diff --git a/.circleci/continue_config.yml b/.circleci/continue_config.yml
index 2bfc81344ac..3bec2b1d1e2 100644
--- a/.circleci/continue_config.yml
+++ b/.circleci/continue_config.yml
@@ -557,9 +557,13 @@ commands:
     parameters:
       prefix:
         type: string
+      triplet:
+        type: string
+      flavour:
+        type: string
     steps:
       - run:
-          name: Build Profiler NTS
+          name: Build Profiler << parameters.flavour >>
           command: |
             if [ -d '/opt/rh/devtoolset-7' ] ; then
                 set +eo pipefail
@@ -568,33 +572,17 @@ commands:
             fi
             set -u
             prefix="<< parameters.prefix >>"
+            triplet="<< parameters.triplet >>"
+            flavour="<< parameters.flavour >>"
             mkdir -vp "${prefix}"
-            command -v switch-php && switch-php "${PHP_VERSION}"
+            command -v switch-php && switch-php "${PHP_VERSION}${flavour}"
             cd profiling
             echo "${CARGO_TARGET_DIR}"
-            cargo build --release
+            touch build.rs # make sure `build.rs` gets executed after `switch-php` call
+            RUSTC_BOOTSTRAP=1 cargo rustc -p datadog-php-profiling --release --target "${triplet}" -Z build-std=panic_abort,core,std,alloc
             cd -
-            cp -v "${CARGO_TARGET_DIR}/release/libdatadog_php_profiling.so" "${prefix}/datadog-profiling.so"
-            objcopy --compress-debug-sections "${prefix}/datadog-profiling.so"
-      - run:
-          name: Build Profiler ZTS
-          command: |
-            if [ -d '/opt/rh/devtoolset-7' ] ; then
-                set +eo pipefail
-                source scl_source enable devtoolset-7
-                set -eo pipefail
-            fi
-            set -u
-            prefix="<< parameters.prefix >>"
-            mkdir -vp "${prefix}"
-            command -v switch-php && switch-php "${PHP_VERSION}-zts"
-            cd profiling
-            echo "${CARGO_TARGET_DIR}"
-            touch build.rs #make sure `build.rs` gets executed after `switch-php` call
-            cargo build --release
-            cd -
-            cp -v "${CARGO_TARGET_DIR}/release/libdatadog_php_profiling.so" "${prefix}/datadog-profiling-zts.so"
-            objcopy --compress-debug-sections "${prefix}/datadog-profiling-zts.so"
+            cp -v "${CARGO_TARGET_DIR}/${triplet}/release/libdatadog_php_profiling.so" "${prefix}/datadog-profiling${flavour}.so"
+            objcopy --compress-debug-sections "${prefix}/datadog-profiling${flavour}.so"
 
 executors:
   with_agent:
@@ -2853,6 +2841,12 @@ jobs:
       - <<: *STEP_APPEND_BUILD_ID
       - build_profiler:
           prefix: datadog-profiling/<< parameters.triplet >>/lib/php/<< parameters.abi_no >>
+          triplet: << parameters.triplet >>
+          flavour: ""
+      - build_profiler:
+          prefix: datadog-profiling/<< parameters.triplet >>/lib/php/<< parameters.abi_no >>
+          triplet: << parameters.triplet >>
+          flavour: "-zts"
       - persist_to_workspace:
           root: .
           paths:
diff --git a/.github/workflows/prof_asan.yml b/.github/workflows/prof_asan.yml
index 7df6c84aa15..319f2c740ea 100644
--- a/.github/workflows/prof_asan.yml
+++ b/.github/workflows/prof_asan.yml
@@ -40,7 +40,7 @@ jobs:
           export LDFLAGS='-fsanitize=address'
           export RUSTC_LINKER=lld-16
           triplet=$(uname -m)-unknown-linux-gnu
-          RUSTFLAGS='-Zsanitizer=address' cargo +nightly-2023-05-03 build -Zbuild-std --target $triplet --release
+          RUSTFLAGS='-Zsanitizer=address' cargo +nightly-2023-05-03 build -Zbuild-std="panic_abort,core,alloc,std" --target $triplet --release
           cp -v "$CARGO_TARGET_DIR/$triplet/release/libdatadog_php_profiling.so" "$(php-config --extension-dir)/datadog-profiling.so"
 
       - name: Cache build dependencies
diff --git a/.gitlab/ci-images.yml b/.gitlab/ci-images.yml
index c9585588f6e..cb1aecf0862 100644
--- a/.gitlab/ci-images.yml
+++ b/.gitlab/ci-images.yml
@@ -16,6 +16,11 @@ CentOS:
   tags: ["arch:amd64"]
   timeout: 1h
   image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:24.0.4-gbi-focal
+  variables:
+    KUBERNETES_CPU_REQUEST: 8
+    KUBERNETES_CPU_LIMIT: 8
+    KUBERNETES_MEMORY_LIMIT: 20Gi
+    KUBERNETES_MEMORY_REQUEST: 20Gi
   parallel:
     matrix:
       - PHP_VERSION:
@@ -67,6 +72,11 @@ Ubuntu Bookworm:
   tags: ["arch:amd64"]
   timeout: 1h
   image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:24.0.4-gbi-focal
+  variables:
+    KUBERNETES_CPU_REQUEST: 8
+    KUBERNETES_CPU_LIMIT: 8
+    KUBERNETES_MEMORY_LIMIT: 20Gi
+    KUBERNETES_MEMORY_REQUEST: 20Gi
   parallel:
     matrix:
       - PHP_VERSION:
@@ -95,6 +105,11 @@ Ubuntu Buster:
   tags: ["arch:amd64"]
   timeout: 1h
   image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:24.0.4-gbi-focal
+  variables:
+    KUBERNETES_CPU_REQUEST: 8
+    KUBERNETES_CPU_LIMIT: 8
+    KUBERNETES_MEMORY_LIMIT: 20Gi
+    KUBERNETES_MEMORY_REQUEST: 20Gi
   parallel:
     matrix:
       - PHP_VERSION:
diff --git a/Cargo.toml b/Cargo.toml
index abc2abc7744..6ce29f782f4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,13 +13,11 @@ license = "Apache-2.0"
 debug = 2 # full debug info
 
 [profile.release]
-debug = 1
-lto = "thin"
+codegen-units = 1
+debug = "line-tables-only"
 incremental = false
+lto = "fat"
+panic = "abort"
 
 [profile.tracer-release]
-debug = 1 # line tables only
-lto = true
-codegen-units = 1
-panic = "abort"
 inherits = "release"
diff --git a/dockerfiles/ci/alpine_compile_extension/Dockerfile b/dockerfiles/ci/alpine_compile_extension/Dockerfile
index ceafacaa825..9991aa9b95d 100644
--- a/dockerfiles/ci/alpine_compile_extension/Dockerfile
+++ b/dockerfiles/ci/alpine_compile_extension/Dockerfile
@@ -25,6 +25,7 @@ RUN set -eux; \
 RUN apk add --no-cache llvm16-libs clang16-dev lld llvm16
 RUN apk add --no-cache rust-stdlib
 RUN apk add --no-cache cargo
+RUN apk add --no-cache rust-src
 RUN apk add --no-cache clang git protoc unzip
 
 FROM base
diff --git a/dockerfiles/ci/bookworm/Dockerfile b/dockerfiles/ci/bookworm/Dockerfile
index a2513a66540..c0869794fc3 100644
--- a/dockerfiles/ci/bookworm/Dockerfile
+++ b/dockerfiles/ci/bookworm/Dockerfile
@@ -214,6 +214,9 @@ RUN set -eux; \
     chown -R circleci:circleci /opt;
 
 ARG RUST_VERSION="1.71.1"
+# rustup-init sha256sum can be found by appending .sha256 to the download url
+ARG RUST_SHA256_ARM="76cd420cb8a82e540025c5f97bda3c65ceb0b0661d5843e6ef177479813b0367"
+ARG RUST_SHA256_X86="a3d541a5484c8fa2f1c21478a6f6c505a778d473c21d60a18a4df5185d320ef8"
 # Nightly version which kinda matches v1.71.1
 ARG RUST_NIGHTLY_VERSION="-2023-05-03"
 # Mount a cache into /rust/cargo if you want to pre-fetch packages or something
@@ -221,13 +224,23 @@ ENV CARGO_HOME=/rust/cargo
 ENV RUSTUP_HOME=/rust/rustup
 RUN mkdir -p -v "${CARGO_HOME}" "${RUSTUP_HOME}" \
     && chmod -R 777 "${CARGO_HOME}" "${RUSTUP_HOME}" \
+    && RUSTUP_VERSION="1.27.0" \
     && MARCH=$(uname -m) \
-    && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain $RUST_VERSION -c "rustc,cargo,clippy-preview,rustfmt-preview,rust-std" \
+    && triplet="$MARCH-unknown-linux-gnu" \
+    && RUST_SHA256=$(if [ "$MARCH" = "x86_64" ]; then echo ${RUST_SHA256_X86}; \
+      elif [ "$MARCH" = "aarch64" ]; then echo ${RUST_SHA256_ARM}; fi) \
+    && curl -L --write-out '%{http_code}' -O https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${triplet}/rustup-init \
+    && printf '%s  rustup-init' "$RUST_SHA256" | sha256sum --check --status \
+    && printf '%s  rustup-init' "$RUST_SHA256" | sha256sum --check --status \
+    && chmod +x "rustup-init" \
+    && ./rustup-init -y --default-toolchain "$RUST_VERSION" -c "rustc,cargo,clippy,rustfmt,rust-std,rust-src" \
+    && rm -fr "rustup-init" \
     && export PATH="/rust/cargo/bin:$PATH" \
     && rustup install nightly${RUST_NIGHTLY_VERSION} \
     && rustup component add rust-src --toolchain nightly${RUST_NIGHTLY_VERSION}-$MARCH-unknown-linux-gnu
 
-ENV PATH="/rust/cargo/bin:${PATH}"
+# Install Rust toolchains for CircleCI user too
+RUN echo ". ${CARGO_HOME?}/env" | tee -a /home/circleci/.bashrc
 
 # Add the wait script to the image: note SHA 672a28f0509433e3b4b9bcd4d9cd7668cea7e31a has been reviewed and should not
 # be changed without an appropriate code review.
diff --git a/dockerfiles/ci/buster/Dockerfile b/dockerfiles/ci/buster/Dockerfile
index 9c70530fa49..5796979e96e 100644
--- a/dockerfiles/ci/buster/Dockerfile
+++ b/dockerfiles/ci/buster/Dockerfile
@@ -260,28 +260,29 @@ RUN set -eux; \
     mkdir -p $PHP_INSTALL_DIR; \
     chown -R circleci:circleci /opt;
 
-# rust sha256sum generated locally after verifying it with sha256
+# rustup-init sha256sum can be found by appending .sha256 to the download url
 ARG RUST_VERSION="1.71.1"
-ARG RUST_SHA256_ARM="c7cf230c740a62ea1ca6a4304d955c286aea44e3c6fc960b986a8c2eeea4ec3f"
-ARG RUST_SHA256_X86="34778d1cda674990dfc0537bc600066046ae9cb5d65a07809f7e7da31d4689c4"
+ARG RUST_SHA256_ARM="76cd420cb8a82e540025c5f97bda3c65ceb0b0661d5843e6ef177479813b0367"
+ARG RUST_SHA256_X86="a3d541a5484c8fa2f1c21478a6f6c505a778d473c21d60a18a4df5185d320ef8"
 # Mount a cache into /rust/cargo if you want to pre-fetch packages or something
 ENV CARGO_HOME=/rust/cargo
 ENV RUSTUP_HOME=/rust/rustup
 RUN mkdir -p -v "${CARGO_HOME}" "${RUSTUP_HOME}" \
     && chmod -R 777 "${CARGO_HOME}" "${RUSTUP_HOME}" \
+    && RUSTUP_VERSION="1.27.0" \
     && MARCH=$(uname -m) \
-    && RUST_SHA256=$(if [ "$MARCH" = "x86_64" ]; then echo ${RUST_SHA256_X86}; elif [ "$MARCH" = "aarch64" ]; then echo ${RUST_SHA256_ARM}; fi) \
-    && FILENAME=rust-${RUST_VERSION}-${MARCH}-unknown-linux-gnu.tar.gz \
-    && curl -L --write-out '%{http_code}' -O https://static.rust-lang.org/dist/${FILENAME} \
-    && printf '%s  %s' "$RUST_SHA256" "$FILENAME" | sha256sum --check --status \
-    && tar -xf "$FILENAME" \
-    && cd ${FILENAME%.tar.gz} \
-    && ./install.sh --components="rustc,cargo,clippy-preview,rustfmt-preview,rust-std-${MARCH}-unknown-linux-gnu" \
-    && cd - \
-    && rm -fr "$FILENAME" "${FILENAME%.tar.gz}" \
+    && triplet="$MARCH-unknown-linux-gnu" \
+    && RUST_SHA256=$(if [ "$MARCH" = "x86_64" ]; then echo ${RUST_SHA256_X86}; \
+      elif [ "$MARCH" = "aarch64" ]; then echo ${RUST_SHA256_ARM}; fi) \
+    && curl -L --write-out '%{http_code}' -O https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${triplet}/rustup-init \
+    && printf '%s  rustup-init' "$RUST_SHA256" | sha256sum --check --status \
+    && chmod +x "rustup-init" \
+    && ./rustup-init -y --default-toolchain "$RUST_VERSION" -c "rustc,cargo,clippy,rustfmt,rust-std,rust-src" \
+    && rm -fr "rustup-init" \
     && rm -rfv /tmp/*
 
-ENV PATH="/rust/cargo/bin:${PATH}"
+# Install Rust toolchains for CircleCI user too
+RUN echo ". ${CARGO_HOME?}/env" | tee -a /home/circleci/.bashrc
 
 ARG GO_VERSION="1.22.1"
 ARG GO_SHA256_ARM="e56685a245b6a0c592fc4a55f0b7803af5b3f827aaa29feab1f40e491acf35b8"
diff --git a/dockerfiles/ci/centos/7/base.Dockerfile b/dockerfiles/ci/centos/7/base.Dockerfile
index 8c3c8fd641c..07d5008f02c 100644
--- a/dockerfiles/ci/centos/7/base.Dockerfile
+++ b/dockerfiles/ci/centos/7/base.Dockerfile
@@ -85,14 +85,22 @@ RUN source scl_source enable devtoolset-7; set -eux; \
     ../configure && make -j $(nproc) && make install; \
     cd - && rm -fr build
 
-# Required: CMake >= 3.0.2 (default version is 2.8.12.2)
+# Required: CMake >= 3.0.2 (default version is 2.8.12.2).
+# LLVM warns about wanting 3.20 or newer.
 # Required to build libzip from source (has to be a separate RUN layer)
 RUN source scl_source enable devtoolset-7; set -eux; \
-    /root/download-src.sh cmake https://github.com/Kitware/CMake/releases/download/v3.18.4/cmake-3.18.4.tar.gz; \
-    cd "${SRC_DIR}/cmake"; \
-    mkdir -v 'build' && cd 'build'; \
-    ../bootstrap && make -j $(nproc) && make install; \
-    cd - && rm -fr build
+    version="3.24.4"; \
+    arch=$(uname -m); \
+    filename="cmake-${version}-linux-$arch.tar.gz"; \
+    sha256_x86_64="cac77d28fb8668c179ac02c283b058aeb846fe2133a57d40b503711281ed9f19"; \
+    sha256_aarch64="86f823f2636bf715af89da10e04daa476755a799d451baee66247846e95d7bee"; \
+    sha256=$(if [[ $arch == "x86_64" ]]; then echo ${sha256_x86_64}; \
+     elif [[ $arch == "aarch64" ]]; then echo ${sha256_aarch64}; fi); \
+    curl -OL https://github.com/Kitware/CMake/releases/download/v${version}/${filename}; \
+    echo "$sha256  cmake-${version}-linux-$arch.tar.gz" | sha256sum -c; \
+    tar -xf "../${filename}" -C /usr/local --strip-components=1; \
+    command -v cmake; \
+    rm -fv "${filename}"
 
 # Required: libzip >= 0.11 (default version is 0.9)
 RUN source scl_source enable devtoolset-7; set -eux; \
@@ -103,6 +111,7 @@ RUN source scl_source enable devtoolset-7; set -eux; \
 
 ENV PKG_CONFIG_PATH="${PKG_CONFIG_PATH}:/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig"
 
+# LLVM, and Ninja to build LLVM
 # Caution, takes a very long time! Since we have to build one from source,
 # I picked LLVM 16, which matches Rust 1.71.
 # Ordinarily we leave sources, but LLVM is 2GiB just for the sources...
@@ -111,8 +120,8 @@ ENV PKG_CONFIG_PATH="${PKG_CONFIG_PATH}:/usr/local/lib/pkgconfig:/usr/local/lib6
 # version.
 RUN source scl_source enable devtoolset-7 \
   && yum install -y python3 \
-  && /root/download-src.sh ninja https://github.com/ninja-build/ninja/archive/refs/tags/v1.11.0.tar.gz \
-  && mkdir -vp "${SRC_DIR}/ninja/build" \
+  && /root/download-src.sh ninja https://github.com/ninja-build/ninja/archive/refs/tags/v1.12.0.tar.gz \
+  && mkdir vp "${SRC_DIR}/ninja/build" \
   && cd "${SRC_DIR}/ninja/build" \
   && ../configure.py --bootstrap --verbose \
   && strip ninja \
@@ -131,46 +140,26 @@ RUN source scl_source enable devtoolset-7 \
   && yum remove -y python3 \
   && yum clean all
 
-ARG PROTOBUF_VERSION="3.19.4"
-ARG PROTOBUF_SHA256="89ac31a93832e204db6d73b1e80f39f142d5747b290f17340adce5be5b122f94"
-RUN source scl_source enable devtoolset-7 \
-  && FILENAME=protobuf-cpp-${PROTOBUF_VERSION}.tar.gz \
-  && cd /usr/local/src \
-  && curl -L -O "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_VERSION}/${FILENAME}" \
-  && tar --no-same-owner -xf "$FILENAME" \
-  && cd protobuf-${PROTOBUF_VERSION} \
-  && ./configure \
-    --prefix=/usr/local \
-    --libdir=/usr/local/lib64 \
-    --with-pic \
-    --disable-shared \
-    --enable-static \
-  && make -j $(nproc) \
-  && make install \
-  && cd - \
-  && rm -fr "$FILENAME" "${FILENAME%.tar.gz}" "protobuf-${PROTOBUF_VERSION}"
-
-# rust sha256sum generated locally after verifying it with sha256
+# rustup-init sha256sum can be found by appending .sha256 to the download url
 ARG RUST_VERSION="1.71.1"
-ARG RUST_SHA256_ARM="c7cf230c740a62ea1ca6a4304d955c286aea44e3c6fc960b986a8c2eeea4ec3f"
-ARG RUST_SHA256_X86="34778d1cda674990dfc0537bc600066046ae9cb5d65a07809f7e7da31d4689c4"
+ARG RUST_SHA256_ARM="76cd420cb8a82e540025c5f97bda3c65ceb0b0661d5843e6ef177479813b0367"
+ARG RUST_SHA256_X86="a3d541a5484c8fa2f1c21478a6f6c505a778d473c21d60a18a4df5185d320ef8"
 # Mount a cache into /rust/cargo if you want to pre-fetch packages or something
 ENV CARGO_HOME=/rust/cargo
 ENV RUSTUP_HOME=/rust/rustup
 RUN source scl_source enable devtoolset-7 \
     && mkdir -p -v "${CARGO_HOME}" "${RUSTUP_HOME}" \
     && chown -R 777 "${CARGO_HOME}" "${RUSTUP_HOME}" \
+    && RUSTUP_VERSION="1.27.0" \
     && MARCH=$(uname -m) \
-    && if [[ $MARCH == "x86_64" ]]; then RUST_SHA256=${RUST_SHA256_X86};\
-     elif [[ $MARCH == "aarch64" ]];then RUST_SHA256=${RUST_SHA256_ARM}; fi && \
-    FILENAME=rust-${RUST_VERSION}-${MARCH}-unknown-linux-gnu.tar.gz && \
-    curl -L --write-out '%{http_code}' -O https://static.rust-lang.org/dist/${FILENAME} && \
-    printf '%s  %s' "$RUST_SHA256" "$FILENAME" | sha256sum --check --status && \
-    tar -xf "$FILENAME" \
-    && cd ${FILENAME%.tar.gz} \
-    && ./install.sh --components="rustc,cargo,clippy-preview,rustfmt-preview,rust-std-${MARCH}-unknown-linux-gnu" \
-    && cd - \
-    && rm -fr "$FILENAME" "${FILENAME%.tar.gz}"
+    && triplet="$MARCH-unknown-linux-gnu" \
+    && RUST_SHA256=$(if [[ $MARCH == "x86_64" ]]; then echo ${RUST_SHA256_X86}; \
+     elif [[ $MARCH == "aarch64" ]]; then echo ${RUST_SHA256_ARM}; fi) \
+    && curl -L --write-out '%{http_code}' -O https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${triplet}/rustup-init \
+    && printf '%s  rustup-init' "$RUST_SHA256" | sha256sum --check --status \
+    && chmod +x "rustup-init" \
+    && ./rustup-init -y --default-toolchain "$RUST_VERSION" -c "rustc,cargo,clippy,rustfmt,rust-std,rust-src" \
+    && rm -fr "rustup-init"
 
 # now install PHP specific dependencies
 RUN set -eux; \