diff --git a/.config/nextest.toml b/.config/nextest.toml
new file mode 100644
index 00000000..441a07f3
--- /dev/null
+++ b/.config/nextest.toml
@@ -0,0 +1,19 @@
+# cargo-nextest configuration
+# https://nexte.st/docs/configuration/
+#
+# A handful of enclave-build tests are annotated with `#[serial_test::serial]`
+# because they share process-wide state (they write `cert.pem`/`key.pem` into,
+# and build from, the crate's working directory). `serial_test` enforces this
+# with an in-process mutex, which works under `cargo test` because all tests run
+# in a single process.
+#
+# nextest runs each test in its own process, so that in-process mutex no longer
+# serializes anything. The `serial` test group below restores the guarantee by
+# allowing at most one of these tests to run at a time across the whole run,
+# mirroring the previous `cargo test` behaviour.
+[test-groups]
+serial = { max-threads = 1 }
+
+[[profile.default.overrides]]
+filter = 'test(test_choose_output_dir) | test(test_reproducible_enclave_builds_with_pinned_version)'
+test-group = 'serial'
diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml
index f224ec73..cebd7863 100644
--- a/.github/workflows/build-and-publish.yml
+++ b/.github/workflows/build-and-publish.yml
@@ -30,7 +30,7 @@ permissions:
   contents: read
 jobs:
   build-linux:
-    runs-on: ubuntu-latest
+    runs-on: ev-runner-x-large
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/lint-and-test-cli.yml b/.github/workflows/lint-and-test-cli.yml
index 502c24f1..b12122bd 100644
--- a/.github/workflows/lint-and-test-cli.yml
+++ b/.github/workflows/lint-and-test-cli.yml
@@ -4,7 +4,7 @@ name: Lint and Test crates
 
 jobs:
   clippy_check_cli:
-    runs-on: ubuntu-latest
+    runs-on: ev-runner-x-large
     steps:
       - uses: actions/checkout@v7
       - uses: actions-hub/docker/cli@f5fdbfc3f9d2a9265ead8962c1314108a7b7ec5d
@@ -14,6 +14,8 @@ jobs:
         with:
           toolchain: stable
           components: rustfmt, clippy
+      - name: Install nextest
+        uses: taiki-e/install-action@nextest
       - name: Compile project
         run: cargo build
       - name: Prepare pcr-sign package for integration testing
@@ -21,7 +23,7 @@ jobs:
           cd crates/pcr-sign
           sh ./scripts/generate-test-signature.sh
       - name: Test project
-        run: cargo test -p ev-cli -p ev-enclave
+        run: cargo nextest run -p ev-cli -p ev-enclave
       - name: Format project
         run: cargo fmt --check
       - name: Lint project
diff --git a/.github/workflows/release-cli-version-staging.yml b/.github/workflows/release-cli-version-staging.yml
index 9032f482..aff64cf4 100644
--- a/.github/workflows/release-cli-version-staging.yml
+++ b/.github/workflows/release-cli-version-staging.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   clippy_check_cli:
-    runs-on: ubuntu-latest
+    runs-on: ev-runner-x-large
     steps:
       - uses: actions/checkout@v7
       - uses: actions-hub/docker/cli@f5fdbfc3f9d2a9265ead8962c1314108a7b7ec5d
@@ -17,10 +17,12 @@ jobs:
           toolchain: stable
           override: true
           components: rustfmt, clippy
+      - name: Install nextest
+        uses: taiki-e/install-action@nextest
       - name: Compile project
         run: cargo build
       - name: Test project
-        run: cargo test -p ev-cli -p ev-enclave
+        run: cargo nextest run -p ev-cli -p ev-enclave
       - name: Format project
         run: cargo fmt --check
       - name: Lint project