diff --git a/.cirrus.yml b/.cirrus.yml
index 11b91b8bc6..8ea88c3834 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -16,7 +16,7 @@ env:
     # The default is 'sh' if unspecified
     CIRRUS_SHELL: "/bin/bash"
     # Save a little typing (path relative to $CIRRUS_WORKING_DIR)
-    SCRIPT_BASE: "./contrib/cirrus"
+    SCRIPT_BASE: "./hack/ci"
     # Runner statistics log file path/name
     STATS_LOGFILE_SFX: 'runner_stats.log'
     STATS_LOGFILE: '$GOSRC/${CIRRUS_TASK_NAME}-${STATS_LOGFILE_SFX}'
@@ -100,7 +100,7 @@ validate-source_task:
         TEST_FLAVOR: validate-source
         TEST_BUILD_TAGS: ""
     # NOTE: The default way Cirrus-CI clones is *NOT* compatible with
-    #       environment expectations in contrib/cirrus/lib.sh.  Specifically
+    #       environment expectations in hack/ci/lib.sh.  Specifically
     #       the 'origin' remote must be defined, and all remote branches/tags
     #       must be available for reference from CI scripts.
     clone_script: &full_clone |
@@ -238,7 +238,7 @@ alt_build_task:
     name: "$ALT_NAME"
     alias: alt_build
     # Don't create task on rhel-release builds
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: &no_rhel_release |
         $CIRRUS_BRANCH !=~ 'v[0-9\.]+-rhel' &&
         $CIRRUS_BASE_BRANCH !=~ 'v[0-9\.]+-rhel'
@@ -279,7 +279,7 @@ alt_build_task:
 osx_alt_build_task:
     name: "Build for MacOS amd64+arm64" # N/B: Referenced by URLencoded strings elsewhere
     alias: osx_alt_build
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: *no_rhel_release  # RHEL never releases podman mac installer binary
     persistent_worker: &mac_pw
         labels:
@@ -297,7 +297,7 @@ osx_alt_build_task:
     clone_script: *full_clone
     # This host is/was shared with potentially many other CI tasks.
     # The previous task may have been canceled or aborted.
-    prep_script: &mac_cleanup "contrib/cirrus/mac_cleanup.sh"
+    prep_script: &mac_cleanup "hack/ci/mac_cleanup.sh"
     basic_build_script:
         - make .install.ginkgo
         - make podman-remote
@@ -328,7 +328,7 @@ freebsd_alt_build_task:
     name: "FreeBSD Cross"
     alias: freebsd_alt_build
     # Only run on 'main' and PRs against 'main'
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: $CIRRUS_BRANCH == 'main' || $CIRRUS_BASE_BRANCH == 'main'
     env:
         <<: *stdenvars
@@ -384,14 +384,14 @@ build_success_task:
 bindings_task:
     name: "Test Bindings"
     alias: bindings
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - bindings test code is changed; or
     #            - actual source code changed
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('pkg/bindings/test/**') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
     depends_on: &build
@@ -413,7 +413,7 @@ bindings_task:
     main_script: *main
     always: &logs_artifacts
         <<: *runner_stats
-        # Required for `contrib/cirrus/logformatter` to work properly
+        # Required for `hack/ci/logformatter` to work properly
         html_artifacts:
             path: ./*.html
             type: text/html
@@ -522,14 +522,14 @@ win_installer_task:
 docker-py_test_task:
     name: Docker-py Compat.
     alias: docker-py_test
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - docker-py test code is changed; or
     #            - actual source code changed
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('test/python/**') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
     depends_on: *build
@@ -549,7 +549,7 @@ docker-py_test_task:
 unit_test_task:
     name: "Unit tests on $DISTRO_NV"
     alias: unit_test
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - unit test files are changed (contains a false positves such as test/e2e/
     #              but that should not be an issue, it only runs when it doesn't have to)
@@ -557,7 +557,7 @@ unit_test_task:
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('**/*_test.go') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
     depends_on: *build
@@ -581,7 +581,7 @@ unit_test_task:
 unit_test_windows_task:
     name: "Unit tests on Windows"
     alias: unit_test_windows
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - unit test files are changed (contains a false positves such as test/e2e/
     #              but that should not be an issue, it only runs when it doesn't have to)
@@ -589,7 +589,7 @@ unit_test_windows_task:
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('winmake.ps1') ||
         changesInclude('**/*_test.go') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
@@ -610,7 +610,7 @@ unit_test_windows_task:
     clone_script: *winclone
     main_script: ".\\repo\\contrib\\cirrus\\win-unit-main.ps1"
     always:
-        # Required for `contrib/cirrus/logformatter` to work properly
+        # Required for `hack/ci/logformatter` to work properly
         html_artifacts:
             path: ./*.html
             type: text/html
@@ -619,14 +619,14 @@ unit_test_windows_task:
 apiv2_test_task:
     name: "APIv2 test on $DISTRO_NV ($PRIV_NAME)"
     alias: apiv2_test
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - apiv2 test code is changed; or
     #            - actual source code changed
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('test/apiv2/**', 'test/python/**') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
     depends_on: *build
@@ -649,14 +649,14 @@ apiv2_test_task:
 compose_test_task:
     name: "$TEST_FLAVOR test on $DISTRO_NV ($PRIV_NAME)"
     alias: compose_test
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - compose test code is changed; or
     #            - actual source code changed
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('test/compose/**') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
     depends_on: *build
@@ -682,14 +682,14 @@ local_integration_test_task: &local_integration_test_task
     # <int.|sys.> <podman|remote> <Distro NV> <root|rootless>
     name: &std_name_fmt "$TEST_FLAVOR $PODBIN_NAME $DISTRO_NV $PRIV_NAME $TEST_ENVIRON ${CI_DESIRED_DATABASE}"
     alias: local_integration_test
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - int test code is changed; or
     #            - actual source code changed
     only_if: &only_if_int_test >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('test/e2e/**', 'test/utils/**') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
     depends_on: *build
@@ -725,7 +725,7 @@ remote_integration_test_task:
 container_integration_test_task:
     name: *std_name_fmt
     alias: container_integration_test
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: *only_if_int_test
     depends_on: *build
     matrix: &fedora_vm_axis
@@ -753,7 +753,7 @@ container_integration_test_task:
 rootless_integration_test_task:
     name: *std_name_fmt
     alias: rootless_integration_test
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: *only_if_int_test
     depends_on: *build
     matrix: *platform_axis
@@ -770,13 +770,13 @@ rootless_integration_test_task:
 podman_machine_task:
     name: *std_name_fmt
     alias: podman_machine
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - machine code files are changed
     only_if: &only_if_machine_test >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('cmd/podman/machine/**', 'pkg/machine/**', '**/*machine*.go')
     depends_on: *build
     ec2_instance:
@@ -826,12 +826,12 @@ podman_machine_windows_task:
     name: *std_name_fmt
     alias: podman_machine_windows
     allow_failures: $TEST_FLAVOR == 'machine-wsl'
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     # Duplicated from the main linux machine task as we also must match winmake.ps1 here since that is used on windows.
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('winmake.ps1') ||
         changesInclude('cmd/podman/machine/**', 'pkg/machine/**', '**/*machine*.go')
     # Special case, we do not run macos/windows builds on rhel branches.
@@ -874,7 +874,7 @@ podman_machine_windows_task:
     always:
         wsl_logs_artifacts:
             path: ./*.zip
-        # Required for `contrib/cirrus/logformatter` to work properly
+        # Required for `hack/ci/logformatter` to work properly
         html_artifacts:
             path: ./*.html
             type: text/html
@@ -894,10 +894,10 @@ podman_machine_mac_task:
         PRIV_NAME: "rootless"  # intended use-case
     matrix:
         - env:
-            # See contrib/cirrus/mac_runner.sh
+            # See hack/ci/mac_runner.sh
             TEST_FLAVOR: "machine-applehv"
         - env:
-            # See contrib/cirrus/mac_runner.sh
+            # See hack/ci/mac_runner.sh
             TEST_FLAVOR: "machine-libkrun"
     clone_script:  # artifacts from osx_alt_build_task
         - mkdir -p $CIRRUS_WORKING_DIR
@@ -907,17 +907,17 @@ podman_machine_mac_task:
     # This host is/was shared with potentially many other CI tasks.
     # The previous task may have been canceled or aborted.
     prep_script: *mac_cleanup
-    setup_script: "contrib/cirrus/mac_setup.sh"
-    env_script: "contrib/cirrus/mac_env.sh"
+    setup_script: "hack/ci/mac_setup.sh"
+    env_script: "hack/ci/mac_env.sh"
     # TODO: Timeout bumped b/c initial image download (~5min) and VM
     #       resize (~2min) causes test-timeout (90s default).  Should
     #       tests deal with this internally?
     test_script:
-        - "contrib/cirrus/mac_runner.sh"
+        - "hack/ci/mac_runner.sh"
     # This host is/was shared with potentially many other CI tasks.
     # Ensure nothing is left running while waiting for the next task.
     always:
-        # Required for `contrib/cirrus/logformatter` to work properly
+        # Required for `hack/ci/logformatter` to work properly
         html_artifacts:
             path: ./*.html
             type: text/html
@@ -931,14 +931,14 @@ podman_machine_mac_task:
 local_system_test_task: &local_system_test_task
     name: *std_name_fmt
     alias: local_system_test
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - sys test code is changed; or
     #            - actual source code changed
     only_if: &only_if_system_test >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('test/system/**') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
     depends_on: *build
@@ -956,7 +956,7 @@ local_system_test_task: &local_system_test_task
 local_system_test_aarch64_task: &local_system_test_task_aarch64
     name: *std_name_fmt
     alias: local_system_test_aarch64
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: *only_if_system_test
     depends_on: *build
     ec2_instance: *standard_build_ec2_aarch64
@@ -1009,7 +1009,7 @@ rootless_remote_system_test_task:
 rootless_system_test_task:
     name: *std_name_fmt
     alias: rootless_system_test
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: *only_if_system_test
     depends_on: *build
     matrix: *platform_axis
@@ -1027,14 +1027,14 @@ rootless_system_test_task:
 farm_test_task:
     name: *std_name_fmt
     alias: farm_test
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - farm test code is changed or one of the shared helper import files from the system test; or
     #            - actual source code changed
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('test/farm/**', 'test/system/*.bash') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
     depends_on: *build
@@ -1052,14 +1052,14 @@ farm_test_task:
 buildah_bud_test_task:
     name: *std_name_fmt
     alias: buildah_bud_test
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - podman build source code files or bud tests files are changed
     #              (vendor updates, i.e. buildah, are already covered in the main rules)
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('**/*build*.go', 'test/buildah-bud/**')
     depends_on: *build
     env:
@@ -1080,14 +1080,14 @@ buildah_bud_test_task:
 upgrade_test_task:
     name: "Upgrade test: from $PODMAN_UPGRADE_FROM"
     alias: upgrade_test
-    # Docs: ./contrib/cirrus/CIModes.md (Cirrus Task contexts and runtime modes)
+    # Docs: ./hack/ci/CIModes.md (Cirrus Task contexts and runtime modes)
     # only when: - main rules (see doc above); or
     #            - upgrade test code is changed or one of the shared helper import files from the system test; or
     #            - actual source code changed
     only_if: >-
         $CIRRUS_PR == '' ||
         $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' ||
-        changesInclude('.cirrus.yml', 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
+        changesInclude('.cirrus.yml', 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf', 'hack/**', 'version/rawversion/*') ||
         changesInclude('test/upgrade/**', 'test/system/*.bash') ||
         (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))
     depends_on: *build
@@ -1189,7 +1189,7 @@ success_task:
 artifacts_task:
     name: "Artifacts"
     alias: artifacts
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: *no_rhel_release
     depends_on:
         - success
@@ -1239,7 +1239,7 @@ release_task:
     name: "Verify Release"
     alias: release
     # This should _only_ run for new tags
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: $CIRRUS_TAG != ''
     depends_on:
         - build_success
@@ -1264,7 +1264,7 @@ release_test_task:
     name: "Optional Release Test"
     alias: release_test
     # Release-PRs always include "release" or "Bump" in the title
-    # Docs: ./contrib/cirrus/CIModes.md
+    # Docs: ./hack/ci/CIModes.md
     only_if: $CIRRUS_CHANGE_TITLE =~ '.*((release)|(bump)).*'
     # Allow running manually only as part of release-related builds
     # see RELEASE_PROCESS.md
diff --git a/Makefile b/Makefile
index 30d470168f..2a8fe53497 100644
--- a/Makefile
+++ b/Makefile
@@ -757,11 +757,11 @@ test-binaries: test/checkseccomp/checkseccomp test/goecho/goecho test/version/ve
 
 .PHONY: tests-included
 tests-included:
-	contrib/cirrus/pr-should-include-tests
+	hack/ci/pr-should-include-tests
 
 .PHONY: test-jira-links-included
 test-jira-links-included:
-	contrib/cirrus/pr-should-link-jira
+	hack/ci/pr-should-link-jira
 
 .PHONY: tests-expect-exit
 tests-expect-exit:
@@ -775,7 +775,7 @@ tests-expect-exit:
 
 .PHONY: pr-removes-fixed-skips
 pr-removes-fixed-skips:
-	contrib/cirrus/pr-removes-fixed-skips
+	hack/ci/pr-removes-fixed-skips
 
 ###
 ### Release/Packaging targets
diff --git a/docs/README.md b/docs/README.md
index abe7d77583..77aafe235c 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -35,7 +35,7 @@ The syntax for the formatting of all man pages can be found [here](MANPAGE_SYNTA
 
 The [latest online documentation](http://docs.podman.io/en/latest/_static/api.html) is
 automatically generated by two cooperating automation systems based on committed upstream
-source code.  Firstly, [the Cirrus-CI docs task](../contrib/cirrus/README.md#docs-task) builds
+source code.  Firstly, [the Cirrus-CI docs task](../hack/ci/README.md#docs-task) builds
 `pkg/api/swagger.yaml` and uploads it to a public-facing location (Google Storage Bucket -
 an online service for storing unstructured data).  Second, [Read The Docs](readthedocs.com)
 reacts to the github.com repository change, building the content for the [libpod documentation
@@ -49,7 +49,7 @@ because the client (i.e. your web browser) is fetching content from multiple loc
 do not share a common domain, accessing the API section may show a stack-trace similar to
 the following:
 
-![JavaScript Stack Trace Image](../contrib/cirrus/swagger_stack_trace.png)
+![JavaScript Stack Trace Image](../hack/ci/swagger_stack_trace.png)
 
 If reloading the page, or clearing your local cache does not fix the problem, it is
 likely caused by broken metadata needed to protect clients from cross-site-scripting
diff --git a/contrib/cirrus/99-do-not-use-google-subnets.conflist b/hack/ci/99-do-not-use-google-subnets.conflist
similarity index 100%
rename from contrib/cirrus/99-do-not-use-google-subnets.conflist
rename to hack/ci/99-do-not-use-google-subnets.conflist
diff --git a/contrib/cirrus/CIModes.md b/hack/ci/CIModes.md
similarity index 98%
rename from contrib/cirrus/CIModes.md
rename to hack/ci/CIModes.md
index f10d74fed1..f1bccdf058 100644
--- a/contrib/cirrus/CIModes.md
+++ b/hack/ci/CIModes.md
@@ -52,7 +52,7 @@ uses the following main rules:
    affect any tasks so the code cannot skip it. It includes
    - `.cirrus.yml` (cirrus changes)
    - `Makefile` (make targets are used to trigger tests)
-   - `contrib/cirrus/**` (cirrus scripts to run the tests)
+   - `hack/ci/**` (cirrus scripts to run the tests)
    - `vendor/**` (dependency updates)
    - `test/tools/**` (test dependency code, i.e. ginkgo)
    - `hack/**` (contains scripts used by several tests)
diff --git a/contrib/cirrus/cirrus_yaml_test.py b/hack/ci/cirrus_yaml_test.py
similarity index 97%
rename from contrib/cirrus/cirrus_yaml_test.py
rename to hack/ci/cirrus_yaml_test.py
index cfa1098a84..ce86cb5369 100755
--- a/contrib/cirrus/cirrus_yaml_test.py
+++ b/hack/ci/cirrus_yaml_test.py
@@ -75,7 +75,7 @@ class TestDependsOn(TestCaseBase):
         """2024-07 PR#23174: ugly but necessary duplication in only_if conditions. Prevent typos or unwanted changes."""
         # N/B: This giant string is white space sensitive, take care when updating/modifying
         beginning = ("$CIRRUS_PR == '' || $CIRRUS_CHANGE_TITLE =~ '.*CI:ALL.*' || changesInclude('.cirrus.yml',"
-                     " 'Makefile', 'contrib/cirrus/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf',"
+                     " 'Makefile', 'hack/ci/**', 'vendor/**', 'test/tools/**', 'test/registries*.conf',"
                      " 'hack/**', 'version/rawversion/*') || ")
         real_source_changes = " || (changesInclude('**/*.go', '**/*.c', '**/*.h') && !changesIncludeOnly('test/**', 'pkg/machine/e2e/**'))"
 
diff --git a/contrib/cirrus/get-local-registry-script b/hack/ci/get-local-registry-script
similarity index 100%
rename from contrib/cirrus/get-local-registry-script
rename to hack/ci/get-local-registry-script
diff --git a/contrib/cirrus/lib.sh b/hack/ci/lib.sh
similarity index 99%
rename from contrib/cirrus/lib.sh
rename to hack/ci/lib.sh
index 85da1d56c1..6e624100a8 100644
--- a/contrib/cirrus/lib.sh
+++ b/hack/ci/lib.sh
@@ -77,7 +77,7 @@ PATH="$HOME/bin:/usr/local/bin:$PATH"
 LD_LIBRARY_PATH="/usr/local/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
 
 # Saves typing / in case location ever moves
-SCRIPT_BASE=${SCRIPT_BASE:-./contrib/cirrus}
+SCRIPT_BASE=${SCRIPT_BASE:-./hack/ci}
 
 # Downloaded, but not installed packages.
 PACKAGE_DOWNLOAD_DIR=/var/cache/download
diff --git a/contrib/cirrus/lib.sh.t b/hack/ci/lib.sh.t
similarity index 100%
rename from contrib/cirrus/lib.sh.t
rename to hack/ci/lib.sh.t
diff --git a/contrib/cirrus/logcollector.sh b/hack/ci/logcollector.sh
similarity index 98%
rename from contrib/cirrus/logcollector.sh
rename to hack/ci/logcollector.sh
index 1d4cee7d01..5a26834f38 100755
--- a/contrib/cirrus/logcollector.sh
+++ b/hack/ci/logcollector.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-# shellcheck source=contrib/cirrus/lib.sh
+# shellcheck source=hack/ci/lib.sh
 source $(dirname $0)/lib.sh
 
 req_env_vars CIRRUS_WORKING_DIR OS_RELEASE_ID
diff --git a/contrib/cirrus/logformatter b/hack/ci/logformatter
similarity index 100%
rename from contrib/cirrus/logformatter
rename to hack/ci/logformatter
diff --git a/contrib/cirrus/logformatter.t b/hack/ci/logformatter.t
similarity index 100%
rename from contrib/cirrus/logformatter.t
rename to hack/ci/logformatter.t
diff --git a/contrib/cirrus/mac_cleanup.sh b/hack/ci/mac_cleanup.sh
similarity index 100%
rename from contrib/cirrus/mac_cleanup.sh
rename to hack/ci/mac_cleanup.sh
diff --git a/contrib/cirrus/mac_env.sh b/hack/ci/mac_env.sh
similarity index 100%
rename from contrib/cirrus/mac_env.sh
rename to hack/ci/mac_env.sh
diff --git a/contrib/cirrus/mac_runner.sh b/hack/ci/mac_runner.sh
similarity index 100%
rename from contrib/cirrus/mac_runner.sh
rename to hack/ci/mac_runner.sh
diff --git a/contrib/cirrus/mac_setup.sh b/hack/ci/mac_setup.sh
similarity index 100%
rename from contrib/cirrus/mac_setup.sh
rename to hack/ci/mac_setup.sh
diff --git a/contrib/cirrus/postbuild.sh b/hack/ci/postbuild.sh
similarity index 97%
rename from contrib/cirrus/postbuild.sh
rename to hack/ci/postbuild.sh
index 52e840d3c6..cdf6026585 100755
--- a/contrib/cirrus/postbuild.sh
+++ b/hack/ci/postbuild.sh
@@ -2,7 +2,7 @@
 
 set -eo pipefail
 
-# shellcheck source=contrib/cirrus/lib.sh
+# shellcheck source=hack/ci/lib.sh
 source $(dirname $0)/lib.sh
 
 # Skip this entire script when run under nightly treadmill cron job.
diff --git a/contrib/cirrus/pr-removes-fixed-skips b/hack/ci/pr-removes-fixed-skips
similarity index 100%
rename from contrib/cirrus/pr-removes-fixed-skips
rename to hack/ci/pr-removes-fixed-skips
diff --git a/contrib/cirrus/pr-removes-fixed-skips.t b/hack/ci/pr-removes-fixed-skips.t
similarity index 100%
rename from contrib/cirrus/pr-removes-fixed-skips.t
rename to hack/ci/pr-removes-fixed-skips.t
diff --git a/contrib/cirrus/pr-should-include-tests b/hack/ci/pr-should-include-tests
similarity index 100%
rename from contrib/cirrus/pr-should-include-tests
rename to hack/ci/pr-should-include-tests
diff --git a/contrib/cirrus/pr-should-include-tests.t b/hack/ci/pr-should-include-tests.t
similarity index 100%
rename from contrib/cirrus/pr-should-include-tests.t
rename to hack/ci/pr-should-include-tests.t
diff --git a/contrib/cirrus/pr-should-link-jira b/hack/ci/pr-should-link-jira
similarity index 100%
rename from contrib/cirrus/pr-should-link-jira
rename to hack/ci/pr-should-link-jira
diff --git a/contrib/cirrus/pr-should-link-jira.t b/hack/ci/pr-should-link-jira.t
similarity index 100%
rename from contrib/cirrus/pr-should-link-jira.t
rename to hack/ci/pr-should-link-jira.t
diff --git a/contrib/cirrus/prebuild.sh b/hack/ci/prebuild.sh
similarity index 98%
rename from contrib/cirrus/prebuild.sh
rename to hack/ci/prebuild.sh
index abbec92252..dba481195e 100755
--- a/contrib/cirrus/prebuild.sh
+++ b/hack/ci/prebuild.sh
@@ -12,7 +12,7 @@ set -eo pipefail
 set -a
 source /etc/automation_environment
 source $AUTOMATION_LIB_PATH/common_lib.sh
-# shellcheck source=contrib/cirrus/lib.sh
+# shellcheck source=hack/ci/lib.sh
 source $(dirname $0)/lib.sh
 set +a
 
diff --git a/contrib/cirrus/runner.sh b/hack/ci/runner.sh
similarity index 99%
rename from contrib/cirrus/runner.sh
rename to hack/ci/runner.sh
index 8816269613..0314dea1e6 100755
--- a/contrib/cirrus/runner.sh
+++ b/hack/ci/runner.sh
@@ -16,7 +16,7 @@ set -eo pipefail
 #    CONTAINER    : 1 if *currently* running inside a container, 0 if host
 #
 
-# shellcheck source=contrib/cirrus/lib.sh
+# shellcheck source=hack/ci/lib.sh
 source $(dirname $0)/lib.sh
 
 showrun echo "starting"
diff --git a/contrib/cirrus/setup_environment.sh b/hack/ci/setup_environment.sh
similarity index 99%
rename from contrib/cirrus/setup_environment.sh
rename to hack/ci/setup_environment.sh
index 2b19eeaccc..8373f12483 100755
--- a/contrib/cirrus/setup_environment.sh
+++ b/hack/ci/setup_environment.sh
@@ -9,7 +9,7 @@
 
 set -e
 
-# shellcheck source=./contrib/cirrus/lib.sh
+# shellcheck source=./hack/ci/lib.sh
 source $(dirname $0)/lib.sh
 
 showrun echo "starting"
@@ -460,7 +460,7 @@ case "$TEST_FLAVOR" in
     *) die_unknown TEST_FLAVOR
 esac
 
-# See ./contrib/cirrus/CIModes.md.
+# See ./hack/ci/CIModes.md.
 # Vars defined by cirrus-ci
 # shellcheck disable=SC2154
 if [[ ! "$OS_RELEASE_ID" =~ "debian" ]] && \
diff --git a/contrib/cirrus/swagger_stack_trace.png b/hack/ci/swagger_stack_trace.png
similarity index 100%
rename from contrib/cirrus/swagger_stack_trace.png
rename to hack/ci/swagger_stack_trace.png
diff --git a/contrib/cirrus/timestamp.awk b/hack/ci/timestamp.awk
similarity index 100%
rename from contrib/cirrus/timestamp.awk
rename to hack/ci/timestamp.awk
diff --git a/contrib/cirrus/win-collect-wsl-logs-start.ps1 b/hack/ci/win-collect-wsl-logs-start.ps1
similarity index 100%
rename from contrib/cirrus/win-collect-wsl-logs-start.ps1
rename to hack/ci/win-collect-wsl-logs-start.ps1
diff --git a/contrib/cirrus/win-collect-wsl-logs-stop.ps1 b/hack/ci/win-collect-wsl-logs-stop.ps1
similarity index 100%
rename from contrib/cirrus/win-collect-wsl-logs-stop.ps1
rename to hack/ci/win-collect-wsl-logs-stop.ps1
diff --git a/contrib/cirrus/win-installer-main.ps1 b/hack/ci/win-installer-main.ps1
similarity index 100%
rename from contrib/cirrus/win-installer-main.ps1
rename to hack/ci/win-installer-main.ps1
diff --git a/contrib/cirrus/win-lib.ps1 b/hack/ci/win-lib.ps1
similarity index 100%
rename from contrib/cirrus/win-lib.ps1
rename to hack/ci/win-lib.ps1
diff --git a/contrib/cirrus/win-podman-machine-main.ps1 b/hack/ci/win-podman-machine-main.ps1
similarity index 100%
rename from contrib/cirrus/win-podman-machine-main.ps1
rename to hack/ci/win-podman-machine-main.ps1
diff --git a/contrib/cirrus/win-podman-machine-test.ps1 b/hack/ci/win-podman-machine-test.ps1
similarity index 100%
rename from contrib/cirrus/win-podman-machine-test.ps1
rename to hack/ci/win-podman-machine-test.ps1
diff --git a/contrib/cirrus/win-sess-launch.ps1 b/hack/ci/win-sess-launch.ps1
similarity index 100%
rename from contrib/cirrus/win-sess-launch.ps1
rename to hack/ci/win-sess-launch.ps1
diff --git a/contrib/cirrus/win-unit-main.ps1 b/hack/ci/win-unit-main.ps1
similarity index 100%
rename from contrib/cirrus/win-unit-main.ps1
rename to hack/ci/win-unit-main.ps1
diff --git a/hack/get_ci_vm.sh b/hack/get_ci_vm.sh
index bdd947bba8..5c74b0a168 100755
--- a/hack/get_ci_vm.sh
+++ b/hack/get_ci_vm.sh
@@ -57,14 +57,14 @@ elif [[ "$1" == "--setup" ]]; then
     # get_ci_vm container entrypoint calls us with this option on the
     # Cirrus-CI environment instance, to perform repo.-specific setup.
     cd $REPO_DIRPATH
-    echo "+ Loading ./contrib/cirrus/lib.sh" > /dev/stderr
-    source ./contrib/cirrus/lib.sh
+    echo "+ Loading ./hack/ci/lib.sh" > /dev/stderr
+    source ./hack/ci/lib.sh
     echo "+ Mimicking .cirrus.yml build_task" > /dev/stderr
     make install.tools
     make binaries
     make docs
     echo "+ Running environment setup" > /dev/stderr
-    ./contrib/cirrus/setup_environment.sh
+    ./hack/ci/setup_environment.sh
 else
     # Pass this repo and CLI args into container for VM creation/management
     mkdir -p $HOME/.config/gcloud/ssh