diff --git a/.dockerignore b/.dockerignore
index 9a9bc82b871..7618fef973e 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -17,11 +17,6 @@
 # Re-allow paths the dogfood Dockerfile.base files consume.
 !dogfood
 !dogfood/coder
-!dogfood/coder/ubuntu-22.04
-!dogfood/coder/ubuntu-22.04/Dockerfile.base
-!dogfood/coder/ubuntu-22.04/configure-chrome-flags.sh
-!dogfood/coder/ubuntu-22.04/files
-!dogfood/coder/ubuntu-22.04/files/**
 !dogfood/coder/ubuntu-26.04
 !dogfood/coder/ubuntu-26.04/Dockerfile.base
 !dogfood/coder/ubuntu-26.04/files
diff --git a/.github/workflows/dogfood.yaml b/.github/workflows/dogfood.yaml
index d469ff80fa2..e2839bbe8e3 100644
--- a/.github/workflows/dogfood.yaml
+++ b/.github/workflows/dogfood.yaml
@@ -58,7 +58,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        image-version: ["22.04", "26.04"]
+        image-version: ["26.04"]
 
     if: github.actor != 'dependabot[bot]' # Skip Dependabot PRs
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
@@ -206,26 +206,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./scripts/dogfood_test_image.sh "dogfood-test:${{ matrix.image-version }}"
 
-      - name: Push final Ubuntu 22.04 image
-        if: matrix.image-version == '22.04' && github.ref == 'refs/heads/main'
-        env:
-          FINAL_SHA: ${{ steps.shas.outputs.final_sha }}
-          DOCKER_TAG: ${{ steps.docker-tag-name.outputs.tag }}
-        # --image-dir points at the OCI layout written by the previous
-        # `mise oci build` step. Without it, `mise oci push` rebuilds
-        # from mise.toml and forgets the --from base. --tool crane
-        # forces the registry client mise oci shells out to, so we
-        # don't drift between the apt-shipped skopeo on whatever runner
-        # image we land on.
-        # TODO: move the `latest` tag to 26.04 soon. we don't want to
-        # transition it immediately because that would make workspaces
-        # switch to it automatically without any grace period.
-        run: |
-          set -euo pipefail
-          for tag in "${FINAL_SHA}-22.04" "$DOCKER_TAG" 22.04 latest; do
-            mise oci push --tool crane --image-dir ./mise-oci "codercom/oss-dogfood:$tag"
-          done
-
       - name: Push final Ubuntu 26.04 image
         if: matrix.image-version == '26.04' && github.ref == 'refs/heads/main'
         env:
@@ -233,7 +213,7 @@ jobs:
           DOCKER_TAG: ${{ steps.docker-tag-name.outputs.tag }}
         run: |
           set -euo pipefail
-          for tag in "${FINAL_SHA}-26.04" "$DOCKER_TAG" 26.04; do
+          for tag in "${FINAL_SHA}-26.04" "$DOCKER_TAG" 26.04 latest; do
             mise oci push --tool crane --image-dir ./mise-oci "codercom/oss-dogfood:$tag"
           done
 
@@ -248,7 +228,7 @@ jobs:
           save: true
           push: ${{ github.ref == 'refs/heads/main' }}
           tags: "codercom/oss-dogfood-vscode-coder:${{ steps.docker-tag-name.outputs.tag }},codercom/oss-dogfood-vscode-coder:latest"
-        if: matrix.image-version == '22.04'
+        if: matrix.image-version == '26.04'
 
   deploy_template:
     needs: build_image
diff --git a/cli/configssh.go b/cli/configssh.go
index f618418e5d3..db344ed6c2a 100644
--- a/cli/configssh.go
+++ b/cli/configssh.go
@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"net/http"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -456,15 +455,7 @@ func (r *RootCmd) configSSH() *serpent.Command {
 
 			coderdConfig, err := client.SSHConfiguration(ctx)
 			if err != nil {
-				// If the error is 404, this deployment does not support
-				// this endpoint yet. Do not error, just assume defaults.
-				// TODO: Remove this in 2 months (May 31, 2023). Just return the error
-				// 	and remove this 404 check.
-				var sdkErr *codersdk.Error
-				if !xerrors.As(err, &sdkErr) || sdkErr.StatusCode() != http.StatusNotFound {
-					return xerrors.Errorf("fetch coderd config failed: %w", err)
-				}
-				coderdConfig.HostnamePrefix = "coder."
+				return xerrors.Errorf("fetch coderd config failed: %w", err)
 			}
 
 			configOptions, err := mergeSSHOptions(sshConfigOpts, coderdConfig, string(root), coderBinary)
diff --git a/coderd/httpmw/organizationparam.go b/coderd/httpmw/organizationparam.go
index 349ffe25e6c..089188b9c91 100644
--- a/coderd/httpmw/organizationparam.go
+++ b/coderd/httpmw/organizationparam.go
@@ -66,16 +66,9 @@ func ExtractOrganizationParam(db database.Store) func(http.Handler) http.Handler
 			var organization database.Organization
 			var dbErr error
 
-			// If the name is exactly "default", then we fetch the default
-			// organization. This is a special case to make it easier
-			// for single org deployments.
-			//
-			// arg == uuid.Nil.String() should be a temporary workaround for
-			// legacy provisioners that don't provide an organization ID.
-			// This prevents a breaking change.
-			// TODO: This change was added March 2024. Nil uuid returning the
-			// 		default org should be removed some number of months after
-			//		that date.
+			// If the name is exactly "default" or the nil UUID, then we fetch
+			// the default organization. This is a special case to make it
+			// easier for single org deployments.
 			if arg == codersdk.DefaultOrganization || arg == uuid.Nil.String() {
 				organization, dbErr = db.GetDefaultOrganization(ctx)
 			} else {
diff --git a/coderd/httpmw/organizationparam_test.go b/coderd/httpmw/organizationparam_test.go
index 5ebbc429e15..3d12e805847 100644
--- a/coderd/httpmw/organizationparam_test.go
+++ b/coderd/httpmw/organizationparam_test.go
@@ -228,10 +228,7 @@ func TestOrganizationParam(t *testing.T) {
 		defer res.Body.Close()
 		require.Equal(t, http.StatusOK, res.StatusCode, "by default keyword")
 
-		// Try by legacy
-		// TODO: This can be removed when legacy nil uuids are no longer supported.
-		//		 This is a temporary measure to ensure as legacy provisioners use
-		//		 nil uuids as the org id and expect the default org.
+		// Try by nil uuid, which resolves to the default org.
 		chi.RouteContext(r.Context()).URLParams.Add("organization", uuid.Nil.String())
 		chi.RouteContext(r.Context()).URLParams.Add("user", user.ID.String())
 		rtr.ServeHTTP(rw, r)
diff --git a/coderd/wsbuilder/wsbuilder.go b/coderd/wsbuilder/wsbuilder.go
index 45071f0ccbe..16cac866d69 100644
--- a/coderd/wsbuilder/wsbuilder.go
+++ b/coderd/wsbuilder/wsbuilder.go
@@ -1394,9 +1394,5 @@ func (b *Builder) usingDynamicParameters() bool {
 	if err != nil {
 		return false // Let another part of the code get this error
 	}
-	if tpl.UseClassicParameterFlow {
-		return false
-	}
-
-	return true
+	return !tpl.UseClassicParameterFlow
 }
diff --git a/codersdk/users.go b/codersdk/users.go
index c784c13e8c9..98925146c89 100644
--- a/codersdk/users.go
+++ b/codersdk/users.go
@@ -2,7 +2,6 @@ package codersdk
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"net/http"
 	"strconv"
@@ -165,26 +164,7 @@ type CreateFirstUserResponse struct {
 	OrganizationID uuid.UUID `json:"organization_id" format:"uuid"`
 }
 
-// CreateUserRequest
-// Deprecated: Use CreateUserRequestWithOrgs instead. This will be removed.
-// TODO: When removing, we should rename CreateUserRequestWithOrgs -> CreateUserRequest
-// Then alias CreateUserRequestWithOrgs to CreateUserRequest.
-// @typescript-ignore CreateUserRequest
 type CreateUserRequest struct {
-	Email    string `json:"email" validate:"required,email" format:"email"`
-	Username string `json:"username" validate:"required,username"`
-	Name     string `json:"name" validate:"user_real_name"`
-	Password string `json:"password"`
-	// UserLoginType defaults to LoginTypePassword.
-	UserLoginType LoginType `json:"login_type"`
-	// DisableLogin sets the user's login type to 'none'. This prevents the user
-	// from being able to use a password or any other authentication method to login.
-	// Deprecated: Set UserLoginType=LoginTypeDisabled instead.
-	DisableLogin   bool      `json:"disable_login"`
-	OrganizationID uuid.UUID `json:"organization_id" validate:"" format:"uuid"`
-}
-
-type CreateUserRequestWithOrgs struct {
 	Email    string `json:"email" validate:"required_unless=ServiceAccount true,omitempty,email" format:"email"`
 	Username string `json:"username" validate:"required,username"`
 	Name     string `json:"name" validate:"user_real_name"`
@@ -201,33 +181,7 @@ type CreateUserRequestWithOrgs struct {
 	Roles []string `json:"roles,omitempty"`
 }
 
-// UnmarshalJSON implements the unmarshal for the legacy param "organization_id".
-// To accommodate multiple organizations, the field has been switched to a slice.
-// The previous field will just be appended to the slice.
-// Note in the previous behavior, omitting the field would result in the
-// default org being applied, but that is no longer the case.
-// TODO: Remove this method in it's entirety after some period of time.
-// This will be released in v1.16.0, and is associated with the multiple orgs
-// feature.
-func (r *CreateUserRequestWithOrgs) UnmarshalJSON(data []byte) error {
-	// By using a type alias, we prevent an infinite recursion when unmarshalling.
-	// This allows us to use the default unmarshal behavior of the original type.
-	type AliasedReq CreateUserRequestWithOrgs
-	type DeprecatedCreateUserRequest struct {
-		AliasedReq
-		OrganizationID *uuid.UUID `json:"organization_id" format:"uuid"`
-	}
-	var dep DeprecatedCreateUserRequest
-	err := json.Unmarshal(data, &dep)
-	if err != nil {
-		return err
-	}
-	*r = CreateUserRequestWithOrgs(dep.AliasedReq)
-	if dep.OrganizationID != nil {
-		r.OrganizationIDs = append(r.OrganizationIDs, *dep.OrganizationID)
-	}
-	return nil
-}
+type CreateUserRequestWithOrgs = CreateUserRequest
 
 type UpdateUserProfileRequest struct {
 	Username string `json:"username" validate:"required,username"`
diff --git a/dogfood/coder/ubuntu-22.04/Dockerfile.base b/dogfood/coder/ubuntu-22.04/Dockerfile.base
deleted file mode 100644
index 7485167548d..00000000000
--- a/dogfood/coder/ubuntu-22.04/Dockerfile.base
+++ /dev/null
@@ -1,266 +0,0 @@
-FROM ubuntu:jammy@sha256:eb29ed27b0821dca09c2e28b39135e185fc1302036427d5f4d70a41ce8fd7659
-
-SHELL ["/bin/bash", "-c"]
-
-# Install packages from apt repositories
-ARG DEBIAN_FRONTEND="noninteractive"
-
-# Updated certificates are necessary to use the teraswitch mirror.
-# This must be ran before copying in configuration since the config replaces
-# the default mirror with teraswitch.
-# Also enable the en_US.UTF-8 locale so that we don't generate multiple locales
-# and unminimize to include man pages.
-RUN apt-get update && \
-	apt-get install --yes ca-certificates locales && \
-	echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen && \
-	locale-gen && \
-	yes | unminimize
-
-COPY dogfood/coder/ubuntu-22.04/files /
-
-# We used to copy /etc/sudoers.d/* in from files/ but this causes issues with
-# permissions and layer caching. Instead, create the file directly.
-RUN mkdir -p /etc/sudoers.d && \
-	echo 'coder ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/nopasswd && \
-	chmod 750 /etc/sudoers.d/ && \
-	chmod 640 /etc/sudoers.d/nopasswd
-
-# Use more reliable mirrors for Ubuntu packages
-RUN sed -i 's|http://archive.ubuntu.com/ubuntu/|http://mirrors.edge.kernel.org/ubuntu/|g' /etc/apt/sources.list && \
-	sed -i 's|http://security.ubuntu.com/ubuntu/|http://mirrors.edge.kernel.org/ubuntu/|g' /etc/apt/sources.list && \
-	apt-get update --quiet && apt-get install --yes \
-	ansible \
-	apt-transport-https \
-	apt-utils \
-	asciinema \
-	bash \
-	bash-completion \
-	bat \
-	bats \
-	bind9-dnsutils \
-	bison \
-	build-essential \
-	ca-certificates \
-	containerd.io \
-	curl \
-	docker-ce \
-	docker-ce-cli \
-	docker-compose-plugin \
-	exa \
-	fd-find \
-	file \
-	fish \
-	flex \
-	gettext-base \
-	git \
-	gnupg \
-	google-cloud-sdk \
-	helix \
-	htop \
-	httpie \
-	inetutils-tools \
-	iproute2 \
-	iputils-ping \
-	iputils-tracepath \
-	jq \
-	kubectl \
-	language-pack-en \
-	less \
-	libgbm-dev \
-	libicu-dev \
-	libreadline-dev \
-	libssl-dev \
-	libx11-xcb1 \
-	lsb-release \
-	lsof \
-	man \
-	meld \
-	ncdu \
-	neovim \
-	net-tools \
-	openjdk-11-jdk-headless \
-	openssh-server \
-	openssl \
-	pkg-config \
-	procps \
-	postgresql-16 \
-	python3 \
-	python3-pip \
-	ripgrep \
-	rsync \
-	screen \
-	shellcheck \
-	strace \
-	sudo \
-	tcptraceroute \
-	termshark \
-	tmux \
-	traceroute \
-	unzip \
-	uuid-dev \
-	vim \
-	wget \
-	xauth \
-	zip \
-	zlib1g-dev \
-	zsh \
-	zstd && \
-	# Delete package cache to avoid consuming space in layer
-	apt-get clean
-
-# Install Google Chrome directly from Google. Ubuntu 22.04 ships
-# chromium-browser as a snap-only package, which does not work in
-# Docker containers.
-# configure-chrome-flags.sh is automatically run after dpkg operations
-# by dogfood/coder/files/etc/apt/apt.conf.d/99-chrome-flags.
-COPY dogfood/coder/ubuntu-22.04/configure-chrome-flags.sh /usr/local/bin/configure-chrome-flags.sh
-RUN chmod a+x /usr/local/bin/configure-chrome-flags.sh && \
-	wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb && \
-	apt-get install --yes ./google-chrome-stable_current_amd64.deb && \
-	rm google-chrome-stable_current_amd64.deb
-
-# Install Rust via rustup. Using rustup ensures we get a current stable
-# toolchain.
-ENV RUSTUP_HOME=/usr/local/rustup \
-	CARGO_HOME=/usr/local/cargo
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
-	sh -s -- -y --default-toolchain stable --profile default -c rust-src
-ENV PATH=$CARGO_HOME/bin:$PATH
-
-# Install the docker buildx component.
-RUN DOCKER_BUILDX_VERSION=$(curl -s "https://api.github.com/repos/docker/buildx/releases/latest" | grep '"tag_name":' |  sed -E 's/.*"(v[^"]+)".*/\1/') && \
-	mkdir -p /usr/local/lib/docker/cli-plugins && \
-	curl -Lo /usr/local/lib/docker/cli-plugins/docker-buildx "https://github.com/docker/buildx/releases/download/${DOCKER_BUILDX_VERSION}/buildx-${DOCKER_BUILDX_VERSION}.linux-amd64" && \
-	chmod a+x /usr/local/lib/docker/cli-plugins/docker-buildx
-
-# GitHub CLI to /usr/bin/gh. The wrapper at files/usr/local/bin/gh
-# execs this for coder external-auth fallback. Apt repo is unreliable:
-# https://github.com/cli/cli/issues/6175#issuecomment-1235984381
-RUN GH_CLI_VERSION=$(curl -s "https://api.github.com/repos/cli/cli/releases/latest" | grep '"tag_name":' |  sed -E 's/.*"v([^"]+)".*/\1/') && \
-	curl -L https://github.com/cli/cli/releases/download/v${GH_CLI_VERSION}/gh_${GH_CLI_VERSION}_linux_amd64.deb -o gh.deb && \
-	dpkg -i gh.deb && \
-	rm gh.deb
-
-# Ensure PostgreSQL binaries are in the users $PATH.
-RUN update-alternatives --install /usr/local/bin/initdb initdb /usr/lib/postgresql/16/bin/initdb 100 && \
-	update-alternatives --install /usr/local/bin/postgres postgres /usr/lib/postgresql/16/bin/postgres 100
-
-# Create links for injected dependencies
-RUN ln --symbolic /var/tmp/coder/coder-cli/coder /usr/local/bin/coder && \
-	ln --symbolic /var/tmp/coder/code-server/bin/code-server /usr/local/bin/code-server
-
-# Disable the PostgreSQL systemd service.
-# Coder uses a custom timescale container to test the database instead.
-RUN systemctl disable \
-	postgresql
-
-# Configure systemd services for CVMs
-RUN systemctl enable \
-	docker \
-	ssh && \
-	# Workaround for envbuilder cache probing not working unless the filesystem is modified.
-	touch /tmp/.envbuilder-systemctl-enable-docker-ssh-workaround
-
-# Add coder user and allow use of docker/sudo
-RUN useradd coder \
-	--create-home \
-	--shell=/bin/bash \
-	--groups=docker \
-	--uid=1000 \
-	--user-group
-
-# Install mise. Binary at /opt/mise/bin so it survives the home
-# volume mount; data dir under ~/.local/share/mise so installs ride
-# along on the per-workspace home volume, matching Homebrew's pattern
-# (see /home/linuxbrew volume in main.tf).
-ARG MISE_VERSION=v2026.5.12 \
-	MISE_SHA256=a238972a3162d710b85b28c324372e96ca4e4b486c81fe78695000d9fbc77c48 \
-	MISE_INSTALL_DIR=/opt/mise/bin \
-	HOMEBREW_INSTALL_COMMIT=540da2ca91271886910572df3a50332540ca84e4 \
-	HOMEBREW_INSTALL_SHA256=dfd5145fe2aa5956a600e35848765273f5798ce6def01bd08ecec088a1268d91
-RUN install --directory --owner=coder --group=coder --mode=0755 "${MISE_INSTALL_DIR}" && \
-	curl --silent --show-error --location --fail \
-		"https://github.com/jdx/mise/releases/download/${MISE_VERSION}/mise-${MISE_VERSION}-linux-x64" \
-		--output "${MISE_INSTALL_DIR}/mise" && \
-	echo "${MISE_SHA256}  ${MISE_INSTALL_DIR}/mise" | sha256sum -c && \
-	chown coder:coder "${MISE_INSTALL_DIR}/mise" && \
-	chmod 0755 "${MISE_INSTALL_DIR}/mise" && \
-	ln --symbolic "${MISE_INSTALL_DIR}/mise" /usr/local/bin/mise && \
-	test -x /usr/local/bin/mise && \
-	sudo --login --user=coder /bin/bash -lc 'set -euo pipefail && mise_bin="$(readlink --canonicalize /usr/local/bin/mise)" && test -w "$(dirname "$mise_bin")" && /usr/local/bin/mise --version && /usr/local/bin/mise self-update --help >/dev/null && /usr/local/bin/mise upgrade --help >/dev/null'
-
-ENV MISE_DATA_DIR=/home/coder/.local/share/mise
-
-# Bake a system fallback for trusted_config_paths so the canonical
-# /home/coder/coder repo and the mise-oci-synthesized /etc/mise/config.toml
-# are trusted without a per-config prompt. The workspace template
-# (dogfood/coder/main.tf install-deps coder_script) seeds a matching
-# user-owned ~/.config/mise/conf.d/00-coder-trust.toml on workspace
-# start, which the user can edit to add their own paths; that file
-# lives on the persistent home volume and overrides this fallback.
-RUN install --directory --mode=0755 /etc/mise /etc/mise/conf.d
-COPY --chmod=0644 <<'EOF' /etc/mise/conf.d/00-coder-trust.toml
-[settings]
-trusted_config_paths = [
-  "/home/coder/coder",
-  "/etc/mise",
-]
-EOF
-
-# Reserve the mount_point declared in mise.toml [oci]. The path is
-# duplicated below in MISE_SHARED_INSTALL_DIRS and PATH; if it ever
-# changes, update all three plus mise.toml. Ownership of /opt/mise
-# and /opt/mise/data is reasserted at workspace start by the
-# install-deps coder_script in dogfood/coder/main.tf: `mise oci
-# build` emits deterministic tar layers with hardcoded uid=0/gid=0
-# (see src/oci/layer.rs), so the final image always overwrites
-# whatever ownership we set here.
-RUN install --directory --owner=coder --group=coder --mode=0755 /opt/mise /opt/mise/data
-
-# Install Homebrew as the coder user so the supported Linux prefix remains
-# writable after the image build.
-RUN sudo --login --user=coder env \
-		NONINTERACTIVE=1 \
-		CI=1 \
-		HOMEBREW_INSTALL_COMMIT=${HOMEBREW_INSTALL_COMMIT} \
-		HOMEBREW_INSTALL_SHA256=${HOMEBREW_INSTALL_SHA256} \
-		/bin/bash -lc 'set -euo pipefail && installer="$(mktemp)" && trap '"'"'rm -f "${installer}"'"'"' EXIT && curl --silent --show-error --location --fail "https://raw.githubusercontent.com/Homebrew/install/${HOMEBREW_INSTALL_COMMIT}/install.sh" --output "${installer}" && echo "${HOMEBREW_INSTALL_SHA256}  ${installer}" | sha256sum -c && /bin/bash "${installer}"' && \
-	test -x /home/linuxbrew/.linuxbrew/bin/brew && \
-	sudo --login --user=coder /bin/bash -lc '/home/linuxbrew/.linuxbrew/bin/brew --version'
-
-# Adjust OpenSSH config and drop the apt lists / cache that survived
-# the package installs above. No later step in this image needs apt.
-RUN echo "PermitUserEnvironment yes" >>/etc/ssh/sshd_config && \
-	echo "X11Forwarding yes" >>/etc/ssh/sshd_config && \
-	echo "X11UseLocalhost no" >>/etc/ssh/sshd_config && \
-	apt-get clean && rm -rf /var/lib/apt/lists/*
-
-USER coder
-
-# mise shims must lead so `command -v` and `mise doctor` resolve
-# mise-managed tools ahead of Homebrew and system binaries.
-ENV HOMEBREW_PREFIX="/home/linuxbrew/.linuxbrew" \
-	HOMEBREW_CELLAR="/home/linuxbrew/.linuxbrew/Cellar" \
-	HOMEBREW_REPOSITORY="/home/linuxbrew/.linuxbrew/Homebrew"
-# Pin npm globals to a stable home dir, otherwise they land in
-# mise's version-specific node bin dir which isn't on PATH.
-ENV NPM_CONFIG_PREFIX="/home/coder/.npm-global"
-# Baked shims trail user shims on PATH so user installs win when
-# both exist.
-ENV MISE_SHARED_INSTALL_DIRS="/opt/mise/data/installs"
-ENV PATH="/home/coder/.npm-global/bin:${MISE_DATA_DIR}/shims:/opt/mise/data/shims:${HOMEBREW_PREFIX}/bin:${HOMEBREW_PREFIX}/sbin:/home/coder/go/bin:${PATH}"
-
-# Override CARGO_HOME so cargo registry/cache writes go to the coder
-# user's home directory instead of the root-owned /usr/local/cargo.
-# The rustup-installed binaries remain on PATH via /usr/local/cargo/bin.
-ENV CARGO_HOME="/home/coder/.cargo"
-
-# This setting prevents Go from using the public checksum database for
-# our module path prefixes. It is required because these are in private
-# repositories that require authentication.
-#
-# For details, see: https://golang.org/ref/mod#private-modules
-ENV GOPRIVATE="coder.com,cdr.dev,go.coder.com,github.com/cdr,github.com/coder"
-
-# Increase memory allocation to NodeJS
-ENV NODE_OPTIONS="--max-old-space-size=8192"
diff --git a/dogfood/coder/ubuntu-22.04/configure-chrome-flags.sh b/dogfood/coder/ubuntu-22.04/configure-chrome-flags.sh
deleted file mode 100644
index ee2e9bbaefe..00000000000
--- a/dogfood/coder/ubuntu-22.04/configure-chrome-flags.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/bin/bash
-# Adds launch flags to all Google Chrome .desktop files so that Chrome
-# works correctly in headless / GPU-less environments (e.g. Coder
-# workspaces running inside Docker containers).
-#
-# This script is idempotent.
-
-set -euo pipefail
-
-CHROME_FLAGS=(
-	--use-gl=angle
-	--use-angle=swiftshader
-	--disable-dev-shm-usage
-	--no-first-run
-	--no-default-browser-check
-	--disable-background-networking
-	--disable-sync
-	--start-maximized
-)
-
-FLAGS_STR="${CHROME_FLAGS[*]}"
-
-for desktop_file in /usr/share/applications/google-chrome*.desktop /usr/share/applications/com.google.Chrome*.desktop; do
-	[ -f "$desktop_file" ] || continue
-	# Skip if flags are already present.
-	if grep -q -- '--use-gl=angle' "$desktop_file"; then
-		continue
-	fi
-	# Insert flags after the binary path on every Exec= line.
-	sed -i "s|Exec=/usr/bin/google-chrome-stable|Exec=/usr/bin/google-chrome-stable ${FLAGS_STR}|" "$desktop_file"
-done
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/apt.conf.d/80-no-recommends b/dogfood/coder/ubuntu-22.04/files/etc/apt/apt.conf.d/80-no-recommends
deleted file mode 100644
index 8cb79c96386..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/apt.conf.d/80-no-recommends
+++ /dev/null
@@ -1,6 +0,0 @@
-// Do not install recommended packages by default
-APT::Install-Recommends "0";
-
-// Do not install suggested packages by default (this is already
-// the Ubuntu default)
-APT::Install-Suggests "0";
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/apt.conf.d/80-retries b/dogfood/coder/ubuntu-22.04/files/etc/apt/apt.conf.d/80-retries
deleted file mode 100644
index d7ee5185258..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/apt.conf.d/80-retries
+++ /dev/null
@@ -1 +0,0 @@
-APT::Acquire::Retries "3";
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/apt.conf.d/99-chrome-flags b/dogfood/coder/ubuntu-22.04/files/etc/apt/apt.conf.d/99-chrome-flags
deleted file mode 100644
index fb74c05a040..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/apt.conf.d/99-chrome-flags
+++ /dev/null
@@ -1,3 +0,0 @@
-// Re-apply Chrome desktop-file flags after any package operation so
-// that a google-chrome-stable upgrade does not silently drop them.
-DPkg::Post-Invoke { "/usr/local/bin/configure-chrome-flags.sh 2>/dev/null || true"; };
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/containerd b/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/containerd
deleted file mode 100644
index ab0b8f9891a..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/containerd
+++ /dev/null
@@ -1,6 +0,0 @@
-# Ref: https://github.com/nestybox/sysbox/issues/879
-# We need to pin containerd to a specific version to avoid breaking
-# Docker-in-Docker.
-Package: containerd.io
-Pin: version 1.7.23-1
-Pin-Priority: 1001
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/docker b/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/docker
deleted file mode 100644
index 91dcb2b37f6..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/docker
+++ /dev/null
@@ -1,23 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin download.docker.com
-Pin-Priority: 1
-
-# Docker Community Edition
-# We need to pin docker-ce to a specific version because containerd is pinned
-# to an older version. Newer major versions of docker-ce require a version of
-# containerd.io greater than our pinned version.
-Package: docker-ce
-Pin: origin download.docker.com
-Pin: version 5:27.*
-Pin-Priority: 500
-
-# Docker command-line tool
-Package: docker-ce-cli
-Pin: origin download.docker.com
-Pin-Priority: 500
-
-# containerd runtime
-Package: containerd.io
-Pin: origin download.docker.com
-Pin-Priority: 500
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/github-cli b/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/github-cli
deleted file mode 100644
index d2dce9f5f30..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/github-cli
+++ /dev/null
@@ -1,8 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin cli.github.com
-Pin-Priority: 1
-
-Package: gh
-Pin: origin cli.github.com
-Pin-Priority: 500
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/google-cloud b/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/google-cloud
deleted file mode 100644
index 637b0e9bb3c..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/google-cloud
+++ /dev/null
@@ -1,19 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin packages.cloud.google.com
-Pin-Priority: 1
-
-# Google Cloud SDK for gcloud and gsutil CLI tools
-Package: google-cloud-sdk
-Pin: origin packages.cloud.google.com
-Pin-Priority: 500
-
-# Datastore emulator for working with the licensor
-Package: google-cloud-sdk-datastore-emulator
-Pin: origin packages.cloud.google.com
-Pin-Priority: 500
-
-# Kubectl for working with Kubernetes (GKE)
-Package: kubectl
-Pin: origin packages.cloud.google.com
-Pin-Priority: 500
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/hashicorp b/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/hashicorp
deleted file mode 100644
index 4323f331cc7..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/hashicorp
+++ /dev/null
@@ -1,14 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin apt.releases.hashicorp.com
-Pin-Priority: 1
-
-# Packer for creating virtual machine disk images
-Package: packer
-Pin: origin apt.releases.hashicorp.com
-Pin-Priority: 500
-
-# Terraform for managing infrastructure
-Package: terraform
-Pin: origin apt.releases.hashicorp.com
-Pin-Priority: 500
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/ppa b/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/ppa
deleted file mode 100644
index 9e8e85724fa..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/preferences.d/ppa
+++ /dev/null
@@ -1,34 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin ppa.launchpad.net
-Pin-Priority: 1
-
-# Ansible
-Package: ansible-base
-Pin: origin ppa.launchpad.net
-Pin-Priority: 500
-
-# Fish
-Package: fish
-Pin: origin ppa.launchpad.net
-Pin-Priority: 500
-
-# Git
-Package: git
-Pin: origin ppa.launchpad.net
-Pin-Priority: 500
-
-# Helix
-Package: helix
-Pin: origin ppa.launchpad.net
-Pin-Priority: 500
-
-# Neovim
-Package: neovim
-Pin: origin ppa.launchpad.net
-Pin-Priority: 500
-
-# Neovim Runtime
-Package: neovim-runtime
-Pin: origin ppa.launchpad.net
-Pin-Priority: 500
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/docker.list b/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/docker.list
deleted file mode 100644
index f00cada1ad1..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/docker.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/google-cloud.list b/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/google-cloud.list
deleted file mode 100644
index 24df98effea..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/google-cloud.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/google-cloud.gpg] https://packages.cloud.google.com/apt cloud-sdk main
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/hashicorp.list b/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/hashicorp.list
deleted file mode 100644
index 6e60053905e..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/hashicorp.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com jammy main
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/postgresql.list b/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/postgresql.list
deleted file mode 100644
index 10262f3e64a..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/postgresql.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/postgresql.gpg] https://apt.postgresql.org/pub/repos/apt jammy-pgdg main
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/ppa.list b/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/ppa.list
deleted file mode 100644
index fbdbef53ea6..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/apt/sources.list.d/ppa.list
+++ /dev/null
@@ -1,9 +0,0 @@
-deb [signed-by=/usr/share/keyrings/ansible.gpg] https://ppa.launchpadcontent.net/ansible/ansible/ubuntu jammy main
-
-deb [signed-by=/usr/share/keyrings/fish-shell.gpg] https://ppa.launchpadcontent.net/fish-shell/release-4/ubuntu/ jammy main
-
-deb [signed-by=/usr/share/keyrings/git-core.gpg] https://ppa.launchpadcontent.net/git-core/ppa/ubuntu jammy main
-
-deb [signed-by=/usr/share/keyrings/helix.gpg] https://ppa.launchpadcontent.net/maveonair/helix-editor/ubuntu/ jammy main
-
-deb [signed-by=/usr/share/keyrings/neovim.gpg] https://ppa.launchpadcontent.net/neovim-ppa/stable/ubuntu jammy main
diff --git a/dogfood/coder/ubuntu-22.04/files/etc/docker/daemon.json b/dogfood/coder/ubuntu-22.04/files/etc/docker/daemon.json
deleted file mode 100644
index c2cbc52c3cc..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/etc/docker/daemon.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-	"registry-mirrors": ["https://mirror.gcr.io"]
-}
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/local/bin/gh b/dogfood/coder/ubuntu-22.04/files/usr/local/bin/gh
deleted file mode 100755
index badd7306ced..00000000000
--- a/dogfood/coder/ubuntu-22.04/files/usr/local/bin/gh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/bin/sh
-#
-# Wrapper for the GitHub CLI (`gh`) that ensures authentication via
-# `coder external-auth` when no other credentials are available.
-#
-# Precedence:
-#   1. GH_TOKEN / GITHUB_TOKEN already set in environment
-#   2. Existing `gh auth` login (e.g. `gh auth login`)
-#   3. Fresh token from `coder external-auth access-token github`
-
-REAL_GH="/usr/bin/gh"
-
-# ENG-2842: prevent gh from probing terminal colors before interactive prompts.
-if [ -z "${NO_COLOR+x}" ]; then
-  export NO_COLOR=1
-fi
-
-# If GH_TOKEN or GITHUB_TOKEN is already set, defer to the real gh.
-if [ -n "${GH_TOKEN:-}" ] || [ -n "${GITHUB_TOKEN:-}" ]; then
-  exec "$REAL_GH" "$@"
-fi
-
-# If the user has manually logged in via `gh auth login`, use that.
-if "$REAL_GH" auth status >/dev/null 2>&1; then
-  exec "$REAL_GH" "$@"
-fi
-
-# Fall back to Coder's external auth for a fresh token (only in a workspace).
-if [ "${CODER:-}" = "true" ]; then
-  TOKEN=$(coder external-auth access-token github 2>/dev/null)
-  if [ -n "$TOKEN" ]; then
-    GITHUB_TOKEN="$TOKEN" exec "$REAL_GH" "$@"
-  fi
-fi
-
-# Nothing worked; run gh anyway and let it show its own auth error.
-exec "$REAL_GH" "$@"
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/ansible.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/ansible.gpg
deleted file mode 100644
index 1731dd2b2fb..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/ansible.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/docker.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/docker.gpg
deleted file mode 100644
index e5dc8cfda8e..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/docker.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/fish-shell.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/fish-shell.gpg
deleted file mode 100644
index bcaac170cb9..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/fish-shell.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/git-core.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/git-core.gpg
deleted file mode 100644
index ff0a7559949..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/git-core.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/github-cli.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/github-cli.gpg
deleted file mode 100644
index eddea90bd75..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/github-cli.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/google-cloud.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/google-cloud.gpg
deleted file mode 100644
index 3b28500f953..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/google-cloud.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/hashicorp.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/hashicorp.gpg
deleted file mode 100644
index 674dd40c421..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/hashicorp.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/helix.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/helix.gpg
deleted file mode 100644
index c4dd02d1579..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/helix.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/neovim.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/neovim.gpg
deleted file mode 100644
index b88f69c53b4..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/neovim.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/postgresql.gpg b/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/postgresql.gpg
deleted file mode 100644
index afa15cb1087..00000000000
Binary files a/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings/postgresql.gpg and /dev/null differ
diff --git a/dogfood/coder/ubuntu-22.04/update-keys.sh b/dogfood/coder/ubuntu-22.04/update-keys.sh
deleted file mode 100755
index 8ccdc3a5c0a..00000000000
--- a/dogfood/coder/ubuntu-22.04/update-keys.sh
+++ /dev/null
@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-PROJECT_ROOT="$(git rev-parse --show-toplevel)"
-
-curl_flags=(
-	--silent
-	--show-error
-	--location
-)
-
-gpg_flags=(
-	--dearmor
-	--yes
-)
-
-pushd "$PROJECT_ROOT/dogfood/coder/ubuntu-22.04/files/usr/share/keyrings"
-
-# Ansible PPA signing key
-# This curl command is now resulting in a 404, causing the script to fail.
-# Rather than fix, we're just upgrading to Ubuntu 26.04 which removed the
-# dependency on this PPA.
-# curl "${curl_flags[@]}" "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0X6125E2A8C77F2818FB7BD15B93C4A3FD7BB9C367" |
-# 	gpg "${gpg_flags[@]}" --output="ansible.gpg"
-
-# Upstream Docker signing key
-curl "${curl_flags[@]}" "https://download.docker.com/linux/ubuntu/gpg" |
-	gpg "${gpg_flags[@]}" --output="docker.gpg"
-
-# Fish signing key
-curl "${curl_flags[@]}" "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x88421E703EDC7AF54967DED473C9FCC9E2BB48DA" |
-	gpg "${gpg_flags[@]}" --output="fish-shell.gpg"
-
-# Git-Core signing key
-curl "${curl_flags[@]}" "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xE1DD270288B4E6030699E45FA1715D88E1DF1F24" |
-	gpg "${gpg_flags[@]}" --output="git-core.gpg"
-
-# GitHub CLI signing key
-curl "${curl_flags[@]}" "https://cli.github.com/packages/githubcli-archive-keyring.gpg" |
-	gpg "${gpg_flags[@]}" --output="github-cli.gpg"
-
-# Google Cloud signing key
-curl "${curl_flags[@]}" "https://packages.cloud.google.com/apt/doc/apt-key.gpg" |
-	gpg "${gpg_flags[@]}" --output="google-cloud.gpg"
-
-# Hashicorp signing key
-curl "${curl_flags[@]}" "https://apt.releases.hashicorp.com/gpg" |
-	gpg "${gpg_flags[@]}" --output="hashicorp.gpg"
-
-# Helix signing key
-curl "${curl_flags[@]}" "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x27642B9FD7F1A161FC2524E3355A4FA515D7C855" |
-	gpg "${gpg_flags[@]}" --output="helix.gpg"
-
-# Neovim signing key
-curl "${curl_flags[@]}" "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x9DBB0BE9366964F134855E2255F96FCF8231B6DD" |
-	gpg "${gpg_flags[@]}" --output="neovim.gpg"
-
-# Upstream PostgreSQL signing key
-curl "${curl_flags[@]}" "https://www.postgresql.org/media/keys/ACCC4CF8.asc" |
-	gpg "${gpg_flags[@]}" --output="postgresql.gpg"
-
-popd
diff --git a/provisioner/terraform/testdata/timings-aggregation/fake-terraform.sh b/provisioner/terraform/testdata/timings-aggregation/fake-terraform.sh
index 582df28c621..96a310a5938 100755
--- a/provisioner/terraform/testdata/timings-aggregation/fake-terraform.sh
+++ b/provisioner/terraform/testdata/timings-aggregation/fake-terraform.sh
@@ -123,9 +123,6 @@ function terraform_apply() {
 EOL
 }
 
-# TODO: remove
-echo "$@" >>/tmp/blah
-
 case "$1" in
 version)
 	terraform_version