diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 396998e..694409d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,21 +87,15 @@ jobs:
           git lfs install --local
           git lfs pull
 
-      # Isaac Sim 6.0.1 on nvcr.io requires authenticated pull; anonymous
-      # access that worked for 6.0.0-dev2 is denied for this tag.
-      - name: Log in to NGC
+      - name: Run E2E tests
+        # The GPU runners are shared. Use an empty job-temporary Docker config so
+        # stale credentials cannot override anonymous access to the public base image,
+        # and this job cannot modify the runner's persistent Docker login.
         env:
-          NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
+          DOCKER_CONFIG: ${{ runner.temp }}/isaac-autodata-docker
         run: |
-          if [ -z "${NGC_API_KEY}" ]; then
-            echo "NGC_API_KEY secret is empty; cannot pull nvcr.io/nvidia/isaac-sim"
-            exit 1
-          fi
-          # $oauthtoken is the literal NGC username.
-          echo "${NGC_API_KEY}" | docker login nvcr.io -u '$oauthtoken' --password-stdin
-
-      - name: Run E2E tests
-        run: ./scripts/ci/run_tests.sh
+          mkdir -p "${DOCKER_CONFIG}"
+          ./scripts/ci/run_tests.sh
 
   build_docs:
     name: Build docs
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index cd9040e..f652463 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -59,21 +59,15 @@ jobs:
           git lfs install --local
           git lfs pull
 
-      # Isaac Sim 6.0.1 on nvcr.io requires authenticated pull; anonymous
-      # access that worked for 6.0.0-dev2 is denied for this tag.
-      - name: Log in to NGC
+      - name: Run full E2E suite
+        # The GPU runners are shared. Use an empty job-temporary Docker config so
+        # stale credentials cannot override anonymous access to the public base image,
+        # and this job cannot modify the runner's persistent Docker login.
         env:
-          NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
+          DOCKER_CONFIG: ${{ runner.temp }}/isaac-autodata-docker
         run: |
-          if [ -z "${NGC_API_KEY}" ]; then
-            echo "NGC_API_KEY secret is empty; cannot pull nvcr.io/nvidia/isaac-sim"
-            exit 1
-          fi
-          # $oauthtoken is the literal NGC username.
-          echo "${NGC_API_KEY}" | docker login nvcr.io -u '$oauthtoken' --password-stdin
-
-      - name: Run full E2E suite
-        run: ./scripts/ci/run_tests.sh
+          mkdir -p "${DOCKER_CONFIG}"
+          ./scripts/ci/run_tests.sh
 
       - name: Test results summary
         if: always()
diff --git a/AGENTS.md b/AGENTS.md
index ccfc122..e27278c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -41,11 +41,3 @@ pre-commit run --all-files
 - Don't mutate the `isaac_autodata` conda env. No `pip install/uninstall`, `conda install/remove`, or version upgrades. If a dependency is missing, surface the exact command and let the user run it.
 - Don't re-run, modify, or work around `conda_installer.sh`. No env recreate/rename/delete, no channel or conda config changes. Installer issues get reported, not patched in-flight.
 - Don't change any existing design docs or diagrams in /docs, that is only for human created files. If you need to add any new diagrams or designs, add them to the /agentic_design directory.
-
-## Working on this codebase
-
-Dev work is phased and coordinated via `docs/agents/`. Before starting any task:
-
-1. Read `docs/agents/INDEX.md` — it names the active phase, sub-phase ownership, and reading order.
-2. Load the sub-phase doc for the work you're doing, plus any contracts it depends on.
-3. Any change that affects an interface signature or invariant must update its contract file in the same commit.
diff --git a/docker/Dockerfile.isaac_autodata b/docker/Dockerfile.isaac_autodata
index 8a31bcb..7cb05e6 100644
--- a/docker/Dockerfile.isaac_autodata
+++ b/docker/Dockerfile.isaac_autodata
@@ -11,6 +11,10 @@ ENV WORKDIR=${WORKDIR}
 WORKDIR "${WORKDIR}"
 
 ENV TERM=xterm
+# Tolerate transient package-index failures on shared CI runners. These settings
+# are inherited by every pip invocation, including those run by isaaclab.sh.
+ENV PIP_RETRIES=10 \
+    PIP_DEFAULT_TIMEOUT=120
 # Path to the (nested) Isaac Lab checkout inside the Arena submodule.
 ENV ISAACLAB_PATH=${WORKDIR}/submodules/IsaacLab-Arena/submodules/IsaacLab