diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ab1645..d2634fb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ jobs:
     runs-on: ubuntu-latest
     env:
       KEYMANHOSTS_TIER: TIER_TEST
+      CONTAINER_DESC: web-keyman-com-app
+      CONTAINER_PORT: 8057
+
       # Composer started complaining about running as root, but we don't care in a GHA
       COMPOSER_ALLOW_SUPERUSER: 1
 
@@ -25,49 +28,72 @@ jobs:
         fail-fast: true
 
     #
-    # Finally, run the tests; note that this is almost all replicated in build.sh; here logging is reduced (TODO sync)
+    # Run tests -- these step definitions are NEARLY identical across:
+    #   help.keyman.com, keyman.com, keymanweb.com, api.keyman.com
+    #
+    # No differences on this site
     #
-    - name: PHP unit tests
+    - name: Test setup
       shell: bash
       run: |
-        docker exec web-keyman-com-app sh -c "vendor/bin/phpunit --testdox"
+        source ./_common/tests.inc.sh
+        set -e
+        do_test_record_start_time
+        echo "TEST_START_TIME=${TEST_START_TIME}" >> "$GITHUB_ENV"
+
+    - name: PHP test
+      if: ${{ !cancelled() }}
+      shell: bash
+      run: |
+        source ./_common/tests.inc.sh
+        set -e
+        do_test_unit_tests "$CONTAINER_DESC"
 
     - name: Lint
+      if: ${{ !cancelled() }}
       shell: bash
       run: |
-        ( set +e; set +o pipefail; find . -name '*.php' | grep -v '/vendor/' | xargs -n 1 -d '\n' php -l | grep -v "No syntax errors detected"; exit ${PIPESTATUS[2]} )
+        source ./_common/tests.inc.sh
+        set -e
+        do_test_lint "$CONTAINER_DESC"
 
     - name: Check broken links
+      if: ${{ !cancelled() }}
+      shell: bash
+      run: |
+        source ./_common/tests.inc.sh
+        set -e
+        do_test_links "http://localhost:${CONTAINER_PORT}" /
+
+      # We split the reporting of broken links into a separate step for ease of
+      # viewing because the broken links are otherwise hidden in a sea of good
+      # links in a very long report
+
+    - name: Report on broken links
+      if: ${{ !cancelled() }}
       shell: bash
       run: |
-        set +e;
-        set +o pipefail;
-        npx broken-link-checker http://localhost:8057 --ordered --recursive --requests 50 --host-requests 50 -e --filter-level 3 | \
-          grep -E "BROKEN|Getting links from" | \
-          grep -B 1 "BROKEN"
-        exit ${PIPESTATUS[0]}
+        source ./_common/tests.inc.sh
+        set -e
+        do_test_print_link_report
 
     - name: Check PHP errors
+      if: ${{ !cancelled() }}
       shell: bash
       run: |
-        CONTAINER=`docker container ls -l -q`
-        if docker container logs $CONTAINER 2>&1 | grep -q 'php7'; then
-          echo 'PHP reported errors or warnings:'
-          docker container logs $CONTAINER 2>&1 | grep 'php7'
-          exit 1
-        else
-          echo 'No PHP errors found'
-          exit 0
-        fi
-    #
-    # If any of the tests fail, let's grab a bit more detail on the environment
-    #
-    - name: Report errors
-      if: ${{ failure() }}
+        source ./_common/tests.inc.sh
+        set -e
+        do_test_print_container_error_logs "$CONTAINER_DESC"
+
+    - name: Verify .bootstrap-required-version
+      if: ${{ !cancelled() }}
       shell: bash
       run: |
-        CONTAINER=`docker container ls -l -q`
-        echo "--- tier.txt ---"
-        cat tier.txt
-        echo "--- PHP errors in Docker log ---"
-        docker container logs $CONTAINER 2>&1 | grep 'php7'
+        # We want to avoid merging a bootstrap version that is not based on a published tag
+        # in the shared-sites repo. We will do this with a heuristic based on the normal
+        # shape of the tags, which is `v#.#.#`. Any other shape we will assume is a test
+        # branch.
+        cat resources/.bootstrap-required-version | grep -qP '^v\d+\.\d+\.\d+$' || (
+          echo "::error file=resources/.bootstrap-required-version,line=1,col=1::This branch cannot be merged, because resources/.bootstrap-required-version references \`$(cat resources/.bootstrap-required-version)\`, which does not appear to be a published tag -- is it a test branch?"
+          exit 1
+        )
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 1ab4d7a..b15a172 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -9,8 +9,7 @@ jobs:
     steps:
     - name: Update labels based on PR title
       id: labeler
-      # latest, but still Node 20
-      uses: fuxingloh/multi-labeler@b15a54460c38f54043fa75f7b08a0e2aa5b94b5b # v4.0.0
+      uses: fuxingloh/multi-labeler@bcd50af464202999e57f556b4aefcf05a34abf85 # v5.0.0
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         config-path: .github/multi-labeler.yml
diff --git a/.gitignore b/.gitignore
index bbdab99..be43cc8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,10 @@ cdn/deploy
 /vendor
 .data/
 
+# unit test artifacts
+linkinator-results.json
+.phpunit.result.cache
+
 # Shared files are bootstrapped:
 resources/bootstrap.inc.sh
 resources/.bootstrap-version
diff --git a/build.sh b/build.sh
index 11f7cdc..3a38456 100755
--- a/build.sh
+++ b/build.sh
@@ -2,7 +2,8 @@
 ## START STANDARD SITE BUILD SCRIPT INCLUDE
 readonly THIS_SCRIPT="$(readlink -f "${BASH_SOURCE[0]}")"
 readonly BOOTSTRAP="$(dirname "$THIS_SCRIPT")/resources/bootstrap.inc.sh"
-readonly BOOTSTRAP_VERSION=v1.0.12
+BOOTSTRAP_VERSION="$(cat "$(dirname "THIS_SCRIPT")/resources/.bootstrap-required-version")" || exit 1
+readonly BOOTSTRAP_VERSION
 if ! [ -f "$BOOTSTRAP" ] || ! source "$BOOTSTRAP"; then
   curl -H "Cache-Control: no-cache" --fail --silent --show-error -w "curl: Finished attempt to download %{url}" "https://raw.githubusercontent.com/keymanapp/shared-sites/$BOOTSTRAP_VERSION/bootstrap.inc.sh" -o "$BOOTSTRAP.tmp" || exit 1
   source "$BOOTSTRAP.tmp"
@@ -29,38 +30,16 @@ builder_describe \
   start \
   stop \
   test \
+  "--no-unit-test" \
+  "--no-lint" \
+  "--no-link-check"
 
 builder_parse "$@"
 
-function test_docker_container() {
-  # Note: ci.yml replicates these
-  echo "TIER_TEST" > tier.txt
-
-  # Run unit tests
-  docker exec $KEYMANWEB_CONTAINER_DESC sh -c "vendor/bin/phpunit --testdox"
-
-  # Lint .php files for obvious errors
-  docker exec $KEYMANWEB_CONTAINER_DESC sh -c "find . -name '*.php' | grep -v '/vendor/' | xargs -n 1 -d '\\n' php -l"
-
-  # Check all internal links
-  # NOTE: link checker runs on host rather than in docker image
-  npx broken-link-checker http://localhost:${PORT_KEYMANWEB_COM} --ordered --recursive --host-requests 10 -e --filter-level 3
-
-  # Check for errors
-  if docker container logs $KEYMANWEB_CONTAINER_DESC 2>&1 | grep -q 'php7'; then
-    echo 'PHP reported errors or warnings:'
-    docker container logs $KEYMANWEB_CONTAINER_DESC 2>&1 | grep 'php7'
-    exit 1
-  else
-    echo 'No PHP errors found'
-    exit 0
-  fi
-}
-
 builder_run_action configure  bootstrap_configure
 builder_run_action clean      clean_docker_container $KEYMANWEB_IMAGE_NAME $KEYMANWEB_CONTAINER_NAME
 builder_run_action stop       stop_docker_container  $KEYMANWEB_IMAGE_NAME $KEYMANWEB_CONTAINER_NAME
 builder_run_action build      build_docker_container $KEYMANWEB_IMAGE_NAME $KEYMANWEB_CONTAINER_NAME
 builder_run_action start      start_docker_container $KEYMANWEB_IMAGE_NAME $KEYMANWEB_CONTAINER_NAME $KEYMANWEB_CONTAINER_DESC $HOST_KEYMANWEB_COM $PORT_KEYMANWEB_COM $BUILDER_CONFIGURATION
 
-builder_run_action test       test_docker_container
+builder_run_action test       test_docker_container  $KEYMANWEB_CONTAINER_DESC $PORT_KEYMANWEB_COM /
diff --git a/resources/.bootstrap-required-version b/resources/.bootstrap-required-version
new file mode 100644
index 0000000..0275cf6
--- /dev/null
+++ b/resources/.bootstrap-required-version
@@ -0,0 +1 @@
+v1.0.15