diff --git a/.config/nextest.toml b/.config/nextest.toml
index dcb0131..3f1d3ee 100644
--- a/.config/nextest.toml
+++ b/.config/nextest.toml
@@ -34,6 +34,17 @@ retries = 2
 [profile.ci.junit]
 path = "target/nextest/ci/junit.xml"
 
+[profile.cover]
+# Coverage profile — used with cargo llvm-cov nextest
+fail-fast = false
+test-threads = "num-cpus"
+failure-output = "immediate-final"
+success-output = "never"
+slow-timeout = { period = "60s", terminate-after = 2 }
+
+[profile.cover.junit]
+path = "target/nextest/cover/junit.xml"
+
 # Postgres tests must run serially (shared database state)
 [[profile.default.overrides]]
 filter = "package(wfe-postgres)"
diff --git a/wfe-containerd-protos/build.rs b/wfe-containerd-protos/build.rs
index a61ab46..973a83e 100644
--- a/wfe-containerd-protos/build.rs
+++ b/wfe-containerd-protos/build.rs
@@ -17,7 +17,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         proto_files.len()
     );
 
-    let out_dir = PathBuf::from(std::env::var("OUT_DIR")?);
+    let _out_dir = PathBuf::from(std::env::var("OUT_DIR")?);
 
     // Use tonic-prost-build (the tonic 0.14 way)
     let mut prost_config = prost_build::Config::new();
diff --git a/wfe-yaml/tests/deno.rs b/wfe-yaml/tests/deno.rs
index 69e5973..e5ec102 100644
--- a/wfe-yaml/tests/deno.rs
+++ b/wfe-yaml/tests/deno.rs
@@ -219,7 +219,7 @@ workflow:
       type: deno
 "#;
     let config = HashMap::new();
-    let result = wfe_yaml::load_workflow_from_str(yaml, &config);
+    let result = wfe_yaml::load_single_workflow_from_str(yaml, &config);
     assert!(result.is_err());
     let msg = result.err().unwrap().to_string();
     assert!(
@@ -242,7 +242,7 @@ workflow:
           FOO: bar
 "#;
     let config = HashMap::new();
-    let result = wfe_yaml::load_workflow_from_str(yaml, &config);
+    let result = wfe_yaml::load_single_workflow_from_str(yaml, &config);
     assert!(result.is_err());
     let msg = result.err().unwrap().to_string();
     assert!(
@@ -264,7 +264,7 @@ workflow:
         script: "output('key', 'val');"
 "#;
     let config = HashMap::new();
-    let compiled = wfe_yaml::load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = wfe_yaml::load_single_workflow_from_str(yaml, &config).unwrap();
     assert!(!compiled.step_factories.is_empty());
     let (key, _factory) = &compiled.step_factories[0];
     assert!(key.contains("deno"), "factory key should contain 'deno', got: {key}");
diff --git a/wfe-yaml/tests/deno_e2e.rs b/wfe-yaml/tests/deno_e2e.rs
index b8b7802..248dfa0 100644
--- a/wfe-yaml/tests/deno_e2e.rs
+++ b/wfe-yaml/tests/deno_e2e.rs
@@ -15,7 +15,7 @@ use wfe::{WorkflowHostBuilder, run_workflow_sync};
 use wfe_core::test_support::{
     InMemoryLockProvider, InMemoryPersistenceProvider, InMemoryQueueProvider,
 };
-use wfe_yaml::load_workflow_from_str;
+use wfe_yaml::load_single_workflow_from_str;
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -30,7 +30,7 @@ async fn run_yaml_workflow_with_data(
     data: serde_json::Value,
 ) -> wfe::models::WorkflowInstance {
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
 
     let persistence = Arc::new(InMemoryPersistenceProvider::new());
     let lock = Arc::new(InMemoryLockProvider::new());
@@ -437,7 +437,7 @@ workflow:
         script: "output('x', 1);"
 "#;
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     assert!(!compiled.step_factories.is_empty());
     let (key, _factory) = &compiled.step_factories[0];
     assert!(
@@ -467,7 +467,7 @@ workflow:
           dynamic_import: true
 "#;
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     assert!(!compiled.step_factories.is_empty());
     // Verify the step config was serialized correctly.
     let step = compiled
@@ -497,7 +497,7 @@ workflow:
         timeout: "3s"
 "#;
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     let step = compiled
         .definition
         .steps
@@ -521,7 +521,7 @@ workflow:
         file: "./scripts/run.js"
 "#;
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     let step = compiled
         .definition
         .steps
@@ -543,7 +543,7 @@ workflow:
       type: deno
 "#;
     let config = HashMap::new();
-    let result = load_workflow_from_str(yaml, &config);
+    let result = load_single_workflow_from_str(yaml, &config);
     match result {
         Err(e) => {
             let msg = e.to_string();
@@ -570,7 +570,7 @@ workflow:
           FOO: bar
 "#;
     let config = HashMap::new();
-    let result = load_workflow_from_str(yaml, &config);
+    let result = load_single_workflow_from_str(yaml, &config);
     match result {
         Err(e) => {
             let msg = e.to_string();
@@ -596,7 +596,7 @@ workflow:
         script: "1+1;"
 "#;
     let config = HashMap::new();
-    assert!(load_workflow_from_str(yaml, &config).is_ok());
+    assert!(load_single_workflow_from_str(yaml, &config).is_ok());
 }
 
 #[test]
@@ -612,7 +612,7 @@ workflow:
         file: "./run.js"
 "#;
     let config = HashMap::new();
-    assert!(load_workflow_from_str(yaml, &config).is_ok());
+    assert!(load_single_workflow_from_str(yaml, &config).is_ok());
 }
 
 #[test]
@@ -632,7 +632,7 @@ workflow:
         script: "output('x', 1);"
 "#;
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     let has_shell = compiled.step_factories.iter().any(|(k, _)| k.contains("shell"));
     let has_deno = compiled.step_factories.iter().any(|(k, _)| k.contains("deno"));
     assert!(has_shell, "should have shell factory");
@@ -655,7 +655,7 @@ workflow:
           - "npm:is-number@7"
 "#;
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     let step = compiled
         .definition
         .steps
@@ -685,7 +685,7 @@ workflow:
           BAZ: qux
 "#;
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     let step = compiled
         .definition
         .steps
@@ -744,7 +744,7 @@ workflow:
 "#;
     let config = HashMap::new();
     // This should compile without errors.
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     assert!(compiled.step_factories.len() >= 2);
 }
 
@@ -809,7 +809,7 @@ workflow:
         script: "1;"
 "#;
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     assert_eq!(
         compiled.definition.description.as_deref(),
         Some("A workflow with deno steps")
@@ -834,7 +834,7 @@ workflow:
         interval: "2s"
 "#;
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     let step = compiled
         .definition
         .steps
diff --git a/wfe-yaml/tests/e2e_yaml.rs b/wfe-yaml/tests/e2e_yaml.rs
index 318879a..547a602 100644
--- a/wfe-yaml/tests/e2e_yaml.rs
+++ b/wfe-yaml/tests/e2e_yaml.rs
@@ -7,11 +7,11 @@ use wfe::{WorkflowHostBuilder, run_workflow_sync};
 use wfe_core::test_support::{
     InMemoryLockProvider, InMemoryPersistenceProvider, InMemoryQueueProvider,
 };
-use wfe_yaml::load_workflow_from_str;
+use wfe_yaml::load_single_workflow_from_str;
 
 async fn run_yaml_workflow(yaml: &str) -> wfe::models::WorkflowInstance {
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
 
     let persistence = Arc::new(InMemoryPersistenceProvider::new());
     let lock = Arc::new(InMemoryLockProvider::new());
diff --git a/wfe-yaml/tests/lib_tests.rs b/wfe-yaml/tests/lib_tests.rs
index d2a150d..54eef05 100644
--- a/wfe-yaml/tests/lib_tests.rs
+++ b/wfe-yaml/tests/lib_tests.rs
@@ -1,7 +1,7 @@
 use std::collections::HashMap;
 use std::io::Write;
 
-use wfe_yaml::{load_workflow, load_workflow_from_str};
+use wfe_yaml::{load_workflow, load_single_workflow_from_str};
 
 #[test]
 fn load_workflow_from_file() {
@@ -45,7 +45,7 @@ fn load_workflow_from_nonexistent_file_returns_error() {
 #[test]
 fn load_workflow_from_str_with_invalid_yaml_returns_error() {
     let yaml = "this is not valid yaml: [[[";
-    let result = load_workflow_from_str(yaml, &HashMap::new());
+    let result = load_single_workflow_from_str(yaml, &HashMap::new());
     assert!(result.is_err());
     let err = match result { Err(e) => e.to_string(), Ok(_) => panic!("expected error") };
     assert!(
@@ -69,7 +69,7 @@ workflow:
     let mut config = HashMap::new();
     config.insert("message".to_string(), serde_json::json!("hello world"));
 
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
     let step = compiled
         .definition
         .steps
@@ -94,7 +94,7 @@ workflow:
       config:
         run: echo ((missing))
 "#;
-    let result = load_workflow_from_str(yaml, &HashMap::new());
+    let result = load_single_workflow_from_str(yaml, &HashMap::new());
     assert!(result.is_err());
     let err = match result { Err(e) => e.to_string(), Ok(_) => panic!("expected error") };
     assert!(
diff --git a/wfe-yaml/tests/shell.rs b/wfe-yaml/tests/shell.rs
index 3b2b680..f5f5834 100644
--- a/wfe-yaml/tests/shell.rs
+++ b/wfe-yaml/tests/shell.rs
@@ -7,14 +7,14 @@ use wfe::{WorkflowHostBuilder, run_workflow_sync};
 use wfe_core::test_support::{
     InMemoryLockProvider, InMemoryPersistenceProvider, InMemoryQueueProvider,
 };
-use wfe_yaml::load_workflow_from_str;
+use wfe_yaml::load_single_workflow_from_str;
 
 async fn run_yaml_workflow_with_data(
     yaml: &str,
     data: serde_json::Value,
 ) -> wfe::models::WorkflowInstance {
     let config = HashMap::new();
-    let compiled = load_workflow_from_str(yaml, &config).unwrap();
+    let compiled = load_single_workflow_from_str(yaml, &config).unwrap();
 
     let persistence = Arc::new(InMemoryPersistenceProvider::new());
     let lock = Arc::new(InMemoryLockProvider::new());