diff --git a/.github/actions/packer.fmt/action.yaml b/.github/actions/packer.fmt/action.yaml
new file mode 100644
index 0000000..fe0597e
--- /dev/null
+++ b/.github/actions/packer.fmt/action.yaml
@@ -0,0 +1,98 @@
+name: Packer - Format
+description: Check that Packer HCL templates are formatted with `packer fmt`. On failure, the diff is added to the job summary. Requires the `packer` CLI on the `PATH`.
+
+
+inputs:
+  target_dir:
+    required: false
+    default: ./
+    description: "(Optional) The directory to check formatting in. Defaults to `./`."
+  recursive:
+    required: false
+    default: "true"
+    description: "(Optional) Whether to also check subdirectories. Defaults to `true`."
+  annotations_enabled:
+    required: false
+    default: "true"
+    description: "(Optional) Whether to annotate the unformatted lines in the pull request when `packer fmt` fails, from the hunks of the diff it printed. Defaults to `true`."
+
+outputs:
+  skipped:
+    value: ${{ steps.target.outputs.skipped }}
+    description: "`true` when `target_dir` holds no Packer HCL files and `packer fmt` was not run. Empty otherwise."
+  stdout:
+    value: ${{ steps.fmt.outputs.stdout }}
+    description: "The STDOUT stream of the call to `packer fmt`. Empty when skipped."
+  stderr:
+    value: ${{ steps.fmt.outputs.stderr }}
+    description: "The STDERR stream of the call to `packer fmt`. Empty when skipped."
+  exitcode:
+    value: ${{ steps.fmt.outputs.exitcode }}
+    description: "The exit code of the call to `packer fmt`. Empty when skipped. The action still fails on a non-zero exit code, so use `continue-on-error: true` to inspect it."
+
+
+runs:
+  using: composite
+
+  steps:
+  - name: Resolve Target
+    id: target
+    shell: bash
+    env:
+      TARGET_DIR: ${{ inputs.target_dir }}
+      RECURSIVE: ${{ inputs.recursive }}
+    run: |
+      target_dir="${TARGET_DIR%/}"
+      target_dir="${target_dir:-.}"
+      echo "target_dir=$target_dir" >> "$GITHUB_OUTPUT"
+
+      # `packer fmt` exits 0 on a directory without Packer HCL files, which would report a vacuous pass.
+      depth_args=()
+      [ "$RECURSIVE" = "true" ] || depth_args=(-maxdepth 1)
+      if [ -z "$(find "$target_dir" "${depth_args[@]}" -type f \( -name '*.pkr.hcl' -o -name '*.pkrvars.hcl' \) -print -quit)" ]; then
+        echo "::notice::Skipping packer fmt: no Packer HCL files in $target_dir."
+        echo "skipped=true" >> "$GITHUB_OUTPUT"
+      fi
+
+  - name: Check Packer Format
+    id: fmt
+    if: steps.target.outputs.skipped != 'true'
+    uses: tedilabs/github-actions/.github/actions/shell.run@main
+    env:
+      TARGET_DIR: ${{ steps.target.outputs.target_dir }}
+      RECURSIVE: ${{ inputs.recursive }}
+    with:
+      run: |
+        args=(-check -diff)
+        if [ "$RECURSIVE" = "true" ]; then
+          args+=(-recursive)
+        fi
+
+        packer fmt "${args[@]}" "$TARGET_DIR"
+
+  # The diff already names each file (`+++ new/<file>`) and the first line of every hunk (`@@ -a,b +c,d @@`), so
+  # the annotations are read from the captured output. `packer fmt` prints the paths as given, relative to the
+  # repository.
+  - name: Annotate Findings
+    id: fmt-annotate
+    if: always() && inputs.annotations_enabled == 'true' && steps.fmt.outcome == 'failure'
+    shell: bash
+    env:
+      LOG_FILE: ${{ steps.fmt.outputs.log_file }}
+    run: |
+      awk '
+        /^\+\+\+ new\// { file = substr($0, 9); next }
+        /^@@ / && file != "" {
+          line = $3; sub(/^\+/, "", line); sub(/,.*/, "", line)
+          printf "::error file=%s,line=%s,title=packer fmt · Not formatted::Run `packer fmt` to format this file.\n", file, line
+        }
+      ' "$LOG_FILE"
+
+  - name: Add Failure Details to Job Summary
+    id: fmt-summary
+    if: always() && steps.fmt.outcome == 'failure'
+    uses: tedilabs/github-actions/.github/actions/github.step-summary@main
+    with:
+      title: "❌ packer fmt · ${{ steps.target.outputs.target_dir }}"
+      file: ${{ steps.fmt.outputs.log_file }}
+      lang: diff
diff --git a/.github/actions/packer.validate/action.yaml b/.github/actions/packer.validate/action.yaml
new file mode 100644
index 0000000..a09180c
--- /dev/null
+++ b/.github/actions/packer.validate/action.yaml
@@ -0,0 +1,139 @@
+name: Packer - Validate
+description: Install the required plugins of a Packer template directory with `packer init` and validate it with `packer validate`. On failure, the output is added to the job summary. Requires the `packer` CLI on the `PATH`.
+
+
+inputs:
+  target_dir:
+    required: false
+    default: ./
+    description: "(Optional) The Packer template directory to initialize and validate. Defaults to `./`."
+  github_token:
+    required: false
+    default: ${{ github.token }}
+    description: "(Optional) The GitHub token used by `packer init` to download plugins from GitHub without hitting the anonymous rate limit, exported as `PACKER_GITHUB_API_TOKEN`. Defaults to the automatically generated `github.token`."
+  syntax_only:
+    required: false
+    default: "false"
+    description: "(Optional) Whether to check only the syntax of the templates with `packer validate -syntax-only`, leaving their configuration unverified. `packer init` is skipped as well, since a syntax-only check resolves no plugins, which is what makes this usable on a runner that cannot reach the plugin registry. Defaults to `false`."
+  annotations_enabled:
+    required: false
+    default: "true"
+    description: "(Optional) Whether to annotate the failing lines in the pull request when `packer validate` fails, from the `Error:` and `on <file> line <n>` lines it printed. A diagnostic that names no file is annotated without a location rather than dropped. Defaults to `true`."
+
+outputs:
+  skipped:
+    value: ${{ steps.target.outputs.skipped }}
+    description: "`true` when `target_dir` holds no Packer template files and neither `packer init` nor `packer validate` was run. Empty otherwise."
+  # When `packer init` fails, `packer validate` does not run, so the outputs come from the command that failed.
+  stdout:
+    value: ${{ steps.init.outcome == 'failure' && steps.init.outputs.stdout || steps.validate.outputs.stdout }}
+    description: "The STDOUT stream of the call to `packer validate`, or to `packer init` when it failed. Empty when skipped."
+  stderr:
+    value: ${{ steps.init.outcome == 'failure' && steps.init.outputs.stderr || steps.validate.outputs.stderr }}
+    description: "The STDERR stream of the call to `packer validate`, or to `packer init` when it failed. Empty when skipped."
+  exitcode:
+    value: ${{ steps.init.outcome == 'failure' && steps.init.outputs.exitcode || steps.validate.outputs.exitcode }}
+    description: "The exit code of the call to `packer validate`, or to `packer init` when it failed. Empty when skipped. The action still fails on a non-zero exit code, so use `continue-on-error: true` to inspect it."
+
+
+runs:
+  using: composite
+
+  steps:
+  - name: Resolve Target
+    id: target
+    shell: bash
+    env:
+      TARGET_DIR: ${{ inputs.target_dir }}
+    run: |
+      target_dir="${TARGET_DIR%/}"
+      target_dir="${target_dir:-.}"
+      echo "target_dir=$target_dir" >> "$GITHUB_OUTPUT"
+
+      # `packer validate` fails on a directory without templates, which would report a failure for an empty target.
+      if [ -z "$(find "$target_dir" -maxdepth 1 -type f \( -name '*.pkr.hcl' -o -name '*.pkr.json' \) -print -quit)" ]; then
+        echo "::notice::Skipping packer validate: no Packer template files in $target_dir."
+        echo "skipped=true" >> "$GITHUB_OUTPUT"
+        exit 0
+      fi
+
+      packer version
+
+  # `-syntax-only` resolves no plugins, so `packer init` is pointless there and would fail on a runner that
+  # cannot reach the plugin registry, which is one of the reasons to ask for a syntax-only check.
+  - name: Packer Init
+    id: init
+    if: steps.target.outputs.skipped != 'true' && inputs.syntax_only != 'true'
+    uses: tedilabs/github-actions/.github/actions/shell.run@main
+    env:
+      PACKER_GITHUB_API_TOKEN: ${{ inputs.github_token }}
+      TARGET_DIR: ${{ steps.target.outputs.target_dir }}
+    with:
+      run: |
+        packer init "$TARGET_DIR"
+
+  - name: Add Failure Details to Job Summary
+    id: init-summary
+    if: always() && steps.init.outcome == 'failure'
+    uses: tedilabs/github-actions/.github/actions/github.step-summary@main
+    with:
+      title: "❌ packer init · ${{ steps.target.outputs.target_dir }}"
+      file: ${{ steps.init.outputs.log_file }}
+      lang: text
+
+  - name: Packer Validate
+    id: validate
+    if: steps.target.outputs.skipped != 'true'
+    uses: tedilabs/github-actions/.github/actions/shell.run@main
+    env:
+      TARGET_DIR: ${{ steps.target.outputs.target_dir }}
+      SYNTAX_ONLY: ${{ inputs.syntax_only }}
+    with:
+      run: |
+        args=()
+        if [ "$SYNTAX_ONLY" = "true" ]; then
+          args+=(-syntax-only)
+        fi
+
+        packer validate "${args[@]}" "$TARGET_DIR"
+
+  # `-machine-readable` is not a better source here: it is the legacy stream format, which packs every diagnostic
+  # of the run into a single `ui,error` record as the same human-readable text with `\n` escaped and each comma
+  # replaced by `%!(PACKER_COMMA)`. It carries no file or line field, so the text output is parsed instead. Each
+  # diagnostic prints `Error: <summary>`, usually followed by `on <file> line <n>:` with the path as given,
+  # relative to the repository. Some, such as an unset variable, name no file and are annotated without one.
+  - name: Annotate Findings
+    id: validate-annotate
+    if: always() && inputs.annotations_enabled == 'true' && steps.validate.outcome == 'failure'
+    shell: bash
+    env:
+      LOG_FILE: ${{ steps.validate.outputs.log_file }}
+    run: |
+      awk '
+        function escape(text) { gsub(/%/, "%25", text); return text }
+        # A diagnostic that reached the next one, or the end of the log, without naming a file still gets an
+        # annotation, just without a location.
+        function flush(  message) {
+          if (summary == "") { return }
+          message = escape(summary)
+          printf "::%s title=packer validate · %s::%s\n", severity, message, message
+          summary = ""
+        }
+        /^(Error|Warning): / { flush(); severity = tolower($1); sub(/:$/, "", severity); summary = substr($0, index($0, ": ") + 2); next }
+        /^[[:space:]]+on .+ line [0-9]+/ && summary != "" {
+          file = $2; line = $4; sub(/[:,].*$/, "", line)
+          message = escape(summary)
+          printf "::%s file=%s,line=%s,title=packer validate · %s::%s\n", severity, file, line, message, message
+          summary = ""
+        }
+        END { flush() }
+      ' "$LOG_FILE"
+
+  - name: Add Failure Details to Job Summary
+    id: validate-summary
+    if: always() && steps.validate.outcome == 'failure'
+    uses: tedilabs/github-actions/.github/actions/github.step-summary@main
+    with:
+      title: "❌ packer validate · ${{ steps.target.outputs.target_dir }}"
+      file: ${{ steps.validate.outputs.log_file }}
+      lang: text
diff --git a/.github/workflows/packer.templates.integration.yaml b/.github/workflows/packer.templates.integration.yaml
new file mode 100644
index 0000000..5e1ab61
--- /dev/null
+++ b/.github/workflows/packer.templates.integration.yaml
@@ -0,0 +1,161 @@
+name: Packer Templates - Integration
+
+
+on:
+  workflow_call:
+    inputs:
+      runs_on:
+        description: >
+          JSON-encoded runs-on value.
+          Examples:
+          - '"ubuntu-latest"'
+          - '["self-hosted","linux","x64"]'
+        required: false
+        type: string
+        default: '"ubuntu-latest"'
+
+      paths:
+        type: string
+        required: false
+        default: |
+          builds/**
+        description: "(Optional) File and directory patterns used to detect changed Packer template directories, one per line. Defaults to `builds/**`."
+      paths_max_depth:
+        type: string
+        required: false
+        default: "2"
+        description: "(Optional) The maximum depth of the changed directories to check. For example, `builds/foo/source.pkr.hcl` with a max depth of `2` is checked as `builds/foo`. Defaults to `2`."
+
+      aws_region:
+        type: string
+        required: false
+        default: us-east-1
+        description: "(Optional) The region exported as `AWS_DEFAULT_REGION` so that Amazon builders without an explicit `region` pass `packer validate` on a runner with no AWS configuration. No credentials are needed. Defaults to `us-east-1`."
+
+      fmt_enabled:
+        type: boolean
+        required: false
+        default: true
+        description: "(Optional) Whether to check formatting with `packer fmt`. Defaults to `true`."
+      validate_enabled:
+        type: boolean
+        required: false
+        default: true
+        description: "(Optional) Whether to run `packer init` and `packer validate`. Defaults to `true`."
+
+      pr_comment_enabled:
+        type: boolean
+        required: false
+        default: true
+        description: "(Optional) Whether to post the integration report as a single sticky comment on pull requests. Requires the `pull-requests: write` permission on the caller. The report is always written to the job summary. Defaults to `true`."
+
+
+jobs:
+  changed:
+    name: Detect Changed Directories
+    runs-on: ${{ fromJson(inputs.runs_on) }}
+
+    outputs:
+      has_directories: ${{ steps.changed-dirs.outputs.has_directories }}
+      directories: ${{ steps.changed-dirs.outputs.directories }}
+
+    steps:
+    - name: Checkout
+      id: checkout
+      uses: actions/checkout@v7
+      with:
+        fetch-depth: 0
+
+    - name: Get Changed Directories
+      id: changed-dirs
+      uses: tedilabs/github-actions/.github/actions/git.changed-dirs@main
+      with:
+        paths: ${{ inputs.paths }}
+        max_depth: ${{ inputs.paths_max_depth }}
+
+
+  lint:
+    name: Lint (${{ matrix.path }})
+    needs:
+    - changed
+    if: needs.changed.outputs.has_directories == 'true'
+    runs-on: ${{ fromJson(inputs.runs_on) }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        path: ${{ fromJson(needs.changed.outputs.directories) }}
+
+    env:
+      AWS_DEFAULT_REGION: ${{ inputs.aws_region }}
+
+    steps:
+    - name: Checkout
+      id: checkout
+      uses: actions/checkout@v7
+
+    # The tools and their versions come from the repository's mise config (`mise.toml` or `.tool-versions`).
+    # The build directory is passed so a `mise.toml` placed there overrides the repository-wide one,
+    # and only `packer` is installed, so a repository that pins other tools does not pay to install them on
+    # every leg of the matrix. Both checks need it, so it is not tied to either toggle.
+    - name: Set up tools
+      id: setup-tools
+      uses: tedilabs/github-actions/.github/actions/mise.setup-tools@main
+      with:
+        working_directory: ${{ matrix.path }}
+        install_args: packer
+
+    - name: Check Format
+      id: fmt
+      if: inputs.fmt_enabled
+      continue-on-error: true
+      uses: tedilabs/github-actions/.github/actions/packer.fmt@main
+      with:
+        target_dir: ${{ matrix.path }}
+
+    - name: Validate
+      id: validate
+      if: inputs.validate_enabled
+      continue-on-error: true
+      uses: tedilabs/github-actions/.github/actions/packer.validate@main
+      with:
+        target_dir: ${{ matrix.path }}
+
+    - name: Collect Results
+      id: results
+      if: always()
+      uses: tedilabs/github-actions/.github/actions/github.matrix-report@main
+      with:
+        mode: collect
+        id: ${{ matrix.path }}
+        id_label: Directory
+        artifact_prefix: packer-integration
+        job_status: ${{ job.status }}
+        # An empty value keeps a check that is turned off out of the report; a check that ran but had
+        # nothing to do reports `skipped`.
+        results: |
+          {
+            "fmt": "${{ inputs.fmt_enabled && (steps.fmt.outputs.skipped == 'true' && 'skipped' || steps.fmt.outcome) || '' }}",
+            "validate": "${{ inputs.validate_enabled && (steps.validate.outputs.skipped == 'true' && 'skipped' || steps.validate.outcome) || '' }}"
+          }
+
+
+  report:
+    name: Report
+    needs:
+    - changed
+    - lint
+    if: always() && needs.changed.outputs.has_directories == 'true'
+    runs-on: ${{ fromJson(inputs.runs_on) }}
+
+    steps:
+    - name: Publish Report
+      id: report
+      uses: tedilabs/github-actions/.github/actions/github.matrix-report@main
+      with:
+        mode: publish
+        id_label: Directory
+        artifact_prefix: packer-integration
+        title: Packer Integration
+        pr_comment_enabled: ${{ inputs.pr_comment_enabled }}
+        pr_comment_marker: packer-integration