diff --git a/.cirrus.yml b/.cirrus.yml
index aa1a2bad2cf..97c2f45d31e 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -13,4 +13,7 @@ task:
     - ./y.sh prepare
   test_script:
     - . $HOME/.cargo/env
+    # Disabling incr comp reduces cache size and incr comp doesn't save as much
+    # on CI anyway.
+    - export CARGO_BUILD_INCREMENTAL=false
     - ./y.sh test
diff --git a/.github/workflows/abi-cafe.yml b/.github/workflows/abi-cafe.yml
index e6bf944f552..a745f2801cc 100644
--- a/.github/workflows/abi-cafe.yml
+++ b/.github/workflows/abi-cafe.yml
@@ -3,6 +3,8 @@ name: Abi-cafe
 on:
   - push
 
+permissions: {}
+
 jobs:
   abi_cafe:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 1fef6bdb945..913a5c5a850 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -4,6 +4,20 @@ on:
   - push
   - pull_request
 
+defaults:
+  run:
+    shell: bash
+
+permissions: {}
+
+env:
+  # Disabling incr comp reduces cache size and incr comp doesn't save as much
+  # on CI anyway.
+  CARGO_BUILD_INCREMENTAL: false
+  # Rust's CI denies warnings. Deny them here too to ensure subtree syncs don't
+  # fail because of warnings.
+  RUSTFLAGS: "-Dwarnings"
+
 jobs:
   rustfmt:
     runs-on: ubuntu-latest
@@ -30,9 +44,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
 
-    defaults:
-      run:
-        shell: bash
+    env:
+      CG_CLIF_EXPENSIVE_CHECKS: 1
 
     strategy:
       fail-fast: false
@@ -48,15 +61,19 @@ jobs:
           - os: ubuntu-latest
             env:
               TARGET_TRIPLE: x86_64-pc-windows-gnu
+            apt_deps: gcc-mingw-w64-x86-64 wine-stable
           - os: ubuntu-latest
             env:
               TARGET_TRIPLE: aarch64-unknown-linux-gnu
+            apt_deps: gcc-aarch64-linux-gnu qemu-user
           - os: ubuntu-latest
             env:
               TARGET_TRIPLE: s390x-unknown-linux-gnu
+            apt_deps: gcc-s390x-linux-gnu qemu-user
           - os: ubuntu-latest
             env:
               TARGET_TRIPLE: riscv64gc-unknown-linux-gnu
+            apt_deps: gcc-riscv64-linux-gnu qemu-user
           - os: windows-latest
             env:
               TARGET_TRIPLE: x86_64-pc-windows-msvc
@@ -81,29 +98,11 @@ jobs:
       if: matrix.os == 'windows-latest' && matrix.env.TARGET_TRIPLE == 'x86_64-pc-windows-gnu'
       run: rustup set default-host x86_64-pc-windows-gnu
 
-    - name: Install MinGW toolchain and wine
-      if: matrix.os == 'ubuntu-latest' && matrix.env.TARGET_TRIPLE == 'x86_64-pc-windows-gnu'
+    - name: Install toolchain and emulator
+      if: matrix.apt_deps != null
       run: |
         sudo apt-get update
-        sudo apt-get install -y gcc-mingw-w64-x86-64 wine-stable
-
-    - name: Install AArch64 toolchain and qemu
-      if: matrix.os == 'ubuntu-latest' && matrix.env.TARGET_TRIPLE == 'aarch64-unknown-linux-gnu'
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y gcc-aarch64-linux-gnu qemu-user
-
-    - name: Install s390x toolchain and qemu
-      if: matrix.env.TARGET_TRIPLE == 's390x-unknown-linux-gnu'
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y gcc-s390x-linux-gnu qemu-user
-
-    - name: Install riscv64gc toolchain and qemu
-      if: matrix.env.TARGET_TRIPLE == 'riscv64gc-unknown-linux-gnu'
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y gcc-riscv64-linux-gnu qemu-user
+        sudo apt-get install -y ${{ matrix.apt_deps }}
 
     - name: Prepare dependencies
       run: ./y.sh prepare
@@ -143,10 +142,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
 
-    defaults:
-      run:
-        shell: bash
-
     steps:
     - uses: actions/checkout@v4
 
@@ -169,10 +164,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
 
-    defaults:
-      run:
-        shell: bash
-
     steps:
     - uses: actions/checkout@v4
 
@@ -194,20 +185,16 @@ jobs:
       run: ./y.sh prepare
 
     - name: Build
-      run: CI_OPT=1 ./y.sh build --sysroot none
+      run: ./y.sh build --sysroot none
 
     - name: Benchmark
-      run: CI_OPT=1 ./y.sh bench
+      run: ./y.sh bench
 
 
   dist:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
 
-    defaults:
-      run:
-        shell: bash
-
     strategy:
       fail-fast: false
       matrix:
@@ -253,10 +240,10 @@ jobs:
       run: ./y.sh prepare
 
     - name: Build backend
-      run: CI_OPT=1 ./y.sh build --sysroot none
+      run: ./y.sh build --sysroot none
 
     - name: Build sysroot
-      run: CI_OPT=1 ./y.sh build
+      run: ./y.sh build
 
     - name: Package prebuilt cg_clif
       run: tar cvfJ cg_clif.tar.xz dist
diff --git a/.github/workflows/rustc.yml b/.github/workflows/rustc.yml
index 930d025b73e..75ea94ee797 100644
--- a/.github/workflows/rustc.yml
+++ b/.github/workflows/rustc.yml
@@ -3,6 +3,8 @@ name: Various rustc tests
 on:
   - push
 
+permissions: {}
+
 jobs:
   bootstrap_rustc:
     runs-on: ubuntu-latest
diff --git a/build_system/build_backend.rs b/build_system/build_backend.rs
index d90111adf77..129713e574a 100644
--- a/build_system/build_backend.rs
+++ b/build_system/build_backend.rs
@@ -1,9 +1,10 @@
+use std::env;
 use std::path::PathBuf;
 
 use crate::path::{Dirs, RelPath};
 use crate::rustc_info::get_file_name;
 use crate::shared_utils::{rustflags_from_env, rustflags_to_cmd_env};
-use crate::utils::{is_ci, is_ci_opt, maybe_incremental, CargoProject, Compiler, LogGroup};
+use crate::utils::{CargoProject, Compiler, LogGroup};
 
 pub(crate) static CG_CLIF: CargoProject = CargoProject::new(&RelPath::SOURCE, "cg_clif");
 
@@ -16,20 +17,15 @@ pub(crate) fn build_backend(
     let _group = LogGroup::guard("Build backend");
 
     let mut cmd = CG_CLIF.build(&bootstrap_host_compiler, dirs);
-    maybe_incremental(&mut cmd);
 
     let mut rustflags = rustflags_from_env("RUSTFLAGS");
 
     rustflags.push("-Zallow-features=rustc_private".to_owned());
 
-    if is_ci() {
-        // Deny warnings on CI
-        rustflags.push("-Dwarnings".to_owned());
-
-        if !is_ci_opt() {
-            cmd.env("CARGO_PROFILE_RELEASE_DEBUG_ASSERTIONS", "true");
-            cmd.env("CARGO_PROFILE_RELEASE_OVERFLOW_CHECKS", "true");
-        }
+    if env::var("CG_CLIF_EXPENSIVE_CHECKS").is_ok() {
+        // Enabling debug assertions implicitly enables the clif ir verifier
+        cmd.env("CARGO_PROFILE_RELEASE_DEBUG_ASSERTIONS", "true");
+        cmd.env("CARGO_PROFILE_RELEASE_OVERFLOW_CHECKS", "true");
     }
 
     if use_unstable_features {
diff --git a/build_system/build_sysroot.rs b/build_system/build_sysroot.rs
index 1ed896c6bf0..10c3f9cfa2c 100644
--- a/build_system/build_sysroot.rs
+++ b/build_system/build_sysroot.rs
@@ -6,8 +6,7 @@ use std::process::Command;
 use crate::path::{Dirs, RelPath};
 use crate::rustc_info::get_file_name;
 use crate::utils::{
-    maybe_incremental, remove_dir_if_exists, spawn_and_wait, try_hard_link, CargoProject, Compiler,
-    LogGroup,
+    remove_dir_if_exists, spawn_and_wait, try_hard_link, CargoProject, Compiler, LogGroup,
 };
 use crate::{config, CodegenBackend, SysrootKind};
 
@@ -270,7 +269,6 @@ fn build_clif_sysroot_for_triple(
     }
     compiler.rustflags.extend(rustflags);
     let mut build_cmd = STANDARD_LIBRARY.build(&compiler, dirs);
-    maybe_incremental(&mut build_cmd);
     if channel == "release" {
         build_cmd.arg("--release");
     }
diff --git a/build_system/main.rs b/build_system/main.rs
index e8cf486e966..cdd2bae03f8 100644
--- a/build_system/main.rs
+++ b/build_system/main.rs
@@ -6,7 +6,7 @@ use std::env;
 use std::path::PathBuf;
 use std::process;
 
-use self::utils::{is_ci, is_ci_opt, Compiler};
+use self::utils::Compiler;
 
 mod abi_cafe;
 mod bench;
@@ -60,14 +60,9 @@ fn main() {
     }
     env::set_var("CG_CLIF_DISABLE_INCR_CACHE", "1");
 
-    if is_ci() {
-        // Disabling incr comp reduces cache size and incr comp doesn't save as much on CI anyway
-        env::set_var("CARGO_BUILD_INCREMENTAL", "false");
-
-        if !is_ci_opt() {
-            // Enable the Cranelift verifier
-            env::set_var("CG_CLIF_ENABLE_VERIFIER", "1");
-        }
+    // Force incr comp even in release mode unless in CI or incremental builds are explicitly disabled
+    if env::var_os("CARGO_BUILD_INCREMENTAL").is_none() {
+        env::set_var("CARGO_BUILD_INCREMENTAL", "true");
     }
 
     let mut args = env::args().skip(1);
diff --git a/build_system/utils.rs b/build_system/utils.rs
index 149f1618f5c..9f95122b341 100644
--- a/build_system/utils.rs
+++ b/build_system/utils.rs
@@ -254,14 +254,6 @@ pub(crate) fn copy_dir_recursively(from: &Path, to: &Path) {
     }
 }
 
-pub(crate) fn is_ci() -> bool {
-    env::var("CI").is_ok()
-}
-
-pub(crate) fn is_ci_opt() -> bool {
-    env::var("CI_OPT").is_ok()
-}
-
 static IN_GROUP: AtomicBool = AtomicBool::new(false);
 pub(crate) struct LogGroup {
     is_gha: bool,
@@ -288,13 +280,3 @@ impl Drop for LogGroup {
         IN_GROUP.store(false, Ordering::SeqCst);
     }
 }
-
-pub(crate) fn maybe_incremental(cmd: &mut Command) {
-    if is_ci() || std::env::var("CARGO_BUILD_INCREMENTAL").map_or(false, |val| val == "false") {
-        // Disabling incr comp reduces cache size and incr comp doesn't save as much on CI anyway
-        cmd.env("CARGO_BUILD_INCREMENTAL", "false");
-    } else {
-        // Force incr comp even in release mode unless in CI or incremental builds are explicitly disabled
-        cmd.env("CARGO_BUILD_INCREMENTAL", "true");
-    }
-}