diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6acc0918..7e19527f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,14 +7,9 @@ updates:
       interval: "daily"
     open-pull-requests-limit: 10
     groups:
-      dotnet:
+      actions:
         patterns:
           - "*" # Prefer a single PR per solution update.
-  # Docker Images
-  - package-ecosystem: "docker"
-    directory: "/"
-    schedule:
-      interval: "daily"
   # Dotnet SDK
   - package-ecosystem: "dotnet-sdk"
     directory: "/"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 39fa22dd..b6d58227 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,21 +33,8 @@ jobs:
         run: dotnet build -c Release
 
       - name: Test with coverage
-        run: >
-          dotnet test -c Release --no-build --
-          --coverage
-          --coverage-output-format cobertura
-          --coverage-output coverage.cobertura.xml
-
-      - name: Restore tools
-        run: dotnet tool restore
-
-      - name: Generate coverage report & badges
-        run: >
-          dotnet reportgenerator
-          -reports:"**/TestResults/coverage.cobertura.xml"
-          -targetdir:"./CoverageReport"
-          -reporttypes:"Html;Badges"
+        shell: pwsh
+        run: ./eng/coverage.ps1 -NoBuild
 
       - name: Upload coverage report
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
diff --git a/Vulthil.SharedKernel.slnx b/Vulthil.SharedKernel.slnx
index 0217d530..2fd956a9 100644
--- a/Vulthil.SharedKernel.slnx
+++ b/Vulthil.SharedKernel.slnx
@@ -11,9 +11,11 @@
     <File Path=".github/instructions/style-guidelines.instructions.md" />
   </Folder>
   <Folder Name="/.github/workflows/">
+    <File Path=".github/workflows/backport.yml" />
     <File Path=".github/workflows/ci.yml" />
     <File Path=".github/workflows/claude-code-review.yml" />
     <File Path=".github/workflows/claude.yml" />
+    <File Path=".github/workflows/codeql.yml" />
     <File Path=".github/workflows/dependabot-approve-and-automerge.yml" />
     <File Path=".github/workflows/docs.yml" />
     <File Path=".github/workflows/release.yml" />
@@ -22,6 +24,9 @@
   <Folder Name="/docs/">
     <File Path="docs/docfx.json" />
   </Folder>
+  <Folder Name="/eng/">
+    <File Path="eng/coverage.ps1" />
+  </Folder>
   <Folder Name="/samples/">
     <File Path="samples/aspire.config.json" />
     <File Path="samples/Directory.Build.props" />
@@ -50,15 +55,8 @@
     <File Path="Directory.Packages.props" />
     <File Path="global.json" />
     <File Path="README.md" />
-    <File Path="test-reports" />
     <File Path="version.json" />
     <File Path="Vulthil.SharedKernel.png" />
-    <File Path="watch" />
-    <File Path="watch-samples" />
-  </Folder>
-  <Folder Name="/Solution Items/TestReports/">
-    <File Path="TestReports/Cobertura.xml" />
-    <File Path="TestReports/index.html" />
   </Folder>
   <Folder Name="/src/">
     <File Path="src/Directory.Build.props" />
diff --git a/eng/coverage.ps1 b/eng/coverage.ps1
new file mode 100644
index 00000000..acac8364
--- /dev/null
+++ b/eng/coverage.ps1
@@ -0,0 +1,23 @@
+# Single source of truth for the coverage commands run by ci.yml's "Test with
+# coverage" step -- keep this script and that step in sync; ci.yml invokes
+# this script directly instead of duplicating the commands below.
+
+param(
+    [switch]$NoBuild
+)
+
+$ErrorActionPreference = 'Stop'
+$PSNativeCommandUseErrorActionPreference = $true
+
+if (-not $NoBuild) {
+    dotnet build -c Release
+}
+
+dotnet test -c Release --no-build -- --coverage --coverage-output-format cobertura --coverage-output coverage.cobertura.xml
+
+dotnet tool restore
+
+dotnet reportgenerator -reports:"**/TestResults/coverage.cobertura.xml" -targetdir:"./CoverageReport" -reporttypes:"Html;Badges"
+
+$reportPath = Join-Path $PWD "CoverageReport" "index.html"
+Write-Host "Coverage report: $reportPath"
diff --git a/test-reports b/test-reports
deleted file mode 100644
index bbc10d3a..00000000
--- a/test-reports
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/bin/bash
-
-# Save the current working directory
-original_dir=$(pwd)
-
-# Find and remove all TestResults folders before running tests
-find . -type d -name "TestResults" -exec rm -rf {} +
-
-test_projects=$(find . -type f -name "Vulthil.*.Tests.csproj" | xargs -n1 dirname | sort -u)
-
-# Run `dotnet test` in parallel for each test project
-pids=()
-for project_dir in $test_projects; do
-  (
-    cd "$project_dir" || exit
-    dotnet test -c Release --coverage --coverage-output-format cobertura --coverage-output coverage.cobertura.xml
-  ) &
-  pids+=($!)
-done
-
-# Wait for all background processes to finish
-trap "kill ${pids[*]} 2>/dev/null; cd \"$original_dir\"; exit" INT TERM
-wait
-
-dotnet reportgenerator -reports:**/TestResults/**/*.cobertura.xml -targetdir:./TestReports -reporttypes:"Cobertura;Html;Badges"
-
-# Restore the original working directory
-cd "$original_dir"
-
diff --git a/watch b/watch
deleted file mode 100644
index 47e84ddd..00000000
--- a/watch
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/bash
-
-# Save the current working directory
-original_dir=$(pwd)
-
-# Find all test project directories containing a *.Tests.csproj file
-test_projects=$(find . -type f -name "Vulthil.*.Tests.csproj" | xargs -n1 dirname | sort -u)
-
-# Run `dotnet watch test` in parallel for each test project
-pids=()
-for project_dir in $test_projects; do
-  (
-    cd "$project_dir" || exit
-    dotnet watch test
-  ) &
-  pids+=($!)
-done
-
-# Wait for all background processes to finish
-trap "kill ${pids[*]} 2>/dev/null; cd \"$original_dir\"; exit" INT TERM
-wait
-
-# Restore the original working directory
-cd "$original_dir"
-
diff --git a/watch-samples b/watch-samples
deleted file mode 100644
index f70cf5c0..00000000
--- a/watch-samples
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/bash
-
-# Save the current working directory
-original_dir=$(pwd)
-
-# Find all test project directories containing a *.Tests.csproj file
-test_projects=$(find ./samples -type f -name "*.Tests.csproj" | xargs -n1 dirname | sort -u)
-
-# Run `dotnet watch test` in parallel for each test project
-pids=()
-for project_dir in $test_projects; do
-  (
-    cd "$project_dir" || exit
-    dotnet watch test
-  ) &
-  pids+=($!)
-done
-
-# Wait for all background processes to finish
-trap "kill ${pids[*]} 2>/dev/null; cd \"$original_dir\"; exit" INT TERM
-wait
-
-# Restore the original working directory
-cd "$original_dir"
-