diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 0e819d825..8a14df583 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -1,126 +1,126 @@
-trigger:
-  branches:
-    include:
-    - "main"
-
-stages:
-- stage: check
-  dependsOn: []
-  pool: "envoy-x64-large"
-  jobs:
-  - job: build_and_format
-    displayName: "do_ci.sh"
-    dependsOn: []
-    strategy:
-      maxParallel: 2
-      matrix:
-        build:
-          CI_TARGET: "build"
-        format:
-          CI_TARGET: "check_format"
-    timeoutInMinutes: 120
-    steps:
-    - template: bazel.yml
-      parameters:
-        ciTarget: $(CI_TARGET)
-
-- stage: test
-  dependsOn: ["check"]
-  pool: "envoy-x64-large"
-  jobs:
-  - job: test_and_benchmark
-    displayName: "do_ci.sh"
-    strategy:
-      # Both test and benchmark need dedicated resources for stability.
-      maxParallel: 1
-      matrix:
-        test:
-          CI_TARGET: "test"
-        benchmark:
-          CI_TARGET: "benchmark_with_own_binaries"
-    timeoutInMinutes: 120
-    steps:
-    - template: bazel.yml
-      parameters:
-        ciTarget: $(CI_TARGET)
-
-- stage: test_gcc
-  dependsOn: ["check"]
-  pool: "envoy-x64-large"
-  jobs:
-  - job: test_gcc
-    displayName: "do_ci.sh"
-    strategy:
-      maxParallel: 1
-      matrix:
-        test_gcc:
-          CI_TARGET: "test_gcc"
-    timeoutInMinutes: 120
-    steps:
-    - template: bazel.yml
-      parameters:
-        ciTarget: $(CI_TARGET)
-
-- stage: sanitizers
-  dependsOn: ["test"]
-  pool: "envoy-x64-large"
-  jobs:
-  - job: sanitizers
-    displayName: "do_ci.sh"
-    strategy:
-      maxParallel: 2
-      matrix:
-        asan:
-          CI_TARGET: "asan"
-        tsan:
-          CI_TARGET: "tsan"
-    timeoutInMinutes: 120
-    steps:
-    - template: bazel.yml
-      parameters:
-        ciTarget: $(CI_TARGET)
-
-- stage: coverage_unit
-  dependsOn: ["test"]
-  pool: "envoy-x64-large"
-  jobs:
-  - job: coverage_unit
-    displayName: "do_ci.sh"
-    strategy:
-      maxParallel: 1
-      matrix:
-        coverage:
-          CI_TARGET: "coverage"
-    timeoutInMinutes: 120
-    steps:
-    - template: bazel.yml
-      parameters:
-        ciTarget: $(CI_TARGET)
-    - task: PublishPipelineArtifact@1
-      condition: always()
-      displayName: 'Publish the line coverage report'
-      inputs:
-        targetPath: $(Build.SourcesDirectory)/coverage_html.zip
-        artifactName: UnitTestCoverageReport-$(System.JobAttempt)
-
-# coverage_integration stage was temporarily removed due to the issue
-# reported by https://github.com/envoyproxy/nighthawk/issues/1006
-- stage: release
-  dependsOn:
-  - "test_gcc"
-  - "sanitizers"
-  - "coverage_unit"
-  condition: eq(variables['PostSubmit'], true)
-  pool: "envoy-x64-large"
-  jobs:
-  - job: release
-    displayName: "do_ci.sh"
-    strategy:
-      matrix:
-        release:
-          CI_TARGET: "docker"
-    timeoutInMinutes: 120
-    steps:
-    - template: bazel.yml
-      parameters:
-        ciTarget: $(CI_TARGET)
+#trigger:
+#  branches:
+#    include:
+#    - "main"
+#
+#stages:
+#- stage: check
+#  dependsOn: []
+#  pool: "envoy-x64-large"
+#  jobs:
+#  - job: build_and_format
+#    displayName: "do_ci.sh"
+#    dependsOn: []
+#    strategy:
+#      maxParallel: 2
+#      matrix:
+#        build:
+#          CI_TARGET: "build"
+#        format:
+#          CI_TARGET: "check_format"
+#    timeoutInMinutes: 120
+#    steps:
+#    - template: bazel.yml
+#      parameters:
+#        ciTarget: $(CI_TARGET)
+#
+#- stage: test
+#  dependsOn: ["check"]
+#  pool: "envoy-x64-large"
+#  jobs:
+#  - job: test_and_benchmark
+#    displayName: "do_ci.sh"
+#    strategy:
+#      # Both test and benchmark need dedicated resources for stability.
+#      maxParallel: 1
+#      matrix:
+#        test:
+#          CI_TARGET: "test"
+#        benchmark:
+#          CI_TARGET: "benchmark_with_own_binaries"
+#    timeoutInMinutes: 120
+#    steps:
+#    - template: bazel.yml
+#      parameters:
+#        ciTarget: $(CI_TARGET)
+#
+#- stage: test_gcc
+#  dependsOn: ["check"]
+#  pool: "envoy-x64-large"
+#  jobs:
+#  - job: test_gcc
+#    displayName: "do_ci.sh"
+#    strategy:
+#      maxParallel: 1
+#      matrix:
+#        test_gcc:
+#          CI_TARGET: "test_gcc"
+#    timeoutInMinutes: 120
+#    steps:
+#    - template: bazel.yml
+#      parameters:
+#        ciTarget: $(CI_TARGET)
+#
+#- stage: sanitizers
+#  dependsOn: ["test"]
+#  pool: "envoy-x64-large"
+#  jobs:
+#  - job: sanitizers
+#    displayName: "do_ci.sh"
+#    strategy:
+#      maxParallel: 2
+#      matrix:
+#        asan:
+#          CI_TARGET: "asan"
+#        tsan:
+#          CI_TARGET: "tsan"
+#    timeoutInMinutes: 120
+#    steps:
+#    - template: bazel.yml
+#      parameters:
+#        ciTarget: $(CI_TARGET)
+#
+#- stage: coverage_unit
+#  dependsOn: ["test"]
+#  pool: "envoy-x64-large"
+#  jobs:
+#  - job: coverage_unit
+#    displayName: "do_ci.sh"
+#    strategy:
+#      maxParallel: 1
+#      matrix:
+#        coverage:
+#          CI_TARGET: "coverage"
+#    timeoutInMinutes: 120
+#    steps:
+#    - template: bazel.yml
+#      parameters:
+#        ciTarget: $(CI_TARGET)
+#    - task: PublishPipelineArtifact@1
+#      condition: always()
+#      displayName: 'Publish the line coverage report'
+#      inputs:
+#        targetPath: $(Build.SourcesDirectory)/coverage_html.zip
+#        artifactName: UnitTestCoverageReport-$(System.JobAttempt)
+#
+## coverage_integration stage was temporarily removed due to the issue
+## reported by https://github.com/envoyproxy/nighthawk/issues/1006
+#- stage: release
+#  dependsOn:
+#  - "test_gcc"
+#  - "sanitizers"
+#  - "coverage_unit"
+#  condition: eq(variables['PostSubmit'], true)
+#  pool: "envoy-x64-large"
+#  jobs:
+#  - job: release
+#    displayName: "do_ci.sh"
+#    strategy:
+#      matrix:
+#        release:
+#          CI_TARGET: "docker"
+#    timeoutInMinutes: 120
+#    steps:
+#    - template: bazel.yml
+#      parameters:
+#        ciTarget: $(CI_TARGET)
diff --git a/.github/workflows/nighthawk-checks.yml b/.github/workflows/nighthawk-checks.yml
index dc28fc872..f79384f03 100644
--- a/.github/workflows/nighthawk-checks.yml
+++ b/.github/workflows/nighthawk-checks.yml
@@ -2,6 +2,7 @@ name: Nighthawk CI/CD
 
 permissions:
   contents: read
+  packages: read
 
 on:
   pull_request:
@@ -12,9 +13,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [build, check_format]
+        target: [test, check_format]
     steps:
     - uses: actions/checkout@v3
     - name: Run CI script
       run: |
-        echo "Hello github"
+        ci/run_envoy_docker.sh 'ci/do_ci.sh ${{ matrix.target }}'
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+        AZP_BRANCH: ${{ github.ref }}
+        AZP_SHA1: ${{ github.sha }}
+        ENVOY_DOCKER_IN_DOCKER: 1
diff --git a/bazel/engflow-bazel-credential-helper.sh b/bazel/engflow-bazel-credential-helper.sh
new file mode 100644
index 000000000..c6c1bd339
--- /dev/null
+++ b/bazel/engflow-bazel-credential-helper.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+# Bazel expects the helper to read stdin.
+# See https://github.com/bazelbuild/bazel/pull/17666
+cat /dev/stdin > /dev/null
+
+# `GITHUB_TOKEN` is provided as a secret.
+echo "{\"headers\":{\"Authorization\":[\"Bearer ${GITHUB_TOKEN}\"]}}"