diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a133fe870..bddf73f07 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -11,15 +11,45 @@ on:
     # Every Saturday
     - cron: '0 0 * * 6'
 
-env:
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
-
+# Workflow-level concurrency control - cancels previous runs when new commits arrive
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+
 jobs:
+  resolve-playwright-version:
+    name: Resolve Playwright version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.out.outputs.version }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Use Node.js 22
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: pnpm
+
+      # Install dependencies to ensure node_modules/@playwright/test exists
+      - name: Install dependencies
+        env:
+          # do not download browsers here
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+        run: pnpm install --frozen-lockfile
+
+      - name: Read @playwright/test version
+        id: out
+        run: |
+          VER=$(node -e "console.log(require(require.resolve('@playwright/test/package.json')).version)")
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
   test:
     timeout-minutes: 5
     runs-on: ubuntu-latest
@@ -107,13 +137,24 @@ jobs:
         run: pnpm run build
 
   test-e2e:
-    timeout-minutes: 10
+    name: Test E2E
+    needs: resolve-playwright-version
+    timeout-minutes: 12
     runs-on: ubuntu-latest
 
+    env:
+      PLAYWRIGHT_TIMEOUT: 300000
+      PLAYWRIGHT_HEADLESS: true
+      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+
+    container:
+      image: mcr.microsoft.com/playwright:v${{ needs.resolve-playwright-version.outputs.version }}-noble
+      options: --user 1001
+
     steps:
       - uses: actions/checkout@v5
         with:
-          fetch-depth: 2 # for checking against main and for following the PR history
+          fetch-depth: 2
 
       # Set Turbo base/head for PRs, see: https://turborepo.com/docs/reference/run#--affected
       - name: Set Turbo base/head for PRs
@@ -125,43 +166,27 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
 
-      - name: Use Node.js 22
+      - name: Use Node.js 
         uses: actions/setup-node@v5
         with:
-          node-version: 22
+          node-version: lts/*
           cache: "pnpm"
 
       - name: Install dependencies
         run: pnpm install
 
-      - name: Cache Playwright browsers
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/ms-playwright
-          key: ubuntu-latest-pw-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ubuntu-latest-pw-
-
-      - name: Install Playwright Browsers
-        run: pnpm exec playwright install --with-deps
-
       - name: Run E2E (PR)
         if: ${{ github.event_name == 'pull_request' }}
         run: pnpm run test:e2e --affected
         env:
-          CI: true
-          PLAYWRIGHT_TIMEOUT: 300000
-          TURBO_LOG: info # or 'trace' for debugging
+          TURBO_LOG: info
           DEBUG: pw:api
-          PLAYWRIGHT_HEADLESS: true
 
       # Pushes to main - run everything
       - name: Run E2E (main)
         if: ${{ github.event_name != 'pull_request' }}
         run: pnpm run test:e2e
         env:
-          CI: true
-          PLAYWRIGHT_TIMEOUT: 300000
           DEBUG: pw:api
 
       - uses: actions/upload-artifact@v4
diff --git a/turbo.json b/turbo.json
index e69112d13..375ad1369 100644
--- a/turbo.json
+++ b/turbo.json
@@ -8,7 +8,8 @@
 			"dependsOn": ["^build"],
 			"inputs": ["$TURBO_DEFAULT$", ".env*", "!**/*.test.ts", "!**/*.test.tsx"],
 			"outputs": ["dist/**", ".next/**", "!.next/cache/**"],
-			"env": ["SENTRY_*"]
+			"env": ["SENTRY_*"],
+			"passThroughEnv": ["SENTRY_AUTH_TOKEN"]
 		},
 		// Development task
 		// See: