diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a58b2d548..b6e6df5f5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -36,6 +36,15 @@ on:
         required: false
         type: boolean
         default: true
+      pre_build_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'
 
 env:
   NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
@@ -77,6 +86,16 @@ jobs:
           clean: true
           fetch-depth: 0
           submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - name: Run pre-build script
+        if: ${{ inputs.pre_build_script != '' }}
+        run: |
+          cat > ./pre-build.sh << 'EOF'
+          ${{ inputs.pre_build_script }}
+          EOF
+          chmod +x ./pre-build.sh
+          bash ./pre-build.sh
 
       - name: Set Build Variables
         id: vars
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c9f96e991..fa7bd7be9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,6 +29,10 @@ on:
         required: false
         type: string
         default: 'test'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'
 
 env:
   TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
@@ -59,6 +63,7 @@ jobs:
           clean: true
           fetch-depth: 0
           submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
 
       - name: Set Build Variables
         id: vars
diff --git a/buildroot b/buildroot
index c32a08efd..658015549 160000
--- a/buildroot
+++ b/buildroot
@@ -1 +1 @@
-Subproject commit c32a08efd2824799ffb4fba4a7d713ec2c6bc8e9
+Subproject commit 658015549a8939565f8320a17e3a5189272c8277