diff --git a/.github/actions/docker-build/action.yml b/.github/actions/docker-build/action.yml
new file mode 100644
index 0000000000000000000000000000000000000000..686cca961d4c651fedddc12fb602cdaf8757511e
--- /dev/null
+++ b/.github/actions/docker-build/action.yml
@@ -0,0 +1,64 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0.
+
+# Use this action to execute the action scripts in tools/ci-build/scripts within the Docker build image.
+name: smithy-rs Docker Build
+description: Run Docker build command for smithy-rs
+inputs:
+  # The name of the script in tools/ci-build/scripts to run
+  action:
+    description: What action to run in the Docker build
+    required: true
+runs:
+  using: composite
+  steps:
+  - uses: actions/cache@v2
+    name: Gradle Cache
+    with:
+      path: |
+        gradle/caches
+        gradle/wrapper
+      key: ${{ runner.os }}-gradle-${{ hashFiles('gradle/caches/**/*', 'gradle/wrapper/**/*') }}
+      restore-keys: |
+        ${{ runner.os }}-gradle-
+      # Pinned to the commit hash of v1.3.0
+  - uses: Swatinem/rust-cache@842ef286fff290e445b90b4002cc9807c3669641
+    with:
+      sharedKey: ${{ runner.os }}-${{ github.job }}
+      target-dir: ./smithy-rs-target
+  - name: Download all artifacts
+    uses: ./smithy-rs/.github/actions/download-all-artifacts
+  - name: Prepare build image
+    shell: bash
+    run: |
+      set -x
+
+      # Check the build artifacts to see if a prior step built a new Docker build image.
+      # If smithy-rs-base-image was included in the downloaded build artifacts, then load
+      # it and tag it as the base image to use for this action. This will prevent acquire-build-image
+      # from attempting to download an image from ECR since it will already exist,
+      # which enables testing build image modifications as part of the pull request.
+      if [[ -d smithy-rs-base-image ]]; then
+        IMAGE_TAG="$(./smithy-rs/tools/ci-build/tools-hash)"
+        docker load -i smithy-rs-base-image/smithy-rs-base-image
+        docker tag "smithy-rs-base-image:${IMAGE_TAG}" "smithy-rs-base-image:local"
+      fi
+
+      # For this step, we want images to come from build artifacts (built as part a prior step),
+      # or from ECR. We disable building the image from scratch so that any mistakes in the CI
+      # configuration won't cause each individual action to build its own image, which would
+      # drastically increase the total CI time. Fail fast!
+      ALLOW_LOCAL_BUILD=false ./smithy-rs/tools/ci-build/acquire-build-image
+    # This runs the commands from the matrix strategy
+  - name: Run ${{ inputs.action }}
+    shell: bash
+    run: |
+      ./smithy-rs/tools/ci-build/ci-action ${{ inputs.action }}
+      tar cfz artifacts-${{ inputs.action }}.tar.gz -C artifacts .
+  - name: Upload artifacts
+    uses: actions/upload-artifact@v3
+    with:
+      name: artifacts-${{ inputs.action }}
+      path: artifacts-${{ inputs.action }}.tar.gz
+      if-no-files-found: error
+      retention-days: 3
diff --git a/.github/actions/download-all-artifacts/action.yml b/.github/actions/download-all-artifacts/action.yml
new file mode 100644
index 0000000000000000000000000000000000000000..39299d647173d70d890cfe66e2e05a868f308909
--- /dev/null
+++ b/.github/actions/download-all-artifacts/action.yml
@@ -0,0 +1,13 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0.
+
+name: Download All Artifacts
+description: Downloads and untars all available build artifacts
+runs:
+  using: composite
+  steps:
+  - name: Download artifacts
+    uses: actions/download-artifact@v3
+  - name: Untar artifacts
+    shell: bash
+    run: find . -maxdepth 2 -iname 'artifacts-*.tar.gz' -print -exec tar vxfz {} \;
diff --git a/.github/workflows/ci-docker-build.yml b/.github/workflows/ci-main.yml
similarity index 56%
rename from .github/workflows/ci-docker-build.yml
rename to .github/workflows/ci-main.yml
index 38344fcc1799868b05e824291e2edcab8c5a74cc..fbd385cce3ccf2e333cfe1baccf757395c8dc8cc 100644
--- a/.github/workflows/ci-docker-build.yml
+++ b/.github/workflows/ci-main.yml
@@ -1,10 +1,11 @@
-name: Docker Build Image
+# This workflow differs from PR CI in that it uploads a Docker build image to public ECR.
+# This should be done only on push to main so that PRs from forks can successfully run CI
+# since GitHub secrets cannot be shared with a PR from a fork.
+name: CI on Branch `main`
 on:
   workflow_dispatch:
   push:
     branches: [main]
-    paths:
-    - tools/**
 
 # Allow only one Docker build image build to run at a time for the entire smithy-rs repo
 concurrency:
@@ -15,6 +16,7 @@ env:
   ecr_repository: public.ecr.aws/w0m4q9l7/github-awslabs-smithy-rs-ci
 
 jobs:
+  # Rebuild and upload the Docker build image
   rebuild-docker-build-image:
     runs-on: ubuntu-latest
     name: Rebuild image
@@ -26,9 +28,12 @@ jobs:
       uses: actions/checkout@v2
     - name: Build image
       run: |
-        IMAGE_TAG="$(git rev-parse HEAD)"
+        IMAGE_TAG="$(./tools/ci-build/tools-hash)"
         cd tools
-        docker build -t "${{ env.ecr_repository }}:${IMAGE_TAG}" .
+        docker build \
+          -t "${{ env.ecr_repository }}:${IMAGE_TAG}" \
+          -t "${{ env.ecr_repository }}:main" \
+          .
     - name: Acquire credentials
       uses: aws-actions/configure-aws-credentials@v1
       with:
@@ -37,6 +42,12 @@ jobs:
         aws-region: us-west-2
     - name: Upload image
       run: |
-        IMAGE_TAG="$(git rev-parse HEAD)"
+        IMAGE_TAG="$(./tools/ci-build/tools-hash)"
         aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
         docker push "${{ env.ecr_repository }}:${IMAGE_TAG}"
+        docker push "${{ env.ecr_repository }}:main"
+
+  # Run normal CI, which should pick up the updated build image
+  ci:
+    needs: rebuild-docker-build-image
+    uses: awslabs/smithy-rs/.github/worfklows/ci.yaml@main
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e54d3576763d8a26517b6f21708a34ac4aa3a3db..3cc3d6b6c3371790ce4615493ad2fa655a11d81a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,8 +1,6 @@
 on:
-  push:
-    branches: [main]
-    tags:
-    - '*'
+  workflow_call:
+  workflow_dispatch:
   pull_request:
 
 name: CI
@@ -23,16 +21,14 @@ jobs:
   acquire-base-image:
     name: Acquire Base Image
     runs-on: ubuntu-latest
-    outputs:
-      image-in-artifacts: ${{ steps.acquire.outputs.image-in-artifacts }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         path: smithy-rs
+        fetch-depth: 0
     - name: Acquire base image
       id: acquire
-      # Script sets boolean output value named `image-in-artifacts`
-      run: ./smithy-rs/tools/ci-build/ci-output-build-image ${{ github.event.pull_request.base.sha }}
+      run: ./smithy-rs/tools/ci-build/acquire-build-image
     - name: Upload base image
       uses: actions/upload-artifact@v3
       with:
@@ -58,52 +54,17 @@ jobs:
         - action: generate-aws-sdk-smoketest
         - action: generate-smithy-rs-runtime-bundle
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         path: smithy-rs
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         repository: awsdocs/aws-doc-sdk-examples
         path: aws-doc-sdk-examples
-    - uses: actions/cache@v2
-      name: Gradle Cache
-      with:
-        path: |
-          gradle/caches
-          gradle/wrapper
-        key: ${{ runner.os }}-gradle-${{ hashFiles('gradle/caches/**/*', 'gradle/wrapper/**/*') }}
-        restore-keys: |
-          ${{ runner.os }}-gradle-
-      # Pinned to the commit hash of v1.3.0
-    - uses: Swatinem/rust-cache@842ef286fff290e445b90b4002cc9807c3669641
-      with:
-        sharedKey: ${{ runner.os }}-${{ env.rust_version }}-${{ github.job }}
-        target-dir: ./smithy-rs-target
-    - name: Download build image
-      if: ${{ needs.acquire-base-image.outputs.image-in-artifacts == 'true' }}
-      uses: actions/download-artifact@v3
-      with:
-        name: smithy-rs-base-image
-    - name: Prepare build image
-      run: |
-        if [[ "${{ needs.acquire-base-image.outputs.image-in-artifacts }}" == "true" ]]; then
-          docker load -i smithy-rs-base-image
-        else
-          ./smithy-rs/tools/ci-build/acquire-base-image --force-remote ${{ github.event.pull_request.base.sha }}
-        fi
-        ./smithy-rs/tools/ci-build/create-local-build-image
-      # This runs the commands from the matrix strategy
     - name: Run ${{ matrix.actions.action }}
-      run: |
-        ./smithy-rs/tools/ci-build/ci-action ${{ matrix.actions.action }}
-        tar cfz artifacts-${{ matrix.actions.action }}.tar.gz -C artifacts .
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v3
+      uses: ./smithy-rs/.github/actions/docker-build
       with:
-        name: artifacts-${{ matrix.actions.action }}
-        path: artifacts-${{ matrix.actions.action }}.tar.gz
-        if-no-files-found: error
-        retention-days: 3
+        action: ${{ matrix.actions.action }}
 
   test:
     name: Test
@@ -115,68 +76,27 @@ jobs:
     # in a matrix strategy. These commands get run in the steps after all the setup.
     strategy:
       fail-fast: false
-      max-parallel: 7
       matrix:
         # These correspond to scripts in tools/ci-build/scripts that will be run in the Docker build image
         test:
-        # Kick off the slowest three first
         - action: check-aws-sdk-services
-        - action: check-client-codegen-unit-tests
-        - action: check-rust-runtimes-and-tools
-        # Order by fastest to slowest
-        - action: check-server-codegen-unit-tests
-        - action: check-server-codegen-integration-tests
-        - action: check-sdk-codegen-unit-tests
-        - action: check-client-codegen-integration-tests
         - action: check-aws-sdk-smoketest-additional-checks
         - action: check-aws-sdk-smoketest-docs-clippy-udeps
         - action: check-aws-sdk-smoketest-unit-tests
+        - action: check-client-codegen-integration-tests
+        - action: check-client-codegen-unit-tests
+        - action: check-rust-runtimes-and-tools
+        - action: check-sdk-codegen-unit-tests
+        - action: check-server-codegen-integration-tests
+        - action: check-server-codegen-unit-tests
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         path: smithy-rs
-    - uses: actions/cache@v2
-      name: Gradle Cache
-      with:
-        path: |
-          gradle/caches
-          gradle/wrapper
-        key: ${{ runner.os }}-gradle-${{ hashFiles('gradle/caches/**/*', 'gradle/wrapper/**/*') }}
-        restore-keys: |
-          ${{ runner.os }}-gradle-
-    # Pinned to the commit hash of v1.3.0
-    - uses: Swatinem/rust-cache@842ef286fff290e445b90b4002cc9807c3669641
-      with:
-        sharedKey: ${{ runner.os }}-${{ env.rust_version }}-${{ github.job }}
-        target-dir: ./smithy-rs-target
-    - name: Download artifacts-generate-aws-sdk
-      uses: actions/download-artifact@v3
-      with:
-        name: artifacts-generate-aws-sdk
-    - name: Download artifacts-generate-aws-sdk-smoketest
-      uses: actions/download-artifact@v3
-      with:
-        name: artifacts-generate-aws-sdk-smoketest
-    - name: Untar artifacts
-      run: |
-        tar xfz artifacts-generate-aws-sdk.tar.gz
-        tar xfz artifacts-generate-aws-sdk-smoketest.tar.gz
-    - name: Download base image
-      if: ${{ needs.acquire-base-image.outputs.image-in-artifacts == 'true' }}
-      uses: actions/download-artifact@v3
-      with:
-        name: smithy-rs-base-image
-    - name: Prepare build image
-      run: |
-        if [[ "${{ needs.acquire-base-image.outputs.image-in-artifacts }}" == "true" ]]; then
-          docker load -i smithy-rs-base-image
-        else
-          ./smithy-rs/tools/ci-build/acquire-base-image --force-remote
-        fi
-        ./smithy-rs/tools/ci-build/create-local-build-image
-    # This runs the commands from the matrix strategy
     - name: Run ${{ matrix.test.action }}
-      run: ./smithy-rs/tools/ci-build/ci-action ${{ matrix.test.action }}
+      uses: ./smithy-rs/.github/actions/docker-build
+      with:
+        action: ${{ matrix.test.action }}
 
   test-rust-windows:
     name: Rust Tests on Windows
@@ -187,7 +107,7 @@ jobs:
       RUSTDOCFLAGS: -D warnings
       RUSTFLAGS: -D warnings
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       # Pinned to the commit hash of v1.3.0
     - uses: Swatinem/rust-cache@842ef286fff290e445b90b4002cc9807c3669641
       with:
@@ -208,6 +128,7 @@ jobs:
           popd &>/dev/null
         done
 
+  # This job is split out from the rest since it is not required to pass for merge
   check-sdk-examples:
     name: Check SDK Examples
     needs:
@@ -215,44 +136,13 @@ jobs:
     - generate
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         path: smithy-rs
-    - uses: actions/cache@v2
-      name: Gradle Cache
-      with:
-        path: |
-          gradle/caches
-          gradle/wrapper
-        key: ${{ runner.os }}-gradle-${{ hashFiles('gradle/caches/**/*', 'gradle/wrapper/**/*') }}
-        restore-keys: |
-          ${{ runner.os }}-gradle-
-      # Pinned to the commit hash of v1.3.0
-    - uses: Swatinem/rust-cache@842ef286fff290e445b90b4002cc9807c3669641
-      with:
-        sharedKey: ${{ runner.os }}-${{ env.rust_version }}-${{ github.job }}
-        target-dir: ./smithy-rs-target
-    - name: Download artifacts-generate-aws-sdk
-      uses: actions/download-artifact@v3
-      with:
-        name: artifacts-generate-aws-sdk
-    - name: Untar artifacts
-      run: tar xfz artifacts-generate-aws-sdk.tar.gz
-    - name: Download build image
-      if: ${{ needs.acquire-base-image.outputs.image-in-artifacts == 'true' }}
-      uses: actions/download-artifact@v3
+    - name: Run ${{ matrix.actions.action }}
+      uses: ./smithy-rs/.github/actions/docker-build
       with:
-        name: smithy-rs-base-image
-    - name: Prepare build image
-      run: |
-        if [[ "${{ needs.acquire-base-image.outputs.image-in-artifacts }}" == "true" ]]; then
-          docker load -i smithy-rs-base-image
-        else
-          ./smithy-rs/tools/ci-build/acquire-base-image --force-remote
-        fi
-        ./smithy-rs/tools/ci-build/create-local-build-image
-    - name: Run check-aws-sdk-examples
-      run: ./smithy-rs/tools/ci-build/ci-action check-aws-sdk-examples
+        action: check-aws-sdk-examples
 
   # Pseudo-job that depends on matrix jobs so that we don't have to enter
   # the myriad of test matrix combinations into GitHub's protected branch rules
diff --git a/tools/ci-build/README.md b/tools/ci-build/README.md
index 663c10a8ecca78325e61fe50918896c5ae8ed93a..bd87ef230f144192483676651944342693da8479 100644
--- a/tools/ci-build/README.md
+++ b/tools/ci-build/README.md
@@ -4,9 +4,9 @@ ci-build
 This directory includes the build Docker image and scripts to use it in CI.
 - `../Dockerfile`: Dockerfile used to create the base build image. Needs to be in `tools/` root so that it
   can copy all the tools source code into the image at build time.
-- `acquire-base-image`: Script that retrieves the base build image from public ECR or creates one locally
-  depending on the state of the tools directory. If the tools have changed (in git history), then it opts
-  to create a new image rather than reuse an existing one.
+- `acquire-build-image`: Script that retrieves the base build image from public ECR or creates one locally
+  depending on the state of the tools directory. If the git hash of the tools directory doesn't exist as a tag
+  in public ECR, then it will build a new image locally. Otherwise, it will download the existing one and reuse it.
 - `add-local-user.dockerfile`: Creates a user in the build image with the host's user ID
 - `build.docker-compose.yml`: Docker Compose file for using the build image
 - `ci-action`: Script for running CI actions inside of the Docker build image
@@ -36,5 +36,4 @@ $ORIGIN_PATH/tools/ci-build/ci-action <action> [args...]
 The action names are the names of the scripts in `scripts/`, and `[args...]` get forwarded to those scripts.
 
 __Note:__ `ci-action` does not rebuild the build image, so if you modified a script,
-you need to run `./acquire-base-image --force-local && ./create-local-build-image` from
-the origin `tools/ci-build` path.
+you need to run `./acquire-build-image` from the origin `tools/ci-build` path.
diff --git a/tools/ci-build/acquire-base-image b/tools/ci-build/acquire-base-image
deleted file mode 100755
index c04e1e1d36599125a64483e932b76177c73bc723..0000000000000000000000000000000000000000
--- a/tools/ci-build/acquire-base-image
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/bin/bash
-#
-# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
-# SPDX-License-Identifier: Apache-2.0.
-#
-
-set -ue
-
-SCRIPT_PATH="$(realpath "$(dirname "$0")")"
-cd "${SCRIPT_PATH}"
-
-if [[ $# -eq 1 && $1 == "--help" ]]; then
-    echo "Usage:"
-    echo "    $0"
-    echo "       OR"
-    echo "    $0 <base-revision>"
-    echo "       OR"
-    echo "    $0 --force-remote"
-    echo "       OR"
-    echo "    $0 --force-local"
-    echo "       OR"
-    echo "    $0 --nothing-or-local-if-changed <base-revision>"
-    echo
-    echo "Determines if tools changed between HEAD and the given <base-revision>, "
-    echo "and locates build Docker image based on that. This image becomes tagged "
-    echo "locally with Docker as 'smithy-rs-base-image'."
-    echo
-    echo "If run with no args, it will pull the remote image."
-    exit 1
-fi
-
-function acquire_remote_image {
-    REMOTE_IMAGE_TAG="$1"
-    REMOTE_IMAGE_NAME="public.ecr.aws/w0m4q9l7/github-awslabs-smithy-rs-ci:${REMOTE_IMAGE_TAG}"
-    docker pull "${REMOTE_IMAGE_NAME}"
-    docker tag "${REMOTE_IMAGE_NAME}" smithy-rs-base-image
-    exit 0
-}
-function acquire_local_image {
-    cd "${SCRIPT_PATH}/.."
-    docker build -t smithy-rs-base-image .
-    exit 0
-}
-
-if [[ $# -eq 0 || "$1" == "--force-remote" ]]; then
-  # Default to "latest" if no base revision is given
-  BASE_REV_OR_IMAGE_TAG="${2:-latest}"
-  acquire_remote_image "${BASE_REV_OR_IMAGE_TAG}"
-elif [[ "$1" == "--force-local" ]]; then
-  acquire_local_image
-elif [[ "$1" == "--nothing-or-local-if-changed" ]]; then
-  BASE_REV="$2"
-  cd "$(git rev-parse --show-toplevel)"
-
-  if (git diff --quiet HEAD "${BASE_REV}" -- tools); then
-      echo "Tools did not change. Doing nothing."
-  else
-      echo "Tools changed. Will build a new Docker build image with updated tools."
-      acquire_local_image
-  fi
-else
-  BASE_REV="$1"
-  cd "$(git rev-parse --show-toplevel)"
-
-  if (git diff --quiet HEAD "${BASE_REV}" -- tools); then
-      echo "Tools did not change. Will reuse existing Docker build image."
-      acquire_remote_image "${BASE_REV}"
-  else
-      echo "Tools changed. Will build a new Docker build image with updated tools."
-      acquire_local_image
-  fi
-fi
diff --git a/tools/ci-build/acquire-build-image b/tools/ci-build/acquire-build-image
new file mode 100755
index 0000000000000000000000000000000000000000..1bfa5bc86f0dcd2a9ae8840cf8572ed4020777b4
--- /dev/null
+++ b/tools/ci-build/acquire-build-image
@@ -0,0 +1,51 @@
+#!/bin/bash
+#
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0.
+#
+
+set -uexo pipefail
+C_YELLOW='\033[1;33m'
+C_RESET='\033[0m'
+
+START_PATH="$(pwd)"
+SCRIPT_PATH="$(realpath "$(dirname "$0")")"
+cd "${SCRIPT_PATH}"
+
+TOOLS_PATH="$(git rev-parse --show-toplevel)/tools"
+
+# The image tag is the SHA-1 hash of the `tools` directory when taking the `.gitignore` into consideration
+IMAGE_TAG=$("${SCRIPT_PATH}/tools-hash")
+IMAGE_NAME="public.ecr.aws/w0m4q9l7/github-awslabs-smithy-rs-ci"
+
+# If the image doesn't already exist locally, then look remotely
+if ! docker inspect "smithy-rs-base-image:${IMAGE_TAG}" >/dev/null; then
+  echo -e "${C_YELLOW}Attempting to pull remote image ${IMAGE_NAME}:${IMAGE_TAG}...${C_RESET}"
+  if ! docker pull "${IMAGE_NAME}:${IMAGE_TAG}" >/dev/null; then
+      # If there is no remote image with the matching IMAGE_TAG, then build one locally
+      if [[ "${ALLOW_LOCAL_BUILD:-}" == "false" ]]; then
+          echo -e "${C_YELLOW}Local build turned off by ALLOW_LOCAL_BUILD env var. Aborting.${C_RESET}"
+          exit 1
+      fi
+
+      echo -e "${C_YELLOW}Failed to pull remote image, which can happen if it doesn't exist. Building a new image locally...${C_RESET}"
+
+      pushd "${TOOLS_PATH}" &>/dev/null
+      docker build -t "smithy-rs-base-image:${IMAGE_TAG}" .
+      popd  &>/dev/null
+
+      if [[ "${GITHUB_ACTIONS:-}" == "true" ]]; then
+          echo -e "${C_YELLOW}Saving base image for use in later jobs...${C_RESET}"
+          docker save -o "${START_PATH}/smithy-rs-base-image" "smithy-rs-base-image:${IMAGE_TAG}"
+      fi
+  else
+      # Otherwise, we have successfully pulled the remote image
+      echo -e "${C_YELLOW}Successfully pulled remote image!${C_RESET}"
+  fi
+else
+  echo -e "${C_YELLOW}Base image found locally! No retrieval or rebuild necessary.${C_RESET}"
+fi
+
+echo -e "${C_YELLOW}Creating local build image...${C_RESET}"
+docker tag "smithy-rs-base-image:${IMAGE_TAG}" smithy-rs-base-image:local
+docker build -t smithy-rs-build-image --file add-local-user.dockerfile --build-arg=USER_ID="$(id -u)" .
diff --git a/tools/ci-build/add-local-user.dockerfile b/tools/ci-build/add-local-user.dockerfile
index d909de7e9095934ec13e43f0c1aecbf6b2e8b0ed..5648dbc067ce3ddd5c3b741ba0ffe62a9416d27c 100644
--- a/tools/ci-build/add-local-user.dockerfile
+++ b/tools/ci-build/add-local-user.dockerfile
@@ -12,8 +12,7 @@
 # Gradle caches, or Cargo/Rust caches will not require root access to manipulate after
 # Docker execution is completed.
 
-ARG base_image=smithy-rs-base-image
-FROM ${base_image} AS bare_base_image
+FROM smithy-rs-base-image:local AS bare_base_image
 
 ARG USER_ID
 RUN useradd -l -u ${USER_ID} -G build -o -s /bin/bash localbuild;
diff --git a/tools/ci-build/ci-output-build-image b/tools/ci-build/ci-output-build-image
deleted file mode 100755
index 577e7e01f06246ce772136540fb673c6b287bdb7..0000000000000000000000000000000000000000
--- a/tools/ci-build/ci-output-build-image
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/bin/bash
-#
-# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
-# SPDX-License-Identifier: Apache-2.0.
-#
-
-# This script is intended to be used in GitHub Actions to save the build Docker image for other jobs to use.
-
-set -uex
-
-if [[ $# -eq 1 ]]; then
-    # If a base revision is given as an argument, use it
-    BASE_REVISION="$1"
-else
-    # Otherwise, for the use-case where CI is being run directly on the main branch
-    # without a pull request, use the commit hash of HEAD
-    BASE_REVISION="$(cd smithy-rs; git rev-parse HEAD)"
-fi
-
-SCRIPT_PATH="$(realpath "$(dirname "$0")")"
-
-"${SCRIPT_PATH}/acquire-base-image" --nothing-or-local-if-changed "${BASE_REVISION}"
-
-# If a local base image was created, then save it off for upload to the artifacts
-if (docker inspect smithy-rs-base-image:latest &>/dev/null); then
-    docker save -o smithy-rs-base-image smithy-rs-base-image:latest;
-    echo "::set-output name=image-in-artifacts::true";
-else
-  # Otherwise, tell dependent jobs to use the public ECR image
-    echo "::set-output name=image-in-artifacts::false";
-fi
diff --git a/tools/ci-build/create-local-build-image b/tools/ci-build/create-local-build-image
deleted file mode 100755
index c5244d29f40af4bca2c065b06a1215c146a26a01..0000000000000000000000000000000000000000
--- a/tools/ci-build/create-local-build-image
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/bash
-#
-# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
-# SPDX-License-Identifier: Apache-2.0.
-#
-
-set -ue
-
-SCRIPT_PATH="$(realpath "$(dirname "$0")")"
-cd "${SCRIPT_PATH}"
-
-# Check to see if the base image is available
-docker inspect smithy-rs-base-image:latest &>/dev/null
-
-# Build a local user version of the image
-docker build -t smithy-rs-build-image --file add-local-user.dockerfile --build-arg=USER_ID="$(id -u)" .
diff --git a/tools/ci-build/tools-hash b/tools/ci-build/tools-hash
new file mode 100755
index 0000000000000000000000000000000000000000..46d7bd3a21ddfdf472d61d628df39a52c099ebb8
--- /dev/null
+++ b/tools/ci-build/tools-hash
@@ -0,0 +1,14 @@
+#!/bin/bash
+#
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0.
+
+# Outputs the git hash of the `tools/` directory.
+# The tools git hash is used to tag the Docker build images that get uploaded to ECR.
+
+set -eo pipefail
+
+cd "$(dirname "$0")"
+cd "$(git rev-parse --show-toplevel)"
+
+git ls-files -s --full-name "tools" | git hash-object --stdin