diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 827fc27b1e7..2f7319726f1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,6 +17,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.pr_number || format('sha-{0}', github.sha) }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   smoketests:
     needs: [lints]
@@ -1143,3 +1147,198 @@ jobs:
       - name: Verify crates/smoketests/tests/smoketests/mod.rs lists all entries
         run: |
           cargo ci smoketests check-mod-list
+
+  docs-build:
+    name: Docs build
+    runs-on: spacetimedb-new-runner-2
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: '22'
+
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: true
+
+      - name: Get pnpm store directory
+        working-directory: sdks/typescript
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - uses: actions/cache@v4
+        name: Setup pnpm cache
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install dependencies
+        working-directory: docs
+        run: pnpm install
+
+      - name: Docusaurus build
+        working-directory: docs
+        run: pnpm build
+
+  typescript-test:
+    name: TypeScript - Tests
+    runs-on: spacetimedb-new-runner-2
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: true
+
+      - name: Get pnpm store directory
+        shell: bash
+        working-directory: crates/bindings-typescript
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - uses: actions/cache@v4
+        name: Setup pnpm cache
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Build module library and SDK
+        working-directory: crates/bindings-typescript
+        run: pnpm build
+
+      - name: Run module library and SDK tests
+        working-directory: crates/bindings-typescript
+        run: pnpm test
+
+      # - name: Extract SpacetimeDB branch name from file
+      #   id: extract-branch
+      #   run: |
+      #     # Define the path to the branch file
+      #     BRANCH_FILE=".github/spacetimedb-branch.txt"
+
+      #     # Default to master if file doesn't exist
+      #     if [ ! -f "$BRANCH_FILE" ]; then
+      #       echo "::notice::No SpacetimeDB branch file found, using 'master'"
+      #       echo "branch=master" >> $GITHUB_OUTPUT
+      #       exit 0
+      #     fi
+
+      #     # Read and trim whitespace from the file
+      #     branch=$(cat "$BRANCH_FILE" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+
+      #     # Fallback to master if empty
+      #     if [ -z "$branch" ]; then
+      #       echo "::warning::SpacetimeDB branch file is empty, using 'master'"
+      #       branch="master"
+      #     fi
+
+      #     echo "branch=$branch" >> $GITHUB_OUTPUT
+      #     echo "Using SpacetimeDB branch from file: $branch"
+
+      - name: Install Rust toolchain
+        uses: dsherret/rust-toolchain-file@v1
+      - name: Set default rust toolchain
+        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ${{ github.workspace }}
+          shared-key: spacetimedb
+          # Let the main CI job save the cache since it builds the most things
+          save-if: false
+          prefix-key: v1
+
+      # This step shouldn't be needed, but somehow we end up with caches that are missing librusty_v8.a.
+      # ChatGPT suspects that this could be due to different build invocations using the same target dir,
+      # and this makes sense to me because we only see it in this job where we mix `cargo build -p` with
+      # `cargo build --manifest-path` (which apparently build different dependency trees).
+      # However, we've been unable to fix it so... /shrug
+      - name: Check v8 outputs
+        run: |
+          find "${CARGO_TARGET_DIR}"/ -type f | grep '[/_]v8' || true
+          if ! [ -f "${CARGO_TARGET_DIR}"/debug/gn_out/obj/librusty_v8.a ]; then
+            echo "Could not find v8 output file librusty_v8.a; rebuilding manually."
+            cargo clean -p v8 || true
+            cargo build -p v8
+          fi
+          if ! [ -f "${CARGO_TARGET_DIR}"/release/gn_out/obj/librusty_v8.a ]; then
+            echo "Could not find v8 output file librusty_v8.a; rebuilding manually."
+            cargo clean --release -p v8 || true
+            cargo build --release -p v8
+          fi
+
+      - name: Install SpacetimeDB CLI from the local checkout
+        run: |
+          export CARGO_HOME="$HOME/.cargo"
+          echo "$CARGO_HOME/bin" >> "$GITHUB_PATH"
+          cargo install --force --path crates/cli --locked --message-format=short
+          cargo install --force --path crates/standalone --locked --message-format=short
+          # Add a handy alias using the old binary name, so that we don't have to rewrite all scripts (incl. in submodules).
+          ln -sf $CARGO_HOME/bin/spacetimedb-cli $CARGO_HOME/bin/spacetime
+          # Clear any existing information
+          spacetime server clear -y
+
+      - name: Generate client bindings
+        working-directory: templates/chat-react-ts
+        run: |
+          pnpm generate
+
+      - name: Check for changes
+        working-directory: templates/chat-react-ts
+        run: |
+          "${GITHUB_WORKSPACE}"/tools/check-diff.sh src/module_bindings || {
+            echo "Error: Bindings are dirty. Please generate bindings again and commit them to this branch."
+            exit 1
+          }
+
+      # - name: Start SpacetimeDB
+      #   run: |
+      #     spacetime start &
+      #     disown
+
+      # - name: Publish module to SpacetimeDB
+      #   working-directory: SpacetimeDB/templates/quickstart-chat-typescript/spacetimedb
+      #   run: |
+      #     spacetime logout && spacetime login --server-issued-login local
+      #     spacetime publish -s local quickstart-chat -c -y
+
+      # - name: Publish module to SpacetimeDB
+      #   working-directory: SpacetimeDB/templates/quickstart-chat-typescript/spacetimedb
+      #   run: |
+      #     spacetime logs quickstart-chat
+
+      - name: Check that quickstart-chat builds
+        working-directory: templates/chat-react-ts
+        run: pnpm build
+
+      - name: Check that templates build
+        working-directory: templates/
+        run: pnpm -r --filter "./**" run build
+
+      - name: Check that subdirectories build
+        working-directory: crates/bindings-typescript
+        run: pnpm -r --filter "./**" run build
+
+      # - name: Run quickstart-chat tests
+      #   working-directory: examples/quickstart-chat
+      #   run: pnpm test
+      #
+      # # Run this step always, even if the previous steps fail
+      # - name: Print rows in the user table
+      #   if: always()
+      #   run: spacetime sql quickstart-chat "SELECT * FROM user"
diff --git a/.github/workflows/docs-test.yaml b/.github/workflows/docs-test.yaml
deleted file mode 100644
index b7233aad847..00000000000
--- a/.github/workflows/docs-test.yaml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: Docs / Test
-permissions:
-  contents: read
-
-on:
-  pull_request:
-
-jobs:
-  build:
-    runs-on: spacetimedb-new-runner-2
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '22'
-      
-      - uses: pnpm/action-setup@v4
-        with:
-          run_install: true
-
-      - name: Get pnpm store directory
-        working-directory: sdks/typescript
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-
-      - uses: actions/cache@v4
-        name: Setup pnpm cache
-        with:
-          path: ${{ env.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Install dependencies
-        working-directory: docs
-        run: pnpm install
-
-      - name: Docusaurus build
-        working-directory: docs
-        run: pnpm build
diff --git a/.github/workflows/typescript-test.yml b/.github/workflows/typescript-test.yml
deleted file mode 100644
index edbbe89fc83..00000000000
--- a/.github/workflows/typescript-test.yml
+++ /dev/null
@@ -1,169 +0,0 @@
-name: TypeScript - Tests
-
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-  merge_group:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || format('sha-{0}', github.sha) }}
-  cancel-in-progress: true
-
-jobs:
-  build-and-test:
-    runs-on: spacetimedb-new-runner-2
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - uses: pnpm/action-setup@v4
-        with:
-          run_install: true
-
-      - name: Get pnpm store directory
-        shell: bash
-        working-directory: crates/bindings-typescript
-        run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-
-      - uses: actions/cache@v4
-        name: Setup pnpm cache
-        with:
-          path: ${{ env.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-      
-      - name: Build module library and SDK
-        working-directory: crates/bindings-typescript
-        run: pnpm build
-
-      - name: Run module library and SDK tests
-        working-directory: crates/bindings-typescript 
-        run: pnpm test
-
-      # - name: Extract SpacetimeDB branch name from file
-      #   id: extract-branch
-      #   run: |
-      #     # Define the path to the branch file
-      #     BRANCH_FILE=".github/spacetimedb-branch.txt"
-
-      #     # Default to master if file doesn't exist
-      #     if [ ! -f "$BRANCH_FILE" ]; then
-      #       echo "::notice::No SpacetimeDB branch file found, using 'master'"
-      #       echo "branch=master" >> $GITHUB_OUTPUT
-      #       exit 0
-      #     fi
-
-      #     # Read and trim whitespace from the file
-      #     branch=$(cat "$BRANCH_FILE" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-
-      #     # Fallback to master if empty
-      #     if [ -z "$branch" ]; then
-      #       echo "::warning::SpacetimeDB branch file is empty, using 'master'"
-      #       branch="master"
-      #     fi
-
-      #     echo "branch=$branch" >> $GITHUB_OUTPUT
-      #     echo "Using SpacetimeDB branch from file: $branch"
-
-      - name: Install Rust toolchain
-        uses: dsherret/rust-toolchain-file@v1
-      - name: Set default rust toolchain
-        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)
-
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ${{ github.workspace }}
-          shared-key: spacetimedb
-          # Let the main CI job save the cache since it builds the most things
-          save-if: false
-          prefix-key: v1
-
-      # This step shouldn't be needed, but somehow we end up with caches that are missing librusty_v8.a.
-      # ChatGPT suspects that this could be due to different build invocations using the same target dir,
-      # and this makes sense to me because we only see it in this job where we mix `cargo build -p` with
-      # `cargo build --manifest-path` (which apparently build different dependency trees).
-      # However, we've been unable to fix it so... /shrug
-      - name: Check v8 outputs
-        run: |
-          find "${CARGO_TARGET_DIR}"/ -type f | grep '[/_]v8' || true
-          if ! [ -f "${CARGO_TARGET_DIR}"/debug/gn_out/obj/librusty_v8.a ]; then
-            echo "Could not find v8 output file librusty_v8.a; rebuilding manually."
-            cargo clean -p v8 || true
-            cargo build -p v8
-          fi
-          if ! [ -f "${CARGO_TARGET_DIR}"/release/gn_out/obj/librusty_v8.a ]; then
-            echo "Could not find v8 output file librusty_v8.a; rebuilding manually."
-            cargo clean --release -p v8 || true
-            cargo build --release -p v8
-          fi
-
-      - name: Install SpacetimeDB CLI from the local checkout
-        run: |
-          export CARGO_HOME="$HOME/.cargo"
-          echo "$CARGO_HOME/bin" >> "$GITHUB_PATH"
-          cargo install --force --path crates/cli --locked --message-format=short
-          cargo install --force --path crates/standalone --locked --message-format=short
-          # Add a handy alias using the old binary name, so that we don't have to rewrite all scripts (incl. in submodules).
-          ln -sf $CARGO_HOME/bin/spacetimedb-cli $CARGO_HOME/bin/spacetime
-          # Clear any existing information
-          spacetime server clear -y
-
-      - name: Generate client bindings
-        working-directory: templates/chat-react-ts
-        run: |
-          pnpm generate
-
-      - name: Check for changes
-        working-directory: templates/chat-react-ts
-        run: |
-          "${GITHUB_WORKSPACE}"/tools/check-diff.sh src/module_bindings || {
-            echo "Error: Bindings are dirty. Please generate bindings again and commit them to this branch."
-            exit 1
-          }
-
-      # - name: Start SpacetimeDB
-      #   run: |
-      #     spacetime start &
-      #     disown
-
-      # - name: Publish module to SpacetimeDB
-      #   working-directory: SpacetimeDB/templates/quickstart-chat-typescript/spacetimedb
-      #   run: |
-      #     spacetime logout && spacetime login --server-issued-login local
-      #     spacetime publish -s local quickstart-chat -c -y
-
-      # - name: Publish module to SpacetimeDB
-      #   working-directory: SpacetimeDB/templates/quickstart-chat-typescript/spacetimedb
-      #   run: |
-      #     spacetime logs quickstart-chat
-
-      - name: Check that quickstart-chat builds
-        working-directory: templates/chat-react-ts
-        run: pnpm build
-
-      - name: Check that templates build
-        working-directory: templates/
-        run: pnpm -r --filter "./**" run build
-
-      - name: Check that subdirectories build
-        working-directory: crates/bindings-typescript
-        run: pnpm -r --filter "./**" run build
-
-      # - name: Run quickstart-chat tests
-      #   working-directory: examples/quickstart-chat
-      #   run: pnpm test
-      #
-      # # Run this step always, even if the previous steps fail
-      # - name: Print rows in the user table
-      #   if: always()
-      #   run: spacetime sql quickstart-chat "SELECT * FROM user"