diff --git a/.ci-mgmt.yaml b/.ci-mgmt.yaml
index af5e30a87..ebc697f95 100644
--- a/.ci-mgmt.yaml
+++ b/.ci-mgmt.yaml
@@ -3,7 +3,9 @@ aws: true
 major-version: 2
 template: generic
 
-buildProviderCmd: "make PROVIDER_BIN=$(1) .make/provider"
+buildProviderCmd: "OS=$(1) ARCH=$(2) OUT=$(3) yarn --cwd awsx build"
+testProviderCmd: "yarn --cwd awsx test"
+renovateCmd: "yarn --cwd awsx dedupe-deps && make generate_sdks"
 
 env:
   ALT_AWS_ACCESS_KEY_ID: ${{ secrets.ALT_AWS_ACCESS_KEY_ID }}
diff --git a/.github/actions/upload-sdk/action.yml b/.github/actions/upload-sdk/action.yml
index bea11eed8..401eedab8 100644
--- a/.github/actions/upload-sdk/action.yml
+++ b/.github/actions/upload-sdk/action.yml
@@ -13,7 +13,7 @@ runs:
       shell: bash
       run: tar -zcf sdk/${{ inputs.language }}.tar.gz -C sdk/${{ inputs.language }} .
     - name: Upload artifacts
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       with:
         name: ${{ inputs.language  }}-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/${{ inputs.language }}.tar.gz
diff --git a/.github/workflows/build_provider.yml b/.github/workflows/build_provider.yml
index 9e96e9169..471658b5a 100644
--- a/.github/workflows/build_provider.yml
+++ b/.github/workflows/build_provider.yml
@@ -71,7 +71,7 @@ jobs:
         run: make provider_dist-${{ matrix.platform.os }}-${{ matrix.platform.arch }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: pulumi-resource-awsx-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz
           path: bin/pulumi-resource-awsx-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 1370e259b..b60147161 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -55,7 +55,7 @@ jobs:
       continue-on-error: true
       run: make prepare_local_workspace
     - name: golangci-lint
-      uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6
+      uses: golangci/golangci-lint-action@ec5d18412c0aeab7936cb16880d708ba2a64e1ae # v6
       with:
         version: v1.60
         working-directory: provider
diff --git a/.github/workflows/prerequisites.yml b/.github/workflows/prerequisites.yml
index c3405352c..9650b5651 100644
--- a/.github/workflows/prerequisites.yml
+++ b/.github/workflows/prerequisites.yml
@@ -103,14 +103,14 @@ jobs:
           Maintainer note: consult the [runbook](https://github.com/pulumi/platform-providers-team/blob/main/playbooks/tf-provider-updating.md) for dealing with any breaking changes.
 
     - name: Upload codegen binary for awsx
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       with:
         name: pulumi-gen-awsx
         path: ${{ github.workspace }}/bin/pulumi-gen-awsx
         retention-days: 30
 
     - name: Upload schema-embed.json
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       with:
         name: schema-embed.json
         path: provider/cmd/pulumi-resource-awsx/schema-embed.json
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index be4334273..a16f0a0c4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -217,6 +217,6 @@ jobs:
     with:
       providerVersion: ${{ inputs.version }}
       # Prelease is run often but we only have 5 concurrent macos runners, so we only test after the stable release.
-      enableMacosRunner: ${{ inputs.isPrerelease == false }}
+      enableMacRunner: ${{ inputs.isPrerelease == false }}
       skipGoSdk: ${{ inputs.skipGoSdk }}
       pythonVersion: ${{ needs.publish_sdk.outputs.python_version }}
diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml
index 070730358..c0ca801db 100644
--- a/.github/workflows/verify-release.yml
+++ b/.github/workflows/verify-release.yml
@@ -26,7 +26,7 @@ on:
         description: "The version of the provider to verify"
         required: true
         type: string
-      enableMacosRunner:
+      enableMacRunner:
         description: "Enable the macos-latest runner in addition to ubuntu-latest and windows-latest. Defaults to 'false'."
         required: false
         type: boolean
@@ -75,7 +75,7 @@ jobs:
         # Expression expands to ["ubuntu-latest","windows-latest"] or ["ubuntu-latest","windows-latest","macos-latest"]
         # GitHub expressions don't have 'if' statements, so we use a ternary operator to conditionally include the MacOS runner suffix.
         # See the docs for a similar example to this: https://docs.github.com/en/actions/learn-github-actions/expressions#fromjson
-        runner: ${{ fromJSON(format('["ubuntu-latest","windows-latest"{0}]', github.event.inputs.enableMacRunner == 'true' && ',"macos-latest"' || '')) }}
+        runner: ${{ fromJSON(format('["ubuntu-latest","windows-latest"{0}]', inputs.enableMacRunner && ',"macos-latest"' || '')) }}
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout Repo
diff --git a/.mk/build.mk b/.mk/build.mk
deleted file mode 100644
index c10021ec3..000000000
--- a/.mk/build.mk
+++ /dev/null
@@ -1,36 +0,0 @@
-PROVIDER_BIN  := bin/${PROVIDER}
-PROVIDER_OS   := $(shell go env GOOS)
-PROVIDER_ARCH := $(shell go env GOARCH)
-
-PKG_ARGS := --no-bytecode --public-packages "*" --public
-AWSX_SRC := $(wildcard awsx/*.*) $(wildcard awsx/*/*.ts)
-
-.PHONY: .make/provider
-.make/provider: .make/provider/${PROVIDER_OS}-${PROVIDER_ARCH}
-
-.make/provider/linux-amd64: TARGET := node16-linuxstatic-x64
-.make/provider/linux-arm64: TARGET := node16-linuxstatic-arm64
-.make/provider/darwin-amd64: TARGET := node16-macos-x64
-.make/provider/darwin-arm64: TARGET := node16-macos-arm64
-.make/provider/windows-amd64: TARGET := node16-win-x64
-.make/provider/%: .make/awsx_bin .make/gen_types
-	cd awsx && yarn run check-duplicate-deps
-	cd awsx && yarn run pkg . ${PKG_ARGS} --target "${TARGET}" --output "${PROVIDER_BIN}"
-	mkdir -p .make/provider
-	@touch $@
-
-.make/gen_types: .make/awsx_node_modules .make/schema
-	cd awsx && yarn gen-types
-	@touch $@
-
-.make/awsx_bin: .make/awsx_node_modules .make/gen_types ${AWSX_SRC}
-	@cd awsx && \
-		yarn tsc && \
-		cp package.json ./bin/ && \
-		cp ../provider/cmd/pulumi-resource-awsx/schema-embed.json ./bin/schema.json && \
-		sed -i.bak -e "s/\$${VERSION}/$(VERSION_GENERIC)/g" ./bin/package.json
-	@touch $@
-
-.make/awsx_node_modules: awsx/package.json awsx/yarn.lock
-	yarn install --cwd awsx --no-progress
-	@touch $@
diff --git a/.mk/renovate.mk b/.mk/renovate.mk
deleted file mode 100644
index 9fc94a5be..000000000
--- a/.mk/renovate.mk
+++ /dev/null
@@ -1,3 +0,0 @@
-.PHONY: renovate
-renovate: generate_sdks
-	cd awsx && yarn run dedupe-deps
diff --git a/.mk/test_provider.mk b/.mk/test_provider.mk
deleted file mode 100644
index 77afe1a28..000000000
--- a/.mk/test_provider.mk
+++ /dev/null
@@ -1,10 +0,0 @@
-test_provider: yarn_tests
-
-yarn_tests:
-	cd awsx && yarn test
-.PHONY: yarn_tests
-
-# istanbul_tests:
-# 	cd awsx-classic/tests && \
-# 		yarn && yarn run build && yarn run mocha $$(find bin -name '*.spec.js')
-# .PHONY: istanbul_tests
diff --git a/Makefile b/Makefile
index 9e845507b..2e300e3fb 100644
--- a/Makefile
+++ b/Makefile
@@ -9,6 +9,7 @@ CODEGEN := pulumi-gen-$(PACK)
 PROVIDER := pulumi-resource-$(PACK)
 JAVA_GEN := pulumi-java-gen
 TESTPARALLELISM := 10
+GOTESTARGS := ""
 WORKING_DIR := $(shell pwd)
 PULUMI_PROVIDER_BUILD_PARALLELISM ?=
 PULUMI_CONVERT := 0
@@ -214,29 +215,26 @@ lint_provider: provider
 lint_provider.fix:
 	cd provider && golangci-lint run --path-prefix provider -c ../.golangci.yml --fix
 .PHONY: lint_provider lint_provider.fix
+build_provider_cmd = OS=$(1) ARCH=$(2) OUT=$(3) yarn --cwd awsx build
+
+provider: bin/$(PROVIDER)
 
 # `make provider_no_deps` builds the provider binary directly, without ensuring that
 # `cmd/pulumi-resource-awsx/schema.json` is valid and up to date.
 # To create a release ready binary, you should use `make provider`.
-build_provider_cmd = make PROVIDER_BIN=$(1) .make/provider
-provider: bin/$(PROVIDER)
 provider_no_deps:
-	$(call build_provider_cmd,$(WORKING_DIR)/bin/$(PROVIDER))
+	$(call build_provider_cmd,$(shell go env GOOS),$(shell go env GOARCH),$(WORKING_DIR)/bin/$(PROVIDER))
 bin/$(PROVIDER): .make/schema
-	$(call build_provider_cmd,$(WORKING_DIR)/bin/$(PROVIDER))
+	$(call build_provider_cmd,$(shell go env GOOS),$(shell go env GOARCH),$(WORKING_DIR)/bin/$(PROVIDER))
 .PHONY: provider provider_no_deps
 
 test: export PATH := $(WORKING_DIR)/bin:$(PATH)
 test:
-	cd examples && go test -v -tags=all -parallel $(TESTPARALLELISM) -timeout 2h
+	cd examples && go test -v -tags=all -parallel $(TESTPARALLELISM) -timeout 2h $(value GOTESTARGS)
 .PHONY: test
-
+test_provider_cmd = yarn --cwd awsx test
 test_provider:
-	cd provider && go test -v -short \
-		-coverprofile="coverage.txt" \
-		-coverpkg="./...,github.com/hashicorp/terraform-provider-..." \
-		-parallel $(TESTPARALLELISM) \
-		./...
+	$(call test_provider_cmd)
 .PHONY: test_provider
 
 tfgen: schema
@@ -310,18 +308,18 @@ SKIP_SIGNING ?=
 
 # These targets assume that the schema-embed.json exists - it's generated by tfgen.
 # We disable CGO to ensure that the binary is statically linked.
-bin/linux-amd64/$(PROVIDER): export GOOS := linux
-bin/linux-amd64/$(PROVIDER): export GOARCH := amd64
-bin/linux-arm64/$(PROVIDER): export GOOS := linux
-bin/linux-arm64/$(PROVIDER): export GOARCH := arm64
-bin/darwin-amd64/$(PROVIDER): export GOOS := darwin
-bin/darwin-amd64/$(PROVIDER): export GOARCH := amd64
-bin/darwin-arm64/$(PROVIDER): export GOOS := darwin
-bin/darwin-arm64/$(PROVIDER): export GOARCH := arm64
-bin/windows-amd64/$(PROVIDER).exe: export GOOS := windows
-bin/windows-amd64/$(PROVIDER).exe: export GOARCH := amd64
+bin/linux-amd64/$(PROVIDER): GOOS := linux
+bin/linux-amd64/$(PROVIDER): GOARCH := amd64
+bin/linux-arm64/$(PROVIDER): GOOS := linux
+bin/linux-arm64/$(PROVIDER): GOARCH := arm64
+bin/darwin-amd64/$(PROVIDER): GOOS := darwin
+bin/darwin-amd64/$(PROVIDER): GOARCH := amd64
+bin/darwin-arm64/$(PROVIDER): GOOS := darwin
+bin/darwin-arm64/$(PROVIDER): GOARCH := arm64
+bin/windows-amd64/$(PROVIDER).exe: GOOS := windows
+bin/windows-amd64/$(PROVIDER).exe: GOARCH := amd64
 bin/%/$(PROVIDER) bin/%/$(PROVIDER).exe: bin/jsign-6.0.jar
-	$(call build_provider_cmd,$(WORKING_DIR)/$@)
+	$(call build_provider_cmd,$(GOOS),$(GOARCH),$(WORKING_DIR)/$@)
 
 	@# Only sign windows binary if fully configured.
 	@# Test variables set by joining with | between and looking for || showing at least one variable is empty.
@@ -379,6 +377,10 @@ provider_dist-darwin-arm64: bin/$(PROVIDER)-v$(VERSION_GENERIC)-darwin-arm64.tar
 provider_dist-windows-amd64: bin/$(PROVIDER)-v$(VERSION_GENERIC)-windows-amd64.tar.gz
 provider_dist: provider_dist-linux-amd64 provider_dist-linux-arm64 provider_dist-darwin-amd64 provider_dist-darwin-arm64 provider_dist-windows-amd64
 .PHONY: provider_dist-linux-amd64 provider_dist-linux-arm64 provider_dist-darwin-amd64 provider_dist-darwin-arm64 provider_dist-windows-amd64 provider_dist
+renovate_cmd = yarn --cwd awsx dedupe-deps && make generate_sdks
+renovate:
+	$(call renovate_cmd)
+.PHONY: renovate
 
 # Permit providers to extend the Makefile with provider-specific Make includes.
 include $(wildcard .mk/*.mk)
diff --git a/awsx/package.json b/awsx/package.json
index 4bfcdab63..f3dd35dae 100644
--- a/awsx/package.json
+++ b/awsx/package.json
@@ -14,6 +14,7 @@
   "scripts": {
     "gen-scripts": "curl https://raw.githubusercontent.com/pulumi/pulumi/master/pkg/codegen/schema/pulumi.json | json2ts -o scripts/pulumi-schema.d.ts --unreachableDefinitions --ignoreMinAndMaxItems",
     "gen-types": "ts-node scripts/generate-provider-types.ts",
+    "build": "SCHEMA=../provider/cmd/pulumi-resource-awsx/schema-embed.json ./scripts/build.sh",
     "format": "prettier --list-different --write .",
     "lint": "tslint -c tslint.json -p tsconfig.json",
     "test": "jest",
diff --git a/awsx/scripts/build.sh b/awsx/scripts/build.sh
new file mode 100755
index 000000000..a5b2f0b5d
--- /dev/null
+++ b/awsx/scripts/build.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Bundle a Pulumi Package Schema and create a stand-alone executable versioned build for a desired platform.
+
+: ${OS?"Environment variable OS must be set to the desired operating system for the build in the GOOS format"}
+: ${ARCH?"Environment variable ARCH must be set to the desired architecture for the build in the GOARCH format"}
+: ${OUT?"Environment variable OUT must be set to the desired output path for the binary"}
+: ${SCHEMA?"Environment variable SCHEMA must point to a file with Pulumi Package Schema to embed in the build"}
+
+NODEOS=""
+case "${OS}" in
+    "linux")
+        NODEOS="linuxstatic"
+        ;;
+    "darwin")
+        NODEOS="macos"
+        ;;
+    "windows")
+        NODEOS="win"
+        ;;
+    *)
+        echo "Unsupported OS: ${OS}"
+        exit 1
+        ;;
+esac
+
+NODEARCH=""
+case "${ARCH}" in
+    "amd64")
+        NODEARCH="x64"
+        ;;
+    "arm64")
+        NODEARCH="arm64"
+        ;;
+    *)
+        echo "Unsupported ARCH: ${ARCH}"
+        exit 1
+        ;;
+esac
+
+TARGET="node16-${NODEOS}-${NODEARCH}"
+VERSION=$(jq -r .version "${SCHEMA}")
+
+yarn install --no-progress --frozen-lockfile
+yarn check-duplicate-deps
+yarn gen-types
+yarn tsc
+cp ${SCHEMA} bin/schema.json
+cp package.json bin/package.json
+yarn --cwd bin version --new-version "${VERSION}" --no-git-tag-version
+yarn run pkg . --no-bytecode --public-packages "*" --public --target "${TARGET}" --output "${OUT}"