diff --git a/.github/ISSUE_TEMPLATE/epic.md b/.github/ISSUE_TEMPLATE/epic.md
new file mode 100644
index 00000000000..27d4e3a440e
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/epic.md
@@ -0,0 +1,35 @@
+---
+name: Epic
+about: Tracks a shippable unit of work
+title: '[Epic] {your-title-here}'
+labels: kind/epic
+projects: ['pulumi/32']
+assignees: ''
+type: Epic
+---
+
+## Overview
+<!-- Start with a one- to three-sentence summary that should be understandable by any Pulumian or community member, even those without any context on the work. -->
+
+## Key KPIs
+<!-- What KPIs should this Epic will move; what could we measure to observe that this project was successful? -->
+
+## Key Stakeholders
+- Product and Engineering: <!-- Teams and individuals involved in the design and implementation -->
+- Documentation: <!-- Representative from the docs team -->
+- Marketing/Partnerships: <!-- Representative from the Marketing team -->
+- Customers: <!-- [Tracking Issue](add-link-and-uncomment) -->
+
+## Key Deliverables
+<!-- List any discrete chunks of work or milestones that are planned in the epic (eg. subcomponent A, dogfood release, beta, etc.) -->
+
+### References 📔
+
+<!-- Any project that is more than one iteration should have a Project Board using this [template](https://github.com/orgs/pulumi/projects/131).  -->
+- [ ] Project View <!-- [Link](add-link-and-uncomment) -->
+- [ ] PR/FAQ <!-- [Link](add-link-and-uncomment) -->
+- [ ] Design Doc <!-- [Link](add-link-and-uncomment) -->
+- [ ] UX Designs <!-- [Link](add-link-and-uncomment) -->
+- [ ] Decision Log <!-- [Link](add-link-and-uncomment) -->
+
+<!-- Work items should be added to the project board linked above  -->
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f8edde6f8cf..e1f366f66b8 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -40,7 +40,7 @@ jobs:
       uses: actions/setup-go@v5
       with:
         # The versions of golangci-lint and setup-go here cross-depend and need to update together.
-        go-version: 1.22
+        go-version: 1.23
         # Either this action or golangci-lint needs to disable the cache
         cache: false
     - name: disarm go:embed directives to enable lint
@@ -53,5 +53,5 @@ jobs:
     - name: golangci-lint
       uses: golangci/golangci-lint-action@v6
       with:
-        version: v1.58.0
+        version: v1.60
         working-directory: provider
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d1cc7837eb5..4109f921b67 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,10 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+name: release
+on:
+  push:
+    tags:
+    - v*.*.*
+    - "!v*.*.*-**"
 
 env:
   AWS_REGION: us-west-2
@@ -352,10 +358,3 @@ jobs:
               make provider-lint
       timeout-minutes: 60
 
-
-name: release
-on:
-  push:
-    tags:
-    - v*.*.*
-    - "!v*.*.*-**"
diff --git a/.github/workflows/run-upstream-tests.yml b/.github/workflows/run-upstream-tests.yml
deleted file mode 100644
index d3d8bd7ae5e..00000000000
--- a/.github/workflows/run-upstream-tests.yml
+++ /dev/null
@@ -1,75 +0,0 @@
-name: run-upstream-tests
-
-description: |
-  Run upstream tests against the patched version of the upstream (terraform-provider-aws) provider.
-
-  This job will run acceptance tests that do provision actual AWS resources. See also:
-
-    ./upstream/docs/running-and-writing-acceptance-tests.md
-
-  One notable problem is that tag-related tests do not currently pass for the patched provider, since the Pulumi bridged
-  provider handles tagging at a higher level. These tests are currently skipped.
-
-  The job matrix is organized by service, corresponding to `ls ./upstream/internal/service` folders.
-
-  Note that adding new services needs to be done with care because test failures may leave unsupervised resources in the
-  test account causing an increase in burn rate, so that account cleaners need to be extended for each new service.
-
-  The primary goal for additional coverage is testing services that have Pulumi patches that may accidentally regress
-  desired upstream behavior.
-
-on:
-  pull_request:
-    paths-ignore:
-    - CHANGELOG.md
-
-env:
-  PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
-  AWS_REGION: us-west-2
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  TF_APPEND_USER_AGENT: pulumi
-
-# This should cancel any previous runs of the same workflow on the same branch which are still running. This exacerbates
-# the problem of leaked resources but results in better utilization of limited CI runner time in the case of rapid-fire
-# pushes, and currently is the preferred trade-off.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  upstream_tests:
-    name: upstream_tests
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        service:
-          - sqs
-          - waf
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ env.PR_COMMIT_SHA }}
-          submodules: true
-      - name: make upstream
-        run: make upstream
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: 1.22.x
-          cache-dependency-path: |
-            upstream/go.sum
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-region: ${{ env.AWS_REGION }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          role-duration-seconds: 3600
-          role-session-name: aws@githubActions
-          role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
-      - name: Test ${{ matrix.service }}
-        run: |
-          cd upstream
-          TF_ACC=1 make testacc GO_VER=go PKG=${{ matrix.service }} ACCTEST_PARALLELISM=6 TESTARGS="-skip 'tags|.*/.*/Tags'"