diff --git a/.github/actions/just/action.yml b/.github/actions/just/action.yml
new file mode 100644
index 0000000000..f52ffe41e3
--- /dev/null
+++ b/.github/actions/just/action.yml
@@ -0,0 +1,11 @@
+name: Install just
+description: Install the pinned just for jobs outside the nix dev shell, which already provides it.
+
+runs:
+  using: composite
+  steps:
+    # A checksum-verified prebuilt, so it costs seconds rather than a
+    # `cargo install`. Keep the version in step with nixpkgs' just in flake.lock.
+    - uses: taiki-e/install-action@9983c65e42da123ff25d1f78505eb6de315aa172 # v2.87.20
+      with:
+        tool: just@1.58.0
diff --git a/.github/justfile b/.github/justfile
index 8a3fb9ff67..1bccfc5338 100644
--- a/.github/justfile
+++ b/.github/justfile
@@ -1,9 +1,10 @@
 set working-directory := '..'
 
-# Lint GitHub Actions workflows and their alert coverage.
+# Lint GitHub Actions workflows, their alert coverage, and that every step runs a recipe.
 check:
     actionlint
     sh/gh/alert.sh check-coverage
+    bun sh/gh/check-runs.ts
 
 # Tests of the release tooling itself; nightly, not on every pull request.
 test:
@@ -11,3 +12,29 @@ test:
     sh/gh/release.test.sh
     python3 sh/rs/package-rename.test.py
     sh/go/publish-wrapper.test.sh
+    bash .claude/hooks/direnv.test.sh
+
+# Release workflow helpers, e.g. `just gh release parse-version moq-cli`.
+[positional-arguments]
+release *args:
+    sh/gh/release.sh "$@"
+
+# Post a failed run to Discord, or check that alert.yml covers every workflow.
+[positional-arguments]
+alert *args:
+    sh/gh/alert.sh "$@"
+
+# Render a Homebrew formula template for a release.
+[positional-arguments]
+formula *args:
+    sh/gh/render-formula.sh "$@"
+
+# Copy a rendered formula into a Homebrew tap checkout, migrating renamed formulae.
+[positional-arguments]
+install-formula *args:
+    python3 sh/gh/install-formula.py "$@"
+
+# Trigger the apt-repo and rpm-repo workflows for a release tag.
+[positional-arguments]
+trigger-repo-publish *args:
+    sh/gh/trigger-repo-publish.sh "$@"
diff --git a/.github/workflows/alert.yml b/.github/workflows/alert.yml
index 78d9c48125..006dfad7f7 100644
--- a/.github/workflows/alert.yml
+++ b/.github/workflows/alert.yml
@@ -78,6 +78,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Post to Discord
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
@@ -88,4 +90,4 @@ jobs:
           RUN_REF: ${{ github.event.workflow_run.head_branch }}
           RUN_TITLE: ${{ github.event.workflow_run.display_title }}
           RUN_ACTOR: ${{ github.event.workflow_run.triggering_actor.login }}
-        run: sh/gh/alert.sh discord
+        run: just gh alert discord
diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 9b8e9b4d85..44c6e807a4 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -50,7 +50,6 @@ concurrency:
 
 env:
   CARGO_NDK_VERSION: 4.1.2
-  JUST_VERSION: 1.52.0
 
 jobs:
   android:
@@ -74,8 +73,10 @@ jobs:
 
       # No Rust cache: this workflow only runs on pull requests, which may not
       # save one, so it would have nothing to restore.
-      - name: Install just and cargo-ndk
-        run: cargo install --locked "just@$JUST_VERSION" "cargo-ndk@$CARGO_NDK_VERSION"
+      - uses: ./.github/actions/just
+
+      - name: Install cargo-ndk
+        run: cargo install --locked "cargo-ndk@$CARGO_NDK_VERSION"
 
       - name: Check
         run: just rs android
diff --git a/.github/workflows/apt-repo.yml b/.github/workflows/apt-repo.yml
index ff790e1583..5e8905ed21 100644
--- a/.github/workflows/apt-repo.yml
+++ b/.github/workflows/apt-repo.yml
@@ -34,6 +34,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Set up packaging tools
         uses: ./.github/actions/setup-packaging
 
@@ -53,10 +55,9 @@ jobs:
       - name: Publish to R2
         shell: bash
         env:
-          ARTIFACTS_DIR: artifacts
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
           SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
           SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-        run: ./infra/apt/publish.sh
+        run: just infra apt publish "$GITHUB_WORKSPACE/artifacts"
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 4b26c72456..5cc62c44b7 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -73,9 +73,6 @@ jobs:
       # Locally an absent formatter means less gets checked; here it would mean
       # a green run that checked nothing, which is the failure mode worth
       # spending a preflight on.
-      - name: Test direnv hook
-        run: bash .claude/hooks/direnv.test.sh
-
       - name: Check
         run: nix develop --command just ci check
         env:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 9f2ba00f14..5fcbc152e4 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -39,6 +39,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - id: parse
         env:
           CRATE: ${{ inputs.package }}
@@ -58,7 +60,7 @@ jobs:
             *) package="$crate" ;;
           esac
           echo "package=${package}" >> "$GITHUB_OUTPUT"
-          sh/gh/release.sh parse-version "$crate"
+          just gh release parse-version "$crate"
 
   build:
     name: Build ${{ matrix.platform }}
diff --git a/.github/workflows/libmoq.yml b/.github/workflows/libmoq.yml
index 3ad2daf514..b74274da81 100644
--- a/.github/workflows/libmoq.yml
+++ b/.github/workflows/libmoq.yml
@@ -40,6 +40,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Nix
         if: matrix.use_nix
         uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
@@ -55,12 +57,12 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       - name: Build and package
         shell: bash
         run: |
-          ./rs/libmoq/build.sh \
+          just rs package-libmoq \
             --target ${{ matrix.target }} \
             --version ${{ steps.parse.outputs.version }} \
             --output dist
@@ -85,13 +87,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       - name: Find previous tag
         id: prev_tag
-        run: sh/gh/release.sh prev-tag libmoq
+        run: just gh release prev-tag libmoq
 
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -105,7 +109,7 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
           RELEASE_TITLE: "libmoq v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts
 
   # The OBS plugin (cpp/obs) statically links libmoq, so it ships with every
   # libmoq release: rebuild it against the release we just published (no
@@ -137,10 +141,12 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       # Native Xcode / Visual Studio; libobs/Qt6/ffmpeg come from the obs-deps
       # bundle and libmoq from the release we just published (--libmoq-release).
@@ -150,7 +156,7 @@ jobs:
           TARGET: ${{ matrix.target }}
           VERSION: ${{ steps.parse.outputs.version }}
         run: |
-          ./cpp/obs/build.sh --target "$TARGET" --libmoq-release "$VERSION" --output dist
+          just obs package --target "$TARGET" --libmoq-release "$VERSION" --output dist
 
       - name: Upload artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -171,9 +177,11 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       # Only the obs-moq archives: the libmoq-* artifacts from the build job
       # belong to the libmoq release, not this one.
@@ -208,4 +216,4 @@ jobs:
           RELEASE_TAG: "obs-moq-v${{ steps.parse.outputs.version }}"
           RELEASE_TITLE: "obs-moq v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts
diff --git a/.github/workflows/moq-cli.yml b/.github/workflows/moq-cli.yml
index 9e82930991..3975e32663 100644
--- a/.github/workflows/moq-cli.yml
+++ b/.github/workflows/moq-cli.yml
@@ -39,6 +39,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -47,7 +49,7 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-cli
+        run: just gh release parse-version moq-cli
 
       - name: Set up packaging tools
         uses: ./.github/actions/setup-packaging
@@ -64,7 +66,7 @@ jobs:
           VERSION: ${{ steps.parse.outputs.version }}
           TARGET: ${{ matrix.target }}
         run: |
-          ./sh/rs/package-binary.sh \
+          just rs package-binary \
             --crate moq-cli \
             --bin moq \
             --binary "target/${TARGET}/release/moq" \
@@ -80,8 +82,8 @@ jobs:
           ARCH: ${{ matrix.deb-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq
         run: |
-          sh/rs/package-nfpm.sh packaging/moq-cli/nfpm.yaml deb dist/
-          sh/rs/package-nfpm.sh packaging/moq-cli/transition.yaml deb dist/
+          just rs package-nfpm packaging/moq-cli/nfpm.yaml deb dist/
+          just rs package-nfpm packaging/moq-cli/transition.yaml deb dist/
 
       - name: Package .rpm
         shell: bash
@@ -89,7 +91,7 @@ jobs:
           VERSION: ${{ steps.parse.outputs.version }}
           ARCH: ${{ matrix.rpm-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq
-        run: sh/rs/package-nfpm.sh packaging/moq-cli/nfpm.yaml rpm dist/
+        run: just rs package-nfpm packaging/moq-cli/nfpm.yaml rpm dist/
 
       - name: Upload artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -114,6 +116,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
           determinate: false
@@ -121,12 +125,12 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-cli
+        run: just gh release parse-version moq-cli
 
       - name: Build and package tarball
         shell: bash
         run: |
-          ./sh/rs/package-binary.sh \
+          just rs package-binary \
             --crate moq-cli \
             --bin moq \
             --target ${{ matrix.target }} \
@@ -154,6 +158,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -169,12 +175,12 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-cli
+        run: just gh release parse-version moq-cli
 
       - name: Build and package zip
         shell: bash
         run: |
-          ./sh/rs/package-windows.sh \
+          just rs package-windows \
             --crate moq-cli \
             --bin moq \
             --target ${{ matrix.target }} \
@@ -202,13 +208,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version moq-cli
+        run: just gh release parse-version moq-cli
 
       - name: Find previous tag
         id: prev_tag
-        run: sh/gh/release.sh prev-tag moq-cli
+        run: just gh release prev-tag moq-cli
 
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -222,10 +230,10 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
           RELEASE_TITLE: "moq-cli v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts
 
       - name: Trigger apt/rpm repo publish
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
-        run: sh/gh/trigger-repo-publish.sh
+        run: just gh trigger-repo-publish
diff --git a/.github/workflows/moq-gst.yml b/.github/workflows/moq-gst.yml
index 139d066c0f..dd0a3218e5 100644
--- a/.github/workflows/moq-gst.yml
+++ b/.github/workflows/moq-gst.yml
@@ -34,6 +34,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
           determinate: false
@@ -41,7 +43,7 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-gst
+        run: just gh release parse-version moq-gst
 
       - name: Build and package (tarball)
         shell: bash
@@ -49,7 +51,7 @@ jobs:
           TARGET: ${{ matrix.target }}
           VERSION: ${{ steps.parse.outputs.version }}
         run: |
-          ./rs/moq-gst/build.sh \
+          just rs package-gst \
             --target "$TARGET" \
             --version "$VERSION" \
             --output dist
@@ -80,7 +82,7 @@ jobs:
         run: |
           set -euo pipefail
           tar -xzf "dist/moq-gst-v${VERSION}-${TARGET}.tar.gz" -C dist/
-          ./rs/moq-gst/smoke.sh "dist/moq-gst-v${VERSION}-${TARGET}/lib/gstreamer-1.0"
+          just rs gst-smoke "dist/moq-gst-v${VERSION}-${TARGET}/lib/gstreamer-1.0"
 
       - name: Upload artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -112,6 +114,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -123,7 +127,7 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-gst
+        run: just gh release parse-version moq-gst
 
       - name: Install GStreamer dev libraries
         shell: bash
@@ -160,7 +164,7 @@ jobs:
           PLUGIN_DIR: /usr/lib/${{ matrix.deb-multiarch }}/gstreamer-1.0
         run: |
           mkdir -p dist
-          sh/rs/package-nfpm.sh packaging/moq-gst/nfpm.yaml deb dist/
+          just rs package-nfpm packaging/moq-gst/nfpm.yaml deb dist/
 
       - name: Package .rpm
         shell: bash
@@ -172,7 +176,7 @@ jobs:
           PLUGIN_DIR: /usr/lib64/gstreamer-1.0
         run: |
           mkdir -p dist
-          sh/rs/package-nfpm.sh packaging/moq-gst/nfpm.yaml rpm dist/
+          just rs package-nfpm packaging/moq-gst/nfpm.yaml rpm dist/
 
       - name: Upload artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -195,13 +199,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version moq-gst
+        run: just gh release parse-version moq-gst
 
       - name: Find previous tag
         id: prev_tag
-        run: sh/gh/release.sh prev-tag moq-gst
+        run: just gh release prev-tag moq-gst
 
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -215,10 +221,10 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
           RELEASE_TITLE: "moq-gst v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts
 
       - name: Trigger apt/rpm repo publish
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
-        run: sh/gh/trigger-repo-publish.sh
+        run: just gh trigger-repo-publish
diff --git a/.github/workflows/moq-relay.yml b/.github/workflows/moq-relay.yml
index 96496d9731..b9ac806f96 100644
--- a/.github/workflows/moq-relay.yml
+++ b/.github/workflows/moq-relay.yml
@@ -42,6 +42,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -50,7 +52,7 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-relay
+        run: just gh release parse-version moq-relay
 
       - name: Set up packaging tools
         uses: ./.github/actions/setup-packaging
@@ -67,7 +69,7 @@ jobs:
           VERSION: ${{ steps.parse.outputs.version }}
           TARGET: ${{ matrix.target }}
         run: |
-          ./sh/rs/package-binary.sh \
+          just rs package-binary \
             --crate moq-relay \
             --bin moq-relay \
             --binary "target/${TARGET}/release/moq-relay" \
@@ -82,7 +84,7 @@ jobs:
           VERSION: ${{ steps.parse.outputs.version }}
           ARCH: ${{ matrix.deb-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq-relay
-        run: sh/rs/package-nfpm.sh packaging/moq-relay/nfpm.yaml deb dist/
+        run: just rs package-nfpm packaging/moq-relay/nfpm.yaml deb dist/
 
       - name: Package .rpm
         shell: bash
@@ -90,7 +92,7 @@ jobs:
           VERSION: ${{ steps.parse.outputs.version }}
           ARCH: ${{ matrix.rpm-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq-relay
-        run: sh/rs/package-nfpm.sh packaging/moq-relay/nfpm.yaml rpm dist/
+        run: just rs package-nfpm packaging/moq-relay/nfpm.yaml rpm dist/
 
       - name: Upload artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -115,6 +117,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
           determinate: false
@@ -122,12 +126,12 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-relay
+        run: just gh release parse-version moq-relay
 
       - name: Build and package tarball
         shell: bash
         run: |
-          ./sh/rs/package-binary.sh \
+          just rs package-binary \
             --crate moq-relay \
             --target ${{ matrix.target }} \
             --version ${{ steps.parse.outputs.version }} \
@@ -154,6 +158,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -169,12 +175,12 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-relay
+        run: just gh release parse-version moq-relay
 
       - name: Build and package zip
         shell: bash
         run: |
-          ./sh/rs/package-windows.sh \
+          just rs package-windows \
             --crate moq-relay \
             --target ${{ matrix.target }} \
             --version ${{ steps.parse.outputs.version }} \
@@ -201,13 +207,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version moq-relay
+        run: just gh release parse-version moq-relay
 
       - name: Find previous tag
         id: prev_tag
-        run: sh/gh/release.sh prev-tag moq-relay
+        run: just gh release prev-tag moq-relay
 
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -221,10 +229,10 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
           RELEASE_TITLE: "moq-relay v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts
 
       - name: Trigger apt/rpm repo publish
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
-        run: sh/gh/trigger-repo-publish.sh
+        run: just gh trigger-repo-publish
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 431d89002e..3341c6d040 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -73,9 +73,7 @@ jobs:
       # over independent observers of the new live broadcast map.
       - name: JS origin broadcast map benchmark
         if: ${{ !cancelled() }}
-        run: |
-          nix develop --command bun install --frozen-lockfile
-          nix develop --command bun js/net/bench/broadcasts.ts
+        run: nix develop --command just js bench
 
       - name: Audit
         if: ${{ !cancelled() }}
@@ -286,11 +284,7 @@ jobs:
           choco install nasm -y --no-progress
           "C:\Program Files\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
 
-      # Pinned: `--locked` fixes just's own dependencies, not which version of
-      # just cargo selects.
-      - name: Install just
-        shell: bash
-        run: cargo install --locked just@1.52.0
+      - uses: ./.github/actions/just
 
       - name: Check
         shell: bash
@@ -323,10 +317,7 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
-      # Pinned: `--locked` fixes just's own dependencies, not which version of
-      # just cargo selects.
-      - name: Install just
-        run: cargo install --locked just@1.52.0
+      - uses: ./.github/actions/just
 
       - name: Check
         run: just rs macos
diff --git a/.github/workflows/release-brew.yml b/.github/workflows/release-brew.yml
index fb06fe444f..5e8594de05 100644
--- a/.github/workflows/release-brew.yml
+++ b/.github/workflows/release-brew.yml
@@ -41,6 +41,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse crate and version
         id: parse
         env:
@@ -98,7 +100,7 @@ jobs:
           VERSION: ${{ steps.parse.outputs.version }}
         run: |
           mkdir -p rendered
-          ./sh/gh/render-formula.sh \
+          just gh formula \
             --template ".github/homebrew/Formula/${CRATE}.rb.tmpl" \
             --version "$VERSION" \
             --release-dir release-assets \
@@ -156,7 +158,7 @@ jobs:
           EOF
           fi
 
-          python3 ../sh/gh/install-formula.py "$CRATE" "../rendered/${CRATE}.rb" .
+          just gh install-formula "$CRATE" "rendered/${CRATE}.rb" homebrew-tap
 
           if git diff --quiet && [[ -z "$(git status --porcelain)" ]]; then
             echo "No changes to commit (formula already up to date)."
diff --git a/.github/workflows/release-dart-ffi.yml b/.github/workflows/release-dart-ffi.yml
index 59f6c7a61c..2744516380 100644
--- a/.github/workflows/release-dart-ffi.yml
+++ b/.github/workflows/release-dart-ffi.yml
@@ -46,9 +46,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version moq-ffi
+        run: just gh release parse-version moq-ffi
 
   build:
     name: Build Native Asset (${{ matrix.target }})
@@ -87,6 +89,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -114,7 +118,7 @@ jobs:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
           IPHONEOS_DEPLOYMENT_TARGET: ${{ contains(matrix.target, 'apple-ios') && '16.0' || '' }}
         run: |
-          ./rs/moq-ffi/build.sh \
+          just rs package-ffi \
             --target "$BUILD_TARGET" \
             --version "$BUILD_VERSION" \
             --output dist \
@@ -151,13 +155,15 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d # v1.8.1
 
       - name: Stage and check package
         env:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./sh/dart/package.sh \
+          just dart package \
             --package moq_ffi \
             --version "$BUILD_VERSION" \
             --output release-out
@@ -186,9 +192,11 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Find previous tag
         id: prev_tag
-        run: sh/gh/release.sh prev-tag moq-ffi
+        run: just gh release prev-tag moq-ffi
 
       - name: Download Native Assets
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -204,7 +212,7 @@ jobs:
           RELEASE_TITLE: "moq-ffi v${{ needs.parse-version.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
           RELEASE_CHECKSUMS: SHA256SUMS-dart
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts
 
   publish:
     name: Publish moq_ffi to pub.dev
diff --git a/.github/workflows/release-dart.yml b/.github/workflows/release-dart.yml
index 4df8f205f4..3578ae386c 100644
--- a/.github/workflows/release-dart.yml
+++ b/.github/workflows/release-dart.yml
@@ -37,6 +37,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d # v1.8.1
 
       - name: Resolve version
@@ -47,7 +49,7 @@ jobs:
           if [[ "$EVENT_NAME" == "pull_request" ]]; then
             VERSION=$(sed -n 's/^version: //p' dart/moq/pubspec.yaml | head -1)
           else
-            sh/gh/release.sh parse-version moq-dart
+            just gh release parse-version moq-dart
             exit 0
           fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
@@ -69,7 +71,7 @@ jobs:
         env:
           BUILD_VERSION: ${{ steps.version.outputs.version }}
         run: |
-          ./sh/dart/package.sh \
+          just dart package \
             --package moq \
             --version "$BUILD_VERSION" \
             --output release-out
diff --git a/.github/workflows/release-go-ffi.yml b/.github/workflows/release-go-ffi.yml
index d1d8477d38..2039f200b3 100644
--- a/.github/workflows/release-go-ffi.yml
+++ b/.github/workflows/release-go-ffi.yml
@@ -51,9 +51,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version moq-ffi
+        run: just gh release parse-version moq-ffi
 
   build:
     name: Build moq-ffi (${{ matrix.target }})
@@ -78,6 +80,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -103,7 +107,7 @@ jobs:
           BUILD_TARGET: ${{ matrix.target }}
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./rs/moq-ffi/build.sh \
+          just rs package-ffi \
             --target "$BUILD_TARGET" \
             --version "$BUILD_VERSION" \
             --output dist
@@ -125,6 +129,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
@@ -144,7 +150,7 @@ jobs:
         env:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./rs/moq-ffi/build.sh \
+          just rs package-ffi \
             --bindings-only \
             --version "$BUILD_VERSION" \
             --output dist
@@ -165,6 +171,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Download per-target libs
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
@@ -208,7 +216,7 @@ jobs:
         env:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./sh/go/package-ffi.sh \
+          just go package-ffi \
             --version "$BUILD_VERSION" \
             --source-dir go/ffi \
             --lib-dir libs \
@@ -232,6 +240,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Generate moq-bot token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: token
@@ -256,7 +266,7 @@ jobs:
           GO_FFI_MIRROR_TOKEN: ${{ steps.token.outputs.token }}
           GIT_AUTHOR_NAME: moq-bot
           GIT_AUTHOR_EMAIL: moq-bot[bot]@users.noreply.github.com
-        run: ./sh/go/publish-ffi.sh
+        run: just go publish-ffi
 
   publish-dry-run:
     name: Publish dry-run
@@ -269,6 +279,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Download package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
@@ -278,4 +290,4 @@ jobs:
       - name: Dry-run publish to mirror
         env:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
-        run: ./sh/go/publish-ffi.sh --dry-run
+        run: just go publish-ffi --dry-run
diff --git a/.github/workflows/release-go.yml b/.github/workflows/release-go.yml
index 92300e5f13..bb817841ac 100644
--- a/.github/workflows/release-go.yml
+++ b/.github/workflows/release-go.yml
@@ -66,6 +66,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.23"
@@ -105,7 +107,7 @@ jobs:
         if: github.event_name == 'push'
         env:
           FFI_VERSION: ${{ steps.ffi.outputs.version }}
-        run: sh/gh/release.sh ffi-unreleased "$FFI_VERSION"
+        run: just gh release ffi-unreleased "$FFI_VERSION"
 
       # Skip on unreleased ffi changes, and when the pinned ffi's mirror tag is
       # missing (release-plz merged but Release Go FFI hasn't published yet):
@@ -160,7 +162,7 @@ jobs:
           LINE: ${{ steps.line.outputs.line }}
           FFI_VERSION: ${{ steps.ffi.outputs.version }}
         run: |
-          ./sh/go/package-wrapper.sh --line "$LINE" --ffi-version "$FFI_VERSION" --output release-out
+          just go package-wrapper --line "$LINE" --ffi-version "$FFI_VERSION" --output release-out
 
       - name: Upload wrapper module
         if: steps.gate.outputs.skip != 'true'
@@ -180,6 +182,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Generate moq-bot token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: token
@@ -203,4 +207,4 @@ jobs:
           GO_MIRROR_TOKEN: ${{ steps.token.outputs.token }}
           GIT_AUTHOR_NAME: moq-bot
           GIT_AUTHOR_EMAIL: moq-bot[bot]@users.noreply.github.com
-        run: ./sh/go/publish-wrapper.sh
+        run: just go publish-wrapper
diff --git a/.github/workflows/release-kt-ffi.yml b/.github/workflows/release-kt-ffi.yml
index 31a6979587..207e70f35b 100644
--- a/.github/workflows/release-kt-ffi.yml
+++ b/.github/workflows/release-kt-ffi.yml
@@ -37,9 +37,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version moq-ffi
+        run: just gh release parse-version moq-ffi
 
   build:
     name: Build moq-ffi (${{ matrix.target }})
@@ -72,6 +74,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -98,7 +102,7 @@ jobs:
           BUILD_TARGET: ${{ matrix.target }}
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./rs/moq-ffi/build.sh \
+          just rs package-ffi \
             --target "$BUILD_TARGET" \
             --version "$BUILD_VERSION" \
             --output dist
@@ -120,6 +124,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
@@ -130,7 +136,7 @@ jobs:
         env:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./rs/moq-ffi/build.sh \
+          just rs package-ffi \
             --bindings-only \
             --version "$BUILD_VERSION" \
             --output dist
@@ -160,6 +166,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
@@ -199,7 +207,7 @@ jobs:
         env:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./sh/kt/package.sh \
+          just kt package \
             --version "$BUILD_VERSION" \
             --lib-dir libs \
             --bindings-dir bindings \
diff --git a/.github/workflows/release-kt-lib.yml b/.github/workflows/release-kt-lib.yml
index 1bec21db75..ce0334622e 100644
--- a/.github/workflows/release-kt-lib.yml
+++ b/.github/workflows/release-kt-lib.yml
@@ -75,6 +75,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Read moq.version
         id: version
         run: |
@@ -103,18 +105,18 @@ jobs:
       - name: Check for unreleased FFI changes
         id: ffi-diff
         if: github.event_name != 'workflow_run'
-        run: sh/gh/release.sh ffi-unreleased "${{ steps.ffi.outputs.version }}"
+        run: just gh release ffi-unreleased "${{ steps.ffi.outputs.version }}"
 
       - name: Check wrapper publication
         id: wrapper
-        run: sh/gh/release.sh maven-exists dev.moq moq "${{ steps.version.outputs.version }}"
+        run: just gh release maven-exists dev.moq moq "${{ steps.version.outputs.version }}"
 
       # The bindings this checkout generates must be on Maven Central, or the
       # wrapper's POM range resolves to an older moq-ffi without them.
       - name: Check bindings publication
         id: bindings
         if: github.event_name != 'workflow_run' && steps.wrapper.outputs.exists != 'true' && steps.ffi-diff.outputs.unreleased != 'true'
-        run: sh/gh/release.sh maven-exists dev.moq moq-ffi "${{ steps.ffi.outputs.version }}"
+        run: just gh release maven-exists dev.moq moq-ffi "${{ steps.ffi.outputs.version }}"
 
       - name: Decide publish
         id: decide
@@ -167,6 +169,8 @@ jobs:
           ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
@@ -178,7 +182,7 @@ jobs:
         env:
           BUILD_VERSION: ${{ needs.check-version.outputs.version }}
         run: |
-          ./rs/moq-ffi/build.sh --bindings-only --version "$BUILD_VERSION" --output dist
+          just rs package-ffi --bindings-only --version "$BUILD_VERSION" --output dist
           mkdir -p kt/moq-ffi/src/jvmAndAndroidMain/kotlin/uniffi/moq
           cp dist/bindings/kotlin/uniffi/moq/moq.kt \
             kt/moq-ffi/src/jvmAndAndroidMain/kotlin/uniffi/moq/moq.kt
@@ -202,7 +206,7 @@ jobs:
       - name: Recheck wrapper publication
         id: recheck
         if: github.event_name != 'pull_request'
-        run: sh/gh/release.sh maven-exists dev.moq moq "${{ needs.check-version.outputs.version }}"
+        run: just gh release maven-exists dev.moq moq "${{ needs.check-version.outputs.version }}"
 
       - name: Publish to Maven Central
         if: github.event_name != 'pull_request' && steps.recheck.outputs.exists != 'true'
diff --git a/.github/workflows/release-py-ffi.yml b/.github/workflows/release-py-ffi.yml
index 2e1fa1bb49..678abd2438 100644
--- a/.github/workflows/release-py-ffi.yml
+++ b/.github/workflows/release-py-ffi.yml
@@ -34,9 +34,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version moq-ffi
+        run: just gh release parse-version moq-ffi
 
       # Maturin reads the wheel version from rs/moq-ffi/Cargo.toml (via
       # `dynamic = ["version"]` in pyproject.toml). If a tag is pushed by
diff --git a/.github/workflows/release-py.yml b/.github/workflows/release-py.yml
index 67a2741e8b..fdb4717c7b 100644
--- a/.github/workflows/release-py.yml
+++ b/.github/workflows/release-py.yml
@@ -56,9 +56,11 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Read version
         id: version
-        run: sh/gh/release.sh read-version py/moq-rs/pyproject.toml
+        run: just gh release read-version py/moq-rs/pyproject.toml
 
       - name: Resolve FFI version
         id: ffi
@@ -78,14 +80,14 @@ jobs:
         if: github.event_name == 'push'
         env:
           FFI_VERSION: ${{ steps.ffi.outputs.version }}
-        run: sh/gh/release.sh ffi-unreleased "$FFI_VERSION"
+        run: just gh release ffi-unreleased "$FFI_VERSION"
 
       - name: Check FFI on PyPI
         id: ffi-pypi
         if: github.event_name == 'push' && steps.ffi-gate.outputs.unreleased != 'true'
         env:
           FFI_VERSION: ${{ steps.ffi.outputs.version }}
-        run: sh/gh/release.sh pypi-exists moq-ffi "$FFI_VERSION"
+        run: just gh release pypi-exists moq-ffi "$FFI_VERSION"
 
       - name: Unpublished FFI notice
         if: github.event_name == 'push' && steps.ffi-gate.outputs.unreleased != 'true' && steps.ffi-pypi.outputs.exists != 'true'
@@ -100,7 +102,7 @@ jobs:
         id: pypi
         env:
           VERSION: ${{ steps.version.outputs.version }}
-        run: sh/gh/release.sh pypi-exists moq-rs "$VERSION"
+        run: just gh release pypi-exists moq-rs "$VERSION"
 
       - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
diff --git a/.github/workflows/release-swift-ffi.yml b/.github/workflows/release-swift-ffi.yml
index 966a1b86c3..0ab0eaa056 100644
--- a/.github/workflows/release-swift-ffi.yml
+++ b/.github/workflows/release-swift-ffi.yml
@@ -34,9 +34,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version moq-ffi
+        run: just gh release parse-version moq-ffi
 
   build:
     name: Build moq-ffi (${{ matrix.target }})
@@ -56,6 +58,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -72,7 +76,7 @@ jobs:
           # Set iOS deployment target to avoid ___chkstk_darwin linker errors.
           IPHONEOS_DEPLOYMENT_TARGET: ${{ contains(matrix.target, 'apple-ios') && '16.0' || '' }}
         run: |
-          ./rs/moq-ffi/build.sh \
+          just rs package-ffi \
             --target "$BUILD_TARGET" \
             --version "$BUILD_VERSION" \
             --output dist
@@ -93,6 +97,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
@@ -103,7 +109,7 @@ jobs:
         env:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./rs/moq-ffi/build.sh \
+          just rs package-ffi \
             --bindings-only \
             --version "$BUILD_VERSION" \
             --output dist
@@ -124,6 +130,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Download per-target libs
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
@@ -149,7 +157,7 @@ jobs:
         env:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./sh/swift/package-ffi.sh \
+          just swift package-ffi \
             --version "$BUILD_VERSION" \
             --lib-dir libs \
             --bindings-dir bindings \
@@ -181,9 +189,11 @@ jobs:
           # up GH_TOKEN directly, so don't persist a contents-write token.
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Find previous tag
         id: prev_tag
-        run: sh/gh/release.sh prev-tag moq-ffi
+        run: just gh release prev-tag moq-ffi
 
       - name: Download package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -197,7 +207,7 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
           RELEASE_TITLE: "moq-ffi v${{ needs.parse-version.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts
 
   verify:
     # Gate the mirror push on actually being able to resolve the staged package
@@ -213,6 +223,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Download staged package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
@@ -223,7 +235,7 @@ jobs:
         env:
           BUILD_VERSION: ${{ needs.parse-version.outputs.version }}
         run: |
-          ./sh/swift/verify-ffi.sh --tarball "artifacts/moq-ffi-${BUILD_VERSION}-swift-ffi.tar.gz"
+          just swift verify-ffi --tarball "artifacts/moq-ffi-${BUILD_VERSION}-swift-ffi.tar.gz"
 
   publish:
     name: Publish to Swift Package mirror
@@ -235,6 +247,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Generate moq-bot token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: token
@@ -259,4 +273,4 @@ jobs:
           SWIFT_MIRROR_TOKEN: ${{ steps.token.outputs.token }}
           GIT_AUTHOR_NAME: moq-bot
           GIT_AUTHOR_EMAIL: moq-bot[bot]@users.noreply.github.com
-        run: ./sh/swift/publish-ffi.sh
+        run: just swift publish-ffi
diff --git a/.github/workflows/release-swift-lib.yml b/.github/workflows/release-swift-lib.yml
index 6361566a57..2684aa4f59 100644
--- a/.github/workflows/release-swift-lib.yml
+++ b/.github/workflows/release-swift-lib.yml
@@ -79,6 +79,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Read versions
         id: version
         env:
@@ -101,13 +103,13 @@ jobs:
         if: github.event_name != 'workflow_run'
         env:
           FFI_VERSION: ${{ steps.version.outputs.ffi_version }}
-        run: sh/gh/release.sh ffi-unreleased "$FFI_VERSION"
+        run: just gh release ffi-unreleased "$FFI_VERSION"
 
       - name: Check FFI mirror tag
         id: ffi-gate
         env:
           FFI_VERSION: ${{ steps.version.outputs.ffi_version }}
-        run: sh/gh/release.sh git-tag-exists moq-dev/moq-swift-ffi "$FFI_VERSION"
+        run: just gh release git-tag-exists moq-dev/moq-swift-ffi "$FFI_VERSION"
 
       - name: Unpublished FFI notice
         if: steps.ffi-diff.outputs.unreleased != 'true' && steps.ffi-gate.outputs.exists != 'true' && github.event_name != 'pull_request'
@@ -121,12 +123,12 @@ jobs:
         id: gate
         env:
           VERSION: ${{ steps.version.outputs.version }}
-        run: sh/gh/release.sh git-tag-exists moq-dev/moq-swift "$VERSION"
+        run: just gh release git-tag-exists moq-dev/moq-swift "$VERSION"
 
       - name: Package
         env:
           BUILD_VERSION: ${{ steps.version.outputs.version }}
-        run: ./sh/swift/package.sh --version "$BUILD_VERSION" --output release-out
+        run: just swift package --version "$BUILD_VERSION" --output release-out
 
       - name: Upload Swift package
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -149,6 +151,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Check FFI mirror tag
         id: ffi
         if: needs.build.outputs.publish == 'true' || (github.event_name == 'pull_request' && needs.build.outputs.ffi_unreleased != 'true')
@@ -158,7 +162,7 @@ jobs:
         # rather than a hard failure, so the first bootstrap (before
         # moq-swift-ffi exists) skips the cross-package resolve instead of
         # failing the job. publish.sh stays idempotent regardless.
-        run: sh/gh/release.sh git-tag-exists moq-dev/moq-swift-ffi "$FFI_VERSION" || echo "exists=false" >> "$GITHUB_OUTPUT"
+        run: just gh release git-tag-exists moq-dev/moq-swift-ffi "$FFI_VERSION" || echo "exists=false" >> "$GITHUB_OUTPUT"
 
       - name: Download staged package
         if: steps.ffi.outputs.exists == 'true'
@@ -171,7 +175,7 @@ jobs:
         if: steps.ffi.outputs.exists == 'true'
         env:
           BUILD_VERSION: ${{ needs.build.outputs.version }}
-        run: ./sh/swift/verify.sh --tarball "artifacts/moq-${BUILD_VERSION}-swift.tar.gz"
+        run: just swift verify --tarball "artifacts/moq-${BUILD_VERSION}-swift.tar.gz"
 
       - name: Skip notice
         if: needs.build.outputs.ffi_unreleased == 'true'
@@ -194,6 +198,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Generate moq-bot token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: token
@@ -218,7 +224,7 @@ jobs:
           SWIFT_MIRROR_TOKEN: ${{ steps.token.outputs.token }}
           GIT_AUTHOR_NAME: moq-bot
           GIT_AUTHOR_EMAIL: moq-bot[bot]@users.noreply.github.com
-        run: ./sh/swift/publish.sh
+        run: just swift publish
 
   publish-dry-run:
     name: Publish dry-run
@@ -231,6 +237,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Download package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
@@ -240,4 +248,4 @@ jobs:
       - name: Dry-run publish to mirror
         env:
           BUILD_VERSION: ${{ needs.build.outputs.version }}
-        run: ./sh/swift/publish.sh --dry-run
+        run: just swift publish --dry-run
diff --git a/.github/workflows/rpm-repo.yml b/.github/workflows/rpm-repo.yml
index 4c7df9dd84..93dc8c4a94 100644
--- a/.github/workflows/rpm-repo.yml
+++ b/.github/workflows/rpm-repo.yml
@@ -32,6 +32,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Set up packaging tools
         uses: ./.github/actions/setup-packaging
 
@@ -51,10 +53,9 @@ jobs:
       - name: Publish to R2
         shell: bash
         env:
-          ARTIFACTS_DIR: artifacts
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
           SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
           SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-        run: ./infra/rpm/publish.sh
+        run: just infra rpm publish "$GITHUB_WORKSPACE/artifacts"
diff --git a/.github/workflows/swift.yml b/.github/workflows/swift.yml
index 23fd44fbf3..9ba45fe5cd 100644
--- a/.github/workflows/swift.yml
+++ b/.github/workflows/swift.yml
@@ -55,6 +55,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -83,4 +85,4 @@ jobs:
           done
 
       - name: Swift check
-        run: ./sh/swift/check.sh
+        run: just swift check
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 10c8135fdb..ccccac5757 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -45,6 +45,10 @@ For each finding:
 - If you don't agree with it, reply to the finding and move on.
 - If it's a relatively easy improvement, fix it and push. Update the summary if needed.
 
+# CI
+
+Workflow steps run `just` recipes, never a script path; `just gh check` enforces it.
+
 # Follow-ups
 
 If you encounter issues, or findings that are out of scope, create follow-up quests.
diff --git a/cpp/obs/justfile b/cpp/obs/justfile
index eed0d37344..8039fc603f 100644
--- a/cpp/obs/justfile
+++ b/cpp/obs/justfile
@@ -57,3 +57,12 @@ check:
 # Auto-fix formatting.
 fix:
     ../../sh/obs/fix.sh
+
+# Runs in the caller's directory, so a relative `--output` means what it would
+# to the script itself.
+
+# Build and package the obs-moq plugin for release.
+[no-cd]
+[positional-arguments]
+package *args:
+    {{ quote(justfile_directory() / "cpp/obs/build.sh") }} "$@"
diff --git a/dart/justfile b/dart/justfile
index 4387f113c8..5c2fc803ff 100644
--- a/dart/justfile
+++ b/dart/justfile
@@ -11,3 +11,12 @@ fix:
 # Regenerate the raw UniFFI Dart bindings.
 generate:
     ../sh/dart/generate.sh
+
+# `package` runs in the caller's directory, so a relative `--output` means
+# what it would to the script itself.
+
+# Package a Dart library for pub.dev.
+[no-cd]
+[positional-arguments]
+package *args:
+    {{ quote(justfile_directory() / "sh/dart/package.sh") }} "$@"
diff --git a/go/ffi/README.md b/go/ffi/README.md
index c45b1e7026..308836ae30 100644
--- a/go/ffi/README.md
+++ b/go/ffi/README.md
@@ -53,4 +53,4 @@ Compiled binaries never live in the source tree. `sh/go/check.sh` stages into th
 
 ## Release
 
-The `release-go-ffi.yml` workflow fires on every `moq-ffi-v*` tag, builds per-target static libraries, runs `uniffi-bindgen-go`, calls `sh/go/package-ffi.sh` to assemble the module, and `sh/go/publish-ffi.sh` to push the result to `moq-dev/moq-go-ffi` with a bare-semver tag (e.g. `v0.2.18`) lockstep with the crate. Go's module proxy picks up the new tag automatically.
+The `release-go-ffi.yml` workflow fires on every `moq-ffi-v*` tag, builds per-target static libraries, runs `uniffi-bindgen-go`, calls `just go package-ffi` to assemble the module, and `just go publish-ffi` to push the result to `moq-dev/moq-go-ffi` with a bare-semver tag (e.g. `v0.2.18`) lockstep with the crate. Go's module proxy picks up the new tag automatically.
diff --git a/go/justfile b/go/justfile
index ad26a9875d..b4fa2d0d07 100644
--- a/go/justfile
+++ b/go/justfile
@@ -16,12 +16,35 @@ default:
 check:
     bash ../sh/go/check.sh
 
-# Stage the in-tree go/ffi source + per-target moq-ffi libs + generated
-# bindings into the moq.dev/moq-ffi module ready for publish.
+# Release recipes run in the caller's directory, so a relative `--output` or
+# `--tarball` means what it would to the script itself.
+
+# Stage the in-tree go/ffi source, per-target moq-ffi libs, and generated
+# bindings into the moq.dev/moq-ffi module.
+
+# Stage the moq.dev/moq-ffi module for publish.
+[no-cd]
+[positional-arguments]
 package-ffi *args:
-    bash ../sh/go/package-ffi.sh {{ args }}
+    {{ quote(justfile_directory() / "sh/go/package-ffi.sh") }} "$@"
 
 # Stage the in-tree go/wrapper source into the moq.dev/moq module, rewriting its
-# moq.dev/moq-ffi require to the target ffi version, ready for publish.
+# moq.dev/moq-ffi require to the target ffi version.
+
+# Stage the moq.dev/moq wrapper module for publish.
+[no-cd]
+[positional-arguments]
 package-wrapper *args:
-    bash ../sh/go/package-wrapper.sh {{ args }}
+    {{ quote(justfile_directory() / "sh/go/package-wrapper.sh") }} "$@"
+
+# Push the staged moq-go-ffi module to the moq-dev/moq-go-ffi mirror.
+[no-cd]
+[positional-arguments]
+publish-ffi *args:
+    {{ quote(justfile_directory() / "sh/go/publish-ffi.sh") }} "$@"
+
+# Push the staged moq-go wrapper module to the moq-dev/moq-go mirror.
+[no-cd]
+[positional-arguments]
+publish-wrapper *args:
+    {{ quote(justfile_directory() / "sh/go/publish-wrapper.sh") }} "$@"
diff --git a/js/justfile b/js/justfile
index 3cc52a9e22..812fa6d9c9 100644
--- a/js/justfile
+++ b/js/justfile
@@ -43,6 +43,11 @@ test:
     bun test common/deps.test.ts
     bun run --filter='*' --elide-lines=0 test
 
+# Benchmark re-pricing the origin broadcast map as routes and observers grow.
+bench:
+    bun install --frozen-lockfile
+    bun net/bench/broadcasts.ts
+
 # Build all packages.
 build:
     bun run --filter='*' build
diff --git a/kt/justfile b/kt/justfile
index af419fb33e..2a3994710a 100644
--- a/kt/justfile
+++ b/kt/justfile
@@ -21,8 +21,11 @@ check:
 generate:
     bash ../sh/kt/generate.sh
 
-# Assemble the KMP module from per-target moq-ffi binaries + bindings.
-# Used by .github/workflows/release-kt-ffi.yml; see kt/README.md for the
-# expected --lib-dir layout.
+# Runs in the caller's directory, so a relative `--lib-dir` or `--output` means
+# what it would to the script itself. See kt/README.md for the --lib-dir layout.
+
+# Assemble the KMP module from per-target moq-ffi binaries and bindings.
+[no-cd]
+[positional-arguments]
 package *args:
-    bash ../sh/kt/package.sh {{ args }}
+    {{ quote(justfile_directory() / "sh/kt/package.sh") }} "$@"
diff --git a/quest/m1/tooling/README.md b/quest/m1/tooling/README.md
index ae2b81172b..e01a88ebc7 100644
--- a/quest/m1/tooling/README.md
+++ b/quest/m1/tooling/README.md
@@ -19,6 +19,5 @@ requires the one before it, so they land as one line of pull requests.
 
 ## Quests
 
-- [Workflows call just](/quest/m1/tooling/workflows-call-just.md) - no workflow `run:` step names a `.sh`; every script a workflow needs has a recipe
 - [Binary release workflow](/quest/m1/tooling/release-binary.md) - moq-cli and moq-relay share one reusable workflow behind two thin callers
 - [FFI release workflow](/quest/m1/tooling/release-ffi.md) - the five `release-*-ffi.yml` share the moq-ffi target matrix and artifact staging
diff --git a/quest/m1/tooling/release-binary.md b/quest/m1/tooling/release-binary.md
index 95eecf91f1..4a1dcdf0c5 100644
--- a/quest/m1/tooling/release-binary.md
+++ b/quest/m1/tooling/release-binary.md
@@ -25,7 +25,3 @@ and workflow name, so `alert.yml`, `release-brew.yml`, and
 - Verify with `just gh check` and by diffing the rendered job list of each
   caller against its predecessor with `gh workflow view`. The next tagged
   release is the end-to-end check; say so in the PR.
-
-## Required
-
-- [Workflows call just](/quest/m1/tooling/workflows-call-just.md) - the reusable workflow is written in the recipe style from the start
diff --git a/quest/m1/tooling/workflows-call-just.md b/quest/m1/tooling/workflows-call-just.md
deleted file mode 100644
index a38fcc5217..0000000000
--- a/quest/m1/tooling/workflows-call-just.md
+++ /dev/null
@@ -1,41 +0,0 @@
-# [M] Every workflow step runs a recipe
-
-## Goal
-
-No `run:` line in `.github/workflows` names a `.sh` file. Every script a
-workflow needs has a `just` recipe, so the menu is the whole command surface
-and a script can move or change its arguments without touching twenty
-workflows. The same recipes work locally for a dry run.
-
-## Plan
-
-Today the workflows call scripts directly at roughly ninety sites:
-`sh/gh/release.sh` (54 calls as a helper library: `parse-version`,
-`prev-tag`, `create`, registry existence checks), `sh/rs/package-nfpm.sh`,
-`sh/rs/package-binary.sh`, `sh/rs/package-windows.sh`,
-`sh/gh/trigger-repo-publish.sh`, `sh/gh/render-formula.sh`, `sh/gh/alert.sh`,
-the swift `package`, `package-ffi`, `publish`, `publish-ffi`, `verify`,
-`verify-ffi`, and `check` scripts, the go `package-ffi`, `package-wrapper`,
-`publish-ffi`, `publish-wrapper` scripts, `sh/dart/package.sh`,
-`sh/kt/package.sh`, and `infra/*/publish.sh`.
-
-- Add pass-through recipes where none exist, named by role under the area
-  module: `just gh release <subcommand> ...`, `just gh alert ...`,
-  `just gh formula ...`, `just gh trigger-repo-publish ...`,
-  `just rs package-binary ...`, `just rs package-nfpm ...`,
-  `just rs package-windows ...`, `just swift publish|verify|package-ffi|...`,
-  `just go publish-ffi|publish-wrapper`, `just dart package`,
-  `just infra apt publish` and `just infra rpm publish` (the recipes exist).
-  Existing wrappers (`kt package`, `swift package`, `go package-ffi`,
-  `go package-wrapper`, `py package`) are used as they are.
-- Rewrite every `run:` step to the recipe. Where a workflow runs outside the
-  nix dev shell (Windows and macOS runners, AlmaLinux containers), `just` is
-  already installed or installable the way nightly.yml does it; keep that
-  pattern rather than falling back to a path.
-- Record the rule in the CI section of `CONTRIBUTING.md` in one line, and
-  have `just gh check` enforce it: fail on any workflow `run:` line matching
-  `\.sh\b`.
-- Verify with `actionlint` via `just gh check`, and with a manual
-  `workflow_dispatch` of apt-repo.yml, rpm-repo.yml, and release-winget.yml
-  where the inputs allow a dry run. The tag-triggered release workflows are
-  verified by the next release; say so in the PR.
diff --git a/rs/justfile b/rs/justfile
index 7b5919eec1..71c272ae43 100644
--- a/rs/justfile
+++ b/rs/justfile
@@ -236,3 +236,38 @@ release:
 # Build a .deb or .rpm locally: `just rs package moq-relay deb`.
 package crate packager:
     sh/rs/package.sh {{ crate }} {{ packager }}
+
+# Build and package a workspace binary as a release tarball.
+[positional-arguments]
+package-binary *args:
+    sh/rs/package-binary.sh "$@"
+
+# Build and package a workspace binary as a Windows .zip.
+[positional-arguments]
+package-windows *args:
+    sh/rs/package-windows.sh "$@"
+
+# Render an nfpm config from the environment and build a .deb or .rpm: CONFIG PACKAGER OUTPUT.
+[positional-arguments]
+package-nfpm *args:
+    sh/rs/package-nfpm.sh "$@"
+
+# Build and package the moq-ffi native libraries, or only its bindings.
+[positional-arguments]
+package-ffi *args:
+    rs/moq-ffi/build.sh "$@"
+
+# Build and package libmoq.
+[positional-arguments]
+package-libmoq *args:
+    rs/libmoq/build.sh "$@"
+
+# Build and package the moq-gst GStreamer plugin.
+[positional-arguments]
+package-gst *args:
+    rs/moq-gst/build.sh "$@"
+
+# Load a packaged moq-gst plugin into the host's GStreamer and find its elements.
+[positional-arguments]
+gst-smoke *args:
+    rs/moq-gst/smoke.sh "$@"
diff --git a/sh/gh/check-runs.ts b/sh/gh/check-runs.ts
new file mode 100644
index 0000000000..c979f47b73
--- /dev/null
+++ b/sh/gh/check-runs.ts
@@ -0,0 +1,26 @@
+// Fail when a workflow `run:` step names a script file. Workflows call `just`
+// recipes, so a script can move or change its arguments without touching them,
+// and the same command works locally.
+import { Glob } from "bun";
+
+type Step = { run?: string };
+type Job = { steps?: Step[] };
+type Workflow = { jobs?: Record<string, Job> };
+
+const violations: string[] = [];
+for await (const path of new Glob(".github/workflows/*.{yml,yaml}").scan({ dot: true })) {
+	const workflow = Bun.YAML.parse(await Bun.file(path).text()) as Workflow;
+	for (const [name, job] of Object.entries(workflow.jobs ?? {})) {
+		for (const step of job.steps ?? []) {
+			for (const line of step.run?.split("\n") ?? []) {
+				if (/\.(sh|py|ts|js|mjs)\b/.test(line)) violations.push(`${path} (${name}): ${line.trim()}`);
+			}
+		}
+	}
+}
+
+if (violations.length > 0) {
+	console.error("workflow steps must run a `just` recipe, not a script:");
+	for (const violation of violations.sort()) console.error(`  ${violation}`);
+	process.exit(1);
+}
diff --git a/swift/justfile b/swift/justfile
index acb2b15029..075ae92314 100644
--- a/swift/justfile
+++ b/swift/justfile
@@ -15,7 +15,41 @@ default:
 check:
     bash ../sh/swift/check.sh
 
+# Release recipes run in the caller's directory, so a relative `--output` or
+# `--tarball` means what it would to the script itself.
+
 # Assemble the released wrapper package from Package.swift.template.
-# Used by .github/workflows/release-swift-lib.yml.
+[no-cd]
+[positional-arguments]
 package *args:
-    bash ../sh/swift/package.sh {{ args }}
+    {{ quote(justfile_directory() / "sh/swift/package.sh") }} "$@"
+
+# Assemble the MoqFFI package from per-target static libs and the generated bindings.
+[no-cd]
+[positional-arguments]
+package-ffi *args:
+    {{ quote(justfile_directory() / "sh/swift/package-ffi.sh") }} "$@"
+
+# Build a throwaway consumer of a staged wrapper package.
+[no-cd]
+[positional-arguments]
+verify *args:
+    {{ quote(justfile_directory() / "sh/swift/verify.sh") }} "$@"
+
+# Build a throwaway consumer of a staged MoqFFI package.
+[no-cd]
+[positional-arguments]
+verify-ffi *args:
+    {{ quote(justfile_directory() / "sh/swift/verify-ffi.sh") }} "$@"
+
+# Push the staged wrapper package to the moq-dev/moq-swift mirror.
+[no-cd]
+[positional-arguments]
+publish *args:
+    {{ quote(justfile_directory() / "sh/swift/publish.sh") }} "$@"
+
+# Push the staged MoqFFI package to the moq-dev/moq-swift-ffi mirror.
+[no-cd]
+[positional-arguments]
+publish-ffi *args:
+    {{ quote(justfile_directory() / "sh/swift/publish-ffi.sh") }} "$@"