diff --git a/.github/workflows/trybot.yml b/.github/workflows/trybot.yml
index c52cc17b7..d9de60234 100644
--- a/.github/workflows/trybot.yml
+++ b/.github/workflows/trybot.yml
@@ -1,5 +1,6 @@
 # Code generated internal/ci/ci_tool.cue; DO NOT EDIT.
 
+name: TryBot
 "on":
   push:
     branches:
@@ -68,44 +69,6 @@ jobs:
         run: |
           echo 'Setting CI_NO_SKIP_CACHE=true'
           echo "CI_NO_SKIP_CACHE=true" >> $GITHUB_ENV
-      - name: Early git and code sanity checks
-        run: |-
-          # Ensure that commit messages have a blank second line.
-          # We know that a commit message must be longer than a single
-          # line because each commit must be signed-off.
-          if git log --format=%B -n 1 HEAD | sed -n '2{/^$/{q1}}'; then
-          	echo "second line of commit message must be blank"
-          	exit 1
-          fi
-
-          # All authors, including co-authors, must have a signed-off trailer by email.
-          # Note that trailers are in the form "Name <email>", so grab the email with sed.
-          # For now, we require the sorted lists of author and signer emails to match.
-          # Note that this also fails if a commit isn't signed-off at all.
-          #
-          # In Gerrit we already enable a form of this via https://gerrit-review.googlesource.com/Documentation/project-configuration.html#require-signed-off-by,
-          # but it does not support co-authors nor can it be used when testing GitHub PRs.
-          commit_authors="$(
-          	{
-          		git log -1 --pretty='%ae'
-          		git log -1 --pretty='%(trailers:key=Co-authored-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p'
-          	} | sort -u
-          )"
-          commit_signers="$(
-          	{
-          		git log -1 --pretty='%(trailers:key=Signed-off-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p'
-          	} | sort -u
-          )"
-          if [[ "${commit_authors}" != "${commit_signers}" ]]; then
-          	echo "Error: commit author email addresses do not match signed-off-by trailers"
-          	echo
-          	echo "Authors:"
-          	echo "${commit_authors}"
-          	echo
-          	echo "Signers:"
-          	echo "${commit_signers}"
-          	exit 1
-          fi
       - if: runner.os == 'macOS'
         name: Set TMPDIR environment variable (${{runner.os}})
         run: |-
@@ -145,6 +108,12 @@ jobs:
         with:
           cache: false
           go-version: 1.23.0
+      - name: Set common go env vars
+        run: |-
+          go env -w GOTOOLCHAIN=local
+
+          # Dump env for good measure
+          go env
       - if: runner.os == 'Linux'
         name: Install Hugo (${{ runner.os }})
         uses: peaceiris/actions-hugo@v2
@@ -154,6 +123,8 @@ jobs:
       - if: runner.os == 'macOS'
         name: Install Hugo (${{ runner.os }})
         run: brew install hugo
+      - name: Early git and code sanity checks
+        run: go run cuelang.org/go/internal/ci/checks@v0.11.0-0.dev.0.20240903133435-46fb300df650
       - name: 'Set PREPROCESSOR_NOWRITECACHE if Preprocessor-No-Write-Cache: true'
         run: |
           if ./_scripts/noWriteCache.bash HEAD
diff --git a/internal/ci/base/base.cue b/internal/ci/base/base.cue
index 39b9010e2..c0dea7dd9 100644
--- a/internal/ci/base/base.cue
+++ b/internal/ci/base/base.cue
@@ -35,7 +35,7 @@ import (
 )
 
 // Package parameters
-githubRepositoryPath:   *(URLPath & {#url: githubRepositoryURL, _}) | string
+githubRepositoryPath: *(URLPath & {#url: githubRepositoryURL, _}) | string
 githubRepositoryURL:    *("https://github.com/" + githubRepositoryPath) | string
 gerritHubHostname:      "review.gerrithub.io"
 gerritHubRepositoryURL: *("https://\(gerritHubHostname)/a/" + githubRepositoryPath) | string
@@ -67,7 +67,7 @@ codeReview: #codeReview & {
 // Define some shared keys and human-readable names.
 //
 // trybot.key and unity.key are shared with
-// github.com/cue-sh/tools/cmd/cueckoo.  The keys are used across various CUE
+// github.com/cue-lang/contrib-tools/cmd/cueckoo.  The keys are used across various CUE
 // workflows and their consistency in those various locations is therefore
 // crucial. As such, we assert specific values for the keys here rather than
 // just deriving values from the human-readable names.
diff --git a/internal/ci/base/codereview.cue b/internal/ci/base/codereview.cue
index 113aab86a..134c9405f 100644
--- a/internal/ci/base/codereview.cue
+++ b/internal/ci/base/codereview.cue
@@ -10,7 +10,7 @@ import (
 // #codeReview defines the schema of a codereview.cfg file that
 // sits at the root of a repository. codereview.cfg is the configuration
 // file that drives golang.org/x/review/git-codereview. This config
-// file is also used by github.com/cue-sh/tools/cmd/cueckoo.
+// file is also used by github.com/cue-lang/contrib-tools/cmd/cueckoo.
 #codeReview: {
 	gerrit?:      string
 	github?:      string
diff --git a/internal/ci/base/github.cue b/internal/ci/base/github.cue
index 5e0eee12b..5b1c4ce0a 100644
--- a/internal/ci/base/github.cue
+++ b/internal/ci/base/github.cue
@@ -15,14 +15,51 @@ bashWorkflow: json.#Workflow & {
 	jobs: [string]: defaults: run: shell: "bash"
 }
 
-installGo: json.#step & {
-	name: "Install Go"
-	uses: "actions/setup-go@v5"
-	with: {
-		// We do our own caching in setupGoActionsCaches.
-		cache:        false
-		"go-version": string
+installGo: {
+	#setupGo: json.#step & {
+		name: "Install Go"
+		uses: "actions/setup-go@v5"
+		with: {
+			// We do our own caching in setupGoActionsCaches.
+			cache:        false
+			"go-version": string
+		}
 	}
+
+	// Why set GOTOOLCHAIN here? As opposed to an environment variable
+	// elsewhere? No perfect answer to this question but here is the thinking:
+	//
+	// Setting the variable here localises it with the installation of Go. Doing
+	// it elsewhere creates distance between the two steps which are
+	// intrinsically related. And it's also hard to do: "when we use this step,
+	// also ensure that we establish an environment variable in the job for
+	// GOTOOLCHAIN".
+	//
+	// Environment variables can only be set at a workflow, job or step level.
+	// Given we currently use a matrix strategy which varies the Go version,
+	// that rules out using an environment variable based approach, because the
+	// Go version is only available at runtime via GitHub actions provided
+	// context. Whether we should instead be templating multiple workflows (i.e.
+	// exploding the matrix ourselves) is a different question, but one that
+	// has performance implications.
+	//
+	// So as clumsy as it is to use a step "template" that includes more than
+	// one step, it's the best option available to us for now.
+	[
+		#setupGo,
+
+		{
+			json.#step & {
+				name: "Set common go env vars"
+				run: """
+					go env -w GOTOOLCHAIN=local
+
+					# Dump env for good measure
+					go env
+					"""
+			}
+		},
+	]
 }
 
 checkoutCode: {
@@ -100,44 +137,7 @@ checkoutCode: {
 
 earlyChecks: json.#step & {
 	name: "Early git and code sanity checks"
-	run: #"""
-		# Ensure that commit messages have a blank second line.
-		# We know that a commit message must be longer than a single
-		# line because each commit must be signed-off.
-		if git log --format=%B -n 1 HEAD | sed -n '2{/^$/{q1}}'; then
-			echo "second line of commit message must be blank"
-			exit 1
-		fi
-
-		# All authors, including co-authors, must have a signed-off trailer by email.
-		# Note that trailers are in the form "Name <email>", so grab the email with sed.
-		# For now, we require the sorted lists of author and signer emails to match.
-		# Note that this also fails if a commit isn't signed-off at all.
-		#
-		# In Gerrit we already enable a form of this via https://gerrit-review.googlesource.com/Documentation/project-configuration.html#require-signed-off-by,
-		# but it does not support co-authors nor can it be used when testing GitHub PRs.
-		commit_authors="$(
-			{
-				git log -1 --pretty='%ae'
-				git log -1 --pretty='%(trailers:key=Co-authored-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p'
-			} | sort -u
-		)"
-		commit_signers="$(
-			{
-				git log -1 --pretty='%(trailers:key=Signed-off-by,valueonly)' | sed -ne 's/.* <\(.*\)>/\1/p'
-			} | sort -u
-		)"
-		if [[ "${commit_authors}" != "${commit_signers}" ]]; then
-			echo "Error: commit author email addresses do not match signed-off-by trailers"
-			echo
-			echo "Authors:"
-			echo "${commit_authors}"
-			echo
-			echo "Signers:"
-			echo "${commit_signers}"
-			exit 1
-		fi
-		"""#
+	run:  "go run cuelang.org/go/internal/ci/checks@v0.11.0-0.dev.0.20240903133435-46fb300df650"
 }
 
 curlGitHubAPI: {
diff --git a/internal/ci/github/trybot.cue b/internal/ci/github/trybot.cue
index cc48243b7..8e95dfc5b 100644
--- a/internal/ci/github/trybot.cue
+++ b/internal/ci/github/trybot.cue
@@ -25,6 +25,8 @@ import (
 )
 
 workflows: trybot: _repo.bashWorkflow & {
+	name: _repo.trybot.name
+
 	on: {
 		push: {
 			branches: list.Concat([[_repo.testDefaultBranch], _repo.protectedBranchPatterns]) // do not run PR branches
@@ -88,17 +90,17 @@ workflows: trybot: _repo.bashWorkflow & {
 					"""
 			},
 
-			_repo.earlyChecks,
-
 			for v in _installDockerMacOS {v},
 
 			_installMacOSUtils,
 			_setupBuildx,
 			_installNode,
-			_installGo,
+			for v in _installGo {v},
 			_installHugoLinux,
 			_installHugoMacOS,
 
+			_repo.earlyChecks,
+
 			// If the commit under test contains the trailer
 			// Preprocessor-No-Write-Cache: true, then set the
 			// PREPROCESSOR_NOWRITECACHE env var to non-empty.
@@ -276,7 +278,8 @@ _installNode: json.#step & {
 }
 
 _installGo: _repo.installGo & {
-	with: "go-version": _repo.goVersion
+	#setupGo: with: "go-version": _repo.goVersion
+	_
 }
 
 _installHugoLinux: _linuxStep & {
@@ -403,7 +406,7 @@ _netlifyDeploy: json.#step & {
 
 // _setupGoActionsCaches is shared between trybot and update_tip.
 _setupGoActionsCaches: _repo.setupGoActionsCaches & {
-	#goVersion: _installGo.with."go-version"
+	#goVersion: _installGo.#setupGo.with."go-version"
 
 	// Unfortunate that we need to hardcode here. Ideally we would be able to derive
 	// the OS from the runner. i.e. from _linuxWorkflow somehow.