diff --git a/.github/workflows/clang-tidy.yml b/.github/workflows/clang-tidy.yml
index 6b03f7a5207c..4ab354b926d1 100644
--- a/.github/workflows/clang-tidy.yml
+++ b/.github/workflows/clang-tidy.yml
@@ -18,20 +18,62 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  LLVM_VERSION: '21'
+  WABT_VERSION: '1.0.39'
+
 jobs:
   check_clang_tidy:
     if: "!contains(github.event.pull_request.labels.*.name, 'skip_buildbots')"
     name: Check clang-tidy
-    runs-on: macos-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
 
       # We intentionally don't use VCPKG here so that we get some
       # notification that the ecosystem is moving on without us.
       - name: Install clang-tidy & dependencies
-        run: brew install flatbuffers llvm@21 lld@21 pybind11 wabt
+        run: |
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
+          echo "deb http://apt.llvm.org/$(lsb_release -cs)/ llvm-toolchain-$(lsb_release -cs)-${LLVM_VERSION} main" | \
+            sudo tee "/etc/apt/sources.list.d/llvm-${LLVM_VERSION}.list"
+          sudo apt-get update
+          sudo apt-get install -y \
+            "clang-${LLVM_VERSION}" \
+            "clang-tidy-${LLVM_VERSION}" \
+            "clang-tools-${LLVM_VERSION}" \
+            flatbuffers-compiler \
+            flatbuffers-compiler-dev \
+            "libclang-${LLVM_VERSION}-dev" \
+            "libclang-cpp${LLVM_VERSION}-dev" \
+            libflatbuffers-dev \
+            "liblld-${LLVM_VERSION}-dev" \
+            libjpeg-turbo8-dev \
+            libpng-dev \
+            "lld-${LLVM_VERSION}" \
+            "llvm-${LLVM_VERSION}-dev" \
+            ninja-build \
+            pybind11-dev
+
+      # Ubuntu's packaged libwabt.a isn't built with -fPIC, so it can't be
+      # linked into libHalide.so -- build our own instead.
+      - name: Build wabt
+        run: |
+          git clone --depth=1 --recurse-submodules -b "${WABT_VERSION}" \
+            https://github.com/WebAssembly/wabt /tmp/wabt-src
+          cmake -G Ninja -S /tmp/wabt-src -B /tmp/wabt-build \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+            -DCMAKE_INSTALL_PREFIX=/opt/wabt \
+            -DWITH_EXCEPTIONS=ON \
+            -DBUILD_TESTS=OFF \
+            -DBUILD_TOOLS=OFF \
+            -DBUILD_LIBWASM=OFF \
+            -DUSE_INTERNAL_SHA256=ON
+          cmake --build /tmp/wabt-build --target install
 
       - name: Run clang-tidy
         run: ./run-clang-tidy.sh
         env:
-          CLANG_TIDY_LLVM_INSTALL_DIR: /opt/homebrew/opt/llvm@21
+          CLANG_TIDY_LLVM_INSTALL_DIR: /usr/lib/llvm-${{ env.LLVM_VERSION }}
+          wabt_ROOT: /opt/wabt
diff --git a/.github/workflows/testing-make.yml b/.github/workflows/testing-make.yml
index 8755309d4437..ce82e35eb153 100644
--- a/.github/workflows/testing-make.yml
+++ b/.github/workflows/testing-make.yml
@@ -21,7 +21,7 @@ on:
       - "python_bindings/**"
 
       - "pyproject.toml"
-      # Don't ignore uv.lock as it influences dependency resolution
+      - "uv.lock"
 
       - "README.md"
       - "CODE_OF_CONDUCT.md"
@@ -58,8 +58,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@v7
-
       - name: Install dependencies
         run: |
           if [ "$RUNNER_OS" = "Linux" ]; then
@@ -82,30 +80,28 @@ jobs:
             echo "LLVM_CONFIG=$(brew --prefix "llvm@${LLVM_VERSION}")/bin/llvm-config" | tee -a "$GITHUB_ENV"
           fi
 
-          uv sync --group ci-base --no-install-project
-          echo "${GITHUB_WORKSPACE}/.venv/bin" | tee -a "$GITHUB_PATH"
-          echo "VIRTUAL_ENV=${GITHUB_WORKSPACE}/.venv" | tee -a "$GITHUB_ENV"
           echo "MAKEFLAGS=-j $(getconf _NPROCESSORS_ONLN)" | tee -a "$GITHUB_ENV"
 
       - run: make build_tests
+        if: runner.os != 'macOS'
 
       - run: make test_internal
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && runner.os != 'macOS' }}
 
       - run: make test_correctness
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && runner.os != 'macOS' }}
 
       - run: make test_generator
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && runner.os != 'macOS' }}
 
       - run: make test_error
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && runner.os != 'macOS' }}
 
       - run: make test_warning
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && runner.os != 'macOS' }}
 
       - run: make test_apps
         if: ${{ !cancelled() }}
 
       - run: make test_tutorial
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && runner.os != 'macOS' }}
diff --git a/run-clang-tidy.sh b/run-clang-tidy.sh
index 1a6c1125c3e7..3331e79058eb 100755
--- a/run-clang-tidy.sh
+++ b/run-clang-tidy.sh
@@ -25,6 +25,13 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
 #   export CLANG_TIDY_LLVM_INSTALL_DIR=/opt/homebrew/opt/llvm@X
 #
 # Where X matches the EXPECTED_VERSION below.
+#
+# On Linux, Ubuntu's packaged libwabt.a isn't built with -fPIC, so it can't
+# be linked into libHalide.so. This script won't build wabt for you; point
+# wabt_ROOT at a wabt install built with -DCMAKE_POSITION_INDEPENDENT_CODE=ON
+# (and, e.g., -DUSE_INTERNAL_SHA256=ON to avoid an OpenSSL dependency):
+#
+#   export wabt_ROOT=/path/to/wabt/install
 
 EXPECTED_VERSION=21
 
@@ -44,6 +51,11 @@ if [ "$(uname)" == "Darwin" ]; then
     _DEFAULT_LLVM_LOCATION="/opt/homebrew/opt/llvm@$EXPECTED_VERSION"
 else
     _DEFAULT_LLVM_LOCATION="/usr/lib/llvm-$EXPECTED_VERSION"
+
+    if [ -z "${wabt_ROOT:-}" ]; then
+        echo "wabt_ROOT must point to a wabt install built with -DCMAKE_POSITION_INDEPENDENT_CODE=ON on Linux." 1>&2
+        exit 1
+    fi
 fi
 
 J=$(get_thread_count)
@@ -115,7 +127,7 @@ if [[ $(${CC} --version) =~ .*Homebrew.* ]]; then
 fi
 
 echo Configuring Halide...
-cmake -S "${ROOT_DIR}" -B "${CLANG_TIDY_BUILD_DIR}" -Wno-dev -DWITH_TESTS=OFF
+cmake -S "${ROOT_DIR}" -B "${CLANG_TIDY_BUILD_DIR}" -Wno-dev -DWITH_TESTS=OFF -DHalide_WASM_BACKEND=wabt
 
 [ -e "${CLANG_TIDY_BUILD_DIR}/compile_commands.json" ]
 
diff --git a/tutorial/lesson_09_update_definitions.cpp b/tutorial/lesson_09_update_definitions.cpp
index 721b20f7c460..d3f9d9fb3171 100644
--- a/tutorial/lesson_09_update_definitions.cpp
+++ b/tutorial/lesson_09_update_definitions.cpp
@@ -15,6 +15,7 @@
 // source tree.
 
 #include "Halide.h"
+#include <cmath>
 #include <cstdio>
 
 // We're going to be using x86 SSE intrinsics later on in this lesson.
@@ -174,7 +175,7 @@ int main() {
         // Check the results match:
         for (int y = 0; y < 100; y++) {
             for (int x = 0; x < 100; x++) {
-                if (fabs(halide_result(x, y) - c_result[y][x]) > 0.01f) {
+                if (std::abs(halide_result(x, y) - c_result[y][x]) > 0.01f) {
                     printf("halide_result(%d, %d) = %f instead of %f\n",
                            x, y, halide_result(x, y), c_result[y][x]);
                     return -1;
@@ -800,6 +801,7 @@ int main() {
 #endif
 
         // Run this one hundred times so we can average the timing results.
+        // NOLINTBEGIN
         for (int iters = 0; iters < 100; iters++) {
 
 #pragma omp parallel for
@@ -890,6 +892,7 @@ int main() {
                 free(clamped_storage);
             }
         }
+        // NOLINTEND
 
 // Skip the timing comparison if we don't have openmp
 // enabled. Otherwise it's unfair to C.