diff --git a/.github/workflows/smoke-chroot.lock.yml b/.github/workflows/smoke-chroot.lock.yml
index e2065e8d2..036d675b4 100644
--- a/.github/workflows/smoke-chroot.lock.yml
+++ b/.github/workflows/smoke-chroot.lock.yml
@@ -19,9 +19,9 @@
 #   gh aw compile
 # For more information: https://github.com/github/gh-aw/blob/main/.github/aw/github-agentic-workflows.md
 #
-# Smoke test workflow that validates the --enable-chroot feature by testing host binary access, network firewall, and security boundaries
+# Smoke test workflow that validates the --enable-chroot feature by testing host binary access and comparing versions
 #
-# frontmatter-hash: fd4c28677cd91a033746443cec4ce46888adc86a792883deb7b3a28ce6ae7390
+# frontmatter-hash: 609448872bf0700e99cd66630a740f6b9332ccb01fff5efee6ae4d16c9cabef2
 
 name: "Smoke Chroot"
 "on":
@@ -119,15 +119,47 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
           persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+      - name: Setup Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
       - name: Create gh-aw temp directory
         run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir.sh
+      - name: Setup Go
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # 0aaccfd150d50ccaeb58ebd88d36e91967a5f35b
+        with:
+          go-version: "1.22"
       - name: Capture host versions for verification
-        run: |-
+        run: |
           echo "=== Capturing host versions for post-verification ==="
-          echo "HOST_PYTHON_VERSION=$(python3 --version 2>&1 | head -1)" >> /tmp/host-versions.env
-          echo "HOST_NODE_VERSION=$(node --version 2>&1 | head -1)" >> /tmp/host-versions.env
-          echo "HOST_GO_VERSION=$(go version 2>&1 | head -1)" >> /tmp/host-versions.env
-          cat /tmp/host-versions.env
+          mkdir -p /tmp/gh-aw/chroot-test
+          {
+            echo "HOST_PYTHON_VERSION='$(python3 --version 2>&1 | head -1)'"
+            echo "HOST_NODE_VERSION='$(node --version 2>&1 | head -1)'"
+            echo "HOST_GO_VERSION='$(go version 2>&1 | head -1)'"
+          } > /tmp/gh-aw/chroot-test/host-versions.env
+          cat /tmp/gh-aw/chroot-test/host-versions.env
+      - name: Install awf dependencies
+        run: npm ci
+      - name: Build awf
+        run: npm run build
+      - name: Install awf binary (local)
+        run: "WORKSPACE_PATH=\"${GITHUB_WORKSPACE:-$(pwd)}\"\nNODE_BIN=\"$(command -v node)\"\nsudo tee /usr/local/bin/awf > /dev/null <<EOF\n#!/bin/bash\nexec \"${NODE_BIN}\" \"${WORKSPACE_PATH}/dist/cli.js\" \"\\$@\"\nEOF\nsudo chmod +x /usr/local/bin/awf\n"
+      - name: Build local containers
+        run: |
+          echo "=== Building local containers ==="
+          docker build -t ghcr.io/github/gh-aw-firewall/squid:latest containers/squid/
+          docker build -t ghcr.io/github/gh-aw-firewall/agent:latest containers/agent/
+      - name: Run chroot version tests
+        run: "echo \"=== Running chroot version tests ===\"\n\n# Capture GOROOT for chroot tests\nexport GOROOT=$(go env GOROOT)\n\n# Test Python version in chroot\necho \"Testing Python...\"\nCHROOT_PYTHON=$(sudo -E awf --enable-chroot --skip-pull --allow-domains localhost -- python3 --version 2>&1 | grep -oP 'Python \\d+\\.\\d+\\.\\d+' | head -1) || CHROOT_PYTHON=\"FAILED\"\n\n# Test Node version in chroot\necho \"Testing Node...\"\nCHROOT_NODE=$(sudo -E awf --enable-chroot --skip-pull --allow-domains localhost -- node --version 2>&1 | grep -oP 'v\\d+\\.\\d+\\.\\d+' | head -1) || CHROOT_NODE=\"FAILED\"\n\n# Test Go version in chroot\necho \"Testing Go...\"\nCHROOT_GO=$(sudo -E awf --enable-chroot --skip-pull --allow-domains localhost -- go version 2>&1 | grep -oP 'go\\d+\\.\\d+(\\.\\d+)?' | head -1) || CHROOT_GO=\"FAILED\"\n\n# Save chroot versions\n{\n  echo \"CHROOT_PYTHON_VERSION=$CHROOT_PYTHON\"\n  echo \"CHROOT_NODE_VERSION=$CHROOT_NODE\"\n  echo \"CHROOT_GO_VERSION=$CHROOT_GO\"\n} > /tmp/gh-aw/chroot-test/chroot-versions.env\n\ncat /tmp/gh-aw/chroot-test/chroot-versions.env\n\n# Compare versions and create results\nsource /tmp/gh-aw/chroot-test/host-versions.env\n\nPYTHON_MATCH=\"NO\"\nNODE_MATCH=\"NO\"\nGO_MATCH=\"NO\"\n\n# Compare Python (extract version number - chroot already extracted as \"Python X.Y.Z\")\nHOST_PY_NUM=$(echo \"$HOST_PYTHON_VERSION\" | grep -oP 'Python \\d+\\.\\d+\\.\\d+' || echo \"\")\nCHROOT_PY_NUM=\"$CHROOT_PYTHON\"\n[ \"$HOST_PY_NUM\" = \"$CHROOT_PY_NUM\" ] && [ -n \"$HOST_PY_NUM\" ] && PYTHON_MATCH=\"YES\"\n\n# Compare Node (extract version number - already extracted as v\\d+.\\d+.\\d+)\nHOST_NODE_NUM=$(echo \"$HOST_NODE_VERSION\" | grep -oP 'v\\d+\\.\\d+\\.\\d+' || echo \"\")\nCHROOT_NODE_NUM=\"$CHROOT_NODE\"\n[ \"$HOST_NODE_NUM\" = \"$CHROOT_NODE_NUM\" ] && [ -n \"$HOST_NODE_NUM\" ] && NODE_MATCH=\"YES\"\n\n# Compare Go (extract version number - chroot already extracted as \"goX.Y.Z\")\nHOST_GO_NUM=$(echo \"$HOST_GO_VERSION\" | grep -oP 'go\\d+\\.\\d+(\\.\\d+)?' || echo \"\")\nCHROOT_GO_NUM=\"$CHROOT_GO\"\n[ \"$HOST_GO_NUM\" = \"$CHROOT_GO_NUM\" ] && [ -n \"$HOST_GO_NUM\" ] && GO_MATCH=\"YES\"\n\n# Create results summary\n{\n  echo \"PYTHON_MATCH=$PYTHON_MATCH\"\n  echo \"NODE_MATCH=$NODE_MATCH\"\n  echo \"GO_MATCH=$GO_MATCH\"\n  echo \"HOST_PY_NUM=$HOST_PY_NUM\"\n  echo \"CHROOT_PY_NUM=$CHROOT_PY_NUM\"\n  echo \"HOST_NODE_NUM=$HOST_NODE_NUM\"\n  echo \"CHROOT_NODE_NUM=$CHROOT_NODE_NUM\"\n  echo \"HOST_GO_NUM=$HOST_GO_NUM\"\n  echo \"CHROOT_GO_NUM=$CHROOT_GO_NUM\"\n} > /tmp/gh-aw/chroot-test/results.env\n\ncat /tmp/gh-aw/chroot-test/results.env\n\n# Determine overall result\nif [ \"$PYTHON_MATCH\" = \"YES\" ] && [ \"$NODE_MATCH\" = \"YES\" ] && [ \"$GO_MATCH\" = \"YES\" ]; then\n  echo \"ALL_TESTS_PASSED=true\" >> /tmp/gh-aw/chroot-test/results.env\n  echo \"=== ALL CHROOT TESTS PASSED ===\"\nelse\n  echo \"ALL_TESTS_PASSED=false\" >> /tmp/gh-aw/chroot-test/results.env\n  echo \"=== SOME CHROOT TESTS FAILED ===\"\nfi\n"
+      - if: always()
+        name: Cleanup test containers
+        run: ./scripts/ci/cleanup.sh || true
 
       - name: Configure Git credentials
         env:
@@ -161,31 +193,8 @@ jobs:
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
       - name: Install GitHub Copilot CLI
         run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.402
-      - name: Install awf dependencies
-        run: npm ci
-      - name: Build awf
-        run: npm run build
-      - name: Install awf binary (local)
-        run: |
-          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
-          NODE_BIN="$(command -v node)"
-          if [ ! -d "$WORKSPACE_PATH" ]; then
-            echo "Workspace path not found: $WORKSPACE_PATH"
-            exit 1
-          fi
-          if [ ! -x "$NODE_BIN" ]; then
-            echo "Node binary not found: $NODE_BIN"
-            exit 1
-          fi
-          if [ ! -d "/usr/local/bin" ]; then
-            echo "/usr/local/bin is missing"
-            exit 1
-          fi
-          sudo tee /usr/local/bin/awf > /dev/null <<EOF
-          #!/bin/bash
-          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
-          EOF
-          sudo chmod +x /usr/local/bin/awf
+      - name: Install awf binary
+        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.13.4
       - name: Determine automatic lockdown mode for GitHub MCP server
         id: determine-automatic-lockdown
         env:
@@ -933,7 +942,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           WORKFLOW_NAME: "Smoke Chroot"
-          WORKFLOW_DESCRIPTION: "Smoke test workflow that validates the --enable-chroot feature by testing host binary access, network firewall, and security boundaries"
+          WORKFLOW_DESCRIPTION: "Smoke test workflow that validates the --enable-chroot feature by testing host binary access and comparing versions"
           HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
         with:
           script: |
diff --git a/.github/workflows/smoke-chroot.md b/.github/workflows/smoke-chroot.md
index 6e7414a5f..3ed0ae0c7 100644
--- a/.github/workflows/smoke-chroot.md
+++ b/.github/workflows/smoke-chroot.md
@@ -1,5 +1,5 @@
 ---
-description: Smoke test workflow that validates the --enable-chroot feature by testing host binary access, network firewall, and security boundaries
+description: Smoke test workflow that validates the --enable-chroot feature by testing host binary access and comparing versions
 on:
   workflow_dispatch:
   pull_request:
@@ -44,50 +44,143 @@ safe-outputs:
       run-failure: "**Chroot tests failed** [{workflow_name}]({run_url}) {status} - See logs for details."
 timeout-minutes: 20
 steps:
+  - name: Setup Go
+    uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b
+    with:
+      go-version: '1.22'
   - name: Capture host versions for verification
     run: |
       echo "=== Capturing host versions for post-verification ==="
-      echo "HOST_PYTHON_VERSION=$(python3 --version 2>&1 | head -1)" >> /tmp/host-versions.env
-      echo "HOST_NODE_VERSION=$(node --version 2>&1 | head -1)" >> /tmp/host-versions.env
-      echo "HOST_GO_VERSION=$(go version 2>&1 | head -1)" >> /tmp/host-versions.env
-      cat /tmp/host-versions.env
+      mkdir -p /tmp/gh-aw/chroot-test
+      {
+        echo "HOST_PYTHON_VERSION='$(python3 --version 2>&1 | head -1)'"
+        echo "HOST_NODE_VERSION='$(node --version 2>&1 | head -1)'"
+        echo "HOST_GO_VERSION='$(go version 2>&1 | head -1)'"
+      } > /tmp/gh-aw/chroot-test/host-versions.env
+      cat /tmp/gh-aw/chroot-test/host-versions.env
+  - name: Install awf dependencies
+    run: npm ci
+  - name: Build awf
+    run: npm run build
+  - name: Install awf binary (local)
+    run: |
+      WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
+      NODE_BIN="$(command -v node)"
+      sudo tee /usr/local/bin/awf > /dev/null <<EOF
+      #!/bin/bash
+      exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
+      EOF
+      sudo chmod +x /usr/local/bin/awf
+  - name: Build local containers
+    run: |
+      echo "=== Building local containers ==="
+      docker build -t ghcr.io/github/gh-aw-firewall/squid:latest containers/squid/
+      docker build -t ghcr.io/github/gh-aw-firewall/agent:latest containers/agent/
+  - name: Run chroot version tests
+    run: |
+      echo "=== Running chroot version tests ==="
+
+      # Capture GOROOT for chroot tests
+      export GOROOT=$(go env GOROOT)
+
+      # Test Python version in chroot
+      echo "Testing Python..."
+      CHROOT_PYTHON=$(sudo -E awf --enable-chroot --skip-pull --allow-domains localhost -- python3 --version 2>&1 | grep -oP 'Python \d+\.\d+\.\d+' | head -1) || CHROOT_PYTHON="FAILED"
+
+      # Test Node version in chroot
+      echo "Testing Node..."
+      CHROOT_NODE=$(sudo -E awf --enable-chroot --skip-pull --allow-domains localhost -- node --version 2>&1 | grep -oP 'v\d+\.\d+\.\d+' | head -1) || CHROOT_NODE="FAILED"
+
+      # Test Go version in chroot
+      echo "Testing Go..."
+      CHROOT_GO=$(sudo -E awf --enable-chroot --skip-pull --allow-domains localhost -- go version 2>&1 | grep -oP 'go\d+\.\d+(\.\d+)?' | head -1) || CHROOT_GO="FAILED"
+
+      # Save chroot versions
+      {
+        echo "CHROOT_PYTHON_VERSION=$CHROOT_PYTHON"
+        echo "CHROOT_NODE_VERSION=$CHROOT_NODE"
+        echo "CHROOT_GO_VERSION=$CHROOT_GO"
+      } > /tmp/gh-aw/chroot-test/chroot-versions.env
+
+      cat /tmp/gh-aw/chroot-test/chroot-versions.env
+
+      # Compare versions and create results
+      source /tmp/gh-aw/chroot-test/host-versions.env
+
+      PYTHON_MATCH="NO"
+      NODE_MATCH="NO"
+      GO_MATCH="NO"
+
+      # Compare Python (extract version number - chroot already extracted as "Python X.Y.Z")
+      HOST_PY_NUM=$(echo "$HOST_PYTHON_VERSION" | grep -oP 'Python \d+\.\d+\.\d+' || echo "")
+      CHROOT_PY_NUM="$CHROOT_PYTHON"
+      [ "$HOST_PY_NUM" = "$CHROOT_PY_NUM" ] && [ -n "$HOST_PY_NUM" ] && PYTHON_MATCH="YES"
+
+      # Compare Node (extract version number - already extracted as v\d+.\d+.\d+)
+      HOST_NODE_NUM=$(echo "$HOST_NODE_VERSION" | grep -oP 'v\d+\.\d+\.\d+' || echo "")
+      CHROOT_NODE_NUM="$CHROOT_NODE"
+      [ "$HOST_NODE_NUM" = "$CHROOT_NODE_NUM" ] && [ -n "$HOST_NODE_NUM" ] && NODE_MATCH="YES"
+
+      # Compare Go (extract version number - chroot already extracted as "goX.Y.Z")
+      HOST_GO_NUM=$(echo "$HOST_GO_VERSION" | grep -oP 'go\d+\.\d+(\.\d+)?' || echo "")
+      CHROOT_GO_NUM="$CHROOT_GO"
+      [ "$HOST_GO_NUM" = "$CHROOT_GO_NUM" ] && [ -n "$HOST_GO_NUM" ] && GO_MATCH="YES"
+
+      # Create results summary
+      {
+        echo "PYTHON_MATCH=$PYTHON_MATCH"
+        echo "NODE_MATCH=$NODE_MATCH"
+        echo "GO_MATCH=$GO_MATCH"
+        echo "HOST_PY_NUM=$HOST_PY_NUM"
+        echo "CHROOT_PY_NUM=$CHROOT_PY_NUM"
+        echo "HOST_NODE_NUM=$HOST_NODE_NUM"
+        echo "CHROOT_NODE_NUM=$CHROOT_NODE_NUM"
+        echo "HOST_GO_NUM=$HOST_GO_NUM"
+        echo "CHROOT_GO_NUM=$CHROOT_GO_NUM"
+      } > /tmp/gh-aw/chroot-test/results.env
+
+      cat /tmp/gh-aw/chroot-test/results.env
+
+      # Determine overall result
+      if [ "$PYTHON_MATCH" = "YES" ] && [ "$NODE_MATCH" = "YES" ] && [ "$GO_MATCH" = "YES" ]; then
+        echo "ALL_TESTS_PASSED=true" >> /tmp/gh-aw/chroot-test/results.env
+        echo "=== ALL CHROOT TESTS PASSED ==="
+      else
+        echo "ALL_TESTS_PASSED=false" >> /tmp/gh-aw/chroot-test/results.env
+        echo "=== SOME CHROOT TESTS FAILED ==="
+      fi
+  - name: Cleanup test containers
+    if: always()
+    run: |
+      ./scripts/ci/cleanup.sh || true
 ---
 
-# Verify Language Runtimes Match Host
-
-This smoke test validates that `--enable-chroot` provides transparent access to host binaries by comparing versions.
-
-## Step 1: Read Host Versions
+# Analyze Chroot Test Results
 
-First, read the host versions that were captured in the setup step:
+The chroot version comparison tests have already been executed in the setup steps. Your job is to analyze the results and report them.
 
-```bash
-cat /tmp/host-versions.env
-```
-
-## Step 2: Run Tests via AWF Chroot
+## Step 1: Read Test Results
 
-Run the same version commands through `awf --enable-chroot` and verify they match:
+Read the test results from the files created during setup:
 
 ```bash
-# Test Python version matches host
-sudo -E awf --enable-chroot --allow-domains localhost -- python3 --version
-
-# Test Node version matches host
-sudo -E awf --enable-chroot --allow-domains localhost -- node --version
-
-# Test Go version matches host
-sudo -E awf --enable-chroot --allow-domains localhost -- go version
+cat /tmp/gh-aw/chroot-test/host-versions.env
+cat /tmp/gh-aw/chroot-test/chroot-versions.env
+cat /tmp/gh-aw/chroot-test/results.env
 ```
 
-## Step 3: Verify Versions Match
+## Step 2: Create Summary Comment
 
-Compare the versions from chroot with the host versions from `/tmp/host-versions.env`.
+Based on the results, add a comment to the PR with a comparison table:
 
-Create a summary table showing:
 | Runtime | Host Version | Chroot Version | Match? |
 |---------|--------------|----------------|--------|
+| Python  | (from HOST_PY_NUM) | (from CHROOT_PY_NUM) | (PYTHON_MATCH) |
+| Node.js | (from HOST_NODE_NUM) | (from CHROOT_NODE_NUM) | (NODE_MATCH) |
+| Go      | (from HOST_GO_NUM) | (from CHROOT_GO_NUM) | (GO_MATCH) |
+
+## Step 3: Add Label if Passed
 
-If ALL versions match, the test passes. Add a comment to the PR with the comparison table.
+If ALL_TESTS_PASSED is true, add the `smoke-chroot` label to the PR.
 
-If all runtimes match, add the label `smoke-chroot`.
+Keep your comment brief and focused on the results.