS_IMAGETAG) VALIDARCHES=amd64 EXCLUDEARCH="$(EXCLUDEARCH)"
+ifeq ($(BRANCH_NAME),master)
+	$(MAKE) BUILD_IMAGES=$(CALICO_SCRATCH_UTILS) retag-build-images-with-registries push-images-to-registries IMAGETAG=latest LATEST_IMAGE_TAG=$(CALICO_SCRATCH_UTILS_IMAGETAG) VALIDARCHES=amd64 EXCLUDEARCH="$(EXCLUDEARCH)"
+endif
+
 ################################################################################
 # Calico rust-build image with Rust toolchain.
 ################################################################################
diff --git a/images/calico-scratch-utils/Dockerfile b/images/calico-scratch-utils/Dockerfile
new file mode 100644
index 00000000..ffaa8bf6
--- /dev/null
+++ b/images/calico-scratch-utils/Dockerfile
@@ -0,0 +1,25 @@
+# The static scratch-utils binary on scratch. Beyond itself it needs exactly two
+# things, so they are prepared from UBI the same way calico-base builds its rootfs:
+# a TLS trust store (every GCP API call fails without one) and a writable /tmp
+# (the compute SA key is written there). No shell, no package manager -- workflow
+# steps run `scratch-utils <subcommand>` directly. The binary is built by ../cmd
+# and copied in by images/Makefile; this Dockerfile does no compilation.
+ARG UBI_VERSION=ubi9
+
+FROM registry.access.redhat.com/${UBI_VERSION}/ubi-minimal:latest AS rootfs
+RUN mkdir -p /rootfs/etc/ssl/certs /rootfs/tmp \
+    && cp /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
+          /rootfs/etc/ssl/certs/ca-certificates.crt \
+    && chmod 1777 /rootfs/tmp
+
+FROM scratch
+
+ARG TARGETARCH
+
+COPY --from=rootfs /rootfs /
+COPY bin/scratch-utils-${TARGETARCH} /usr/local/bin/scratch-utils
+
+# Numeric so no /etc/passwd is needed; same uid distroless nonroot uses.
+USER 65532
+
+ENTRYPOINT ["/usr/local/bin/scratch-utils"]
diff --git a/images/calico-scratch-utils/versions.yaml b/images/calico-scratch-utils/versions.yaml
new file mode 100644
index 00000000..3cefbfd8
--- /dev/null
+++ b/images/calico-scratch-utils/versions.yaml
@@ -0,0 +1,4 @@
+# Image tag (calico/scratch-utils:<version>). Bump on a behaviour change to the
+# binary; workflow steps pin this tag.
+scratch-utils:
+  version: v0.4
diff --git a/preload-disks/ci-cache/build-preload-disk.sh b/preload-disks/ci-cache/build-preload-disk.sh
new file mode 100755
index 00000000..36a03a3a
--- /dev/null
+++ b/preload-disks/ci-cache/build-preload-disk.sh
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Tigera, Inc. All rights reserved.
+#
+# Build a GKE secondary-boot-disk image with the images CI pulls most already on
+# it, so pods skip the pull. Wraps Google's gke-disk-image-builder.
+#
+#   PROJECT=tigera-cc-dev GCS_PATH=gs://<bucket> ./build-preload-disk.sh
+#
+# Needs gcloud, git, yq and a Go toolchain. ~5-8 min. Attach the result at node
+# pool CREATE time (there is no update flag for it), with image streaming on:
+#
+#   gcloud container node-pools create <pool> --cluster=<c> --location=<l> \
+#     --enable-image-streaming \
+#     --secondary-boot-disk=disk-image=projects/$PROJECT/global/images/<IMAGE>,mode=CONTAINER_IMAGE_CACHE
+#
+# A cluster in another project needs roles/compute.imageUser on this one for BOTH
+# its default compute SA and its service-<num>@container-engine-robot SA. Missing
+# either fails NODE creation, not pool creation, so it surfaces far from the cause.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+command -v yq >/dev/null || { echo "yq is required to read the pinned versions" >&2; exit 1; }
+
+# The clusters' own project: cross-project works but needs the IAM noted above.
+PROJECT="${PROJECT:-tigera-cc-dev}"
+ZONE="${ZONE:-us-central1-a}"
+# A node pool pins this exact name. GKE caps it at 39 chars (GCE allows 63) and
+# only enforces that on attach, so -m fails here instead. "cic" rather than
+# "ci-cache" because the full go-build tag needs the room: a release-candidate tag
+# is 34 characters on its own.
+IMAGE_NAME="${IMAGE_NAME:-$("$REPO/hack/generate-image-name.sh" -p cic -m 39)}"
+DISK_SIZE_GB="${DISK_SIZE_GB:-20}"
+# Override where "default" is a legacy network with no subnets (unique-caldron-775
+# is one): the builder demands a subnetwork and fails validation without it.
+NETWORK="${NETWORK:-default}"
+SUBNET="${SUBNET:-default}"
+GCS_PATH="${GCS_PATH:?set GCS_PATH to a gs:// bucket/path for the builder logs}"
+# Space-separated, each with a tag or digest: the cache hits only the exact ref a
+# pod requests, so a floating tag caches nothing. Add anything CI pulls often; the
+# default is this repo's go-build image, resolved so it cannot drift.
+if [ -z "${CONTAINER_IMAGES:-}" ]; then
+  go_build_tag="$("$REPO/hack/generate-version-tag-name.sh" -f "$REPO/images/calico-go-build/versions.yaml")"
+  CONTAINER_IMAGES="docker.io/calico/go-build:${go_build_tag}"
+fi
+# Pinned in versions.yaml; a branch or tag also works, for testing upstream.
+AI_ON_GKE_REF="${AI_ON_GKE_REF:-$(yq -r '.ai-on-gke.ref' "$HERE/versions.yaml")}"
+
+log() { echo "[preload-disk] $*"; }
+
+workdir="$(mktemp -d)"
+trap 'rm -rf "$workdir"' EXIT INT TERM
+
+# Not `clone --branch`: that cannot check out a bare commit. This accepts any ref.
+log "fetching gke-disk-image-builder (ai-on-gke/tools @ ${AI_ON_GKE_REF})"
+git init -q "$workdir/tools"
+git -C "$workdir/tools" remote add origin https://github.com/ai-on-gke/tools.git
+git -C "$workdir/tools" sparse-checkout init --cone
+git -C "$workdir/tools" sparse-checkout set gke-disk-image-builder
+git -C "$workdir/tools" fetch -q --depth 1 --filter=blob:none origin "$AI_ON_GKE_REF"
+git -C "$workdir/tools" checkout -q FETCH_HEAD
+log "builder at $(git -C "$workdir/tools" rev-parse HEAD)"
+
+args=(
+  --project-name="$PROJECT"
+  --image-name="$IMAGE_NAME"
+  --zone="$ZONE"
+  --gcs-path="$GCS_PATH"
+  --disk-size-gb="$DISK_SIZE_GB"
+  --network="$NETWORK"
+  --subnet="$SUBNET"
+)
+for img in $CONTAINER_IMAGES; do args+=(--container-image="$img"); done
+
+# Release images are immutable; branch images are replaced. A pool stores the image
+# PATH, not an id, so a same-name recreate leaves its config valid.
+if gcloud compute images describe "$IMAGE_NAME" --project="$PROJECT" >/dev/null 2>&1; then
+  if [ "${SEMAPHORE_GIT_REF_TYPE:-}" = "tag" ]; then
+    log "image $IMAGE_NAME already exists in $PROJECT -- this release is already built."
+    log "to rebuild it: gcloud compute images delete $IMAGE_NAME --project=$PROJECT"
+    log "or set IMAGE_NAME=<name> to build under a different name."
+    exit 1
+  fi
+  log "replacing existing branch image $IMAGE_NAME"
+  log "note: existing nodes keep their copy (the disk attaches at node creation)."
+  log "      Only nodes created before this build finishes miss the cache."
+  gcloud --quiet compute images delete "$IMAGE_NAME" --project="$PROJECT"
+fi
+
+log "building disk image ${IMAGE_NAME} in ${PROJECT} (network ${NETWORK}/${SUBNET})"
+log "preloading: ${CONTAINER_IMAGES}"
+( cd "$workdir/tools/gke-disk-image-builder" && go run ./cli "${args[@]}" )
+
+log "done: image ${IMAGE_NAME} (project ${PROJECT}, ${#IMAGE_NAME}/39 chars)"
diff --git a/preload-disks/ci-cache/versions.yaml b/preload-disks/ci-cache/versions.yaml
new file mode 100644
index 00000000..be7050f5
--- /dev/null
+++ b/preload-disks/ci-cache/versions.yaml
@@ -0,0 +1,10 @@
+# Upstream ref for the gke-disk-image-builder that build-preload-disk.sh fetches.
+#
+# Not a Go module dependency: ai-on-gke/tools still declares the old
+# GoogleCloudPlatform/ai-on-gke path in its go.mod and the directory was deleted
+# from that repo, so `go get` reaches only an abandoned 2023 snapshot.
+#
+# A commit, not a branch: this runs on every go-build release, and `main` moving
+# would mean two releases building disks with different builder code.
+ai-on-gke:
+  ref: 462a06c810c00868514edadf8adfd149ea1d6943
diff --git a/scratch-utils/gce/retry.go b/scratch-utils/gce/retry.go
new file mode 100644
index 00000000..2cbe08c8
--- /dev/null
+++ b/scratch-utils/gce/retry.go
@@ -0,0 +1,90 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package gce
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"google.golang.org/api/googleapi"
+)
+
+// retryBackoff is the first inter-attempt delay (doubled each retry). A package
+// var so tests can shrink it.
+var retryBackoff = time.Second
+
+// retry runs fn with exponential backoff on transient errors -- GCE control-plane
+// calls occasionally drop the HTTP/2 connection or return a 429/5xx. Permanent
+// errors return at once. Every error is wrapped with what, including those, or a
+// 404 would arrive with nothing identifying the call.
+func retry(ctx context.Context, what string, fn func() error) error {
+	const attempts = 4
+	backoff := retryBackoff
+	var err error
+	for i := 0; i < attempts; i++ {
+		if err = fn(); err == nil {
+			return nil
+		}
+		if !isTransient(err) {
+			return fmt.Errorf("%s: %w", what, err)
+		}
+		if i == attempts-1 {
+			break
+		}
+		select {
+		case <-ctx.Done():
+			// Name the last failure: a bare deadline says nothing about why.
+			return fmt.Errorf("%s: %w (last attempt: %v)", what, ctx.Err(), err)
+		case <-time.After(backoff):
+		}
+		backoff *= 2
+	}
+	return fmt.Errorf("%s: giving up after %d attempts: %w", what, attempts, err)
+}
+
+// errNotReady marks a condition that simply has not happened yet -- a field GCE
+// populates asynchronously. Retrying is the whole point, so it counts as transient.
+var errNotReady = errors.New("not ready yet")
+
+// isTransient reports whether err is worth retrying: a rate-limit/server error
+// from the API, a network timeout, or one of the transport-level drops that
+// surface as a plain error string (the HTTP/2 connection-lost flake among them).
+func isTransient(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, errNotReady) {
+		return true
+	}
+	var gerr *googleapi.Error
+	if errors.As(err, &gerr) {
+		switch gerr.Code {
+		case 429, 500, 502, 503, 504:
+			return true
+		}
+	}
+	var nerr net.Error
+	if errors.As(err, &nerr) && nerr.Timeout() {
+		return true
+	}
+	msg := err.Error()
+	for _, m := range []string{
+		"http2: client connection lost",
+		"connection reset",
+		"connection refused",
+		"unexpected EOF",
+		"i/o timeout",
+		"TLS handshake",
+		"server closed idle connection",
+		"broken pipe",
+	} {
+		if strings.Contains(msg, m) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/scratch-utils/gce/retry_test.go b/scratch-utils/gce/retry_test.go
new file mode 100644
index 00000000..83aba5cd
--- /dev/null
+++ b/scratch-utils/gce/retry_test.go
@@ -0,0 +1,165 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package gce
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"testing"
+	"time"
+
+	"google.golang.org/api/googleapi"
+)
+
+func TestIsTransient(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"nil", nil, false},
+		{"http2 connection lost", fmt.Errorf("Post ...: %w", errors.New("http2: client connection lost")), true},
+		{"connection reset", errors.New("read tcp: connection reset by peer"), true},
+		{"googleapi 503", &googleapi.Error{Code: 503}, true},
+		{"googleapi 429", &googleapi.Error{Code: 429}, true},
+		{"googleapi 404 (permanent)", &googleapi.Error{Code: 404}, false},
+		{"net timeout", timeoutErr{}, true},
+		{"plain permanent", errors.New("instance not found"), false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isTransient(tc.err); got != tc.want {
+				t.Fatalf("isTransient(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestRetry(t *testing.T) {
+	orig := retryBackoff
+	retryBackoff = time.Millisecond
+	defer func() { retryBackoff = orig }()
+
+	transient := errors.New("http2: client connection lost")
+
+	t.Run("succeeds immediately", func(t *testing.T) {
+		calls := 0
+		err := retry(context.Background(), "op", func() error { calls++; return nil })
+		if err != nil || calls != 1 {
+			t.Fatalf("err=%v calls=%d, want nil/1", err, calls)
+		}
+	})
+
+	t.Run("permanent error returns at once", func(t *testing.T) {
+		calls := 0
+		permanent := errors.New("not found")
+		err := retry(context.Background(), "op", func() error { calls++; return permanent })
+		if !errors.Is(err, permanent) || calls != 1 {
+			t.Fatalf("err=%v calls=%d, want permanent/1", err, calls)
+		}
+	})
+
+	t.Run("transient then success", func(t *testing.T) {
+		calls := 0
+		err := retry(context.Background(), "op", func() error {
+			calls++
+			if calls < 3 {
+				return transient
+			}
+			return nil
+		})
+		if err != nil || calls != 3 {
+			t.Fatalf("err=%v calls=%d, want nil/3", err, calls)
+		}
+	})
+
+	t.Run("gives up after all attempts", func(t *testing.T) {
+		calls := 0
+		err := retry(context.Background(), "op", func() error { calls++; return transient })
+		if !errors.Is(err, transient) || calls != 4 {
+			t.Fatalf("err=%v calls=%d, want transient/4", err, calls)
+		}
+	})
+
+	t.Run("honours context cancellation", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		calls := 0
+		err := retry(ctx, "op", func() error { calls++; return transient })
+		if !errors.Is(err, context.Canceled) {
+			t.Fatalf("err=%v, want context.Canceled", err)
+		}
+	})
+}
+
+// timeoutErr is a net.Error that reports a timeout, for the isTransient table.
+type timeoutErr struct{}
+
+func (timeoutErr) Error() string   { return "i/o deadline" }
+func (timeoutErr) Timeout() bool   { return true }
+func (timeoutErr) Temporary() bool { return true }
+
+var _ net.Error = timeoutErr{}
+
+// The callers pass their whole message as what ("get instance vm-1"), so an error
+// returned bare would leave a 404 with nothing identifying the call. This applies
+// to the permanent path especially -- that is the common failure.
+func TestRetryWrapsEveryErrorWithWhat(t *testing.T) {
+	old := retryBackoff
+	retryBackoff = time.Millisecond
+	defer func() { retryBackoff = old }()
+
+	t.Run("permanent", func(t *testing.T) {
+		err := retry(context.Background(), "get instance vm-1", func() error {
+			return errors.New("googleapi: Error 404: not found")
+		})
+		if err == nil || !strings.Contains(err.Error(), "get instance vm-1") {
+			t.Fatalf("want the call named, got: %v", err)
+		}
+	})
+
+	t.Run("exhausted", func(t *testing.T) {
+		err := retry(context.Background(), "set metadata on vm-1", func() error {
+			return errors.New("http2: client connection lost")
+		})
+		if err == nil || !strings.Contains(err.Error(), "set metadata on vm-1") {
+			t.Fatalf("want the call named, got: %v", err)
+		}
+	})
+
+	t.Run("context cancelled keeps both the deadline and the last failure", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Millisecond)
+		defer cancel()
+		err := retry(ctx, "wait op op-9", func() error {
+			return errors.New("http2: client connection lost")
+		})
+		if err == nil {
+			t.Fatal("want error")
+		}
+		if !errors.Is(err, context.DeadlineExceeded) {
+			t.Errorf("errors.Is(DeadlineExceeded) must still hold: %v", err)
+		}
+		for _, want := range []string{"wait op op-9", "http2: client connection lost"} {
+			if !strings.Contains(err.Error(), want) {
+				t.Errorf("error should mention %q, got: %v", want, err)
+			}
+		}
+	})
+}
+
+// errNotReady exists so a field GCE populates asynchronously (an external IP on a
+// freshly created VM) is retried rather than reported as a terminal failure.
+func TestErrNotReadyIsTransient(t *testing.T) {
+	if !isTransient(errNotReady) {
+		t.Error("bare errNotReady must be transient")
+	}
+	if !isTransient(fmt.Errorf("external IP of vm-1: %w", errNotReady)) {
+		t.Error("wrapped errNotReady must be transient")
+	}
+	if isTransient(errors.New("not ready yet")) {
+		t.Error("an unrelated error with the same text must not be transient")
+	}
+}
diff --git a/scratch-utils/gce/ssh.go b/scratch-utils/gce/ssh.go
new file mode 100644
index 00000000..5e7e61db
--- /dev/null
+++ b/scratch-utils/gce/ssh.go
@@ -0,0 +1,413 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// SSH access to a GCE VM without gcloud: an ephemeral keypair goes in as the
+// instance's `ssh-keys` metadata (the guest agent installs it), the external IP
+// comes from the instance, and the connection is a plain x/crypto/ssh dial. This
+// is what lets the run step drive the VM from the same distroless image.
+package gce
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+	compute "google.golang.org/api/compute/v1"
+
+	"github.com/projectcalico/go-build/scratch-utils/util"
+)
+
+// SSH is a live connection to a VM. Close it when done.
+type SSH struct {
+	client *ssh.Client
+}
+
+// DialSSH injects an ephemeral keypair, reads the external IP and dials, retrying
+// until reachable -- a fresh VM accepts SSH only once sshd, the guest agent and
+// the key have caught up. This retry is the readiness check createvm skips. The
+// host key is not verified: we just made the VM, it lives for minutes, and there
+// is no prior key to pin.
+func (c *Client) DialSSH(ctx context.Context, zone, name, user string) (*SSH, error) {
+	signer, authorized, err := ephemeralKey()
+	if err != nil {
+		return nil, err
+	}
+	ip, err := c.injectKeyAndGetIP(ctx, zone, name, user, authorized)
+	if err != nil {
+		return nil, err
+	}
+
+	cfg := &ssh.ClientConfig{
+		User:            user,
+		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), //nolint:gosec // ephemeral CI VM, no key to pin
+		Timeout:         10 * time.Second,
+	}
+	addr := net.JoinHostPort(ip, "22")
+
+	deadline := time.Now().Add(3 * time.Minute)
+	var lastErr error
+	for time.Now().Before(deadline) {
+		client, err := dial(addr, cfg)
+		if err == nil {
+			go keepalive(client)
+			return &SSH{client: client}, nil
+		}
+		lastErr = err
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-time.After(5 * time.Second):
+		}
+	}
+	return nil, fmt.Errorf("ssh to %s (%s) not ready after 3m: %w", name, addr, lastErr)
+}
+
+// dial bounds the handshake, not just the connect. ssh.Dial leaves NewClientConn
+// with no deadline, so a VM whose sshd has bound the socket but is not answering
+// stalls forever -- the exact state the retry loop above exists for, and it would
+// never get back there.
+func dial(addr string, cfg *ssh.ClientConfig) (*ssh.Client, error) {
+	conn, err := net.DialTimeout("tcp", addr, cfg.Timeout)
+	if err != nil {
+		return nil, err
+	}
+	if err := conn.SetDeadline(time.Now().Add(cfg.Timeout)); err != nil {
+		conn.Close()
+		return nil, err
+	}
+	c, chans, reqs, err := ssh.NewClientConn(conn, addr, cfg)
+	if err != nil {
+		conn.Close()
+		return nil, err
+	}
+	// Clear it again: the deadline covered the handshake, and the session that
+	// follows carries a CI job of unbounded length.
+	if err := conn.SetDeadline(time.Time{}); err != nil {
+		c.Close()
+		return nil, err
+	}
+	return ssh.NewClient(c, chans, reqs), nil
+}
+
+// keepalive stops GCP reaping the connection: a VPC drops an idle established flow
+// after 10 minutes, untunable, and x/crypto/ssh sends nothing itself. A quiet
+// stretch in the job would otherwise kill the session and the artifact pull with it.
+func keepalive(client *ssh.Client) {
+	t := time.NewTicker(60 * time.Second)
+	defer t.Stop()
+	for range t.C {
+		if _, _, err := client.SendRequest("keepalive@openssh.com", true, nil); err != nil {
+			return // connection is gone; Run/GetDir will report it
+		}
+	}
+}
+
+// injectKeyAndGetIP sets the instance's ssh-keys metadata to authorize user with
+// the given key (preserving any other metadata) and returns its external IP.
+func (c *Client) injectKeyAndGetIP(ctx context.Context, zone, name, user, authorized string) (string, error) {
+	var inst *compute.Instance
+	if err := retry(ctx, "get instance "+name, func() (err error) {
+		inst, err = c.svc.Instances.Get(c.project, zone, name).Context(ctx).Do()
+		return err
+	}); err != nil {
+		return "", err
+	}
+
+	md := inst.Metadata
+	if md == nil {
+		md = &compute.Metadata{}
+	}
+	sshKeys := fmt.Sprintf("%s:%s", user, strings.TrimSpace(authorized))
+	replaced := false
+	for _, it := range md.Items {
+		if it.Key == "ssh-keys" {
+			it.Value = strPtr(sshKeys)
+			replaced = true
+			break
+		}
+	}
+	if !replaced {
+		md.Items = append(md.Items, &compute.MetadataItems{Key: "ssh-keys", Value: strPtr(sshKeys)})
+	}
+	var op *compute.Operation
+	if err := retry(ctx, "set ssh-keys metadata on "+name, func() (err error) {
+		op, err = c.svc.Instances.SetMetadata(c.project, zone, name, md).Context(ctx).Do()
+		return err
+	}); err != nil {
+		return "", err
+	}
+	if err := c.waitZoneOp(ctx, zone, op.Name); err != nil {
+		return "", fmt.Errorf("set-metadata op on %s: %w", name, err)
+	}
+
+	// Re-read rather than reuse the snapshot from before the metadata op: createvm
+	// does not wait for readiness, so natIP can still be unset when the insert
+	// reaches DONE, and it appears seconds later. Retried for the same reason.
+	var ip string
+	if err := retry(ctx, "external IP of "+name, func() error {
+		fresh, err := c.svc.Instances.Get(c.project, zone, name).Context(ctx).Do()
+		if err != nil {
+			return err
+		}
+		if ip = externalIP(fresh); ip == "" {
+			return fmt.Errorf("external IP of %s: %w", name, errNotReady)
+		}
+		return nil
+	}); err != nil {
+		return "", err
+	}
+	return ip, nil
+}
+
+func externalIP(inst *compute.Instance) string {
+	for _, ni := range inst.NetworkInterfaces {
+		for _, ac := range ni.AccessConfigs {
+			if ac.NatIP != "" {
+				return ac.NatIP
+			}
+		}
+	}
+	return ""
+}
+
+// ephemeralKey returns an ssh signer and its authorized_keys line.
+func ephemeralKey() (ssh.Signer, string, error) {
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, "", fmt.Errorf("generate key: %w", err)
+	}
+	signer, err := ssh.NewSignerFromKey(priv)
+	if err != nil {
+		return nil, "", fmt.Errorf("signer: %w", err)
+	}
+	sshPub, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		return nil, "", fmt.Errorf("public key: %w", err)
+	}
+	return signer, string(ssh.MarshalAuthorizedKey(sshPub)), nil
+}
+
+// Close closes the underlying connection.
+func (s *SSH) Close() error { return s.client.Close() }
+
+// Run executes cmd on the VM, streaming output to the given writers. A non-zero
+// exit comes back as exitCode with a nil error so the caller can propagate it;
+// err is non-nil only for a connection or protocol failure.
+func (s *SSH) Run(cmd string, stdout, stderr io.Writer) (exitCode int, err error) {
+	sess, err := s.client.NewSession()
+	if err != nil {
+		return -1, err
+	}
+	defer sess.Close()
+	sess.Stdout = stdout
+	sess.Stderr = stderr
+	if err := sess.Run(cmd); err != nil {
+		var ee *ssh.ExitError
+		if errors.As(err, &ee) {
+			return ee.ExitStatus(), nil
+		}
+		return -1, err
+	}
+	return 0, nil
+}
+
+// PutData writes data to remote at the given mode, creating parent dirs.
+func (s *SSH) PutData(data []byte, remote string, mode os.FileMode) error {
+	sess, err := s.client.NewSession()
+	if err != nil {
+		return err
+	}
+	defer sess.Close()
+	sess.Stdin = bytes.NewReader(data)
+	// Capture remote stderr so a failing mkdir/chmod says why.
+	var errBuf bytes.Buffer
+	sess.Stderr = &errBuf
+	// Single-quoted, not %q: %q is double-quoted, and bash expands $(...) inside
+	// double quotes, so a crafted remote path would execute on the VM.
+	q := util.ShellQuote(remote)
+	cmd := fmt.Sprintf("mkdir -p %s && cat > %s && chmod %o %s",
+		util.ShellQuote(filepath.Dir(remote)), q, mode.Perm(), q)
+	if err := sess.Run(cmd); err != nil {
+		return fmt.Errorf("put %s: %w: %s", remote, err, strings.TrimSpace(errBuf.String()))
+	}
+	return nil
+}
+
+// PutFile uploads a single local file to remote at the given mode.
+func (s *SSH) PutFile(local, remote string, mode os.FileMode) error {
+	data, err := os.ReadFile(local)
+	if err != nil {
+		return err
+	}
+	return s.PutData(data, remote, mode)
+}
+
+// PutDir uploads a local directory tree to a remote directory (created if absent)
+// by streaming a tar over the connection and untarring on the VM.
+func (s *SSH) PutDir(localDir, remoteDir string) error {
+	sess, err := s.client.NewSession()
+	if err != nil {
+		return err
+	}
+	defer sess.Close()
+
+	pr, pw := io.Pipe()
+	sess.Stdin = pr
+	// Unblocks tarDir if the session dies before draining the pipe.
+	defer pr.Close()
+	// Buffered so the goroutine finishes even on the early returns below.
+	tarErr := make(chan error, 1)
+	go func() {
+		err := tarDir(localDir, pw)
+		pw.CloseWithError(err)
+		tarErr <- err
+	}()
+	var errBuf bytes.Buffer
+	sess.Stderr = &errBuf
+
+	q := util.ShellQuote(remoteDir)
+	cmd := fmt.Sprintf("mkdir -p %s && tar xzf - -C %s", q, q)
+	if err := sess.Run(cmd); err != nil {
+		return fmt.Errorf("put dir %s: %w: %s", remoteDir, err, strings.TrimSpace(errBuf.String()))
+	}
+	// Run returned, so the tar is done. An error here means we shipped a truncated
+	// tree the remote untarred without complaint.
+	if err := <-tarErr; err != nil {
+		return fmt.Errorf("tar %s for %s: %w", localDir, remoteDir, err)
+	}
+	return nil
+}
+
+// GetDir streams a remote directory's contents into localDir. Best-effort: a
+// missing remote path is not an error, since an epilogue runs precisely when the
+// files it wants may have never been produced.
+func (s *SSH) GetDir(remoteDir, localDir string) error {
+	sess, err := s.client.NewSession()
+	if err != nil {
+		return err
+	}
+	defer sess.Close()
+
+	stdout, err := sess.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	// Tar the contents (not the dir itself) so they land directly under localDir.
+	cmd := fmt.Sprintf("cd %s 2>/dev/null && tar czf - . || true", util.ShellQuote(remoteDir))
+	if err := sess.Start(cmd); err != nil {
+		return err
+	}
+	if err := untar(stdout, localDir); err != nil {
+		// Drain first: abandoning the pipe while the remote tar writes blocks it
+		// forever, and Wait with it.
+		_, _ = io.Copy(io.Discard, stdout)
+		_ = sess.Wait()
+		return err
+	}
+	return sess.Wait()
+}
+
+// tarDir writes a gzipped tar of dir's contents (paths relative to dir) to w.
+func tarDir(dir string, w io.Writer) error {
+	gz := gzip.NewWriter(w)
+	tw := tar.NewWriter(gz)
+	err := filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		rel, err := filepath.Rel(dir, path)
+		if err != nil {
+			return err
+		}
+		if rel == "." {
+			return nil
+		}
+		hdr, err := tar.FileInfoHeader(info, "")
+		if err != nil {
+			return err
+		}
+		hdr.Name = filepath.ToSlash(rel)
+		if err := tw.WriteHeader(hdr); err != nil {
+			return err
+		}
+		if info.IsDir() {
+			return nil
+		}
+		f, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		// Not deferred: that would hold every descriptor until the walk finished.
+		_, err = io.Copy(tw, f)
+		f.Close()
+		return err
+	})
+	if err != nil {
+		return err
+	}
+	if err := tw.Close(); err != nil {
+		return err
+	}
+	return gz.Close()
+}
+
+// untar extracts a gzipped tar stream into destDir, guarding against paths that
+// would escape it.
+func untar(r io.Reader, destDir string) error {
+	if err := os.MkdirAll(destDir, 0o755); err != nil {
+		return err
+	}
+	gz, err := gzip.NewReader(r)
+	if err != nil {
+		// An empty stream (missing remote dir) is not an error.
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		return err
+	}
+	tr := tar.NewReader(gz)
+	for {
+		hdr, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		target := filepath.Join(destDir, filepath.Clean("/"+hdr.Name))
+		if !strings.HasPrefix(target, filepath.Clean(destDir)+string(os.PathSeparator)) && target != destDir {
+			return fmt.Errorf("tar entry escapes dest: %q", hdr.Name)
+		}
+		switch hdr.Typeflag {
+		case tar.TypeDir:
+			if err := os.MkdirAll(target, os.FileMode(hdr.Mode)); err != nil {
+				return err
+			}
+		case tar.TypeReg:
+			if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
+				return err
+			}
+			f, err := os.OpenFile(target, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, os.FileMode(hdr.Mode))
+			if err != nil {
+				return err
+			}
+			if _, err := io.Copy(f, tr); err != nil { //nolint:gosec // CI artifacts we produced
+				f.Close()
+				return err
+			}
+			f.Close()
+		}
+	}
+}
diff --git a/scratch-utils/gce/ssh_test.go b/scratch-utils/gce/ssh_test.go
new file mode 100644
index 00000000..0b4960db
--- /dev/null
+++ b/scratch-utils/gce/ssh_test.go
@@ -0,0 +1,128 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package gce
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// tarDir and untar are the two halves of PutDir/GetDir: a tree that survives both
+// unchanged is the contract.
+func TestTarDirUntarRoundTrip(t *testing.T) {
+	src := t.TempDir()
+	files := map[string]string{
+		"top.txt":            "top",
+		"sub/nested.txt":     "nested",
+		"sub/deep/leaf.txt":  "leaf",
+		"sub/deep/empty.txt": "",
+	}
+	for rel, content := range files {
+		p := filepath.Join(src, rel)
+		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(p, []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	var buf bytes.Buffer
+	if err := tarDir(src, &buf); err != nil {
+		t.Fatalf("tarDir: %v", err)
+	}
+	dst := t.TempDir()
+	if err := untar(&buf, dst); err != nil {
+		t.Fatalf("untar: %v", err)
+	}
+	for rel, want := range files {
+		got, err := os.ReadFile(filepath.Join(dst, rel))
+		if err != nil {
+			t.Errorf("%s: %v", rel, err)
+			continue
+		}
+		if string(got) != want {
+			t.Errorf("%s = %q, want %q", rel, got, want)
+		}
+	}
+}
+
+// GetDir untars whatever the remote sends; ../ entries must not escape destDir.
+func TestUntarRejectsPathEscape(t *testing.T) {
+	for _, name := range []string{
+		"../escaped.txt",
+		"../../escaped.txt",
+		"sub/../../escaped.txt",
+		"/absolute.txt",
+	} {
+		dst := t.TempDir()
+		// Where a successful escape would land.
+		outside := filepath.Join(filepath.Dir(dst), "escaped.txt")
+		_ = os.Remove(outside)
+
+		err := untar(bytes.NewReader(tarWith(t, name, "pwned")), dst)
+		if _, statErr := os.Stat(outside); statErr == nil {
+			os.Remove(outside)
+			t.Fatalf("%q escaped the destination directory", name)
+		}
+		// An absolute path is cleaned into destDir rather than rejected; both are
+		// safe, so only require that nothing escaped.
+		if err != nil && !strings.Contains(err.Error(), "escapes dest") {
+			t.Errorf("%q: unexpected error %v", name, err)
+		}
+	}
+}
+
+// A missing remote dir makes GetDir's `cd ... || true` emit nothing -- the normal
+// "no artifacts this run" case, not a failure.
+func TestUntarEmptyStreamIsNotAnError(t *testing.T) {
+	dst := t.TempDir()
+	if err := untar(bytes.NewReader(nil), dst); err != nil {
+		t.Fatalf("empty stream: %v", err)
+	}
+}
+
+func TestUntarCreatesDestination(t *testing.T) {
+	dst := filepath.Join(t.TempDir(), "does", "not", "exist")
+	if err := untar(bytes.NewReader(tarWith(t, "f.txt", "x")), dst); err != nil {
+		t.Fatalf("untar: %v", err)
+	}
+	got, err := os.ReadFile(filepath.Join(dst, "f.txt"))
+	if err != nil || string(got) != "x" {
+		t.Fatalf("f.txt = %q, %v", got, err)
+	}
+}
+
+// tarWith writes one file at the given (possibly hostile) name; archive/tar emits
+// it verbatim, which is the point.
+func tarWith(t *testing.T, name, content string) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	gz := gzip.NewWriter(&buf)
+	tw := tar.NewWriter(gz)
+	hdr := &tar.Header{
+		Name:     name,
+		Mode:     0o644,
+		Size:     int64(len(content)),
+		Typeflag: tar.TypeReg,
+	}
+	if err := tw.WriteHeader(hdr); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := io.WriteString(tw, content); err != nil {
+		t.Fatal(err)
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return buf.Bytes()
+}
diff --git a/scratch-utils/gce/vm.go b/scratch-utils/gce/vm.go
new file mode 100644
index 00000000..ffbed82d
--- /dev/null
+++ b/scratch-utils/gce/vm.go
@@ -0,0 +1,309 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// Package gce creates and deletes a GCE VM via the compute API and drives it over
+// SSH (ssh.go) — no gcloud, so callers can run from a distroless image. Create
+// does not wait for the VM to be usable; DialSSH's retry is the readiness check.
+package gce
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	compute "google.golang.org/api/compute/v1"
+	"google.golang.org/api/googleapi"
+)
+
+// Config describes the VM to create. Zones are tried in order (capacity), and the
+// first that succeeds is returned. The project is the Client's, not a field here.
+type Config struct {
+	Name          string
+	Zones         []string
+	MachineType   string // e.g. "n2-standard-16"
+	DiskType      string // e.g. "pd-ssd"
+	DiskSizeGB    int64
+	Image         string // exact image name; wins over ImageFamily when set
+	ImageFamily   string // e.g. "ubuntu-2404-lts-amd64"
+	ImageProject  string // e.g. "ubuntu-os-cloud"
+	MaxRun        time.Duration
+	Labels        map[string]string
+	StartupScript string // bash run as the GCE startup-script (on the VM)
+}
+
+// Client is a compute API client scoped to one project.
+type Client struct {
+	svc     *compute.Service
+	project string
+}
+
+// New builds a client using Application Default Credentials. Point
+// GOOGLE_APPLICATION_CREDENTIALS at the service-account key (a mounted secret)
+// before calling -- the cmd wrappers do this from COMPUTE_SA_KEY.
+func New(ctx context.Context, project string) (*Client, error) {
+	svc, err := compute.NewService(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("compute client: %w", err)
+	}
+	return &Client{svc: svc, project: project}, nil
+}
+
+// PerZoneTimeout bounds ONE zone's attempt, so a degraded zone can be skipped
+// rather than consuming the whole budget. Three minutes because the failure mode
+// is slowness, not rejection: a zone can accept an insert and take tens of minutes
+// to finish it.
+const PerZoneTimeout = 3 * time.Minute
+
+// Create inserts the instance in the first zone that accepts it and returns that
+// zone. The VM gets an external IP, cloud-platform scope, and a max-run-duration
+// GCP reclaims it at -- eventually, since that reclaim is itself an operation and
+// can queue behind a wedged insert. Every zone's error is reported, not just the
+// last.
+func (c *Client) Create(ctx context.Context, cfg Config) (zone string, err error) {
+	if len(cfg.Zones) == 0 {
+		return "", fmt.Errorf("no zones configured")
+	}
+	var errs []error
+	for _, z := range cfg.Zones {
+		if err := ctx.Err(); err != nil {
+			errs = append(errs, fmt.Errorf("%s: not attempted: %w", z, err))
+			continue
+		}
+		fmt.Fprintf(os.Stderr, "[gce] trying %s in %s\n", cfg.Name, z)
+		if err := c.createInZone(ctx, z, cfg); err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", z, err))
+			continue
+		}
+		return z, nil
+	}
+	return "", fmt.Errorf("could not create %s in any zone: %w", cfg.Name, errors.Join(errs...))
+}
+
+// createInZone attempts one zone under its own deadline.
+func (c *Client) createInZone(ctx context.Context, zone string, cfg Config) error {
+	zctx, cancel := context.WithTimeout(ctx, PerZoneTimeout)
+	defer cancel()
+
+	op, err := c.svc.Instances.Insert(c.project, zone, c.instanceSpec(zone, cfg)).Context(zctx).Do()
+	if err != nil {
+		return fmt.Errorf("insert: %w", err)
+	}
+	if err := c.waitZoneOp(zctx, zone, op.Name); err != nil {
+		// The insert was accepted, so an instance may exist. Left behind it would run
+		// to max-run-duration while we boot another elsewhere -- two VMs for one job.
+		c.deleteBestEffort(zone, cfg.Name)
+		return fmt.Errorf("wait for insert: %w", err)
+	}
+	return nil
+}
+
+// deleteBestEffort builds its own context: the caller's is typically already
+// expired, which is why we are here.
+func (c *Client) deleteBestEffort(zone, name string) {
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+	fmt.Fprintf(os.Stderr, "[gce] cleaning up abandoned %s in %s\n", name, zone)
+	if err := c.Delete(ctx, zone, name); err != nil {
+		fmt.Fprintf(os.Stderr, "[gce] cleanup of %s in %s failed: %v (max-run-duration is the backstop)\n", name, zone, err)
+	}
+}
+
+func (c *Client) instanceSpec(zone string, cfg Config) *compute.Instance {
+	inst := &compute.Instance{
+		Name:        cfg.Name,
+		MachineType: fmt.Sprintf("zones/%s/machineTypes/%s", zone, cfg.MachineType),
+		Labels:      cfg.Labels,
+		Disks: []*compute.AttachedDisk{{
+			Boot:       true,
+			AutoDelete: true,
+			InitializeParams: &compute.AttachedDiskInitializeParams{
+				SourceImage: sourceImage(cfg),
+				DiskSizeGb:  cfg.DiskSizeGB,
+				DiskType:    fmt.Sprintf("zones/%s/diskTypes/%s", zone, cfg.DiskType),
+			},
+		}},
+		// One NAT access config = an ephemeral external IP (SSH from the run step).
+		NetworkInterfaces: []*compute.NetworkInterface{{
+			AccessConfigs: []*compute.AccessConfig{{Type: "ONE_TO_ONE_NAT", Name: "External NAT"}},
+		}},
+		ServiceAccounts: []*compute.ServiceAccount{{
+			Email:  "default",
+			Scopes: []string{compute.CloudPlatformScope},
+		}},
+	}
+	// Optional: the ci-base image is already provisioned, so createvm passes none.
+	// Only set it for a stock image.
+	if cfg.StartupScript != "" {
+		inst.Metadata = &compute.Metadata{Items: []*compute.MetadataItems{
+			{Key: "startup-script", Value: strPtr(cfg.StartupScript)},
+		}}
+	}
+	if cfg.MaxRun > 0 {
+		inst.Scheduling = &compute.Scheduling{
+			ProvisioningModel:         "STANDARD",
+			InstanceTerminationAction: "DELETE",
+			MaxRunDuration:            &compute.Duration{Seconds: int64(cfg.MaxRun.Seconds())},
+		}
+	}
+	return inst
+}
+
+// Delete removes the instance and waits for the delete operation to finish. A
+// not-found instance is treated as already deleted.
+func (c *Client) Delete(ctx context.Context, zone, name string) error {
+	op, err := c.svc.Instances.Delete(c.project, zone, name).Context(ctx).Do()
+	if err != nil {
+		if isNotFound(err) {
+			return nil
+		}
+		return fmt.Errorf("delete %s in %s: %w", name, zone, err)
+	}
+	return c.waitZoneOp(ctx, zone, op.Name)
+}
+
+// FindZone returns the zone of an instance with this name in any state, or "" if
+// there is none. For cleanup: deletevm wants a TERMINATED VM too, since it is
+// stopped but still holding its disk.
+func (c *Client) FindZone(ctx context.Context, name string) (string, error) {
+	found, err := c.listInstances(ctx, name)
+	if err != nil {
+		return "", err
+	}
+	return pickZone(name, found, false)
+}
+
+// FindLiveZone returns the zone of a USABLE instance with this name. An instance
+// that is stopping, stopped or suspended is an error rather than a target -- for
+// a caller about to SSH in and run a job, that VM is not a place to run it, and
+// picking it would fail confusingly or, worse, half-work.
+func (c *Client) FindLiveZone(ctx context.Context, name string) (string, error) {
+	found, err := c.listInstances(ctx, name)
+	if err != nil {
+		return "", err
+	}
+	return pickZone(name, found, true)
+}
+
+// listInstances finds every instance of this name, across all zones.
+func (c *Client) listInstances(ctx context.Context, name string) ([]zoneInstance, error) {
+	// The value must be quoted -- an unquoted name with a - or . is a syntax error,
+	// not a non-match -- and AggregatedList pages even for a single match.
+	call := c.svc.Instances.AggregatedList(c.project).Filter(fmt.Sprintf("name=%q", name))
+	var found []zoneInstance
+	for {
+		agg, err := call.Context(ctx).Do()
+		if err != nil {
+			return nil, err
+		}
+		for scope, list := range agg.Items {
+			// scope is "zones/<zone>".
+			z := strings.TrimPrefix(scope, "zones/")
+			for _, inst := range list.Instances {
+				found = append(found, zoneInstance{zone: z, status: inst.Status})
+			}
+		}
+		if agg.NextPageToken == "" {
+			break
+		}
+		call = call.PageToken(agg.NextPageToken)
+	}
+	return found, nil
+}
+
+// zoneInstance is one instance of a given name, and where and how it is.
+type zoneInstance struct {
+	zone   string
+	status string
+}
+
+// goingAway reports a status from which the instance will not become usable --
+// it is shutting down, already stopped, or on its way out.
+func goingAway(status string) bool {
+	switch status {
+	case "STOPPING", "STOPPED", "SUSPENDING", "SUSPENDED", "TERMINATED":
+		return true
+	}
+	return false
+}
+
+// pickZone chooses which instance of this name to act on. Names are only
+// zone-unique and Create can leave one behind, so two is possible; two LIVE ones
+// are refused rather than resolved by map order.
+//
+// requireLive is the caller's intent: a run step errors on a dying VM rather than
+// running a job on it, cleanup reaps either.
+func pickZone(name string, found []zoneInstance, requireLive bool) (string, error) {
+	var live, dying []zoneInstance
+	for _, zi := range found {
+		if goingAway(zi.status) {
+			dying = append(dying, zi)
+		} else {
+			live = append(live, zi)
+		}
+	}
+	switch {
+	case len(live) > 1:
+		return "", fmt.Errorf("%s exists in more than one zone (%s); set ZONE to pick one", name, describe(live))
+	case len(live) == 1:
+		return live[0].zone, nil
+	case len(dying) == 0:
+		return "", nil // no instance of that name at all
+	case requireLive:
+		return "", fmt.Errorf("%s exists but is not usable (%s)", name, describe(dying))
+	case len(dying) > 1:
+		return "", fmt.Errorf("%s exists in more than one zone (%s); set ZONE to pick one", name, describe(dying))
+	default:
+		return dying[0].zone, nil
+	}
+}
+
+func describe(set []zoneInstance) string {
+	out := make([]string, 0, len(set))
+	for _, zi := range set {
+		out = append(out, zi.zone+"="+zi.status)
+	}
+	sort.Strings(out)
+	return strings.Join(out, ", ")
+}
+
+// waitZoneOp blocks until a zone operation reaches DONE, surfacing its error.
+func (c *Client) waitZoneOp(ctx context.Context, zone, op string) error {
+	for {
+		var got *compute.Operation
+		if err := retry(ctx, "wait op "+op, func() (err error) {
+			got, err = c.svc.ZoneOperations.Wait(c.project, zone, op).Context(ctx).Do()
+			return err
+		}); err != nil {
+			return err
+		}
+		if got.Status == "DONE" {
+			if got.Error != nil && len(got.Error.Errors) > 0 {
+				return fmt.Errorf("%s: %s", got.Error.Errors[0].Code, got.Error.Errors[0].Message)
+			}
+			return nil
+		}
+	}
+}
+
+// sourceImage resolves the boot image: an exact name when Image is set, else the
+// family, which always yields its newest member. The pin lets a job hold one image
+// steady while newer releases land in the family.
+func sourceImage(cfg Config) string {
+	if cfg.Image != "" {
+		return fmt.Sprintf("projects/%s/global/images/%s", cfg.ImageProject, cfg.Image)
+	}
+	return fmt.Sprintf("projects/%s/global/images/family/%s", cfg.ImageProject, cfg.ImageFamily)
+}
+
+// isNotFound reports a 404 from the compute API. Matching the status beats
+// matching the message: the prose varies by endpoint and could change under us.
+func isNotFound(err error) bool {
+	var gerr *googleapi.Error
+	return errors.As(err, &gerr) && gerr.Code == http.StatusNotFound
+}
+
+func strPtr(s string) *string { return &s }
diff --git a/scratch-utils/gce/vm_test.go b/scratch-utils/gce/vm_test.go
new file mode 100644
index 00000000..5f941717
--- /dev/null
+++ b/scratch-utils/gce/vm_test.go
@@ -0,0 +1,245 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package gce
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"google.golang.org/api/googleapi"
+)
+
+// The family path always yields the newest member, so pinning an exact image is
+// the only way a job can hold one steady while newer releases land in the family.
+func TestSourceImage(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		cfg  Config
+		want string
+	}{
+		{
+			name: "family when no exact image is given",
+			cfg:  Config{ImageProject: "unique-caldron-775", ImageFamily: "ci-base"},
+			want: "projects/unique-caldron-775/global/images/family/ci-base",
+		},
+		{
+			name: "exact image when given",
+			cfg: Config{
+				ImageProject: "unique-caldron-775",
+				ImageFamily:  "ci-base",
+				Image:        "ci-base-1-27-0-llvm21-1-8-k8s1-37-0",
+			},
+			want: "projects/unique-caldron-775/global/images/ci-base-1-27-0-llvm21-1-8-k8s1-37-0",
+		},
+		{
+			name: "exact image wins over the family",
+			cfg: Config{
+				ImageProject: "ubuntu-os-cloud",
+				ImageFamily:  "ubuntu-2404-lts-amd64",
+				Image:        "ubuntu-2404-noble-amd64-v20260101",
+			},
+			want: "projects/ubuntu-os-cloud/global/images/ubuntu-2404-noble-amd64-v20260101",
+		},
+	} {
+		if got := sourceImage(tc.cfg); got != tc.want {
+			t.Errorf("%s: sourceImage() = %q, want %q", tc.name, got, tc.want)
+		}
+	}
+}
+
+// instanceSpec is what actually reaches the API, so make sure the pin survives it.
+func TestInstanceSpecUsesPinnedImage(t *testing.T) {
+	c := &Client{project: "unique-caldron-775"}
+	inst := c.instanceSpec("us-central1-a", Config{
+		Name:         "vm",
+		MachineType:  "n2-standard-16",
+		DiskType:     "pd-ssd",
+		DiskSizeGB:   200,
+		ImageProject: "unique-caldron-775",
+		ImageFamily:  "ci-base",
+		Image:        "ci-base-1-27-0-llvm21-1-8-k8s1-37-0",
+	})
+	got := inst.Disks[0].InitializeParams.SourceImage
+	want := "projects/unique-caldron-775/global/images/ci-base-1-27-0-llvm21-1-8-k8s1-37-0"
+	if got != want {
+		t.Errorf("SourceImage = %q, want %q", got, want)
+	}
+}
+
+func TestCreateRejectsEmptyZoneList(t *testing.T) {
+	c := &Client{project: "p"}
+	if _, err := c.Create(context.Background(), Config{Name: "vm"}); err == nil {
+		t.Fatal("want an error when no zones are configured")
+	}
+}
+
+// A dead context must not be reported as a per-zone failure: that is what made the
+// original bug unreadable, with the last zone blamed for a deadline an earlier zone
+// had already consumed. Every zone should say it was not attempted, and none should
+// reach the API.
+func TestCreateReportsUnattemptedZonesSeparately(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	// svc is nil: if any zone reached the API this would panic, which is the point.
+	c := &Client{project: "p"}
+	_, err := c.Create(ctx, Config{Name: "vm", Zones: []string{"z-a", "z-b", "z-c"}})
+	if err == nil {
+		t.Fatal("want an error")
+	}
+	got := err.Error()
+	for _, z := range []string{"z-a", "z-b", "z-c"} {
+		if !strings.Contains(got, z+": not attempted") {
+			t.Errorf("error should name %s as not attempted; got: %s", z, got)
+		}
+	}
+}
+
+// Delete treats a not-found instance as already deleted, so this decides whether
+// a cleanup step is idempotent or spuriously fails.
+func TestIsNotFound(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"nil", nil, false},
+		{"googleapi 404", &googleapi.Error{Code: 404, Message: "not found"}, true},
+		{"googleapi 404 wrapped", fmt.Errorf("delete vm: %w", &googleapi.Error{Code: 404}), true},
+		{"googleapi 403", &googleapi.Error{Code: 403, Message: "forbidden"}, false},
+		{"googleapi 500", &googleapi.Error{Code: 500}, false},
+		// A permission error whose prose happens to contain the old sentinel must
+		// not be read as "already gone", or cleanup would silently skip a live VM.
+		{"prose mentioning notFound", errors.New("caller lacks permission; resource notFound checks disabled"), false},
+		{"unrelated", errors.New("connection reset"), false},
+	} {
+		if got := isNotFound(tc.err); got != tc.want {
+			t.Errorf("%s: isNotFound = %v, want %v", tc.name, got, tc.want)
+		}
+	}
+}
+
+// The case this exists for: an insert that outlived PerZoneTimeout leaves a VM in
+// one zone -- possibly with a delete queued behind the wedged insert -- while
+// Create succeeds in the next. Names are only zone-unique, so both exist.
+//
+// requireLive is the caller's intent: a run step must not be handed a VM that is
+// shutting down, while cleanup is happy to reap one.
+func TestPickZone(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		found       []zoneInstance
+		wantLive    string // requireLive=true; "" with wantLiveErr=false means not found
+		wantLiveErr bool
+		wantAny     string // requireLive=false
+		wantAnyErr  bool
+	}{
+		{
+			name: "nothing found",
+		},
+		{
+			name:     "one running",
+			found:    []zoneInstance{{"us-central1-b", "RUNNING"}},
+			wantLive: "us-central1-b",
+			wantAny:  "us-central1-b",
+		},
+		{
+			name: "abandoned one going away, real one live",
+			found: []zoneInstance{
+				{"us-central1-a", "STOPPING"},
+				{"us-central1-b", "RUNNING"},
+			},
+			wantLive: "us-central1-b",
+			wantAny:  "us-central1-b",
+		},
+		{
+			// A wedged insert can still report STAGING, so both count as live.
+			name: "two live is genuine ambiguity either way",
+			found: []zoneInstance{
+				{"us-central1-a", "STAGING"},
+				{"us-central1-b", "RUNNING"},
+			},
+			wantLiveErr: true,
+			wantAnyErr:  true,
+		},
+		{
+			// The correction: a dying VM is never a place to run a job. Cleanup still
+			// wants it -- stopped, but holding its disk.
+			name:        "only a terminated one",
+			found:       []zoneInstance{{"us-central1-a", "TERMINATED"}},
+			wantLiveErr: true,
+			wantAny:     "us-central1-a",
+		},
+		{
+			name:        "only a stopping one",
+			found:       []zoneInstance{{"us-central1-f", "STOPPING"}},
+			wantLiveErr: true,
+			wantAny:     "us-central1-f",
+		},
+		{
+			// The compute API lists STOPPED as well as TERMINATED for a halted VM.
+			name:        "only a stopped one",
+			found:       []zoneInstance{{"us-central1-c", "STOPPED"}},
+			wantLiveErr: true,
+			wantAny:     "us-central1-c",
+		},
+		{
+			name: "two going away: nothing to run on, and ambiguous to reap",
+			found: []zoneInstance{
+				{"us-central1-a", "TERMINATED"},
+				{"us-central1-f", "STOPPING"},
+			},
+			wantLiveErr: true,
+			wantAnyErr:  true,
+		},
+	} {
+		for _, mode := range []struct {
+			requireLive bool
+			want        string
+			wantErr     bool
+			label       string
+		}{
+			{true, tc.wantLive, tc.wantLiveErr, "requireLive"},
+			{false, tc.wantAny, tc.wantAnyErr, "any"},
+		} {
+			got, err := pickZone("vm-1", tc.found, mode.requireLive)
+			switch {
+			case mode.wantErr && err == nil:
+				t.Errorf("%s [%s]: want an error, got zone %q", tc.name, mode.label, got)
+			case !mode.wantErr && err != nil:
+				t.Errorf("%s [%s]: unexpected error %v", tc.name, mode.label, err)
+			case !mode.wantErr && got != mode.want:
+				t.Errorf("%s [%s]: got %q, want %q", tc.name, mode.label, got, mode.want)
+			}
+		}
+	}
+}
+
+// A refusal has to say which zones and what state, or the operator cannot act.
+func TestPickZoneErrorsAreActionable(t *testing.T) {
+	_, err := pickZone("vm-1", []zoneInstance{
+		{"us-central1-b", "RUNNING"},
+		{"us-central1-a", "STAGING"},
+	}, true)
+	if err == nil {
+		t.Fatal("want an error for two live instances")
+	}
+	for _, want := range []string{"vm-1", "us-central1-a=STAGING", "us-central1-b=RUNNING", "set ZONE"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("ambiguity error should mention %q: %v", want, err)
+		}
+	}
+
+	_, err = pickZone("vm-1", []zoneInstance{{"us-central1-a", "STOPPING"}}, true)
+	if err == nil {
+		t.Fatal("want an error when the only instance is dying")
+	}
+	for _, want := range []string{"vm-1", "not usable", "us-central1-a=STOPPING"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("unusable error should mention %q: %v", want, err)
+		}
+	}
+}
diff --git a/scratch-utils/subcmd/createvm/createvm.go b/scratch-utils/subcmd/createvm/createvm.go
new file mode 100644
index 00000000..a4b7ce06
--- /dev/null
+++ b/scratch-utils/subcmd/createvm/createvm.go
@@ -0,0 +1,135 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// Package createvm creates the CI GCE VM from the ci-base image — docker, go,
+// kind, kubectl and gh prebaked, so no startup script — and writes its zone to
+// ZONE_OUT for the next workflow step. It does not wait or SSH; the run step's
+// connect is the readiness check. Config comes from env vars the workflow sets;
+// the compute SA is a mounted key file (COMPUTE_SA_KEY) or its env var (see util).
+package createvm
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/projectcalico/go-build/scratch-utils/gce"
+	"github.com/projectcalico/go-build/scratch-utils/util"
+)
+
+// Run executes the createvm subcommand and returns its exit code.
+func Run() int {
+	if err := run(context.Background()); err != nil {
+		fmt.Fprintf(os.Stderr, "createvm: %v\n", err)
+		return 1
+	}
+	return 0
+}
+
+func run(ctx context.Context) error {
+	name := os.Getenv("VM_NAME")
+	if name == "" {
+		return fmt.Errorf("VM_NAME must be set")
+	}
+	project := util.EnvOr("GCP_VM_PROJECT", "unique-caldron-775")
+	zoneOut := util.EnvOr("ZONE_OUT", "/tmp/vm-zone")
+	// Point ADC at the compute SA (mounted key file, or materialized from its env var).
+	if err := util.SetupComputeADC(); err != nil {
+		return err
+	}
+
+	maxRun, err := parseMaxRun(util.EnvOr("GOOGLE_VM_MAX_RUN_DURATION", "90m"))
+	if err != nil {
+		return err
+	}
+	diskGB, err := parseDiskGB(util.EnvOr("GOOGLE_VM_DISK_SIZE", "200GB"))
+	if err != nil {
+		return err
+	}
+
+	client, err := gce.New(ctx, project)
+	if err != nil {
+		return err
+	}
+
+	zones := strings.Fields(util.EnvOr("GOOGLE_VM_ZONES", "us-central1-a us-central1-b us-central1-c us-central1-f"))
+	if len(zones) == 0 {
+		return fmt.Errorf("GOOGLE_VM_ZONES is empty")
+	}
+	// Bound the whole create so an operation that never reaches DONE fails the step
+	// instead of hanging it until the workflow's own timeout. Derived from the zone
+	// count so every zone gets its full per-zone budget.
+	ctx, cancel := context.WithTimeout(ctx, time.Duration(len(zones))*gce.PerZoneTimeout+time.Minute)
+	defer cancel()
+
+	cfg := gce.Config{
+		Name:        name,
+		Zones:       zones,
+		MachineType: util.EnvOr("GOOGLE_VM_MACHINE_TYPE", "n2-standard-16"),
+		DiskType:    util.EnvOr("GOOGLE_VM_DISK_TYPE", "pd-ssd"),
+		DiskSizeGB:  diskGB,
+		// ci-base has the toolchain baked in (built by vm-images/ci-base/build-image.sh), so
+		// the VM boots ready and the job does no installs. Override for stock Ubuntu.
+		// GOOGLE_VM_IMAGE pins one exact image (e.g.
+		// ci-base-1-27-0-llvm21-1-8-k8s1-37-0) so the image can be rolled without
+		// rebuilding this binary; unset, the family gives whatever is newest.
+		Image:        os.Getenv("GOOGLE_VM_IMAGE"),
+		ImageFamily:  util.EnvOr("GOOGLE_VM_IMAGE_FAMILY", "ci-base"),
+		ImageProject: util.EnvOr("GOOGLE_VM_IMAGE_PROJECT", "unique-caldron-775"),
+		MaxRun:       maxRun,
+		Labels: map[string]string{
+			"ci-runner":   "true",
+			"ci-project":  "kindrig",
+			"ci-workflow": util.EnvOr("CI_WORKFLOW_LABEL", "unknown"),
+		},
+	}
+
+	from := "family " + cfg.ImageFamily
+	if cfg.Image != "" {
+		from = "image " + cfg.Image
+	}
+	fmt.Printf("[createvm] creating %s (%s) from %s in %s across %v\n", name, cfg.MachineType, from, project, cfg.Zones)
+	zone, err := client.Create(ctx, cfg)
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(zoneOut, []byte(zone), 0o644); err != nil {
+		return fmt.Errorf("write zone to %s: %w", zoneOut, err)
+	}
+	// Readiness is the run step's job: runonvm must connect to ship and run anyway,
+	// so that connect is the check.
+	fmt.Printf("[createvm] %s created in %s (zone -> %s)\n", name, zone, zoneOut)
+	return nil
+}
+
+// parseMaxRun parses the VM's reclaim deadline. Non-positive is rejected rather
+// than passed on: instanceSpec omits the whole Scheduling block when MaxRun is not
+// positive, so "0s" would create a VM with no deadline at all -- and deletevm
+// returning 0 on any failure assumes that deadline is there to catch it.
+func parseMaxRun(s string) (time.Duration, error) {
+	d, err := time.ParseDuration(s)
+	if err != nil {
+		return 0, fmt.Errorf("GOOGLE_VM_MAX_RUN_DURATION %q: %w", s, err)
+	}
+	if d <= 0 {
+		return 0, fmt.Errorf("GOOGLE_VM_MAX_RUN_DURATION %q: must be positive", s)
+	}
+	return d, nil
+}
+
+// parseDiskGB accepts "200GB", "200G", or "200" and returns the GB count.
+func parseDiskGB(s string) (int64, error) {
+	// Errors quote s, not trimmed: report what the caller actually set.
+	trimmed := strings.TrimSpace(strings.ToUpper(s))
+	trimmed = strings.TrimSuffix(strings.TrimSuffix(trimmed, "GB"), "G")
+	n, err := strconv.ParseInt(strings.TrimSpace(trimmed), 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("GOOGLE_VM_DISK_SIZE %q: want e.g. 200GB: %w", s, err)
+	}
+	if n <= 0 {
+		return 0, fmt.Errorf("GOOGLE_VM_DISK_SIZE %q: must be positive", s)
+	}
+	return n, nil
+}
diff --git a/scratch-utils/subcmd/createvm/createvm_test.go b/scratch-utils/subcmd/createvm/createvm_test.go
new file mode 100644
index 00000000..13499211
--- /dev/null
+++ b/scratch-utils/subcmd/createvm/createvm_test.go
@@ -0,0 +1,72 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package createvm
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestParseDiskGB(t *testing.T) {
+	for _, tc := range []struct {
+		in   string
+		want int64
+	}{
+		{"200GB", 200},
+		{"200G", 200},
+		{"200", 200},
+		{" 200gb ", 200},
+		{"1500GB", 1500},
+	} {
+		got, err := parseDiskGB(tc.in)
+		if err != nil {
+			t.Errorf("parseDiskGB(%q) errored: %v", tc.in, err)
+			continue
+		}
+		if got != tc.want {
+			t.Errorf("parseDiskGB(%q) = %d, want %d", tc.in, got, tc.want)
+		}
+	}
+}
+
+func TestParseDiskGBRejectsGarbage(t *testing.T) {
+	// A non-positive size parses fine but reaches the GCE API and fails there,
+	// a long way from the env var that caused it.
+	for _, in := range []string{"", "GB", "200GBx", "two hundred", "200TB", "0", "0GB", "-10GB", "-1"} {
+		if _, err := parseDiskGB(in); err == nil {
+			t.Errorf("parseDiskGB(%q) accepted garbage", in)
+		}
+	}
+}
+
+// The error must name the value the operator set, not the parser's leftovers --
+// that is what makes a bad env var findable from a CI log.
+func TestParseDiskGBErrorQuotesOriginalInput(t *testing.T) {
+	_, err := parseDiskGB(" 200GBx ")
+	if err == nil {
+		t.Fatal("want an error")
+	}
+	if want := `" 200GBx "`; !strings.Contains(err.Error(), want) {
+		t.Errorf("error %q does not contain the original input %s", err, want)
+	}
+}
+
+// A non-positive duration parses fine but makes instanceSpec omit Scheduling
+// entirely, leaving the VM with no reclaim deadline -- the backstop deletevm
+// assumes when it returns 0 on a failed cleanup.
+func TestParseMaxRun(t *testing.T) {
+	for _, in := range []string{"90m", "1h", "30s", "1h30m"} {
+		d, err := parseMaxRun(in)
+		if err != nil || d <= 0 {
+			t.Errorf("parseMaxRun(%q) = %v, %v", in, d, err)
+		}
+	}
+	for _, in := range []string{"0", "0s", "-5m", "-1h", "", "ninety minutes", "90"} {
+		if d, err := parseMaxRun(in); err == nil {
+			t.Errorf("parseMaxRun(%q) accepted it, returning %v", in, d)
+		}
+	}
+	if _, err := parseMaxRun("-5m"); err == nil || !strings.Contains(err.Error(), `"-5m"`) {
+		t.Errorf("error should quote the input: %v", err)
+	}
+}
diff --git a/scratch-utils/subcmd/deletevm/deletevm.go b/scratch-utils/subcmd/deletevm/deletevm.go
new file mode 100644
index 00000000..62d30eab
--- /dev/null
+++ b/scratch-utils/subcmd/deletevm/deletevm.go
@@ -0,0 +1,63 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// Package deletevm deletes the CI GCE VM by name, finding its zone if ZONE is not
+// given. Best-effort: the VM's max-run-duration is the backstop, so a failure here
+// is logged, not fatal. Runs in the workflow's onExit cleanup step.
+package deletevm
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/projectcalico/go-build/scratch-utils/gce"
+	"github.com/projectcalico/go-build/scratch-utils/util"
+)
+
+// Run executes the deletevm subcommand and returns its exit code. Every failure to
+// delete returns 0 -- the VM's max-run-duration is the backstop, so a cleanup step
+// should not fail the workflow. A missing VM_NAME is not that: it means the step is
+// misconfigured and deleted nothing, which is worth failing on.
+func Run() int {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	name := os.Getenv("VM_NAME")
+	if name == "" {
+		fmt.Fprintln(os.Stderr, "deletevm: VM_NAME must be set")
+		return 1
+	}
+	project := util.EnvOr("GCP_VM_PROJECT", "unique-caldron-775")
+	// The cleanup step injects the SA as an env var, not a mounted file.
+	if err := util.SetupComputeADC(); err != nil {
+		fmt.Fprintf(os.Stderr, "deletevm: %v (leaving to max-run-duration)\n", err)
+		return 0
+	}
+
+	client, err := gce.New(ctx, project)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "deletevm: %v (leaving to max-run-duration)\n", err)
+		return 0
+	}
+
+	zone := os.Getenv("ZONE")
+	if zone == "" {
+		if zone, err = client.FindZone(ctx, name); err != nil {
+			fmt.Fprintf(os.Stderr, "deletevm: find zone for %s: %v (leaving to max-run-duration)\n", name, err)
+			return 0
+		}
+	}
+	if zone == "" {
+		fmt.Printf("[deletevm] no VM %s found; nothing to delete\n", name)
+		return 0
+	}
+
+	fmt.Printf("[deletevm] deleting %s in %s\n", name, zone)
+	if err := client.Delete(ctx, zone, name); err != nil {
+		fmt.Fprintf(os.Stderr, "deletevm: %v (leaving to max-run-duration)\n", err)
+		return 0
+	}
+	fmt.Printf("[deletevm] deleted %s\n", name)
+	return 0
+}
diff --git a/scratch-utils/subcmd/runonvm/runonvm.go b/scratch-utils/subcmd/runonvm/runonvm.go
new file mode 100644
index 00000000..806d8f79
--- /dev/null
+++ b/scratch-utils/subcmd/runonvm/runonvm.go
@@ -0,0 +1,225 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// Package runonvm runs a script on a GCE VM over SSH: the generic "runOn: vm"
+// primitive. It ships files and secrets, runs a script (a FILE, never a command
+// string, so nothing must survive three levels of shell quoting), pulls artifacts
+// back on ANY exit, and exits with the script's own status.
+//
+// Meant to be the `command` of an Argo `script` template: Argo writes `source:` to
+// a temp file and appends its path as the last argument, so that block just runs on
+// the VM. Everything job-specific is a flag, so this stays generic.
+//
+//	command: [scratch-utils, runonvm,          # subcommand is an ARGUMENT: the
+//	          --put-env, ENV_VAR:remote/path,  # ENTRYPOINT is the binary, so a bare
+//	          --env,     ENV_VAR,              # command: [runonvm] fails to exec
+//	          --get,     remote/dir:local/dir]
+//	source: |
+//	  ...
+package runonvm
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"os"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/projectcalico/go-build/scratch-utils/gce"
+	"github.com/projectcalico/go-build/scratch-utils/util"
+)
+
+type stringList []string
+
+func (s *stringList) String() string { return strings.Join(*s, ",") }
+func (s *stringList) Set(v string) error {
+	*s = append(*s, v)
+	return nil
+}
+
+// setupTimeout bounds the compute-API phase (find zone, inject key, dial SSH). It
+// deliberately excludes running the script: that is the CI job, and it takes as
+// long as it takes.
+const setupTimeout = 10 * time.Minute
+
+// Run executes the runonvm subcommand and returns its exit code.
+func Run() int {
+	return run(context.Background())
+}
+
+func run(ctx context.Context) int {
+	var puts, putEnvs, envs, gets stringList
+	scriptFlag := flag.String("script", "", "script to run on the VM (Argo appends the source file as a trailing arg; --script is the CLI equivalent)")
+	user := flag.String("user", util.EnvOr("VM_SSH_USER", "ubuntu"), "SSH user")
+	flag.Var(&puts, "put", "LOCAL:REMOTE file or dir to upload before running (repeatable)")
+	flag.Var(&putEnvs, "put-env", "ENVVAR:REMOTE -- write an env var's value to a 0600 remote file (repeatable)")
+	flag.Var(&envs, "env", "ENVVAR to forward into an env file the script sources before running (repeatable)")
+	flag.Var(&gets, "get", "REMOTE:LOCAL dir to pull back on exit, best-effort (repeatable)")
+	flag.Parse()
+
+	// Argo passes the staged source file as the trailing arg.
+	script := *scriptFlag
+	if flag.NArg() > 0 {
+		script = flag.Arg(0)
+	}
+	if script == "" {
+		fmt.Fprintln(os.Stderr, "runonvm: need a script (trailing arg or --script)")
+		return 2
+	}
+
+	name := os.Getenv("VM_NAME")
+	if name == "" {
+		fmt.Fprintln(os.Stderr, "runonvm: VM_NAME must be set")
+		return 2
+	}
+	project := util.EnvOr("GCP_VM_PROJECT", "unique-caldron-775")
+
+	if err := util.SetupComputeADC(); err != nil {
+		fmt.Fprintf(os.Stderr, "runonvm: %v\n", err)
+		return 1
+	}
+	client, err := gce.New(ctx, project)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "runonvm: %v\n", err)
+		return 1
+	}
+
+	// Bounds setup only; the script run below is unbounded.
+	setupCtx, cancelSetup := context.WithTimeout(ctx, setupTimeout)
+	defer cancelSetup()
+
+	zone := os.Getenv("ZONE")
+	if zone == "" {
+		zone, err = client.FindLiveZone(setupCtx, name)
+		if err != nil || zone == "" {
+			fmt.Fprintf(os.Stderr, "runonvm: could not find zone for %s (set ZONE): %v\n", name, err)
+			return 1
+		}
+	}
+
+	fmt.Printf("[runonvm] connecting to %s in %s\n", name, zone)
+	conn, err := client.DialSSH(setupCtx, zone, name, *user)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "runonvm: %v\n", err)
+		return 1
+	}
+	defer conn.Close()
+	cancelSetup()
+
+	// On ANY exit, so a mid-run failure still returns logs.
+	defer func() {
+		for _, g := range gets {
+			remote, local, ok := splitPair(g)
+			if !ok {
+				continue
+			}
+			if err := conn.GetDir(remote, local); err != nil {
+				fmt.Fprintf(os.Stderr, "[runonvm] get %s: %v (continuing)\n", remote, err)
+			} else {
+				fmt.Printf("[runonvm] pulled %s -> %s\n", remote, local)
+			}
+		}
+	}()
+
+	// Ship files and secrets before running.
+	for _, p := range puts {
+		local, remote, ok := splitPair(p)
+		if !ok {
+			fmt.Fprintf(os.Stderr, "runonvm: bad --put %q (want LOCAL:REMOTE)\n", p)
+			return 2
+		}
+		info, err := os.Stat(local)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "runonvm: --put %s: %v\n", local, err)
+			return 1
+		}
+		if info.IsDir() {
+			err = conn.PutDir(local, remote)
+		} else {
+			err = conn.PutFile(local, remote, 0o644)
+		}
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "runonvm: %v\n", err)
+			return 1
+		}
+		fmt.Printf("[runonvm] put %s -> %s\n", local, remote)
+	}
+	for _, pe := range putEnvs {
+		envVar, remote, ok := splitPair(pe)
+		if !ok {
+			fmt.Fprintf(os.Stderr, "runonvm: bad --put-env %q (want ENVVAR:REMOTE)\n", pe)
+			return 2
+		}
+		val, present := os.LookupEnv(envVar)
+		if !present {
+			fmt.Fprintf(os.Stderr, "runonvm: --put-env %s: env var not set\n", envVar)
+			return 1
+		}
+		if err := conn.PutData([]byte(val), remote, 0o600); err != nil {
+			fmt.Fprintf(os.Stderr, "runonvm: %v\n", err)
+			return 1
+		}
+		fmt.Printf("[runonvm] put-env %s -> %s (0600)\n", envVar, remote)
+	}
+
+	// Forward env vars through a file the script sources -- the generic path for a
+	// commit SHA, tokens, etc. Values are shell-quoted, so any content is safe. An
+	// unset var is skipped; the script decides whether that is fatal.
+	remoteEnv := "/tmp/runonvm.env"
+	haveEnv := false
+	if len(envs) > 0 {
+		var b strings.Builder
+		for _, name := range envs {
+			// The value is quoted, but the NAME is interpolated bare, so a name like
+			// "FOO; rm -rf /" would run when the script sources this file.
+			if err := util.CheckShellName(name); err != nil {
+				fmt.Fprintf(os.Stderr, "runonvm: --env %v\n", err)
+				return 2
+			}
+			val, present := os.LookupEnv(name)
+			if !present {
+				fmt.Fprintf(os.Stderr, "[runonvm] --env %s not set, skipping\n", name)
+				continue
+			}
+			fmt.Fprintf(&b, "export %s=%s\n", name, util.ShellQuote(val))
+			haveEnv = true
+		}
+		if haveEnv {
+			if err := conn.PutData([]byte(b.String()), remoteEnv, 0o600); err != nil {
+				fmt.Fprintf(os.Stderr, "runonvm: write env file: %v\n", err)
+				return 1
+			}
+		}
+	}
+
+	// A file, not a command string.
+	remoteScript := path.Join("/tmp", path.Base(script))
+	if err := conn.PutFile(script, remoteScript, 0o755); err != nil {
+		fmt.Fprintf(os.Stderr, "runonvm: upload script: %v\n", err)
+		return 1
+	}
+
+	qScript := util.ShellQuote(remoteScript)
+	runCmd := "bash " + qScript
+	if haveEnv {
+		runCmd = fmt.Sprintf(". %s && bash %s", util.ShellQuote(remoteEnv), qScript)
+	}
+	fmt.Printf("[runonvm] running %s on %s\n", remoteScript, name)
+	code, err := conn.Run(runCmd, os.Stdout, os.Stderr)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "runonvm: run: %v\n", err)
+		return 1
+	}
+	fmt.Printf("[runonvm] script finished (rc=%d)\n", code)
+	return code
+}
+
+// splitPair splits "A:B" on the first colon.
+func splitPair(s string) (a, b string, ok bool) {
+	before, after, ok := strings.Cut(s, ":")
+	if !ok {
+		return "", "", false
+	}
+	return before, after, true
+}
diff --git a/scratch-utils/subcmd/runonvm/runonvm_test.go b/scratch-utils/subcmd/runonvm/runonvm_test.go
new file mode 100644
index 00000000..db6cabb6
--- /dev/null
+++ b/scratch-utils/subcmd/runonvm/runonvm_test.go
@@ -0,0 +1,26 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package runonvm
+
+import "testing"
+
+func TestSplitPair(t *testing.T) {
+	for _, tc := range []struct {
+		in   string
+		a, b string
+		ok   bool
+	}{
+		{"local:remote", "local", "remote", true},
+		{"/a/b:/c/d", "/a/b", "/c/d", true},
+		// Splits on the FIRST colon, so a remote path may contain one.
+		{"VAR:/tmp/x:y", "VAR", "/tmp/x:y", true},
+		{"", "", "", false},
+		{"nocolon", "", "", false},
+	} {
+		a, b, ok := splitPair(tc.in)
+		if a != tc.a || b != tc.b || ok != tc.ok {
+			t.Errorf("splitPair(%q) = (%q, %q, %v), want (%q, %q, %v)",
+				tc.in, a, b, ok, tc.a, tc.b, tc.ok)
+		}
+	}
+}
diff --git a/scratch-utils/subcmd/secret/secret.go b/scratch-utils/subcmd/secret/secret.go
new file mode 100644
index 00000000..5a925209
--- /dev/null
+++ b/scratch-utils/subcmd/secret/secret.go
@@ -0,0 +1,31 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// Package secret materializes a mounted-secret env var to a file, the Go form of
+// cc-utils' createLocalSecret. Usage: secret NAME PATH.
+package secret
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/projectcalico/go-build/scratch-utils/util"
+)
+
+// Run executes the secret subcommand and returns its exit code.
+func Run() int {
+	if len(os.Args) != 3 {
+		fmt.Fprintln(os.Stderr, "usage: secret <ENV_VAR_NAME> <DEST_PATH>")
+		return 2
+	}
+	found, err := util.LocalSecret(os.Args[1], os.Args[2])
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "secret: %v\n", err)
+		return 1
+	}
+	if !found {
+		fmt.Printf("secret %s not created (env var not set)\n", os.Args[1])
+		return 0
+	}
+	fmt.Printf("created %s\n", os.Args[2])
+	return 0
+}
diff --git a/scratch-utils/util/env.go b/scratch-utils/util/env.go
new file mode 100644
index 00000000..effa7e90
--- /dev/null
+++ b/scratch-utils/util/env.go
@@ -0,0 +1,15 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package util
+
+import "os"
+
+// EnvOr returns key's value, or def when key is unset or empty. Treating empty as
+// absent is deliberate, so a workflow declaring a var it has no value for gets the
+// default. Where the difference matters, use os.LookupEnv directly.
+func EnvOr(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
diff --git a/scratch-utils/util/secret.go b/scratch-utils/util/secret.go
new file mode 100644
index 00000000..a21fb520
--- /dev/null
+++ b/scratch-utils/util/secret.go
@@ -0,0 +1,76 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+// Package util reimplements the cc-utils argoci common-scripts in Go, since a
+// distroless image has no bash to run them. Slated to move to a shared folder.
+package util
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// LocalSecret writes env var name to destPath at 0600, creating parent dirs. A
+// missing env var is a no-op, as in the script it replaces, returning found=false
+// so callers decide whether that is fatal.
+func LocalSecret(name, destPath string) (found bool, err error) {
+	v, ok := os.LookupEnv(name)
+	if !ok {
+		return false, nil
+	}
+	if err := os.MkdirAll(filepath.Dir(destPath), 0o755); err != nil {
+		return false, fmt.Errorf("mkdir for %s: %w", destPath, err)
+	}
+	if err := os.WriteFile(destPath, []byte(v), 0o600); err != nil {
+		return false, fmt.Errorf("write secret %s: %w", destPath, err)
+	}
+	return true, nil
+}
+
+// MustLocalSecret is LocalSecret, but absent means error — for a secret the caller
+// cannot proceed without.
+func MustLocalSecret(name, destPath string) error {
+	found, err := LocalSecret(name, destPath)
+	if err != nil {
+		return err
+	}
+	if !found {
+		return fmt.Errorf("required secret env var %q not set", name)
+	}
+	return nil
+}
+
+// SetupComputeADC points Application Default Credentials at the compute SA key:
+// the file at COMPUTE_SA_KEY if it exists, else the env var named by
+// COMPUTE_SA_ENV materialized to a temp file.
+func SetupComputeADC() error {
+	if p := os.Getenv("COMPUTE_SA_KEY"); p != "" {
+		if _, err := os.Stat(p); err == nil {
+			os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", p)
+			return nil
+		}
+	}
+	name := os.Getenv("COMPUTE_SA_ENV")
+	if name == "" {
+		name = "banzai-google-service-account.json"
+	}
+	v, ok := os.LookupEnv(name)
+	if !ok {
+		return fmt.Errorf("compute SA: env var %q not set (set COMPUTE_SA_KEY to a mounted key file, or COMPUTE_SA_ENV to the key's env var name)", name)
+	}
+	// CreateTemp opens O_EXCL at 0600 with a random name, so it cannot follow a
+	// pre-planted symlink or collide with another run.
+	f, err := os.CreateTemp("", "compute-sa-*.json")
+	if err != nil {
+		return fmt.Errorf("compute SA: %w", err)
+	}
+	if _, err := f.WriteString(v); err != nil {
+		f.Close()
+		return fmt.Errorf("compute SA: write %s: %w", f.Name(), err)
+	}
+	if err := f.Close(); err != nil {
+		return fmt.Errorf("compute SA: close %s: %w", f.Name(), err)
+	}
+	os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", f.Name())
+	return nil
+}
diff --git a/scratch-utils/util/secret_test.go b/scratch-utils/util/secret_test.go
new file mode 100644
index 00000000..72e5364c
--- /dev/null
+++ b/scratch-utils/util/secret_test.go
@@ -0,0 +1,114 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package util
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLocalSecretWritesModeAndContent(t *testing.T) {
+	dest := filepath.Join(t.TempDir(), "nested", "dir", "secret")
+	t.Setenv("TEST_SECRET_VAR", "s3cr3t")
+
+	found, err := LocalSecret("TEST_SECRET_VAR", dest)
+	if err != nil || !found {
+		t.Fatalf("LocalSecret: found=%v err=%v", found, err)
+	}
+	got, err := os.ReadFile(dest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != "s3cr3t" {
+		t.Errorf("content = %q, want %q", got, "s3cr3t")
+	}
+	// Readable by anyone but the owner would defeat the point.
+	fi, err := os.Stat(dest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if perm := fi.Mode().Perm(); perm != 0o600 {
+		t.Errorf("mode = %#o, want 0600", perm)
+	}
+}
+
+// An unset var is a no-op, not an error: the caller decides whether that is fatal,
+// which is what MustLocalSecret is for.
+func TestLocalSecretMissingVarIsNoOp(t *testing.T) {
+	dest := filepath.Join(t.TempDir(), "secret")
+	found, err := LocalSecret("TEST_SECRET_VAR_DEFINITELY_UNSET", dest)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if found {
+		t.Error("found = true for an unset env var")
+	}
+	if _, err := os.Stat(dest); !os.IsNotExist(err) {
+		t.Error("a file was created for an unset env var")
+	}
+}
+
+func TestLocalSecretEmptyValueStillWrites(t *testing.T) {
+	dest := filepath.Join(t.TempDir(), "secret")
+	t.Setenv("TEST_SECRET_EMPTY", "")
+	found, err := LocalSecret("TEST_SECRET_EMPTY", dest)
+	if err != nil || !found {
+		t.Fatalf("a set-but-empty var should still be written: found=%v err=%v", found, err)
+	}
+	if _, err := os.Stat(dest); err != nil {
+		t.Errorf("file not created: %v", err)
+	}
+}
+
+func TestMustLocalSecretErrorsWhenUnset(t *testing.T) {
+	dest := filepath.Join(t.TempDir(), "secret")
+	if err := MustLocalSecret("TEST_SECRET_VAR_DEFINITELY_UNSET", dest); err == nil {
+		t.Fatal("want an error for a required-but-unset secret")
+	}
+}
+
+// The key must land on a private, per-run path: O_EXCL at 0600 with a random
+// name, so it cannot follow a symlink or collide with a concurrent run.
+func TestSetupComputeADCUsesAPrivateUniqueFile(t *testing.T) {
+	t.Setenv("COMPUTE_SA_KEY", "")
+	t.Setenv("COMPUTE_SA_ENV", "TEST_SA_JSON")
+	t.Setenv("TEST_SA_JSON", `{"type":"service_account"}`)
+
+	var paths []string
+	for range 2 {
+		if err := SetupComputeADC(); err != nil {
+			t.Fatalf("SetupComputeADC: %v", err)
+		}
+		p := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
+		paths = append(paths, p)
+		t.Cleanup(func() { os.Remove(p) })
+
+		got, err := os.ReadFile(p)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if string(got) != `{"type":"service_account"}` {
+			t.Errorf("content = %q", got)
+		}
+		fi, err := os.Stat(p)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if perm := fi.Mode().Perm(); perm != 0o600 {
+			t.Errorf("mode = %#o, want 0600", perm)
+		}
+	}
+	// Two runs in one namespace must not fight over the same file.
+	if paths[0] == paths[1] {
+		t.Errorf("both runs used the same path %q", paths[0])
+	}
+}
+
+func TestSetupComputeADCErrorsWhenTheEnvVarIsMissing(t *testing.T) {
+	t.Setenv("COMPUTE_SA_KEY", "")
+	t.Setenv("COMPUTE_SA_ENV", "TEST_SA_DEFINITELY_UNSET")
+	if err := SetupComputeADC(); err == nil {
+		t.Fatal("want an error when the named env var is unset")
+	}
+}
diff --git a/scratch-utils/util/shell.go b/scratch-utils/util/shell.go
new file mode 100644
index 00000000..278f16d9
--- /dev/null
+++ b/scratch-utils/util/shell.go
@@ -0,0 +1,33 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package util
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// ShellQuote single-quotes s for a POSIX shell, so any value survives verbatim.
+// Use it, never fmt %q, for anything going into a remote command: %q is
+// double-quoted, and bash still expands $(...) inside double quotes.
+//
+// The escape itself is only in the code below -- gofmt rewrites a doubled
+// apostrophe in a doc comment into a curly quote.
+func ShellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}
+
+// shellName is the portable environment-variable name: a leading letter or
+// underscore, then letters, digits or underscores.
+var shellName = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
+
+// CheckShellName rejects a name that cannot be used as a shell variable. Values
+// can be quoted, but a NAME is interpolated bare into `export NAME=...`, so
+// something like "FOO; rm -rf /" would run when the file is sourced.
+func CheckShellName(name string) error {
+	if !shellName.MatchString(name) {
+		return fmt.Errorf("%q is not a valid environment variable name", name)
+	}
+	return nil
+}
diff --git a/scratch-utils/util/shell_test.go b/scratch-utils/util/shell_test.go
new file mode 100644
index 00000000..7d640b2f
--- /dev/null
+++ b/scratch-utils/util/shell_test.go
@@ -0,0 +1,100 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+
+package util
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+// The output is sourced by bash on the VM, so the contract is a byte-for-byte
+// round trip through a shell. Ask a shell.
+func TestShellQuoteRoundTripsThroughBash(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skip("bash not available")
+	}
+	for _, val := range []string{
+		"plain",
+		"with space",
+		"it's",
+		`double"quote`,
+		"$(rm -rf /)",
+		"`backtick`",
+		"semi; echo pwned",
+		`back\slash`,
+		"new\nline",
+		"tab\there",
+		"*glob*",
+		"${VAR}",
+		"",
+		"''",
+		`'\''`,
+	} {
+		script := "printf %s " + ShellQuote(val)
+		out, err := exec.Command("bash", "-c", script).Output()
+		if err != nil {
+			t.Errorf("bash rejected quoting of %q: %v", val, err)
+			continue
+		}
+		if string(out) != val {
+			t.Errorf("round trip of %q gave %q", val, out)
+		}
+	}
+}
+
+// The env file is `export NAME=<quoted>` lines; a hostile value must not break out
+// of the assignment.
+func TestShellQuoteInExportLine(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skip("bash not available")
+	}
+	evil := "x'; touch /tmp/pwned-by-runonvm; echo '"
+	script := "export EVIL=" + ShellQuote(evil) + "\nprintf %s \"$EVIL\""
+	out, err := exec.Command("bash", "-c", script).Output()
+	if err != nil {
+		t.Fatalf("bash rejected the export line: %v", err)
+	}
+	if string(out) != evil {
+		t.Fatalf("value did not survive the export line: got %q, want %q", out, evil)
+	}
+	if strings.Contains(script, "\ntouch") {
+		t.Fatal("quoting let the payload escape onto its own line")
+	}
+}
+
+// A name is interpolated bare into `export NAME=...`, so anything that is not a
+// plain identifier can break out of the assignment when the file is sourced.
+func TestCheckShellName(t *testing.T) {
+	for _, ok := range []string{"FOO", "foo", "_foo", "FOO_BAR", "F1", "_", "a1_B2"} {
+		if err := CheckShellName(ok); err != nil {
+			t.Errorf("CheckShellName(%q) rejected a valid name: %v", ok, err)
+		}
+	}
+	for _, bad := range []string{
+		"", "1FOO", "FOO-BAR", "FOO BAR", "FOO;rm -rf /", "FOO=bar", "FOO$X",
+		"FOO\nBAR", "$(id)", "FOO.BAR", "foo/bar",
+	} {
+		if err := CheckShellName(bad); err == nil {
+			t.Errorf("CheckShellName(%q) accepted an injectable name", bad)
+		}
+	}
+}
+
+// The reason ShellQuote exists: fmt %q is double-quoted, and bash expands $(...)
+// inside double quotes. Prove single quoting does not.
+func TestShellQuoteBlocksCommandSubstitution(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skip("bash not available")
+	}
+	for _, payload := range []string{"/tmp/x$(id -u)", "/tmp/`id -u`", "/tmp/${HOME}"} {
+		out, err := exec.Command("bash", "-c", "printf %s "+ShellQuote(payload)).Output()
+		if err != nil {
+			t.Errorf("bash rejected %q: %v", payload, err)
+			continue
+		}
+		if string(out) != payload {
+			t.Errorf("payload was expanded: %q became %q", payload, out)
+		}
+	}
+}
diff --git a/vm-images/ci-base/build-image.sh b/vm-images/ci-base/build-image.sh
new file mode 100755
index 00000000..b18de7bd
--- /dev/null
+++ b/vm-images/ci-base/build-image.sh
@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Tigera, Inc. All rights reserved.
+#
+# Build (or refresh) the ci-base CI VM image: a throwaway builder VM runs
+# provision.sh, its disk is snapshotted into FAMILY, the builder is deleted.
+# createvm boots from FAMILY, so it always gets the newest.
+#
+#   PROJECT=unique-caldron-775 FAMILY=ci-base ./vm-images/ci-base/build-image.sh
+#
+# Needs gcloud (authed, compute instance + image create/delete) and yq. ~3-4 min.
+set -euo pipefail
+
+PROJECT="${PROJECT:-unique-caldron-775}"
+ZONE="${ZONE:-us-central1-a}"
+FAMILY="${FAMILY:-ci-base}"
+BUILDER="${BUILDER:-ci-img-builder-$$}"
+HERE="$(cd "$(dirname "$0")" && pwd)"
+REPO="$(cd "$HERE/../.." && pwd)"
+
+log() { echo "[build-image] $*"; }
+
+# The toolchain tracks the go-build image, not this repo's go.mod: a job here would
+# otherwise have run inside calico/go-build, so it must see the same Go.
+VERSIONS="$REPO/images/calico-go-build/versions.yaml"
+command -v yq >/dev/null || { echo "yq is required to read $VERSIONS" >&2; exit 1; }
+GO_VERSION="${GO_VERSION:-$("$REPO/hack/generate-version-tag-name.sh" -f "$VERSIONS" -g)}"
+GO_SHA256="${GO_SHA256:-$(yq -r '.golang.checksum.sha256.amd64' "$VERSIONS")}"
+GO_BUILD_IMAGE="${GO_BUILD_IMAGE:-calico/go-build:$("$REPO/hack/generate-version-tag-name.sh" -f "$VERSIONS")}"
+# kubectl tracks the same k8s release the go-build image is cut against.
+KUBECTL_VERSION="${KUBECTL_VERSION:-v$(yq -r '.kubernetes.version' "$VERSIONS")}"
+log "go $GO_VERSION, kubectl $KUBECTL_VERSION, prepulling $GO_BUILD_IMAGE (from images/calico-go-build/versions.yaml)"
+
+# Named off the go-build release tag, so image and toolchain match by eye.
+IMAGE="${IMAGE:-$("$REPO/hack/generate-image-name.sh" -p "$FAMILY" -f "$VERSIONS")}"
+log "image name: $IMAGE (family $FAMILY)"
+
+# Deterministic names collide on a rebuild; check now, not after four minutes of
+# builder VM. Release images are immutable, branch images are replaced -- the same
+# split calico/go-build makes between its tags.
+if gcloud compute images describe "$IMAGE" --project="$PROJECT" >/dev/null 2>&1; then
+  if [ "${SEMAPHORE_GIT_REF_TYPE:-}" = "tag" ]; then
+    log "image $IMAGE already exists in $PROJECT -- this release is already built."
+    log "to rebuild it: gcloud compute images delete $IMAGE --project=$PROJECT"
+    log "or set IMAGE=<name> to build under a different name."
+    exit 1
+  fi
+  log "replacing existing branch image $IMAGE"
+  gcloud --quiet compute images delete "$IMAGE" --project="$PROJECT"
+fi
+
+# kind and gh have no entry in the go-build versions file. All pinned, so an image
+# build is reproducible from a commit.
+VM_VERSIONS="$HERE/versions.yaml"
+KIND_VERSION="${KIND_VERSION:-$(yq -r '.kind.version' "$VM_VERSIONS")}"
+# Space-separated: env vars cannot hold arrays, and image refs contain no spaces.
+KIND_NODE_IMAGES="${KIND_NODE_IMAGES:-$(yq -r '.kind.node_images | join(" ")' "$VM_VERSIONS")}"
+[ -n "$KIND_NODE_IMAGES" ] || { echo "kind.node_images is empty in $VM_VERSIONS" >&2; exit 1; }
+GH_VERSION="${GH_VERSION:-$(yq -r '.gh.version' "$VM_VERSIONS")}"
+log "kind $KIND_VERSION, gh $GH_VERSION (from vm-images/ci-base/versions.yaml)"
+for img in $KIND_NODE_IMAGES; do log "  node image: $img"; done
+
+# provision.sh runs as the builder's startup-script and cannot read this repo.
+STARTUP="$(mktemp)"
+{
+  echo '#!/usr/bin/env bash'
+  echo '# Preamble injected by build-image.sh from the repo versions.yaml files.'
+  printf 'export GO_VERSION=%q\n' "$GO_VERSION"
+  printf 'export GO_SHA256=%q\n' "$GO_SHA256"
+  printf 'export GO_BUILD_IMAGE=%q\n' "$GO_BUILD_IMAGE"
+  printf 'export KUBECTL_VERSION=%q\n' "$KUBECTL_VERSION"
+  printf 'export KIND_VERSION=%q\n' "$KIND_VERSION"
+  printf 'export KIND_NODE_IMAGES=%q\n' "$KIND_NODE_IMAGES"
+  printf 'export GH_VERSION=%q\n' "$GH_VERSION"
+  tail -n +2 "$HERE/provision.sh" # its shebang is replaced by the one above
+} >"$STARTUP"
+
+cleanup() {
+  rm -f "$STARTUP"
+  gcloud --quiet compute instances delete "$BUILDER" --project="$PROJECT" --zone="$ZONE" 2>/dev/null || true
+}
+trap cleanup EXIT INT TERM
+
+log "creating builder $BUILDER in $ZONE"
+# max-run-duration so the builder cannot outlive the job: the trap misses a
+# SIGKILL, and the poll below can run past the pipeline's 30-minute limit.
+gcloud compute instances create "$BUILDER" --project="$PROJECT" --zone="$ZONE" \
+  --machine-type=e2-standard-8 \
+  --image-family=ubuntu-2404-lts-amd64 --image-project=ubuntu-os-cloud \
+  --boot-disk-size=50GB --boot-disk-type=pd-ssd \
+  --max-run-duration=60m --instance-termination-action=DELETE \
+  --metadata-from-file startup-script="$STARTUP"
+
+log "waiting for provision.sh (~2-3 min)"
+ready=""
+for _ in $(seq 1 120); do
+  if gcloud --quiet compute ssh "ubuntu@$BUILDER" --project="$PROJECT" --zone="$ZONE" \
+       --ssh-flag="-o BatchMode=yes -o ConnectTimeout=10" --command='test -e /var/run/provision-done' 2>/dev/null; then
+    ready=1; break
+  fi
+  sleep 10
+done
+if [ -z "$ready" ]; then
+  log "provision timed out; serial console tail:"
+  gcloud compute instances get-serial-port-output "$BUILDER" --project="$PROJECT" --zone="$ZONE" 2>/dev/null | tail -100 || true
+  exit 1
+fi
+
+# Enforcing, not informational: every binary must run and every pre-pulled image
+# must be in the cache, or nothing is published from this builder.
+log "verifying the toolchain before snapshotting"
+if ! gcloud --quiet compute ssh "ubuntu@$BUILDER" --project="$PROJECT" --zone="$ZONE" \
+  --command="set -e
+    docker --version
+    /usr/local/go/bin/go version
+    kind version
+    kubectl version --client
+    gh --version
+    echo '--- baked images ---'
+    sudo docker images --format '{{.Repository}}:{{.Tag}} ({{.Size}})'
+    for img in $GO_BUILD_IMAGE $KIND_NODE_IMAGES registry:2; do
+      sudo docker image inspect \"\$img\" >/dev/null || { echo \"missing from cache: \$img\"; exit 1; }
+    done"; then
+  log "verification FAILED -- not publishing an image from this builder"
+  exit 1
+fi
+
+log "stopping builder for a consistent disk"
+gcloud --quiet compute instances stop "$BUILDER" --project="$PROJECT" --zone="$ZONE"
+
+# Dots become dashes, matching the munged form in the image name -- label values
+# may not contain dots, so this cannot hold the tag verbatim.
+log "creating image $IMAGE in family $FAMILY"
+gcloud compute images create "$IMAGE" --project="$PROJECT" \
+  --source-disk="$BUILDER" --source-disk-zone="$ZONE" --family="$FAMILY" \
+  --labels="go-build-tag=$(echo "$GO_BUILD_IMAGE" | sed 's|.*:||; s|\.|-|g')"
+
+log "done: image $IMAGE (family $FAMILY, project $PROJECT). createvm: GOOGLE_VM_IMAGE_PROJECT=$PROJECT GOOGLE_VM_IMAGE_FAMILY=$FAMILY"
diff --git a/vm-images/ci-base/provision.sh b/vm-images/ci-base/provision.sh
new file mode 100755
index 00000000..2ed22434
--- /dev/null
+++ b/vm-images/ci-base/provision.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Tigera, Inc. All rights reserved.
+#
+# Provisioner for the ci-base VM image -- any CI job needing docker/go/kubectl on a
+# GCE VM. Runs once as a throwaway builder's startup-script; its disk becomes the
+# image. Publishes /var/run/provision-done when finished.
+set -xeuo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+# Injected by build-image.sh. Required, not defaulted: silently baking a stale Go
+# is the drift this exists to prevent.
+GO_VERSION="${GO_VERSION:?set by build-image.sh from images/calico-go-build/versions.yaml}"
+GO_SHA256="${GO_SHA256:?set by build-image.sh from images/calico-go-build/versions.yaml}"
+GO_BUILD_IMAGE="${GO_BUILD_IMAGE:?set by build-image.sh from images/calico-go-build/versions.yaml}"
+KUBECTL_VERSION="${KUBECTL_VERSION:?set by build-image.sh from images/calico-go-build/versions.yaml}"
+KIND_VERSION="${KIND_VERSION:?set by build-image.sh from vm-images/ci-base/versions.yaml}"
+KIND_NODE_IMAGES="${KIND_NODE_IMAGES:?set by build-image.sh from vm-images/ci-base/versions.yaml}"
+GH_VERSION="${GH_VERSION:?set by build-image.sh from vm-images/ci-base/versions.yaml}"
+
+APT=(apt-get -o DPkg::Lock::Timeout=600 -y)
+retry() { local n=8; for i in $(seq 1 $n); do "$@" && return 0; echo "retry $i/$n: $*"; sleep 5; done; return 1; }
+
+# --- base packages ----------------------------------------------------------
+retry "${APT[@]}" update
+retry "${APT[@]}" install --no-install-recommends ca-certificates curl gnupg git make iproute2 zstd
+
+# --- docker (kind's runtime); ubuntu joins the docker group -----------------
+install -m 0755 -d /etc/apt/keyrings
+retry curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+chmod a+r /etc/apt/keyrings/docker.asc
+codename=$(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
+printf 'Types: deb\nURIs: https://download.docker.com/linux/ubuntu\nSuites: %s\nComponents: stable\nSigned-By: /etc/apt/keyrings/docker.asc\n' "$codename" > /etc/apt/sources.list.d/docker.sources
+retry "${APT[@]}" update
+retry "${APT[@]}" install --no-install-recommends docker-ce docker-ce-cli containerd.io docker-buildx-plugin
+usermod -a -G docker ubuntu
+systemctl enable docker
+
+# --- go / kind / kubectl / gh (all pinned) ----------------------------------
+# -f on every download: without it curl exits 0 on an HTTP error and writes the
+# error page to the output file, so a 404 would install an HTML "kind" and the
+# image would build clean and ship broken. Only go has a checksum to catch it.
+fetch() { retry curl -fsSL --retry-connrefused -o "$1" "$2"; }
+
+fetch /tmp/go.tgz "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz"
+# Checksum from versions.yaml, as the go-build Dockerfile does.
+echo "${GO_SHA256}  /tmp/go.tgz" | sha256sum -c -
+rm -rf /usr/local/go && tar -C /usr/local -xzf /tmp/go.tgz
+# go + a per-user GOBIN on PATH for interactive + non-interactive shells.
+printf 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin\n' > /etc/profile.d/go.sh
+
+fetch /usr/local/bin/kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-amd64"
+chmod 0755 /usr/local/bin/kind
+
+fetch /usr/local/bin/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
+chmod 0755 /usr/local/bin/kubectl
+
+fetch /tmp/gh.tgz "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.tar.gz"
+tar -C /tmp -xzf /tmp/gh.tgz && install -m 0755 "/tmp/gh_${GH_VERSION}_linux_amd64/bin/gh" /usr/local/bin/gh
+
+# --- inotify limits for 3 kind clusters (persist across boots) --------------
+cat > /etc/sysctl.d/99-kind.conf <<EOF
+fs.inotify.max_user_instances=512
+fs.inotify.max_user_watches=524288
+EOF
+
+# --- pre-pull the heavy CI images so jobs skip the pull ---------------------
+# Tags are injected by build-image.sh, so they cannot drift.
+systemctl start docker
+PREPULL_IMAGES=("$GO_BUILD_IMAGE" "registry:2")
+# Unquoted on purpose: KIND_NODE_IMAGES is a space-separated list.
+for img in $KIND_NODE_IMAGES; do PREPULL_IMAGES+=("$img"); done
+# Fatal, not a warning: `|| echo` neutralised set -e, so a registry blip or a bad
+# digest let the marker below be written and the image publish with an empty cache
+# -- which only ever shows up as jobs being slower.
+for img in "${PREPULL_IMAGES[@]}"; do
+  retry docker pull "$img"
+done
+
+# Assert the cache holds everything, so a pull that somehow succeeded without
+# landing the image cannot reach the snapshot.
+for img in "${PREPULL_IMAGES[@]}"; do
+  docker image inspect "$img" >/dev/null
+done
+
+# Readiness marker for the image-build poll.
+touch /var/run/provision-done
diff --git a/vm-images/ci-base/versions.yaml b/vm-images/ci-base/versions.yaml
new file mode 100644
index 00000000..9bd60639
--- /dev/null
+++ b/vm-images/ci-base/versions.yaml
@@ -0,0 +1,14 @@
+# Tools with no home in images/calico-go-build/versions.yaml. Go and the prepulled
+# calico/go-build image come from THAT file, so the VM cannot drift from the
+# go-build image. Pinned so two builds of a commit match; bump and re-run
+# build-image.sh.
+kind:
+  version: v0.33.0
+  # Every k8s version the rig tests against, all pre-pulled. The first tracks
+  # calico's lib/kind DefaultNodeImage. Each adds ~1.5GB to the image, so add a
+  # version when it is actually tested, not speculatively. Digests, not tags: a
+  # tag would let the cached node image drift from the one kind asks for.
+  node_images:
+    - kindest/node:v1.33.7@sha256:d26ef333bdb2cbe9862a0f7c3803ecc7b4303d8cea8e814b481b09949d353040
+gh:
+  version: 2.99.0