diff --git a/.github/actions/setup-openshell/action.yml b/.github/actions/setup-openshell/action.yml
new file mode 100644
index 0000000..f583bea
--- /dev/null
+++ b/.github/actions/setup-openshell/action.yml
@@ -0,0 +1,36 @@
+name: Setup OpenShell
+description: Install the pinned OpenShell CLI and wait for the gateway to become ready.
+
+runs:
+  using: composite
+  steps:
+    - name: Install openshell
+      # Version is pinned in .openshell-version (the single source of truth,
+      # also read by `make openshell`). The install script otherwise
+      # grabs the latest tagged release, which can drift past the chart's
+      # supervisor image and break the sandbox ssh/tar relay with
+      # "supervisor session not found".
+      shell: bash
+      run: |
+        ver="$(cat .openshell-version)"
+        test -n "$ver" || { echo "error: .openshell-version is empty"; exit 1; }
+        tmp="$(mktemp)"
+        curl -fLsS https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh -o "$tmp"
+        OPENSHELL_VERSION="$ver" sh "$tmp"
+
+    - name: Wait for gateway
+      shell: bash
+      run: |
+        ready=false
+        for _ in $(seq 1 30); do
+          if openshell inference get &>/dev/null; then
+            ready=true
+            break
+          fi
+          sleep 1
+        done
+        if [[ "$ready" != true ]]; then
+          openshell gateway list || true
+          echo "OpenShell gateway did not become ready" >&2
+          exit 1
+        fi
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index c27f38a..89d4991 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -17,34 +17,8 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Install openshell
-        # Version is pinned in .openshell-version (the single source of truth,
-        # also read by `make openshell`). The install script otherwise
-        # grabs the latest tagged release, which can drift past the chart's
-        # supervisor image and break the sandbox ssh/tar relay with
-        # "supervisor session not found".
-        run: |
-          ver="$(cat .openshell-version)"
-          test -n "$ver" || { echo "error: .openshell-version is empty"; exit 1; }
-          tmp="$(mktemp)"
-          curl -fLsS https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh -o "$tmp"
-          OPENSHELL_VERSION="$ver" sh "$tmp"
-
-      - name: Wait for gateway
-        run: |
-          ready=false
-          for _ in $(seq 1 30); do
-            if openshell inference get &>/dev/null; then
-              ready=true
-              break
-            fi
-            sleep 1
-          done
-          if [[ "$ready" != true ]]; then
-            openshell gateway list || true
-            echo "OpenShell gateway did not become ready" >&2
-            exit 1
-          fi
+      - name: Setup OpenShell
+        uses: ./.github/actions/setup-openshell
 
       - name: Run local integration
         run: |
@@ -78,34 +52,8 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Install openshell
-        # Version is pinned in .openshell-version (the single source of truth,
-        # also read by `make openshell`). The install script otherwise
-        # grabs the latest tagged release, which can drift past the chart's
-        # supervisor image and break the sandbox ssh/tar relay with
-        # "supervisor session not found".
-        run: |
-          ver="$(cat .openshell-version)"
-          test -n "$ver" || { echo "error: .openshell-version is empty"; exit 1; }
-          tmp="$(mktemp)"
-          curl -fLsS https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh -o "$tmp"
-          OPENSHELL_VERSION="$ver" sh "$tmp"
-
-      - name: Wait for gateway
-        run: |
-          ready=false
-          for _ in $(seq 1 30); do
-            if openshell inference get &>/dev/null; then
-              ready=true
-              break
-            fi
-            sleep 1
-          done
-          if [[ "$ready" != true ]]; then
-            openshell gateway list || true
-            echo "OpenShell gateway did not become ready" >&2
-            exit 1
-          fi
+      - name: Setup OpenShell
+        uses: ./.github/actions/setup-openshell
 
       # install_only: kind-lifecycle.sh creates its own cluster with an
       # isolated kubeconfig — only the kind binary is needed here.
diff --git a/cmd/image.go b/cmd/image.go
new file mode 100644
index 0000000..fa6b800
--- /dev/null
+++ b/cmd/image.go
@@ -0,0 +1,41 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// Version is the build version, set at link time and used to tag versioned
+// sandbox images.
+var Version = "dev"
+
+// resolveSandboxImagePath resolves a relative Dockerfile directory against
+// harnessDir. An image ref (or an already-absolute path) is returned unchanged.
+func resolveSandboxImagePath(image, harnessDir string) string {
+	if image == "" || filepath.IsAbs(image) {
+		return image
+	}
+	candidate := filepath.Join(harnessDir, image)
+	if info, err := os.Stat(candidate); err == nil && info.IsDir() {
+		return candidate
+	}
+	return image
+}
+
+func resolveSandboxImage(agentImage string) string {
+	if envImage := os.Getenv("HARNESS_OS_IMAGE"); envImage != "" {
+		return envImage
+	}
+	if agentImage != "" {
+		return agentImage
+	}
+	return versionedImage("sandbox")
+}
+
+func versionedImage(name string) string {
+	base := "quay.io/rcochran/openshell"
+	if Version == "" || Version == "dev" {
+		return base + ":" + name
+	}
+	return base + ":" + name + "-" + Version
+}
diff --git a/cmd/sandbox.go b/cmd/sandbox.go
deleted file mode 100644
index 7fb7304..0000000
--- a/cmd/sandbox.go
+++ /dev/null
@@ -1,19 +0,0 @@
-package cmd
-
-import (
-	"os"
-	"path/filepath"
-)
-
-// resolveSandboxImagePath resolves a relative Dockerfile directory against
-// harnessDir. An image ref (or an already-absolute path) is returned unchanged.
-func resolveSandboxImagePath(image, harnessDir string) string {
-	if image == "" || filepath.IsAbs(image) {
-		return image
-	}
-	candidate := filepath.Join(harnessDir, image)
-	if info, err := os.Stat(candidate); err == nil && info.IsDir() {
-		return candidate
-	}
-	return image
-}
diff --git a/cmd/sandbox_image.go b/cmd/sandbox_image.go
deleted file mode 100644
index 4ffb94b..0000000
--- a/cmd/sandbox_image.go
+++ /dev/null
@@ -1,23 +0,0 @@
-package cmd
-
-import "os"
-
-var Version = "dev"
-
-func resolveSandboxImage(agentImage string) string {
-	if envImage := os.Getenv("HARNESS_OS_IMAGE"); envImage != "" {
-		return envImage
-	}
-	if agentImage != "" {
-		return agentImage
-	}
-	return versionedImage("sandbox")
-}
-
-func versionedImage(name string) string {
-	base := "quay.io/rcochran/openshell"
-	if Version == "" || Version == "dev" {
-		return base + ":" + name
-	}
-	return base + ":" + name + "-" + Version
-}