diff --git a/.circleci/config.yml b/.circleci/config.yml
index 8692cd0a1b..2fd8c0596f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -3,21 +3,15 @@ version: 2
 
 workflows:
   version: 2
-  program-analysis:
-    # TODO(iphydf): Re-enable tsan when it's fixed.
+  circleci:
     jobs:
-      # Dynamic analysis in the Bazel build
       - bazel-asan
       - bazel-msan
-      # - bazel-tsan
-      # Dynamic analysis with CMake
-      - asan
-      # - tsan
-      - ubsan
-      # Static analysis
       - clang-analyze
       - cpplint
       - static-analysis
+      - cimplefmt
+      - generate-events
 
 jobs:
   bazel-asan:
@@ -30,20 +24,6 @@ jobs:
       - run: .circleci/bazel-test
           //c-toxcore/...
 
-  bazel-tsan:
-    working_directory: /tmp/cirrus-ci-build
-    docker:
-      - image: toxchat/toktok-stack:latest-tsan
-
-    steps:
-      - checkout
-      - run: .circleci/bazel-test
-          //c-toxcore/...
-          -//c-toxcore/auto_tests:conference_av_test
-          -//c-toxcore/auto_tests:conference_test
-          -//c-toxcore/auto_tests:onion_test
-          -//c-toxcore/auto_tests:tox_many_test
-
   bazel-msan:
     working_directory: /tmp/cirrus-ci-build
     docker:
@@ -54,7 +34,7 @@ jobs:
       - run: .circleci/bazel-test
           //c-toxcore/auto_tests:lossless_packet_test
 
-  asan:
+  static-analysis:
     working_directory: ~/work
     docker:
       - image: ubuntu
@@ -78,39 +58,6 @@ jobs:
             llvm-dev
             ninja-build
             pkg-config
-      - checkout
-      - run: git submodule update --init --recursive
-      - run: CC=clang .circleci/cmake-asan
-
-  tsan:
-    working_directory: ~/work
-    docker:
-      - image: ubuntu
-
-    steps:
-      - run: *apt_install
-      - checkout
-      - run: git submodule update --init --recursive
-      - run: CC=clang .circleci/cmake-tsan
-
-  ubsan:
-    working_directory: ~/work
-    docker:
-      - image: ubuntu
-
-    steps:
-      - run: *apt_install
-      - checkout
-      - run: git submodule update --init --recursive
-      - run: CC=clang .circleci/cmake-ubsan
-
-  static-analysis:
-    working_directory: ~/work
-    docker:
-      - image: ubuntu
-
-    steps:
-      - run: *apt_install
       - run:
           apt-get install -y --no-install-recommends
             ca-certificates
@@ -147,3 +94,22 @@ jobs:
       - checkout
       - run: git submodule update --init --recursive
       - run: other/analysis/run-cpplint
+
+  cimplefmt:
+    working_directory: ~/work
+    machine: { image: ubuntu-2204:current }
+
+    steps:
+      - checkout
+      - run: git submodule update --init --recursive
+      - run: other/docker/cimplefmt/run -u $(find tox* -name "*.[ch]")
+
+  generate-events:
+    working_directory: ~/work
+    machine: { image: ubuntu-2204:current }
+
+    steps:
+      - checkout
+      - run: git submodule update --init --recursive
+      - run: other/event_tooling/run
+      - run: git diff --exit-code
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 46aa57f315..99cbe7b2d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
       fail-fast: false
       matrix:
         tool: [autotools, clang-tidy, compcert, cppcheck, doxygen, goblint, infer, freebsd, misra, modules, pkgsrc, rpm, slimcc, sparse, tcc, tokstyle]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -34,37 +34,34 @@ jobs:
         with:
           file: other/docker/${{ matrix.tool }}/${{ matrix.tool }}.Dockerfile
 
-  coverage-linux:
-    runs-on: ubuntu-latest
+  sanitizer:
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [asan, tsan, ubsan]
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
         with:
-          submodules: recursive
-      - name: Build, test, and upload coverage
-        run: other/docker/coverage/run
-
-  generate-events:
-    runs-on: ubuntu-latest
-    steps:
+          driver: docker
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: Run generate_event_c
-        run: |
-          other/event_tooling/run
-          git diff --exit-code
+      - name: Run sanitizer
+        run: other/docker/circleci/run "${{ matrix.sanitizer }}"
 
-  cimplefmt:
-    runs-on: ubuntu-latest
+  coverage-linux:
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: Run cimplefmt
-        run: other/docker/cimplefmt/run -u $(find tox* -name "*.[ch]")
+      - name: Build, test, and upload coverage
+        run: other/docker/coverage/run
 
   build-android:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:
@@ -111,7 +108,7 @@ jobs:
           ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:6 --build-config Debug
 
   build-netbsd:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:
@@ -146,7 +143,7 @@ jobs:
             ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:6
 
   build-freebsd:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:
@@ -183,7 +180,7 @@ jobs:
             ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:6
 
   mypy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/other/docker/circleci/Dockerfile b/other/docker/circleci/Dockerfile
index 3b23eed793..cb431c3d9f 100644
--- a/other/docker/circleci/Dockerfile
+++ b/other/docker/circleci/Dockerfile
@@ -1,18 +1,18 @@
 ################################################
 # cmake-asan
-FROM ubuntu:20.04
+FROM ubuntu:24.04
 
 RUN apt-get update && \
  DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
  clang \
  cmake \
+ libclang-rt-dev \
  libconfig-dev \
  libgmock-dev \
  libgtest-dev \
  libopus-dev \
  libsodium-dev \
  libvpx-dev \
- llvm-dev \
  ninja-build \
  pkg-config \
  && apt-get clean \
@@ -22,8 +22,8 @@ COPY entrypoint.sh /
 RUN ["chmod", "755", "/entrypoint.sh"]
 
 WORKDIR /home/builder
-RUN groupadd -r -g 1000 builder \
- && useradd --no-log-init -r -g builder -u 1000 builder \
+RUN groupadd -r -g 987 builder \
+ && useradd --no-log-init -r -g builder -u 987 builder \
  && chown builder:builder /home/builder
 USER builder
 
diff --git a/other/docker/circleci/entrypoint.sh b/other/docker/circleci/entrypoint.sh
index 971759235f..0788e71d51 100755
--- a/other/docker/circleci/entrypoint.sh
+++ b/other/docker/circleci/entrypoint.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 
-set -eu
+set -eux
 
 SANITIZER="${1:-asan}"
 
 cp -a /c-toxcore .
 cd c-toxcore
-.circleci/cmake-"$SANITIZER"
+.circleci/cmake-"$SANITIZER" || (cat /home/builder/c-toxcore/_build/CMakeFiles/CMakeError.log && false)
diff --git a/other/docker/circleci/run b/other/docker/circleci/run
index 668e0fc865..4b20807f2a 100755
--- a/other/docker/circleci/run
+++ b/other/docker/circleci/run
@@ -1,6 +1,14 @@
 #!/bin/sh
 
+set -eux
+
 SANITIZER="${1:-asan}"
 
+if [ -t 0 ]; then
+  TTY=true
+else
+  TTY=false
+fi
+
 docker build -t toxchat/c-toxcore:circleci other/docker/circleci
-docker run --name toxcore-circleci --rm -it -v "$PWD:/c-toxcore" toxchat/c-toxcore:circleci "$SANITIZER"
+docker run --name toxcore-circleci --rm --interactive="$TTY" --tty="$TTY" --volume "$PWD:/c-toxcore" toxchat/c-toxcore:circleci "$SANITIZER"