diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
index 071e9ff..96cbf66 100644
--- a/.github/workflows/kernel-build.yml
+++ b/.github/workflows/kernel-build.yml
@@ -46,16 +46,13 @@ jobs:
     timeout-minutes: 100
     env:
         ARTIFACTS_ARCHIVE: "vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst"
-        BASE_BRANCH: >-
-          ${{ github.event_name == 'push' && github.ref_name
-              || github.base_ref
-              || 'bpf-next'
-          }}
         BUILD_SCHED_EXT_SELFTESTS: ${{ inputs.arch == 'x86_64' || inputs.arch == 'aarch64' && 'true' || '' }}
+        CACHED_KERNEL_BUILD: ${{ github.event_name == 'push' || github.repository == 'libbpf/ci'  && 'true' || '' }}
         KBUILD_OUTPUT: ${{ github.workspace }}/kbuild-output
         KERNEL: ${{ inputs.kernel }}
         REPO_PATH: ""
         REPO_ROOT: ${{ github.workspace }}
+        KERNEL_ROOT: ${{ github.workspace }}
     steps:
       - uses: actions/checkout@v4
         # We fetch an actual bit of history here to facilitate incremental
@@ -64,23 +61,32 @@ jobs:
           fetch-depth: 50
       - if: ${{ inputs.download_sources }}
         name: Download bpf-next tree
+        env:
+          FETCH_DEPTH: ${{ env.CACHED_KERNEL_BUILD && 16 || 0 }}
         uses: ./get-linux-source
         with:
           dest: '.kernel'
-      - if: ${{ inputs.download_sources }}
-        name: Move linux source in place
-        shell: bash
-        run: |
-          rm -rf .kernel/.git
-          cp -rf .kernel/. .
-          rm -rf .kernel
-      - uses: ./prepare-incremental-build
+      - if: ${{ env.CACHED_KERNEL_BUILD }}
+        uses: ./prepare-incremental-build
         with:
-          repo-root: ${{ env.REPO_ROOT }}
-          base-branch: ${{ env.BASE_BRANCH }}
+          repo-root: ${{ inputs.download_sources && '.kernel' || env.REPO_ROOT }}
+          base-branch: >-
+            ${{    github.repository == 'kernel-patches/bpf' && github.event_name == 'push' && github.ref_name
+                || github.repository == 'kernel-patches/bpf' && github.event_name != 'push' && github.base_ref
+                || 'master'
+             }}
           arch: ${{ inputs.arch }}
           toolchain_full: ${{ inputs.toolchain_full }}
           kbuild-output: ${{ env.KBUILD_OUTPUT }}
+      - if: ${{ inputs.download_sources }}
+        name: Move linux source in place
+        shell: bash
+        run: |
+          cd .kernel
+          rm -rf .git
+          mv -t .. $(ls -A)
+          cd ..
+          rmdir .kernel
       - uses:  ./patch-kernel
         with:
           patches-root: '${{ github.workspace }}/ci/diffs'
@@ -109,17 +115,15 @@ jobs:
           llvm-version: ${{ inputs.llvm-version }}
       - name: Build selftests/bpf
         uses: ./build-selftests
+        env:
+          MAX_MAKE_JOBS: 32
+          RELEASE: ${{ inputs.release && '1' || '' }}
         with:
           arch: ${{ inputs.arch }}
-          toolchain: ${{ inputs.toolchain }}
-          kbuild-output: ${{ env.KBUILD_OUTPUT }}
-          max-make-jobs: 32
+          kernel-root: ${{ env.KERNEL_ROOT }}
           llvm-version: ${{ inputs.llvm-version }}
-        env:
-          # RELEASE= disables all optimizaions
-          # RELEASE=0 adds -O0 make flag
-          # RELEASE=1 adds -O2 make flag
-          RELEASE: ${{ inputs.release && '1' || '' }}
+          toolchain: ${{ inputs.toolchain }}
+
       - if: ${{ env.BUILD_SCHED_EXT_SELFTESTS }}
         name: Build selftests/sched_ext
         uses: ./build-scx-selftests
@@ -151,7 +155,7 @@ jobs:
           archive: ${{ env.ARTIFACTS_ARCHIVE }}
           kbuild-output: ${{ env.KBUILD_OUTPUT }}
           repo-root: ${{ env.REPO_ROOT }}
-      - if: ${{ github.event_name != 'push' }}
+      - if: ${{ ! env.CACHED_KERNEL_BUILD }}
         name: Remove KBUILD_OUTPUT content
         shell: bash
         run: |
diff --git a/.github/workflows/kernel-test.yml b/.github/workflows/kernel-test.yml
index 21efc04..f2386ce 100644
--- a/.github/workflows/kernel-test.yml
+++ b/.github/workflows/kernel-test.yml
@@ -38,21 +38,46 @@ jobs:
     runs-on: ${{ fromJSON(inputs.runs_on) }}
     timeout-minutes: 100
     env:
+      ARCH: ${{ inputs.arch }}
       KERNEL: ${{ inputs.kernel }}
       REPO_ROOT: ${{ github.workspace }}
       REPO_PATH: ""
       # https://github.com/actions/runner/issues/1483#issuecomment-1031671517
       # booleans are weird in GH.
       CONTINUE_ON_ERROR: ${{ inputs.continue_on_error }}
+      DEPLOYMENT: ${{ github.repository == 'kernel-patches/bpf' && 'prod' || 'rc' }}
+      ALLOWLIST_FILE: /tmp/allowlist
+      DENYLIST_FILE: /tmp/denylist
     steps:
       - uses: actions/checkout@v4
+
       - uses: actions/download-artifact@v4
         with:
           name: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}
           path: .
+
       - name: Untar artifacts
         # zstd is installed by default in the runner images.
         run: zstd -d -T0  vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst --stdout | tar -xf -
+
+      - name: Prepare ALLOW/DENYLIST
+        env:
+          SELFTESTS_BPF: ${{ github.workspace }}/selftests/bpf
+          VMTEST_CONFIGS: ${{ github.workspace }}/ci/vmtest/configs
+        run: |
+          cat "${SELFTESTS_BPF}/ALLOWLIST"          \
+              "${SELFTESTS_BPF}/ALLOWLIST.${ARCH}"  \
+              "${VMTEST_CONFIGS}/ALLOWLIST"         \
+              "${VMTEST_CONFIGS}/ALLOWLIST.${ARCH}" \
+            2> /dev/null > "${ALLOWLIST_FILE}" || true
+
+          cat "${SELFTESTS_BPF}/DENYLIST" \
+              "${SELFTESTS_BPF}/DENYLIST.${ARCH}" \
+              "${VMTEST_CONFIGS}/DENYLIST" \
+              "${VMTEST_CONFIGS}/DENYLIST.${ARCH}" \
+              "${VMTEST_CONFIGS}/DENYLIST.${DEPLOYMENT}" \
+            2> /dev/null > "${DENYLIST_FILE}" || true
+
       - name: Run selftests
         uses: ./run-vmtest
         # https://github.com/actions/runner/issues/1483#issuecomment-1031671517