diff --git a/.github/workflows/auto-cache-restore/action.yaml b/.github/workflows/auto-cache-restore/action.yaml
new file mode 100644
index 00000000000000..0aab3b3eef7422
--- /dev/null
+++ b/.github/workflows/auto-cache-restore/action.yaml
@@ -0,0 +1,34 @@
+name: 'automatically cache based on current runner'
+
+inputs:
+  path:
+    description: 'path to cache'
+    required: true
+  key:
+    description: 'key'
+    required: true
+  restore-keys:
+    description: 'restore-keys'
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: setup namespace cache
+      if: ${{ contains(runner.name, 'nsc') }} 
+      uses: namespacelabs/nscloud-cache-action@v1
+      with:
+        path: ${{ inputs.path }}
+
+    - name: setup github cache
+      if: ${{ !contains(runner.name, 'nsc') }}
+      uses: actions/cache/restore@v3
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}
+        restore-keys: ${{ inputs.restore-keys }}
+
+    # make the directory manually in case we didn't get a hit, so it doesn't fail on future steps
+    - id: scons-cache-setup
+      shell: bash
+      run: mkdir -p ${{ inputs.path }}
diff --git a/.github/workflows/compile-openpilot/action.yaml b/.github/workflows/compile-openpilot/action.yaml
index 8775c962620a2f..2945b67d2e8138 100644
--- a/.github/workflows/compile-openpilot/action.yaml
+++ b/.github/workflows/compile-openpilot/action.yaml
@@ -1,11 +1,5 @@
 name: 'compile openpilot'
 
-inputs:
-  cache_key_prefix:
-    description: 'Prefix for caching key'
-    required: false
-    default: 'scons'
-
 runs:
   using: "composite"
   steps:
@@ -24,4 +18,4 @@ runs:
       if: github.ref == 'refs/heads/master'
       with:
         path: .ci_cache/scons_cache
-        key: ${{ inputs.cache_key_prefix }}-${{ env.CACHE_COMMIT_DATE }}-${{ github.sha }}
+        key: scons-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}-${{ github.sha }}
diff --git a/.github/workflows/selfdrive_tests.yaml b/.github/workflows/selfdrive_tests.yaml
index b9e80e9f74d303..dfd3570d4f66de 100644
--- a/.github/workflows/selfdrive_tests.yaml
+++ b/.github/workflows/selfdrive_tests.yaml
@@ -75,7 +75,7 @@ jobs:
            ((github.repository == 'commaai/openpilot') &&
               ((github.event_name != 'pull_request') || 
                (github.event.pull_request.head.repo.full_name == 'commaai/openpilot'))) && '["x86_64", "aarch64"]' || '["x86_64"]' ) }}
-    runs-on: ${{ (matrix.arch == 'aarch64') && 'buildjet-2vcpu-ubuntu-2204-arm' || 'ubuntu-20.04' }}
+    runs-on: ${{ (matrix.arch == 'aarch64') && 'namespace-profile-arm64-2x8' || 'ubuntu-20.04' }}
     steps:
     - uses: actions/checkout@v4
       with:
@@ -83,18 +83,15 @@ jobs:
     - uses: ./.github/workflows/setup-with-retry
       with:
         docker_hub_pat: ${{ secrets.DOCKER_HUB_PAT }}
-        cache_key_prefix: scons_${{ matrix.arch }}
     - uses: ./.github/workflows/compile-openpilot
       timeout-minutes: ${{ ((steps.restore-scons-cache.outputs.cache-hit == 'true') && 15 || 30) }} # allow more time when we missed the scons cache
-      with:
-        cache_key_prefix: scons_${{ matrix.arch }}
 
   docker_push:
     name: docker push
     strategy:
       matrix:
         arch: ${{ fromJson( (github.repository == 'commaai/openpilot') && '["x86_64", "aarch64"]' || '["x86_64"]' ) }}
-    runs-on: ${{ (matrix.arch == 'aarch64') && 'buildjet-2vcpu-ubuntu-2204-arm' || 'ubuntu-20.04' }}
+    runs-on: ${{ (matrix.arch == 'aarch64') && 'namespace-profile-arm64-2x8' || 'ubuntu-20.04' }}
     if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' && github.repository == 'commaai/openpilot'
     steps:
     - uses: actions/checkout@v4
@@ -133,7 +130,9 @@ jobs:
 
   static_analysis:
     name: static analysis
-    runs-on: ubuntu-20.04
+    runs-on: ${{ ((github.repository == 'commaai/openpilot') &&
+                   ((github.event_name != 'pull_request') || 
+                    (github.event.pull_request.head.repo.full_name == 'commaai/openpilot'))) && 'namespace-profile-amd64-8x16' || 'ubuntu-20.04' }}
     steps:
     - uses: actions/checkout@v4
       with:
@@ -165,7 +164,7 @@ jobs:
     name: unit tests
     runs-on: ${{ ((github.repository == 'commaai/openpilot') &&
                    ((github.event_name != 'pull_request') || 
-                    (github.event.pull_request.head.repo.full_name == 'commaai/openpilot'))) && 'buildjet-8vcpu-ubuntu-2004' || 'ubuntu-20.04' }}
+                    (github.event.pull_request.head.repo.full_name == 'commaai/openpilot'))) && 'namespace-profile-amd64-8x16' || 'ubuntu-20.04' }}
     steps:
     - uses: actions/checkout@v4
       with:
@@ -181,7 +180,7 @@ jobs:
       run: |
         ${{ env.RUN }} "source selfdrive/test/setup_xvfb.sh && \
                         export MAPBOX_TOKEN='pk.eyJ1Ijoiam5ld2IiLCJhIjoiY2xxNW8zZXprMGw1ZzJwbzZneHd2NHljbSJ9.gV7VPRfbXFetD-1OVF0XZg' && \
-                        $PYTEST --timeout 40 -m 'not slow' && \
+                        $PYTEST --timeout 40 -m 'not slow' -n $(nproc) && \
                         ./selfdrive/ui/tests/create_test_translations.sh && \
                         QT_QPA_PLATFORM=offscreen ./selfdrive/ui/tests/test_translations && \
                         ./selfdrive/ui/tests/test_translations.py"
@@ -196,7 +195,7 @@ jobs:
     name: process replay
     runs-on: ${{ ((github.repository == 'commaai/openpilot') &&
                    ((github.event_name != 'pull_request') || 
-                    (github.event.pull_request.head.repo.full_name == 'commaai/openpilot'))) && 'buildjet-8vcpu-ubuntu-2004' || 'ubuntu-20.04' }}
+                    (github.event.pull_request.head.repo.full_name == 'commaai/openpilot'))) && 'namespace-profile-amd64-8x16' || 'ubuntu-20.04' }}
     steps:
     - uses: actions/checkout@v4
       with:
diff --git a/.github/workflows/setup-with-retry/action.yaml b/.github/workflows/setup-with-retry/action.yaml
index e0da746b4452f9..369ac45c9a81f6 100644
--- a/.github/workflows/setup-with-retry/action.yaml
+++ b/.github/workflows/setup-with-retry/action.yaml
@@ -5,10 +5,6 @@ inputs:
     description: 'Auth token for Docker Hub, required for BuildJet jobs'
     required: false
     default: ''
-  cache_key_prefix:
-    description: 'Prefix for caching key'
-    required: false
-    default: 'scons_x86_64'
   sleep_time:
     description: 'Time to sleep between retries'
     required: false
@@ -22,7 +18,6 @@ runs:
       continue-on-error: true
       with:
         docker_hub_pat: ${{ inputs.docker_hub_pat }}
-        cache_key_prefix: ${{ inputs.cache_key_prefix }}
         is_retried: true
     - if: steps.setup1.outcome == 'failure'
       shell: bash
@@ -33,7 +28,6 @@ runs:
       continue-on-error: true
       with:
         docker_hub_pat: ${{ inputs.docker_hub_pat }}
-        cache_key_prefix: ${{ inputs.cache_key_prefix }}
         is_retried: true
     - if: steps.setup2.outcome == 'failure'
       shell: bash
@@ -43,5 +37,4 @@ runs:
       uses: ./.github/workflows/setup
       with:
         docker_hub_pat: ${{ inputs.docker_hub_pat }}
-        cache_key_prefix: ${{ inputs.cache_key_prefix }}
         is_retried: true
diff --git a/.github/workflows/setup/action.yaml b/.github/workflows/setup/action.yaml
index 8bb1ccc3766f50..ec1626c01b5ea5 100644
--- a/.github/workflows/setup/action.yaml
+++ b/.github/workflows/setup/action.yaml
@@ -5,10 +5,6 @@ inputs:
     description: 'Auth token for Docker Hub, required for BuildJet jobs'
     required: true
     default: ''
-  cache_key_prefix:
-    description: 'Prefix for caching key'
-    required: true
-    default: 'scons_x86_64'
   is_retried:
     description: 'A mock param that asserts that we use the setup-with-retry instead of this action directly'
     required: false
@@ -47,19 +43,14 @@ runs:
       run: echo "CACHE_COMMIT_DATE=$(git log -1 --pretty='format:%cd' --date=format:'%Y-%m-%d-%H:%M')" >> $GITHUB_ENV
     - shell: bash
       run: echo "$CACHE_COMMIT_DATE"
-    - id: restore-scons-cache
-      uses: actions/cache/restore@v3
+    - id: scons-cache
+      uses: ./.github/workflows/auto-cache-restore
       with:
         path: .ci_cache/scons_cache
-        key: ${{ inputs.cache_key_prefix }}-${{ env.CACHE_COMMIT_DATE }}-${{ github.sha }}
+        key: scons-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}-${{ github.sha }}
         restore-keys: |
-          ${{ inputs.cache_key_prefix }}-${{ env.CACHE_COMMIT_DATE }}-
-          ${{ inputs.cache_key_prefix }}-
-    # if we didn't get a cache hit, make the directory manually so it doesn't fail on future steps
-    - id: scons-cache-setup
-      shell: bash
-      if: steps.restore-scons-cache.outputs.cache-hit != 'true'
-      run: mkdir -p $GITHUB_WORKSPACE/.ci_cache/scons_cache
+          scons-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}
+          scons-${{ runner.arch }}
     # as suggested here: https://github.com/moby/moby/issues/32816#issuecomment-910030001
     - id: normalize-file-permissions
       shell: bash
@@ -67,12 +58,6 @@ runs:
       run: |
         find . -type f -executable -not -perm 755 -exec chmod 755 {} \;
         find . -type f -not -executable -not -perm 644 -exec chmod 644 {} \;
-    - id: setup-buildx-action
-      if: contains(runner.name, 'buildjet')
-      name: Set up Docker Buildx on buildjet to ensure a consistent cache
-      uses: docker/setup-buildx-action@v2
-      with:
-        driver: docker-container
     # build our docker image
     - shell: bash
       run: eval ${{ env.BUILD }}
\ No newline at end of file
diff --git a/.github/workflows/tools_tests.yaml b/.github/workflows/tools_tests.yaml
index f549ece1b1ca41..5cecfb7e4e917e 100644
--- a/.github/workflows/tools_tests.yaml
+++ b/.github/workflows/tools_tests.yaml
@@ -81,7 +81,7 @@ jobs:
     - name: Run dev container
       run: |
         mkdir -p /tmp/devcontainer_scons_cache/
-        cp -r $GITHUB_WORKSPACE/.ci_cache/scons_cache/* /tmp/devcontainer_scons_cache/
+        cp -r $GITHUB_WORKSPACE/.ci_cache/scons_cache/. /tmp/devcontainer_scons_cache/
         devcontainer up --workspace-folder .
     - name: Test environment
       run: |
diff --git a/selfdrive/test/docker_build.sh b/selfdrive/test/docker_build.sh
index bd8c34c4727ac7..5f77ceb10d9c7e 100755
--- a/selfdrive/test/docker_build.sh
+++ b/selfdrive/test/docker_build.sh
@@ -17,7 +17,7 @@ fi
 
 source $SCRIPT_DIR/docker_common.sh $1 "$TAG_SUFFIX"
 
-DOCKER_BUILDKIT=1 docker buildx build --pull --platform $PLATFORM --load --cache-to type=inline --cache-from type=registry,ref=$REMOTE_TAG -t $REMOTE_TAG -t $LOCAL_TAG -f $OPENPILOT_DIR/$DOCKER_FILE $OPENPILOT_DIR
+DOCKER_BUILDKIT=1 docker buildx build --provenance false --pull --platform $PLATFORM --load --cache-to type=inline --cache-from type=registry,ref=$REMOTE_TAG -t $REMOTE_TAG -t $LOCAL_TAG -f $OPENPILOT_DIR/$DOCKER_FILE $OPENPILOT_DIR
 
 if [ -n "$PUSH_IMAGE" ]; then
   docker push $REMOTE_TAG