diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd1482047836..2b53c52eb7bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,179 +16,122 @@ concurrency:
   group: "${{ github.ref_name }}-${{ github.head_ref }}"
   cancel-in-progress: true
 
-jobs:
-  lint:
-    name: Lint
-    runs-on: ubuntu-24.04
-    steps:
-
-      - name: Check out code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: "0"
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: "go.mod"
-
-      - name: check-fmt
-        run: make check-fmt
-
-      - name: check-jsonnetfmt
-        run: make check-jsonnetfmt
-
-      - name: Get year and week number
-        id: get-year-week-number
-        run: echo "date=$(date +"%Yweek%U")" >> $GITHUB_OUTPUT
-
-      - name: cache golangci
-        uses: actions/cache@v4
-        with:
-          path: .cache/golangci-lint
-          key: golangci-lint-${{ runner.os }}-${{ steps.get-year-week-number.outputs.date }}-${{ hashFiles('go.mod', '.golangci.yml') }}
-
-      - name: lint
-        run: |
-          make lint base=origin/${{github.base_ref}}
-          sudo chown -R $(id -u):$(id -g) .cache/golangci-lint  # needed to archive cache
+permissions:
+  contents: read
+  id-token: write
 
 
-  unit-tests:
-    name: Run Unit Tests
+jobs:
+  get-tag:
+    if: github.repository == 'grafana/tempo'  # skip in forks
     runs-on: ubuntu-24.04
-    strategy:
-      matrix:
-        test-target:
-          [
-            test-with-cover-pkg,
-            test-with-cover-tempodb,
-            test-with-cover-tempodb-wal,
-            test-with-cover-others,
-          ]
-
+    outputs:
+      tag: ${{ steps.get-tag.outputs.tag }}
     steps:
-      - name: Check out code
+      - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: "go.mod"
+      - name: fetch tags
+        run: git fetch --tags
 
-      - name: Run Tests
-        run: make ${{ matrix.test-target }}
+      - id: get-tag
+        run: |
+          echo "tag=$(./tools/image-tag)" >> "$GITHUB_OUTPUT"
 
-  integration-tests:
-    name: Run integration tests
-    runs-on: ubuntu-24.04
+  docker:
+    if: github.repository == 'grafana/tempo'
+    needs: get-tag
     strategy:
       matrix:
-        test-target:
-          [
-            test-e2e,
-            test-integration-poller,
-            test-e2e-deployments,
-            test-e2e-serverless,
-          ]
-
+        component: [ tempo, tempo-vulture, tempo-query, tempo-cli ]
+        runner_arch: [ { runner: ubuntu-24.04, arch: amd64 }, { runner: github-hosted-ubuntu-arm64, arch: arm64 } ]
+    runs-on: ${{ matrix.runner_arch.runner }}
+    env:
+      TAG: ${{ needs.get-tag.outputs.tag }}
     steps:
-      - name: Check out code
+      - name: Checkout
         uses: actions/checkout@v4
-      - name: Fetch tags
-        run: git fetch --prune --unshallow --tags
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: "go.mod"
-      - name: Run Tests
-        run: make ${{ matrix.test-target }}
 
-  build:
-    name: Build
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
+      - name: fetch tags
+        run: git fetch --tags
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: "go.mod"
+      - name: build-tempo-binaries
+        run: |
+          COMPONENT=${{ matrix.component }} GOARCH=${{ matrix.runner_arch.arch }} make exe
 
-      - name: Build Tempo
-        run: make tempo
+      - name: docker-build
+        run: |
+          TAG_ARCH="$TAG-${{ matrix.runner_arch.arch }}"
+          docker build -f cmd/${{ matrix.component }}/Dockerfile -t grafana/${{ matrix.component }}:$TAG_ARCH .
 
-      - name: generate-manifest
-        run: make generate-manifest
+      - name: Login to DockerHub
+        uses: grafana/shared-workflows/actions/dockerhub-login@dockerhub-login-v1.0.0
 
-      - name: Build tempo-query
-        run: make tempo-query
+      - name: docker-push
+        run: |
+          echo $TAG_ARCH
 
-      - name: Build vulture
-        run: make tempo-vulture
 
-      - name: Build tempo-cli
-        run: make tempo-cli
 
-  benchmark:
-    name: Benchmark
+  cd-to-dev-env:
+    # This job deploys the latest main commit to the dev environment
     runs-on: ubuntu-24.04
     steps:
-      - name: Check out code
+      - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: "go.mod"
-
-      - name: Bench
-        run: make test-bench
+      - name: fetch tags
+        run: git fetch --tags
 
-  vendor-check:
-    name: Vendor check
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
+      - name: get-tag
+        run: |
+          echo "grafana/tempo:$(./tools/image-tag)" > .tags-for-cd-tempo
+          echo "grafana/tempo-query:$(./tools/image-tag)" > .tags-for-cd-tempo_query
+          echo "grafana/tempo-vulture:$(./tools/image-tag)" > .tags-for-cd-tempo_vulture
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
+      - name: Authenticate to GAR
+        uses: grafana/shared-workflows/actions/login-to-gar@main
+        id: login-to-gar
         with:
-          go-version-file: "go.mod"
+          registry: us-docker.pkg.dev
+          environment: prod
 
-      - name: Install Protoc
-        uses: arduino/setup-protoc@v3
-
-      - name: Check vendor
-        run: make vendor-check
-
-  tempo-jsonnet:
-    name: Check jsonnet & tempo-mixin
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
+      - name: Get Vault secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main
         with:
-          go-version-file: "go.mod"
+          common_secrets: |
+            GITHUB_APP_ID=updater-app:app-id
+            GITHUB_APP_INSTALLATION_ID=updater-app:app-installation-id
+            GITHUB_APP_PRIVATE_KEY=updater-app:private-key
 
-      - name: Check jsonnet
-        run: make jsonnet-check
-
-      - name: Check tempo-mixin
-        run: make tempo-mixin-check
-
-      - name: Test jsonnet
-        run: make jsonnet-test
+      - name: Update jsonnet
+        run: |
+          set -e -o pipefail
+
+          cat << EOF > config.json
+          {
+            "destination_branch": "master",
+            "pull_request_branch_prefix": "auto-merge/cd-tempo-dev",
+            "pull_request_enabled": true,
+            "pull_request_existing_strategy": "ignore",
+            "repo_name": "deployment_tools",
+            "update_jsonnet_attribute_configs": [
+              {
+                "file_path": "ksonnet/environments/tempo/dev-us-central-0.tempo-dev-01/images.libsonnet",
+                "jsonnet_key": "tempo",
+                "jsonnet_value_file": ".tags-for-cd-tempo"
+              },
+              {
+                "file_path": "ksonnet/environments/tempo/dev-us-central-0.tempo-dev-01/images.libsonnet",
+                "jsonnet_key": "tempo_query",
+                "jsonnet_value_file": ".tags-for-cd-tempo_query"
+              },
+              {
+                "file_path": "ksonnet/environments/tempo/dev-us-central-0.tempo-dev-01/images.libsonnet",
+                "jsonnet_key": "tempo_vulture",
+                "jsonnet_value_file": ".tags-for-cd-tempo_vulture"
+              }
+            ]
+          }
+          EOF
 
-  build-technical-documentation:
-    name: Build technical documentation
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
-      - name: Build Website
-        run: docker run -v ${PWD}/docs/sources:/hugo/content/docs/tempo/latest --rm grafana/docs-base:latest make prod
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 9b80c17133d6..fb5170c5fc7a 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -22,8 +22,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          fetch-tags: true
+
+      - name: fetch tags
+        run: git fetch --tags
 
       - id: get-tag
         run: |
@@ -42,45 +43,36 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          fetch-tags: true
 
-      - name: Login to DockerHub
-        uses: grafana/shared-workflows/actions/dockerhub-login@dockerhub-login-v1.0.0
+      - name: fetch tags
+        run: git fetch --tags
 
       - name: build-tempo-binaries
         run: |
           COMPONENT=${{ matrix.component }} GOARCH=${{ matrix.runner_arch.arch }} make exe
 
-      - name: docker-build-and-push-tempo
+      - name: docker-build
         run: |
           TAG_ARCH="$TAG-${{ matrix.runner_arch.arch }}"
-          docker build -f cmd/${{ matrix.component }}/Dockerfile -t grafana/${{ matrix.component }}:TAG_ARCH .
-          docker push grafana/${{ matrix.component }}:TAG_ARCH
+          docker build -f cmd/${{ matrix.component }}/Dockerfile -t grafana/${{ matrix.component }}:$TAG_ARCH .
 
-      - name: docker-manifest-create-and-push
+      - name: Login to DockerHub
+        uses: grafana/shared-workflows/actions/dockerhub-login@dockerhub-login-v1.0.0
+
+      - name: docker-push
         run: |
-          docker manifest create \
-          	grafana/${{ matrix.component }}:$TAG               \
-          	--amend grafana/${{ matrix.component }}:$TAG-amd64  \
-          	--amend grafana/${{ matrix.component }}:$TAG-arm64 
-          docker manifest push grafana/${{ matrix.component }}:$TAG
-
-          docker manifest create \
-          	grafana/${{ matrix.component }}:latest            \
-          	--amend grafana/${{ matrix.component }}:$TAG-amd64   \
-          	--amend grafana/${{ matrix.component }}:$TAG-arm64 
-          docker manifest push grafana/${{ matrix.component }}:latest
+            docker push grafana/${{ matrix.component }}:$TAG_ARCH
+
 
   cd-to-dev-env:
     # This job deploys the latest main commit to the dev environment
-    if: github.repository == 'grafana/tempo' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          fetch-tags: true
+
+      - name: fetch tags
+        run: git fetch --tags
 
       - name: get-tag
         run: |