diff --git a/.gitea/workflows/build-tstudio.yml b/.gitea/workflows/build-tstudio.yml
index 5563d9ee98..b112640da2 100644
--- a/.gitea/workflows/build-tstudio.yml
+++ b/.gitea/workflows/build-tstudio.yml
@@ -15,20 +15,11 @@ jobs:
   build:
     runs-on: host
     steps:
-      - name: Install tools
-        run: |
-          apt-get update && apt-get install -y curl git ca-certificates unzip
-          # Go
-          curl -fsSL https://go.dev/dl/go1.26.2.linux-amd64.tar.gz | tar -C /usr/local -xz
-          export PATH=$PATH:/usr/local/go/bin
-          go version
-          # AWS CLI
-          curl -fsSL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscli.zip
-          unzip -q awscli.zip && ./aws/install && rm -rf awscli.zip aws/
-          aws --version
+      - uses: tinqs/ci/checkout@v1
 
-      - name: Checkout
-        run: git clone --depth 1 --branch main https://tinqs.com/tinqs/studio.git .
+      - uses: tinqs/ci/setup-go@v1
+
+      - uses: tinqs/ci/setup-aws@v1
 
       - name: Detect version
         id: version
@@ -39,7 +30,6 @@ jobs:
 
       - name: Build all platforms
         run: |
-          export PATH=$PATH:/usr/local/go/bin
           VERSION="${{ steps.version.outputs.version }}"
           LDFLAGS="-s -w -X main.Version=${VERSION}"
           mkdir -p dist/tstudio
@@ -63,4 +53,4 @@ jobs:
             aws s3 cp "$BIN" "$S3_BASE/v$VERSION/$NAME" --region eu-west-1
           done
 
-          echo "OK tstudio $VERSION → S3"
+          echo "OK tstudio $VERSION -> S3"
diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 627ccf0936..e311d1709f 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -37,8 +37,12 @@ jobs:
   build:
     runs-on: host
     steps:
-      - name: Checkout
-        run: git clone --depth 1 --branch main https://tinqs.com/tinqs/studio.git .
+      - uses: tinqs/ci/checkout@v1
+
+      - uses: tinqs/ci/setup-aws@v1
+        with:
+          ecr-login: 'true'
+          ecr-repo: ${{ env.ECR_REPO }}
 
       - name: Set version
         id: version
@@ -47,11 +51,6 @@ jobs:
           echo "sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"
           echo "tag=main-$SHORT_SHA" >> "$GITHUB_OUTPUT"
 
-      - name: Login to ECR
-        run: |
-          aws ecr get-login-password --region $AWS_REGION | \
-            docker login --username AWS --password-stdin $ECR_REPO
-
       - name: Build Docker image
         run: |
           TAG="${{ steps.version.outputs.tag }}"
@@ -93,7 +92,6 @@ jobs:
       - name: Upload binary to S3 (backup)
         run: |
           SHORT_SHA="${{ steps.version.outputs.sha }}"
-          # Extract binary from image for S3 archive
           CONTAINER=$(docker create $ECR_REPO:latest)
           docker cp $CONTAINER:/usr/local/bin/gitea ./gitea 2>/dev/null || \
             docker cp $CONTAINER:/app/gitea/gitea ./gitea 2>/dev/null || true
diff --git a/.gitea/workflows/deploy-arikigame.yml b/.gitea/workflows/deploy-arikigame.yml
index 0c5e65cb5f..c5744a041d 100644
--- a/.gitea/workflows/deploy-arikigame.yml
+++ b/.gitea/workflows/deploy-arikigame.yml
@@ -15,8 +15,9 @@ jobs:
   deploy:
     runs-on: host
     steps:
-      - name: Checkout
-        run: git clone --depth 1 --branch main https://tinqs.com/tinqs/studio.git .
+      - uses: tinqs/ci/checkout@v1
+
+      - uses: tinqs/ci/setup-aws@v1
 
       - name: Deploy static site to S3 + CloudFront
         env:
@@ -29,7 +30,7 @@ jobs:
             echo "Missing $SRC — nothing to deploy"
             exit 1
           fi
-          echo "Syncing $SRC → s3://${S3_BUCKET}/"
+          echo "Syncing $SRC -> s3://${S3_BUCKET}/"
           aws s3 sync "$SRC" "s3://${S3_BUCKET}/" --delete \
             --cache-control "public, max-age=300"
           echo "Invalidating CloudFront ${CF_DISTRIBUTION}..."
diff --git a/.gitea/workflows/deploy-bot.yml b/.gitea/workflows/deploy-bot.yml
index 0f4f48bfc5..29ae8da0fa 100644
--- a/.gitea/workflows/deploy-bot.yml
+++ b/.gitea/workflows/deploy-bot.yml
@@ -20,8 +20,12 @@ jobs:
   build:
     runs-on: host
     steps:
-      - name: Checkout
-        run: git clone --depth 1 --branch main https://tinqs.com/tinqs/studio.git .
+      - uses: tinqs/ci/checkout@v1
+
+      - uses: tinqs/ci/setup-aws@v1
+        with:
+          ecr-login: 'true'
+          ecr-repo: ${{ env.ECR_REPO }}
 
       - name: Set version
         id: version
@@ -30,11 +34,6 @@ jobs:
           echo "sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"
           echo "tag=bot-$SHORT_SHA" >> "$GITHUB_OUTPUT"
 
-      - name: Login to ECR
-        run: |
-          aws ecr get-login-password --region $AWS_REGION | \
-            docker login --username AWS --password-stdin $ECR_REPO
-
       - name: Create ECR repo if needed
         run: |
           aws ecr describe-repositories --repository-names tinqs-bot --region $AWS_REGION 2>/dev/null || \
@@ -59,7 +58,6 @@ jobs:
 
       - name: Deploy bot staging
         run: |
-          # Deploy if ECS service exists, skip if not yet created
           aws ecs update-service \
             --cluster $ECS_CLUSTER \
             --service tinqs-bot-staging \
diff --git a/.gitea/workflows/deploy-docs.yml b/.gitea/workflows/deploy-docs.yml
index 816b4e1f7d..e2a499385e 100644
--- a/.gitea/workflows/deploy-docs.yml
+++ b/.gitea/workflows/deploy-docs.yml
@@ -22,20 +22,11 @@ jobs:
   deploy:
     runs-on: host
     steps:
-      - name: Install tools
-        run: |
-          apt-get update && apt-get install -y curl git ca-certificates unzip
-          # Node 22
-          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
-          apt-get install -y nodejs
-          npm install -g pnpm
-          node --version && pnpm --version
-          # AWS CLI
-          curl -fsSL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscli.zip
-          unzip -q awscli.zip && ./aws/install && rm -rf awscli.zip aws/
+      - uses: tinqs/ci/checkout@v1
 
-      - name: Checkout
-        run: git clone --depth 1 --branch main https://tinqs.com/tinqs/studio.git .
+      - uses: tinqs/ci/setup-node@v1
+
+      - uses: tinqs/ci/setup-aws@v1
 
       - name: Build Docusaurus
         run: |
diff --git a/.gitea/workflows/deploy-proxy.yml b/.gitea/workflows/deploy-proxy.yml
index 7d6fb1f274..25d906c349 100644
--- a/.gitea/workflows/deploy-proxy.yml
+++ b/.gitea/workflows/deploy-proxy.yml
@@ -15,8 +15,9 @@ jobs:
   deploy:
     runs-on: host
     steps:
-      - name: Checkout
-        run: git clone --depth 1 --branch main https://tinqs.com/tinqs/studio.git .
+      - uses: tinqs/ci/checkout@v1
+
+      - uses: tinqs/ci/setup-go@v1
 
       - name: Build proxy binary
         run: |