diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index 31098e633e..91bbe7e0bd 100644
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -26,127 +26,32 @@ timeout:
       script: |
         ls -la
 functions:
-  fetch-source:
+  setup-system:
     # Executes clone and applies the submitted patch, if any
     - command: git.get_project
       type: system
       params:
         directory: src/go.mongodb.org/mongo-driver
-    # Make an evergreen expansion file with dynamic values
-    - command: shell.exec
+    # Make an env.sh and evergreen expansion file with dynamic values
+    - command: subprocess.exec
       params:
-        shell: "bash"
+        binary: bash
         working_dir: src/go.mongodb.org/mongo-driver
-        script: |
-          set -o errexit
-
-          # Get the current unique version of this checkout.
-          if [ "${is_patch}" = "true" ]; then
-             CURRENT_VERSION=$(git describe)-patch-${version_id}
-          else
-             CURRENT_VERSION=latest
-          fi
-
-          # Set Golang environment vars. GOROOT is wherever current Go distribution is; GOPATH is always 3
-          # directories up from pwd; GOCACHE is under .cache in the pwd.
-          export GOROOT="${GO_DIST}"
-          export GOPATH="$(dirname $(dirname $(dirname `pwd`)))"
-          export GOCACHE="$(pwd)/.cache"
-
-          # Set other relevant variables for Evergreen processes.
-          export DRIVERS_TOOLS="$(dirname $(dirname $(dirname `pwd`)))/drivers-tools"
-          export PROJECT_DIRECTORY="$(pwd)"
-          export MONGO_ORCHESTRATION_HOME="$DRIVERS_TOOLS/.evergreen/orchestration"
-          export MONGODB_BINARIES="$DRIVERS_TOOLS/mongodb/bin"
-          export PROJECT="${project}"
-
-          # If on Windows, convert paths with cygpath. GOROOT should not be converted as Windows expects it
-          # to be separated with '\'.
-          if [ "Windows_NT" = "$OS" ]; then
-             export GOPATH=$(cygpath -m $GOPATH)
-             export GOCACHE=$(cygpath -m $GOCACHE)
-             export DRIVERS_TOOLS=$(cygpath -m $DRIVERS_TOOLS)
-             export PROJECT_DIRECTORY=$(cygpath -m $PROJECT_DIRECTORY)
-             export MONGO_ORCHESTRATION_HOME=$(cygpath -m $MONGO_ORCHESTRATION_HOME)
-             export MONGODB_BINARIES=$(cygpath -m $MONGODB_BINARIES)
-             export PROJECT=$(cygpath -m $PROJECT)
-
-             # Set home variables for Windows, too.
-             export USERPROFILE=$(cygpath -w $(dirname $(dirname $(dirname `pwd`))))
-             export HOME=$USERPROFILE
-          fi
-
-          # Set actual PATH. PATH should contain binaries from GOROOT, GOPATH, GCC_PATH and mongodb.
-          export GOROOTBIN="$GOROOT/bin"
-          export GOPATHBIN="$GOPATH/bin"
-          if [ "Windows_NT" = "$OS" ]; then
-             # Convert all Windows-style paths (e.g. C:/) to Bash-style Cygwin paths
-             # (e.g. /cygdrive/c/...) because PATH is interpreted by Bash, which uses ":" as a
-             # separator so doesn't support Windows-style paths. Other scripts or binaries that
-             # aren't part of Cygwin still need the environment variables to use Windows-style
-             # paths, so only convert them when setting PATH. Note that GCC_PATH is already a
-             # Bash-style Cygwin path for all Windows tasks.
-             export PATH="$(cygpath $GOROOTBIN):$(cygpath $GOPATHBIN):${GCC_PATH}:$(cygpath $MONGODB_BINARIES):$PATH"
-          else
-             export PATH="$GOROOTBIN:$GOPATHBIN:${GCC_PATH}:$MONGODB_BINARIES:$PATH"
-          fi
-
-          # Check Go installation.
-          go version
-          go env
-
-          # Install taskfile.
-          go install github.com/go-task/task/v3/cmd/task@latest
-
-          # Install libmongocrypt.
-          task install-libmongocrypt
-          if [ "Windows_NT" = "$OS" ]; then
-            export PATH=$PATH:/cygdrive/c/libmongocrypt/bin
-          fi
-
-          cat <<EOT > expansion.yml
-          CURRENT_VERSION: "$CURRENT_VERSION"
-          DRIVERS_TOOLS: "$DRIVERS_TOOLS"
-          MONGO_ORCHESTRATION_HOME: "$MONGO_ORCHESTRATION_HOME"
-          MONGODB_BINARIES: "$MONGODB_BINARIES"
-          PROJECT_DIRECTORY: "$PROJECT_DIRECTORY"
-          PREPARE_SHELL: |
-             set -o errexit
-             export SKIP_LEGACY_SHELL=1
-             export GOROOT="$GOROOT"
-             export GOPATH="$GOPATH"
-             export GOCACHE="$GOCACHE"
-             export DRIVERS_TOOLS="$DRIVERS_TOOLS"
-             export PROJECT_DIRECTORY="$PROJECT_DIRECTORY"
-             export MONGO_ORCHESTRATION_HOME="$MONGO_ORCHESTRATION_HOME"
-             export MONGODB_BINARIES="$MONGODB_BINARIES"
-             export PROJECT="$PROJECT"
-             export TMPDIR="$MONGO_ORCHESTRATION_HOME/db"
-             export PKG_CONFIG_PATH=$(pwd)/install/libmongocrypt/lib64/pkgconfig
-             export LD_LIBRARY_PATH=$(pwd)/install/libmongocrypt/lib64
-             export PATH="$PATH"
-          EOT
-          # See what we variables we've set.
-          cat expansion.yml
-    # Load the expansion file to make an evergreen variable with the current unique version
+        env:
+          GOROOT: ${GO_DIST}
+          IS_PATCH: ${is_patch}
+          VERSION_ID: ${version_id}
+        args: 
+          - ".evergreen/setup-system.sh"
     - command: expansions.update
       params:
         file: src/go.mongodb.org/mongo-driver/expansion.yml
-
-  prepare-resources:
-    - command: shell.exec
-      params:
-        shell: "bash"
-        script: |
-          ${PREPARE_SHELL}
-          rm -rf $DRIVERS_TOOLS
-          git clone https://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS
     - command: subprocess.exec
       params:
-        binary: "bash"
+        binary: bash
         include_expansions_in_env: ["PROJECT_DIRECTORY"]
         args:
-          - ${DRIVERS_TOOLS}/.evergreen/setup.sh
+          - "${DRIVERS_TOOLS}/.evergreen/setup.sh"
 
   handle-test-artifacts:
     - command: gotest.parse_files
@@ -184,7 +89,6 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
           find . -name \*.suite | xargs tar czf test_suite.tgz
     - command: s3.put
       params:
@@ -217,8 +121,6 @@ functions:
         shell: "bash"
         script: |
           set -x
-          ${PREPARE_SHELL}
-
           MONGODB_VERSION=${VERSION} \
           TOPOLOGY=${TOPOLOGY} \
           AUTH=${AUTH} \
@@ -236,8 +138,6 @@ functions:
       params:
         shell: "bash"
         script: |
-          ${PREPARE_SHELL}
-
           MONGODB_VERSION=${VERSION} \
           TOPOLOGY=${TOPOLOGY} \
           AUTH=${AUTH} \
@@ -279,9 +179,7 @@ functions:
         shell: bash
         include_expansions_in_env: ["DRIVERS_TOOLS", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
         script: |
-          ${PREPARE_SHELL}
-          export OIDC="oidc"
-          task test-oidc
+          OIDC="oidc" ${RUN_TASK} test-oidc
 
   run-task:
     - command: shell.exec
@@ -290,8 +188,8 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          ${BUILD_ENV|} BUILD_TAGS=${BUILD_TAGS|-tags=cse,gssapi} task ${targets}
+          ${BUILD_ENV|} BUILD_TAGS=${BUILD_TAGS|-tags=cse,gssapi} ${RUN_TASK} setup-test
+          ${RUN_TASK} ${targets}
 
   run-tests:
     - command: shell.exec
@@ -301,8 +199,14 @@ functions:
         working_dir: src/go.mongodb.org/mongo-driver
         include_expansions_in_env: ["TOPOLOGY", "AUTH", "SSL", "SKIP_CSOT_TESTS", "MONGODB_URI", "CRYPT_SHARED_LIB_PATH", "SKIP_CRYPT_SHARED_LIB", "RACE", "MONGO_GO_DRIVER_COMPRESSOR", "REQUIRE_API_VERSION", "LOAD_BALANCER"]
         script: |
-          ${PREPARE_SHELL}
-          bash ${PROJECT_DIRECTORY}/.evergreen/run-tests.sh
+          set -e
+          GO_BUILD_TAGS="cse" ${RUN_TASK} setup-test
+          if [ "$(uname -s)" = "Darwin" ]; then
+              # Run a subset of the tests on Darwin
+              ${RUN_TASK} evg-test-load-balancers
+          else
+              ${RUN_TASK} evg-test
+          fi
 
   create-api-report:
     - command: shell.exec
@@ -311,10 +215,9 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
           export BASE_SHA=${revision}
           export HEAD_SHA=${github_commit}
-          task api-report
+          ${RUN_TASK} api-report
 
   "add PR labels":
     - command: shell.exec
@@ -323,9 +226,8 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          export CONFIG=$PROJECT_DIRECTORY/.github/labeler.yml
-          export SCRIPT="$DRIVERS_TOOLS/.evergreen/github_app/apply-labels.sh"
+          export CONFIG=${PROJECT_DIRECTORY}/.github/labeler.yml
+          export SCRIPT="${DRIVERS_TOOLS}/.evergreen/github_app/apply-labels.sh"
           bash $SCRIPT -l $CONFIG -h ${github_commit} -o "mongodb" -n "mongo-go-driver"
 
   "add PR reviewer":
@@ -335,9 +237,8 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          export CONFIG=$PROJECT_DIRECTORY/.github/reviewers.txt
-          export SCRIPT="$DRIVERS_TOOLS/.evergreen/github_app/assign-reviewer.sh"
+          export CONFIG=${PROJECT_DIRECTORY}/.github/reviewers.txt
+          export SCRIPT="${DRIVERS_TOOLS}/.evergreen/github_app/assign-reviewer.sh"
           bash $SCRIPT -p $CONFIG -h ${github_commit} -o "mongodb" -n "mongo-go-driver"
 
   "backport pr":
@@ -367,8 +268,8 @@ functions:
         working_dir: src/go.mongodb.org/mongo-driver
         include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
         script: |
-          ${PREPARE_SHELL}
-          bash ./etc/run-enterprise-plain-test.sh
+          ${RUN_TASK} setup-test -- enterprise-plain
+          ${RUN_TASK} --silent evg-test-enterprise-auth
 
   run-enterprise-gssapi-auth-tests:
     - command: ec2.assume_role
@@ -381,8 +282,8 @@ functions:
         working_dir: src/go.mongodb.org/mongo-driver
         include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
         script: |
-          ${PREPARE_SHELL}
-          bash ./etc/run-enterprise-gssapi-test.sh
+          ${RUN_TASK} setup-test -- enterprise-gssapi
+          ${RUN_TASK} --silent evg-test-enterprise-auth
 
   run-atlas-test:
     - command: ec2.assume_role
@@ -395,8 +296,8 @@ functions:
         working_dir: src/go.mongodb.org/mongo-driver
         include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
         script: |
-          ${PREPARE_SHELL}
-          task test-atlas
+          ${RUN_TASK} setup-test -- atlas-connect
+          ${RUN_TASK} test-atlas-connect
 
   run-ocsp-test:
     - command: shell.exec
@@ -405,8 +306,7 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          export MONGO_GO_DRIVER_CA_FILE="$DRIVERS_TOOLS/.evergreen/ocsp/${OCSP_ALGORITHM}/ca.pem"
+          export MONGO_GO_DRIVER_CA_FILE="${DRIVERS_TOOLS}/.evergreen/ocsp/${OCSP_ALGORITHM}/ca.pem"
           if [ "Windows_NT" = "$OS" ]; then # Magic variable in cygwin
             export MONGO_GO_DRIVER_CA_FILE=$(cygpath -m $MONGO_GO_DRIVER_CA_FILE)
           fi
@@ -416,7 +316,7 @@ functions:
           TOPOLOGY="server" \
           MONGODB_URI="${MONGODB_URI}" \
           OCSP_TLS_SHOULD_SUCCEED="${OCSP_TLS_SHOULD_SUCCEED}" \
-          task evg-test-ocsp
+          ${RUN_TASK} evg-test-ocsp
 
   run-versioned-api-test:
     - command: shell.exec
@@ -425,30 +325,18 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          source ./secrets-export.sh
-
-          if [ "${SKIP_CRYPT_SHARED_LIB}" = "true" ]; then
-            CRYPT_SHARED_LIB_PATH=""
-            echo "crypt_shared library is skipped"
-          elif [ -z "${CRYPT_SHARED_LIB_PATH}" ]; then
-            echo "crypt_shared library path is empty"
-          else
-            CRYPT_SHARED_LIB_PATH=${CRYPT_SHARED_LIB_PATH}
-            echo "crypt_shared library will be loaded from path: $CRYPT_SHARED_LIB_PATH"
-          fi
-
           AUTH="${AUTH}" \
           SSL="${SSL}" \
           MONGODB_URI="${MONGODB_URI}" \
           TOPOLOGY="${TOPOLOGY}" \
           MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
-          BUILD_TAGS="-tags=cse" \
+          GO_BUILD_TAGS="cse" \
           REQUIRE_API_VERSION="${REQUIRE_API_VERSION}" \
+          SKIP_CRYPT_SHARED_LIB=${SKIP_CRYPT_SHARED_LIB} \
           CRYPT_SHARED_LIB_PATH="$CRYPT_SHARED_LIB_PATH" \
-          task evg-test-versioned-api \
-          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
-          LD_LIBRARY_PATH=$LD_LIBRARY_PATH
+          ${RUN_TASK} setup-test
+
+          ${RUN_TASK} evg-test-versioned-api
 
   run-load-balancer-tests:
     - command: shell.exec
@@ -457,21 +345,6 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-
-          if [ ${SSL} = "ssl" ]; then
-              export MONGO_GO_DRIVER_CA_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/ca.pem"
-              export MONGO_GO_DRIVER_KEY_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/client.pem"
-              export MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/client-pkcs8-encrypted.pem"
-              export MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/client-pkcs8-unencrypted.pem"
-              if [ "Windows_NT" = "$OS" ]; then # Magic variable in cygwin
-                  export MONGO_GO_DRIVER_CA_FILE=$(cygpath -m $MONGO_GO_DRIVER_CA_FILE)
-                  export MONGO_GO_DRIVER_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_KEY_FILE)
-                  export MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE)
-                  export MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE)
-              fi
-          fi
-
           # Verify that the required LB URI expansions are set to ensure that the test runner can correctly connect to
           # the LBs.
           if [ -z "${SINGLE_MONGOS_LB_URI}" ]; then
@@ -485,15 +358,16 @@ functions:
 
           # Per the LB testing spec, the URI of an LB fronting a single mongos should be used to configure internal
           # testing Client instances, so we set MONGODB_URI to SINGLE_MONGOS_LB_URI.
-
           AUTH="${AUTH}" \
           SSL="${SSL}" \
           MONGODB_URI="${SINGLE_MONGOS_LB_URI}" \
-          SINGLE_MONGOS_LB_URI="${SINGLE_MONGOS_LB_URI}" \
-          MULTI_MONGOS_LB_URI="${MULTI_MONGOS_LB_URI}" \
           TOPOLOGY="${TOPOLOGY}" \
           MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
-          task evg-test-load-balancers
+          ${RUN_TASK} setup-test
+
+          SINGLE_MONGOS_LB_URI="${SINGLE_MONGOS_LB_URI}" \
+          MULTI_MONGOS_LB_URI="${MULTI_MONGOS_LB_URI}" \
+          ${RUN_TASK} evg-test-load-balancers
 
   run-serverless-tests:
     - command: shell.exec
@@ -502,8 +376,8 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          bash etc/run-serverless-test.sh
+          ${RUN_TASK} setup-test -- serverless
+          ${RUN_TASK} evg-test-serverless
 
   run-atlas-data-lake-test:
     - command: shell.exec
@@ -512,12 +386,13 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
           AUTH="auth" \
           SSL="nossl" \
           TOPOLOGY="server" \
           MONGODB_URI="mongodb://mhuser:pencil@localhost" \
-          task evg-test-atlas-data-lake
+          ${RUN_TASK} setup-test
+
+          ${RUN_TASK} evg-test-atlas-data-lake
 
   run-docker-test:
     - command: shell.exec
@@ -526,9 +401,8 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          task run-docker
-          TOPOLOGY=sharded_cluster task run-docker -- test-short
+          ${RUN_TASK} run-docker
+          TOPOLOGY=sharded_cluster ${RUN_TASK} run-docker -- test-short
 
   run-valid-ocsp-server:
     - command: shell.exec
@@ -611,9 +485,8 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
           TEST_INDEX_URI="${TEST_INDEX_URI}" \
-          task evg-test-search-index
+          ${RUN_TASK} evg-test-search-index
 
   add-aws-auth-variables-to-file:
     - command: ec2.assume_role
@@ -632,115 +505,85 @@ functions:
       type: test
       params:
         shell: "bash"
-        working_dir: "src"
+        working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh regular
+          ${RUN_TASK} evg-test-aws -- regular
 
   run-aws-auth-test-with-assume-role-credentials:
     - command: shell.exec
       type: test
       params:
         shell: "bash"
-        working_dir: "src"
+        working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh assume-role
+          ${RUN_TASK} evg-test-aws -- assume-role
 
   run-aws-auth-test-with-aws-EC2-credentials:
     - command: shell.exec
       type: test
       params:
         shell: "bash"
-        working_dir: "src"
+        working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
           if [ "${SKIP_EC2_AUTH_TEST}" = "true" ]; then
             echo "This platform does not support the EC2 auth test, skipping..."
             exit 0
           fi
-          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh ec2
+          ${RUN_TASK} evg-test-aws -- ec2
 
   run-aws-auth-test-with-aws-credentials-as-environment-variables:
     - command: shell.exec
       type: test
       params:
         shell: "bash"
-        working_dir: "src"
+        working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh env-creds
+          ${RUN_TASK} evg-test-aws -- env-creds
 
   run-aws-auth-test-with-aws-credentials-and-session-token-as-environment-variables:
     - command: shell.exec
       type: test
       params:
         shell: "bash"
-        working_dir: "src"
+        working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh session-creds
+          ${RUN_TASK} evg-test-aws -- session-creds
 
   run-aws-ECS-auth-test:
-    - command: shell.exec
-      type: test
-      params:
-        shell: "bash"
-        working_dir: src/go.mongodb.org/mongo-driver
-        script: |
-          ${PREPARE_SHELL}
-          if [ "${SKIP_ECS_AUTH_TEST}" = "true" ]; then
-            echo "This platform does not support the ECS auth test, skipping..."
-            exit 0
-          fi
-          task build-aws-ecs-test
-    - command: shell.exec
+    - command: subprocess.exec
       type: test
       params:
-        shell: "bash"
-        working_dir: "src"
-        script: |
-          ${PREPARE_SHELL}
-          if [ "${SKIP_ECS_AUTH_TEST}" = "true" ]; then
-            exit 0
-          fi
-          AUTH_AWS_DIR=${DRIVERS_TOOLS}/.evergreen/auth_aws
-          ECS_SRC_DIR=$AUTH_AWS_DIR/src
-          # pack up project directory to ssh it to the container
-          mkdir -p $ECS_SRC_DIR/.evergreen
-          cp ${PROJECT_DIRECTORY}/main $ECS_SRC_DIR
-          cp ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-ecs-test.sh $ECS_SRC_DIR/.evergreen
-          tar -czf $ECS_SRC_DIR/src.tgz -C $PROJECT_DIRECTORY .
-
-          export PROJECT_DIRECTORY="$ECS_SRC_DIR"
-          $AUTH_AWS_DIR/aws_setup.sh ecs
+        binary: "bash"
+        working_dir: src
+        include_expansions_in_env: ["SKIP_ECS_AUTH_TEST"]
+        args: 
+          - ${RUN_TASK} 
+          - evg-test-aws-ecs
 
   run-aws-auth-test-with-aws-web-identity-credentials:
     - command: shell.exec
       type: test
       params:
         shell: "bash"
-        working_dir: "src"
+        working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
           if [ "${SKIP_WEB_IDENTITY_AUTH_TEST}" = "true" ]; then
              echo "This platform does not support the web identity auth test, skipping..."
              exit 0
           fi
-          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh web-identity
+          ${RUN_TASK} evg-test-aws -- web-identity
     - command: shell.exec
       type: test
       params:
         shell: "bash"
-        working_dir: "src"
+        working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
           if [ "${SKIP_WEB_IDENTITY_AUTH_TEST}" = "true" ]; then
              echo "This platform does not support the web identity auth test, skipping..."
              exit 0
           fi
           export AWS_ROLE_SESSION_NAME="test"
-          ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh web-identity
+          ${RUN_TASK} evg-test-aws -- web-identity
 
   start-cse-servers:
     - command: ec2.assume_role
@@ -768,19 +611,15 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          source ./secrets-export.sh
-          export KMS_TLS_TESTCASE="${KMS_TLS_TESTCASE}"
-
           AUTH="${AUTH}" \
           SSL="${SSL}" \
           MONGODB_URI="${MONGODB_URI}" \
           TOPOLOGY="${TOPOLOGY}" \
           MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
-          BUILD_TAGS="-tags=cse" \
-          task evg-test-kms \
-          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
-          LD_LIBRARY_PATH=$LD_LIBRARY_PATH
+          GO_BUILD_TAGS="cse" \
+          ${RUN_TASK} setup-test 
+
+          KMS_TLS_TESTCASE="${KMS_TLS_TESTCASE}" ${RUN_TASK} evg-test-kms
 
   run-kmip-tests:
     - command: shell.exec
@@ -789,33 +628,27 @@ functions:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          source ./secrets-export.sh
-          export KMS_MOCK_SERVERS_RUNNING="true"
-
           AUTH="${AUTH}" \
           SSL="${SSL}" \
           MONGODB_URI="${MONGODB_URI}" \
           TOPOLOGY="${TOPOLOGY}" \
           MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
-          BUILD_TAGS="-tags=cse" \
-          task evg-test-kmip \
-          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
-          LD_LIBRARY_PATH=$LD_LIBRARY_PATH
+          GO_BUILD_TAGS="cse" \
+          ${RUN_TASK} setup-test 
+
+          KMS_MOCK_SERVERS_RUNNING="true" ${RUN_TASK} evg-test-kmip
 
   run-fuzz-tests:
     - command: shell.exec
       type: test
       params:
         shell: "bash"
-        working_dir: "src"
+        working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          ${PROJECT_DIRECTORY}/.evergreen/run-fuzz.sh
+          ${RUN_TASK} run-fuzz
 
 pre:
-  - func: fetch-source
-  - func: prepare-resources
+  - func: setup-system
 
 post:
   - func: teardown
@@ -1725,20 +1558,16 @@ tasks:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          echo "Building build-kms-test ... begin"
-          BUILD_TAGS="-tags=cse" \
-          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
-            task build-kms-test
-          echo "Building build-kms-test ... end"
-          source $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/secrets-export.sh
+          GO_BUILD_TAGS="cse" ${RUN_TASK} setup-test
+          ${RUN_TASK} build-kms-test
+          source ${DRIVERS_TOOLS}/.evergreen/csfle/gcpkms/secrets-export.sh
           echo "Copying files ... begin"
           tar czf testgcpkms.tgz ./testkms ./install/libmongocrypt/lib64/libmongocrypt.*
-          GCPKMS_SRC=testgcpkms.tgz GCPKMS_DST=$GCPKMS_INSTANCENAME: $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/copy-file.sh
+          GCPKMS_SRC=testgcpkms.tgz GCPKMS_DST=$GCPKMS_INSTANCENAME: ${DRIVERS_TOOLS}/.evergreen/csfle/gcpkms/copy-file.sh
           echo "Copying files ... end"
 
           echo "Untarring file ... begin"
-          GCPKMS_CMD="tar xf testgcpkms.tgz" $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/run-command.sh
+          GCPKMS_CMD="tar xf testgcpkms.tgz" ${DRIVERS_TOOLS}/.evergreen/csfle/gcpkms/run-command.sh
           echo "Untarring file ... end"
 
     - command: shell.exec
@@ -1747,9 +1576,8 @@ tasks:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          source $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/secrets-export.sh
-          GCPKMS_CMD="LD_LIBRARY_PATH=./install/libmongocrypt/lib64 MONGODB_URI='mongodb://localhost:27017' PROVIDER='gcp' ./testkms" $DRIVERS_TOOLS/.evergreen/csfle/gcpkms/run-command.sh
+          source ${DRIVERS_TOOLS}/.evergreen/csfle/gcpkms/secrets-export.sh
+          GCPKMS_CMD="LD_LIBRARY_PATH=./install/libmongocrypt/lib64 MONGODB_URI='mongodb://localhost:27017' PROVIDER='gcp' ./testkms" ${DRIVERS_TOOLS}/.evergreen/csfle/gcpkms/run-command.sh
 
   - name: "testgcpkms-fail-task"
     # testgcpkms-fail-task runs in a non-GCE environment.
@@ -1761,12 +1589,9 @@ tasks:
           shell: "bash"
           working_dir: src/go.mongodb.org/mongo-driver
           script: |
-            ${PREPARE_SHELL}
-            echo "Building build-kms-test ... begin"
-            BUILD_TAGS="-tags=cse" \
-            PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
-              task build-kms-test
-            echo "Building build-kms-test ... end"
+            GO_BUILD_TAGS="cse" ${RUN_TASK} setup-test
+            ${RUN_TASK} build-kms-test
+
             LD_LIBRARY_PATH=./install/libmongocrypt/lib64 \
             MONGODB_URI='mongodb://localhost:27017/' \
             EXPECT_ERROR='unable to retrieve GCP credentials' \
@@ -1781,8 +1606,7 @@ tasks:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          task test-awskms
+          ${RUN_TASK} test-awskms
 
   - name: "testawskms-fail-task"
     # testawskms-fail-task runs without environment variables.
@@ -1794,9 +1618,8 @@ tasks:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
           export EXPECT_ERROR='status=400'
-          task test-awskms
+          ${RUN_TASK} test-awskms
 
   - name: "testazurekms-task"
     commands:
@@ -1806,20 +1629,15 @@ tasks:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          echo "Building build-kms-test ... begin"
-          BUILD_TAGS="-tags=cse" \
-          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
-            task build-kms-test
-          echo "Building build-kms-test ... end"
-
+          GO_BUILD_TAGS="cse" ${RUN_TASK} setup-test
+          ${RUN_TASK} build-kms-test
           echo "Copying files ... begin"
-          source $DRIVERS_TOOLS/.evergreen/csfle/azurekms/secrets-export.sh
+          source ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/secrets-export.sh
           tar czf testazurekms.tgz ./testkms ./install/libmongocrypt/lib64/libmongocrypt.*
-          AZUREKMS_SRC=testazurekms.tgz AZUREKMS_DST=/tmp $DRIVERS_TOOLS/.evergreen/csfle/azurekms/copy-file.sh
+          AZUREKMS_SRC=testazurekms.tgz AZUREKMS_DST=/tmp ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/copy-file.sh
           echo "Copying files ... end"
           echo "Untarring file ... begin"
-          AZUREKMS_CMD="tar xf /tmp/testazurekms.tgz" $DRIVERS_TOOLS/.evergreen/csfle/azurekms/run-command.sh
+          AZUREKMS_CMD="tar xf /tmp/testazurekms.tgz" ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/run-command.sh
           echo "Untarring file ... end"
 
     - command: shell.exec
@@ -1828,9 +1646,8 @@ tasks:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          source $DRIVERS_TOOLS/.evergreen/csfle/azurekms/secrets-export.sh
-          AZUREKMS_CMD="LD_LIBRARY_PATH=./install/libmongocrypt/lib64 MONGODB_URI='mongodb://localhost:27017' PROVIDER='azure' AZUREKMS_KEY_NAME=$AZUREKMS_KEYNAME AZUREKMS_KEY_VAULT_ENDPOINT=$AZUREKMS_KEYVAULTENDPOINT ./testkms" $DRIVERS_TOOLS/.evergreen/csfle/azurekms/run-command.sh
+          source ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/secrets-export.sh
+          AZUREKMS_CMD="LD_LIBRARY_PATH=./install/libmongocrypt/lib64 MONGODB_URI='mongodb://localhost:27017' PROVIDER='azure' AZUREKMS_KEY_NAME=$AZUREKMS_KEYNAME AZUREKMS_KEY_VAULT_ENDPOINT=$AZUREKMS_KEYVAULTENDPOINT ./testkms" ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/run-command.sh
 
   - name: "testazurekms-fail-task"
     # testazurekms-fail-task runs without environment variables.
@@ -1842,13 +1659,8 @@ tasks:
         shell: "bash"
         working_dir: src/go.mongodb.org/mongo-driver
         script: |
-          ${PREPARE_SHELL}
-          echo "Building build-kms-test ... begin"
-          BUILD_TAGS="-tags=cse" \
-          PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
-            task build-kms-test
-          echo "Building build-kms-test ... end"
-
+          GO_BUILD_TAGS="cse" ${RUN_TASK} setup-test
+          ${RUN_TASK} build-kms-test
           . ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/setup-secrets.sh
           LD_LIBRARY_PATH=./install/libmongocrypt/lib64 \
           MONGODB_URI='mongodb://localhost:27017' \
@@ -1878,11 +1690,7 @@ tasks:
             AWS_REGION: us-east-1
           include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
           script: |
-            ${PREPARE_SHELL}
-            pushd $TEST_LAMBDA_DIRECTORY/mongodb
-            go mod tidy
-            popd
-            ./.evergreen/run-deployed-lambda-aws-tests.sh
+            ${RUN_TASK} evg-test-deployed-lambda-aws
 
   - name: "oidc-auth-test"
     commands:
@@ -1897,7 +1705,7 @@ tasks:
         shell: bash
         script: |-
           set -o errexit
-          ${PREPARE_SHELL}
+          source env.sh
           export AZUREOIDC_DRIVERS_TAR_FILE=/tmp/mongo-go-driver.tar.gz
           # we need to statically link libc to avoid the situation where the VM has a different
           # version of libc
@@ -1912,7 +1720,7 @@ tasks:
           # Ensure that we source the environment file created for us, set up any other variables we need,
           # and then run our test suite on the vm.
           export AZUREOIDC_TEST_CMD="PROJECT_DIRECTORY='.' OIDC_ENV=azure OIDC=oidc ./etc/run-oidc-test.sh ./test"
-          bash $DRIVERS_TOOLS/.evergreen/auth_oidc/azure/run-driver-test.sh
+          bash ${DRIVERS_TOOLS}/.evergreen/auth_oidc/azure/run-driver-test.sh
 
   - name: "oidc-auth-test-gcp"
     commands:
@@ -1923,7 +1731,7 @@ tasks:
         shell: bash
         script: |-
           set -o errexit
-          ${PREPARE_SHELL}
+          source env.sh
           export GCPOIDC_DRIVERS_TAR_FILE=/tmp/mongo-go-driver.tar.gz
           # we need to statically link libc to avoid the situation where the VM has a different
           # version of libc
@@ -1938,7 +1746,7 @@ tasks:
           # Ensure that we source the environment file created for us, set up any other variables we need,
           # and then run our test suite on the vm.
           export GCPOIDC_TEST_CMD="PROJECT_DIRECTORY='.' OIDC_ENV=gcp OIDC=oidc ./etc/run-oidc-test.sh ./test"
-          bash $DRIVERS_TOOLS/.evergreen/auth_oidc/gcp/run-driver-test.sh
+          bash ${DRIVERS_TOOLS}/.evergreen/auth_oidc/gcp/run-driver-test.sh
 
   - name: "test-search-index"
     commands:
@@ -2111,9 +1919,7 @@ task_groups:
     setup_group_can_fail_task: true
     setup_group_timeout_secs: 1800 # 30 minutes
     setup_group:
-      - func: fetch-source
-      - func: prepare-resources
-      - func: start-cse-servers
+      - func: setup-system
       - command: subprocess.exec
         params:
           binary: "bash"
@@ -2126,8 +1932,6 @@ task_groups:
         params:
           shell: "bash"
           script: |
-            ${PREPARE_SHELL}
-
             # Find the crypt_shared library file in the current directory and set the CRYPT_SHARED_LIB_PATH to
             # the path of that file. Only look for .so, .dll, or .dylib files to prevent matching any other
             # downloaded files.
@@ -2164,8 +1968,7 @@ task_groups:
     setup_group_can_fail_task: true
     setup_group_timeout_secs: 1800 # 30 minutes
     setup_group:
-      - func: fetch-source
-      - func: prepare-resources
+      - func: setup-system
       - command: subprocess.exec
         params:
           binary: "bash"
@@ -2187,15 +1990,12 @@ task_groups:
     teardown_group_can_fail_task: true
     setup_group_timeout_secs: 1800 # 30 minutes
     setup_group:
-      - func: fetch-source
-      - func: prepare-resources
+      - func: setup-system
       - command: shell.exec
         params:
           shell: "bash"
           script: |
-            ${PREPARE_SHELL}
             export AZUREKMS_VMNAME_PREFIX="GODRIVER"
-            export AZUREKMS_DRIVERS_TOOLS=$DRIVERS_TOOLS
             # Get azurekms credentials from the vault.
             . ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/setup-secrets.sh
             ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/create-and-setup-vm.sh
@@ -2213,8 +2013,7 @@ task_groups:
 
   - name: testoidc_task_group
     setup_group:
-      - func: fetch-source
-      - func: prepare-resources
+      - func: setup-system
       - func: assume-ec2-role
       - command: subprocess.exec
         params:
@@ -2239,8 +2038,7 @@ task_groups:
 
   - name: testazureoidc_task_group
     setup_group:
-      - func: fetch-source
-      - func: prepare-resources
+      - func: setup-system
       - command: subprocess.exec
         params:
           binary: bash
@@ -2263,8 +2061,7 @@ task_groups:
 
   - name: testgcpoidc_task_group
     setup_group:
-      - func: fetch-source
-      - func: prepare-resources
+      - func: setup-system
       - command: subprocess.exec
         params:
           binary: bash
@@ -2287,8 +2084,7 @@ task_groups:
 
   - name: test-aws-lambda-task-group
     setup_group:
-      - func: fetch-source
-      - func: prepare-resources
+      - func: setup-system
       - command: subprocess.exec
         params:
           working_dir: src/go.mongodb.org/mongo-driver
@@ -2316,8 +2112,7 @@ task_groups:
 
   - name: test-search-index-task-group
     setup_group:
-      - func: fetch-source
-      - func: prepare-resources
+      - func: setup-system
       - command: subprocess.exec
         params:
           working_dir: src/go.mongodb.org/mongo-driver
diff --git a/.evergreen/run-deployed-lambda-aws-tests.sh b/.evergreen/run-deployed-lambda-aws-tests.sh
deleted file mode 100755
index bde083a732..0000000000
--- a/.evergreen/run-deployed-lambda-aws-tests.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/bash
-#
-set -o errexit  # Exit the script with error if any of the commands fail.
-
-source ${DRIVERS_TOOLS}/.evergreen/atlas/secrets-export.sh
-
-VARLIST=(
-	AWS_REGION
-	DRIVERS_TOOLS
-	DRIVERS_ATLAS_PUBLIC_API_KEY
-	DRIVERS_ATLAS_PRIVATE_API_KEY
-	DRIVERS_ATLAS_LAMBDA_USER
-	DRIVERS_ATLAS_LAMBDA_PASSWORD
-	DRIVERS_ATLAS_GROUP_ID
-	LAMBDA_STACK_NAME
-	PROJECT_DIRECTORY
-	TEST_LAMBDA_DIRECTORY
-)
-
-# Ensure that all variables required to run the test are set, otherwise throw
-# an error.
-for VARNAME in ${VARLIST[*]}; do
-	[[ -z "${!VARNAME}" ]] && echo "ERROR: $VARNAME not set" && exit 1;
-done
-
-echo "Starting deployment"
-. ${DRIVERS_TOOLS}/.evergreen/aws_lambda/run-deployed-lambda-aws-tests.sh
diff --git a/.evergreen/run-task.sh b/.evergreen/run-task.sh
new file mode 100755
index 0000000000..564d937703
--- /dev/null
+++ b/.evergreen/run-task.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+#
+# Source the env.sh file and run the given task
+set -eu
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+PROJECT_DIRECTORY=$(dirname $SCRIPT_DIR)
+pushd ${PROJECT_DIRECTORY} > /dev/null
+
+source env.sh
+task "$@"
+
+popd > /dev/null
diff --git a/.evergreen/run-tests.sh b/.evergreen/run-tests.sh
deleted file mode 100755
index 617b6e1d4c..0000000000
--- a/.evergreen/run-tests.sh
+++ /dev/null
@@ -1,103 +0,0 @@
-#!/bin/bash
-
-set -o errexit
-
-export GOPATH=$(dirname $(dirname $(dirname `pwd`)))
-export GOCACHE="$(pwd)/.cache"
-export DRIVERS_TOOLS=${DRIVERS_TOOLS:-""}
-
-if [ -z $DRIVERS_TOOLS ]; then
-  export DRIVERS_TOOLS="$(dirname $(dirname $(dirname `pwd`)))/drivers-tools"
-fi
-
-if [ "Windows_NT" = "${OS:-}" ]; then
-    export GOPATH=$(cygpath -m $GOPATH)
-    export GOCACHE=$(cygpath -m $GOCACHE)
-    export DRIVERS_TOOLS=$(cygpath -m $DRIVERS_TOOLS)
-fi
-
-export GOROOT="${GOROOT}"
-export PATH="${GOROOT}/bin:${GCC_PATH}:$GOPATH/bin:$PATH"
-export PROJECT="${project}"
-export PKG_CONFIG_PATH=$(pwd)/install/libmongocrypt/lib64/pkgconfig
-export LD_LIBRARY_PATH=$(pwd)/install/libmongocrypt/lib64
-
-if [ "$(uname -s)" = "Darwin" ]; then
-  export PKG_CONFIG_PATH=$(pwd)/install/libmongocrypt/lib/pkgconfig
-  export DYLD_FALLBACK_LIBRARY_PATH=$(pwd)/install/libmongocrypt/lib
-else
-  export PKG_CONFIG_PATH=$(pwd)/install/libmongocrypt/lib64/pkgconfig
-  export LD_LIBRARY_PATH=$(pwd)/install/libmongocrypt/lib64
-fi
-
-SSL=${SSL:-nossl}
-if [ "$SSL" != "nossl" -a -z "${SERVERLESS+x}" ]; then
-    export MONGO_GO_DRIVER_CA_FILE="${DRIVERS_TOOLS}/.evergreen/x509gen/ca.pem"
-    export MONGO_GO_DRIVER_KEY_FILE="${DRIVERS_TOOLS}/.evergreen/x509gen/client.pem"
-    export MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE="${DRIVERS_TOOLS}/.evergreen/x509gen/client-pkcs8-encrypted.pem"
-    export MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE="${DRIVERS_TOOLS}/.evergreen/x509gen/client-pkcs8-unencrypted.pem"
-
-    if [ "Windows_NT" = "$OS" ]; then
-        export MONGO_GO_DRIVER_CA_FILE=$(cygpath -m $MONGO_GO_DRIVER_CA_FILE)
-        export MONGO_GO_DRIVER_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_KEY_FILE)
-        export MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE)
-        export MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE)
-    fi
-fi
-
-if [ -f "secrets-export.sh" ]; then
-    source $(pwd)/secrets-export.sh
-fi
-
-# If GO_BUILD_TAGS is not set, set the default Go build tags to "cse" to enable
-# client-side encryption, which requires linking the libmongocrypt C library.
-if [ -z ${GO_BUILD_TAGS+x} ]; then
-  GO_BUILD_TAGS="cse"
-fi
-
-if [[ $GO_BUILD_TAGS == *"cse"* ]]; then
-  if [ "Windows_NT" = "$OS" ]; then
-    if [ ! -d /cygdrive/c/libmongocrypt/bin ]; then
-      bash $(pwd)/etc/install-libmongocrypt.sh
-    fi
-    export PATH=$PATH:/cygdrive/c/libmongocrypt/bin
-  elif [ ! -d "$PKG_CONFIG_PATH" ]; then
-    bash $(pwd)/etc/install-libmongocrypt.sh
-  fi
-fi
-
-if [ "${SKIP_CRYPT_SHARED_LIB}" = "true" ]; then
-  CRYPT_SHARED_LIB_PATH=""
-  echo "crypt_shared library is skipped"
-elif [ -z "${CRYPT_SHARED_LIB_PATH}" ]; then
-  echo "crypt_shared library path is empty"
-else
-  CRYPT_SHARED_LIB_PATH=${CRYPT_SHARED_LIB_PATH}
-  echo "crypt_shared library will be loaded from path: $CRYPT_SHARED_LIB_PATH"
-fi
-
-if [ -z ${TASKFILE_TARGET+x} ]; then
-  if [ "$(uname -s)" = "Darwin" ]; then
-      # Run a subset of the tests on Darwin
-      TASKFILE_TARGET="evg-test-load-balancers"
-  else
-    TASKFILE_TARGET="evg-test"
-  fi
-fi
-
-AUTH=${AUTH} \
-SSL=${SSL} \
-SKIP_CSOT_TESTS=${SKIP_CSOT_TESTS} \
-MONGO_GO_DRIVER_CA_FILE=${MONGO_GO_DRIVER_CA_FILE} \
-MONGO_GO_DRIVER_KEY_FILE=${MONGO_GO_DRIVER_KEY_FILE} \
-MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE=${MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE} \
-MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE=${MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE} \
-MONGODB_URI="${MONGODB_URI}" \
-TOPOLOGY=${TOPOLOGY} \
-MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
-BUILD_TAGS="${RACE} -tags=${GO_BUILD_TAGS}" \
-CRYPT_SHARED_LIB_PATH=$CRYPT_SHARED_LIB_PATH \
-PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
-LD_LIBRARY_PATH=$LD_LIBRARY_PATH \
-MACOS_LIBRARY_PATH=$DYLD_FALLBACK_LIBRARY_PATH \
-task $TASKFILE_TARGET
diff --git a/.evergreen/setup-system.sh b/.evergreen/setup-system.sh
new file mode 100755
index 0000000000..7b7e402da6
--- /dev/null
+++ b/.evergreen/setup-system.sh
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+#
+# Set up environment and write env.sh and expansion.yml files.
+set -eu
+
+# Set up default environment variables.
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+PROJECT_DIRECTORY=$(dirname $SCRIPT_DIR)
+ROOT_DIR=$(dirname $PROJECT_DIRECTORY)
+DRIVERS_TOOLS=${DRIVERS_TOOLS:-${ROOT_DIR}/drivers-evergreen-tools}
+MONGO_ORCHESTRATION_HOME="${DRIVERS_TOOLS}/.evergreen/orchestration"
+MONGODB_BINARIES="${DRIVERS_TOOLS}/mongodb/bin"
+OS="${OS:-""}"
+
+# Set Golang environment vars. GOROOT is wherever current Go distribution is, and is set in evergreen config.
+# GOPATH is always 3 directories up from pwd on EVG; GOCACHE is under .cache in the pwd.
+GOROOT=${GOROOT:-$(dirname "$(dirname "$(which go)")")}
+export GOPATH=${GOPATH:-$ROOT_DIR}
+export GOCACHE="${GO_CACHE:-$PROJECT_DIRECTORY/.cache}"
+
+# Handle paths on Windows.
+if [ "Windows_NT" = "${OS:-}" ]; then # Magic variable in cygwin
+  GOPATH=$(cygpath -m $GOPATH)
+  GOCACHE=$(cygpath -w $GOCACHE)
+  DRIVERS_TOOLS=$(cygpath -m $DRIVERS_TOOLS)
+  PROJECT_DIRECTORY=$(cygpath -m $PROJECT_DIRECTORY)
+  EXTRA_PATH=/cygdrive/c/libmongocrypt/bin
+  MONGO_ORCHESTRATION_HOME=$(cygpath -m $MONGO_ORCHESTRATION_HOME)
+  MONGODB_BINARIES=$(cygpath -m $MONGODB_BINARIES)
+  # Set home variables for Windows, too.
+  USERPROFILE=$(cygpath -w "$ROOT_DIR")
+  HOME=$USERPROFILE
+else
+  EXTRA_PATH=${GCC:-}
+fi
+
+# Add binaries to the path.
+PATH="${GOROOT}/bin:${GOPATH}/bin:${MONGODB_BINARIES}:${EXTRA_PATH}:${PATH}"
+
+# Get the current unique version of this checkout.
+if [ "${IS_PATCH:-}" = "true" ]; then
+    CURRENT_VERSION=$(git describe)-patch-${VERSION_ID}
+else
+    CURRENT_VERSION=latest
+fi
+
+# Ensure a checkout of drivers-tools.
+if [ ! -d "$DRIVERS_TOOLS" ]; then
+  git clone https://github.com/mongodb-labs/drivers-evergreen-tools $DRIVERS_TOOLS
+fi
+
+# Write the .env file for drivers-tools.
+cat <<EOT > ${DRIVERS_TOOLS}/.env
+SKIP_LEGACY_SHELL=1
+DRIVERS_TOOLS="$DRIVERS_TOOLS"
+MONGO_ORCHESTRATION_HOME="$MONGO_ORCHESTRATION_HOME"
+MONGODB_BINARIES="$MONGODB_BINARIES"
+TMPDIR="$MONGO_ORCHESTRATION_HOME/db"
+EOT
+
+# Check Go installation.
+go version
+go env
+
+# Install taskfile.
+go install github.com/go-task/task/v3/cmd/task@v3.39.1
+
+# Write our own env file.
+cat <<EOT > env.sh
+export GOROOT="$GOROOT"
+export GOPATH="$GOPATH"
+export GOCACHE="$GOCACHE"
+export DRIVERS_TOOLS="$DRIVERS_TOOLS"
+export PROJECT_DIRECTORY="$PROJECT_DIRECTORY"
+export PATH="$PATH"
+EOT
+
+if [ "Windows_NT" = "$OS" ]; then
+    echo "export USERPROFILE=$USERPROFILE" >> env.sh
+    echo "export HOME=$HOME" >> env.sh
+fi
+
+# source the env.sh file and write the expansion file.
+cat <<EOT > expansion.yml
+CURRENT_VERSION: "$CURRENT_VERSION"
+DRIVERS_TOOLS: "$DRIVERS_TOOLS"
+PROJECT_DIRECTORY: "$PROJECT_DIRECTORY"
+RUN_TASK: "$PROJECT_DIRECTORY/.evergreen/run-task.sh"
+EOT
+
+cat env.sh
diff --git a/.gitignore b/.gitignore
index a3a646d873..c024a44d76 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,9 @@ libmongocrypt
 venv
 test.suite
 go.work.sum
+.task
+env.sh
+expansion.yml
 
 # AWS SAM-generated files
 internal/cmd/faas/awslambda/.aws-sam
@@ -36,3 +39,4 @@ api-report.txt
 # Ignore secrets files
 secrets-expansion.yml
 secrets-export.sh
+.test.env
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 1c82f8a5aa..571868de35 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -34,7 +34,7 @@ repos:
   hooks:
     - id: shellcheck
       name: shellcheck
-      args: ["--severity=error"]
+      args: ["--severity=warning"]
 
 - repo: https://github.com/codespell-project/codespell
   rev: "v2.2.6"
diff --git a/Taskfile.yml b/Taskfile.yml
index a87226cb5e..76c89600e1 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -5,6 +5,8 @@ env:
   TEST_TIMEOUT: 1800
   LONG_TEST_TIMEOUT: 3600
 
+dotenv: ['.test.env']
+
 tasks:
 
   ### Utility tasks. ###
@@ -16,7 +18,7 @@ tasks:
   check-license: bash etc/check_license.sh
 
   build:
-    deps: [cross-compile, build-tests, build-compile-check]
+    deps: [cross-compile, build-tests, build-compile-check, install-libmongocrypt]
     cmds:
       - go build ./...
       - go build ${BUILD_TAGS} ./...
@@ -25,6 +27,8 @@ tasks:
 
   build-compile-check: bash etc/compile_check.sh
 
+  build-aws-ecs-test: go build ${BUILD_TAGS} ./internal/cmd/testaws/main.go
+
   cross-compile: 
     - GOOS=linux GOARCH=386 go build ./...
     - GOOS=linux GOARCH=arm go build ./...
@@ -46,10 +50,15 @@ tasks:
 
   api-report: bash etc/api_report.sh
 
-  install-libmongocrypt: bash etc/install-libmongocrypt.sh
+  install-libmongocrypt: 
+    cmds: [bash etc/install-libmongocrypt.sh]
+    status: 
+      - test -d install || test -d /cygdrive/c/libmongocrypt/bin
 
   run-docker: bash etc/run_docker.sh
 
+  run-fuzz: bash etc/run-fuzz.sh
+
   cherry-picker: bash etc/cherry-picker.sh
 
   # Lint with various GOOS and GOARCH tasks to catch static analysis failures that may only affect
@@ -80,7 +89,8 @@ tasks:
 
   test-oidc: bash etc/run-oidc-test.sh 'task --silent evg-test-oidc-auth'
 
-  test-atlas: bash etc/run-atlas-test.sh
+  test-atlas-connect: 
+    - go test -v -run ^TestAtlas$ go.mongodb.org/mongo-driver/v2/internal/cmd/testatlas -args "$ATLAS_REPL" "$ATLAS_SHRD" "$ATLAS_FREE" "$ATLAS_TLS11" "$ATLAS_TLS12" "$ATLAS_SERVERLESS" "$ATLAS_SRV_REPL" "$ATLAS_SRV_SHRD" "$ATLAS_SRV_FREE" "$ATLAS_SRV_TLS11" "$ATLAS_SRV_TLS12" "$ATLAS_SRV_SERVERLESS" >> test.suite
 
   test-awskms: bash etc/run-awskms-test.sh
 
@@ -92,7 +102,7 @@ tasks:
       - make -c internal/cmd/faas/awslambda
 
   ### Evergreen specific tasks. ###
-  build-aws-ecs-test: go build ${BUILD_TAGS} ./internal/cmd/testaws/main.go
+  setup-test: bash etc/setup-test.sh {{.CLI_ARGS}}
 
   evg-test:
     - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} DYLD_LIBRARY_PATH=$MACOS_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s -p 1 ./... >> test.suite
@@ -101,7 +111,8 @@ tasks:
     - ATLAS_DATA_LAKE_INTEGRATION_TEST=true go test -v ./internal/integration -run TestUnifiedSpecs/atlas-data-lake-testing >> spec_test.suite
     - ATLAS_DATA_LAKE_INTEGRATION_TEST=true go test -v ./internal/integration -run TestAtlasDataLake >> spec_test.suite
 
-  evg-test-enterprise-auth: go run -tags gssapi ./internal/cmd/testentauth/main.go
+  evg-test-enterprise-auth: 
+    - go run -tags gssapi ./internal/cmd/testentauth/main.go
 
   evg-test-oidc-auth:
     - go run ./internal/cmd/testoidcauth/main.go
@@ -164,6 +175,12 @@ tasks:
     - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} DYLD_LIBRARY_PATH=${MACOS_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration >> test.suite
     - go test -exec "env PKG_CONFIG_PATH=${PKG_CONFIG_PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} DYLD_LIBRARY_PATH=${MACOS_LIBRARY_PATH}" ${BUILD_TAGS} -v -timeout {{.TEST_TIMEOUT}}s ./internal/integration/unified >> test.suite
 
+  evg-test-aws: bash etc/run-mongodb-aws-test.sh {{.CLI_ARGS}}
+
+  evg-test-aws-ecs: bash etc/run-mongodb-aws-ecs-test.sh
+
+  evg-test-deployed-lambda-aws: bash ${DRIVERS_TOOLS}/.evergreen/aws_lambda/run-deployed-lambda-aws-tests.sh
+
   build-kms-test: go build ${BUILD_TAGS} ./internal/cmd/testkms
 
   ### Benchmark specific tasks and support. ###
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index fcca800429..7514557427 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -183,7 +183,9 @@ However, some of the tests require secrets handling.  Please see the team [Wiki]
 The test suite can be run with or without the secrets as follows:
 
 ```bash
-TASKFILE_TARGET=evg-test-versioned-api bash .evergreen/run-tests.sh
+task setup-env
+task setup-test
+task evg-test-versioned-api
 ```
 
 ### Load Balancer
diff --git a/etc/check_license.sh b/etc/check_license.sh
index 36a32bf342..5d13fa68e3 100755
--- a/etc/check_license.sh
+++ b/etc/check_license.sh
@@ -12,7 +12,8 @@ add_copyright() {
     file=$1
 
     # Check if first 24 bytes match first 24 bytes of copyright notice.
-    local line=$(head -c 24 $file)
+    local line
+    line=$(head -c 24 $file)
     if [ "$line" == "// Copyright (C) MongoDB" ]; then
         if [ ! -z "$verbose" ]; then
             echo "$file already has copyright notice" >&2
@@ -21,7 +22,7 @@ add_copyright() {
     fi
 
     # Check if first 14 bytes matches the prefix "// Copied from"
-    local line=$(head -c 14 $file)
+    line=$(head -c 14 $file)
     if [ "$line" == "// Copied from" ]; then
         if [ ! -z "$verbose" ]; then
             echo "$file has a third-party copyright notice" >&2
@@ -46,6 +47,10 @@ do
     case "${flag}" in
         a) add=1;;
         v) verbose=1;;
+        *)
+            echo "flag not recognized"
+            exit 1
+            ;;
     esac
 done
 
diff --git a/etc/check_modules.sh b/etc/check_modules.sh
index 62d8a6fcae..9204ec34a2 100755
--- a/etc/check_modules.sh
+++ b/etc/check_modules.sh
@@ -8,7 +8,7 @@ set -eu
 mods=$(find . -name go.mod)
 exit_code=0
 for mod in $mods; do
-  pushd $(dirname $mod) > /dev/null
+  pushd "$(dirname $mod)" > /dev/null
   echo "Checking $mod..."
   go mod tidy -v
   git diff --exit-code go.mod go.sum || {
diff --git a/etc/compile_check.sh b/etc/compile_check.sh
index f63fd62d85..69e4395a12 100755
--- a/etc/compile_check.sh
+++ b/etc/compile_check.sh
@@ -4,6 +4,7 @@ set -x # show all commands being run
 
 GC=go
 COMPILE_CHECK_DIR="internal/cmd/compilecheck"
+# shellcheck disable=SC2034
 DEV_MIN_VERSION=1.19
 
 # version will flatten a version string of upto 4 components for inequality
@@ -23,7 +24,7 @@ function compile_check {
 	MACHINE_VERSION=`${GC} version | { read _ _ v _; echo ${v#go}; }`
 
 	# If the version is not 1.13, then run "go mod tidy"
-	if [ $(version $MACHINE_VERSION) -ge $(version 1.15) ]; then
+	if [ "$(version $MACHINE_VERSION)" -ge "$(version 1.15)" ]; then
 		go mod tidy
 	fi
 
diff --git a/etc/docker_entry.sh b/etc/docker_entry.sh
index 654ab98a47..52f4db7eb1 100755
--- a/etc/docker_entry.sh
+++ b/etc/docker_entry.sh
@@ -11,5 +11,7 @@ cp -r $HOME/install ./install
 
 export PATH="$MONGODB_BINARIES:$HOME/go/bin:$PATH"
 
+task setup-test
+
 # Run the test.
-bash ./.evergreen/run-tests.sh
+task evg-test
diff --git a/etc/golangci-lint.sh b/etc/golangci-lint.sh
index f7e6f5c20d..8c72fe75df 100755
--- a/etc/golangci-lint.sh
+++ b/etc/golangci-lint.sh
@@ -10,7 +10,8 @@ export GOARCH=
 # Keep this in sync with go version used in static-analysis Evergreen build variant.
 go install golang.org/dl/go1.22.7@latest
 go1.22.7 download
-export PATH="$(go1.22.7 env GOROOT)/bin:$PATH"
+PATH="$(go1.22.7 env GOROOT)/bin:$PATH"
+export PATH
 go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.60.1
 
 export GOOS=$GOOS_ORIG
diff --git a/etc/prep-perf.sh b/etc/prep-perf.sh
index 9d645e9cde..6ec31d6e4d 100755
--- a/etc/prep-perf.sh
+++ b/etc/prep-perf.sh
@@ -9,7 +9,7 @@ fi
 
 curl --retry 5 "https://s3.amazonaws.com/boxes.10gen.com/build/driver-test-data.tar.gz" -o driver-test-data.tar.gz --silent --max-time 120
 
-if [ $(uname -s) == "Darwin" ]; then
+if [ "$(uname -s)" == "Darwin" ]; then
     tar -zxf driver-test-data.tar.gz -s /testdata/perf/
 else
     tar -zxf driver-test-data.tar.gz  --transform=s/testdata/perf/
diff --git a/etc/run-atlas-test.sh b/etc/run-atlas-test.sh
deleted file mode 100755
index c096f7096e..0000000000
--- a/etc/run-atlas-test.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-# run-atlas-test
-# Run atlas connectivity tests.
-set -eu
-set +x
-
-# Get the atlas secrets.
-. ${DRIVERS_TOOLS}/.evergreen/secrets_handling/setup-secrets.sh drivers/atlas_connect
-
-echo "Running cmd/testatlas"
-go test -v -run ^TestAtlas$ go.mongodb.org/mongo-driver/v2/internal/cmd/testatlas -args "$ATLAS_REPL" "$ATLAS_SHRD" "$ATLAS_FREE" "$ATLAS_TLS11" "$ATLAS_TLS12" "$ATLAS_SERVERLESS" "$ATLAS_SRV_REPL" "$ATLAS_SRV_SHRD" "$ATLAS_SRV_FREE" "$ATLAS_SRV_TLS11" "$ATLAS_SRV_TLS12" "$ATLAS_SRV_SERVERLESS" >> test.suite
diff --git a/etc/run-awskms-test.sh b/etc/run-awskms-test.sh
index d04040fcb6..e37c27f57f 100755
--- a/etc/run-awskms-test.sh
+++ b/etc/run-awskms-test.sh
@@ -1,12 +1,10 @@
 #!/usr/bin/env bash
 # run-awskms-test
 # Runs the awskms test.
+set -eu
 
-echo "Building build-kms-test ... begin"
-BUILD_TAGS="-tags=cse" \
-    PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
-    task build-kms-test
-echo "Building build-kms-test ... end"
+GO_BUILD_TAGS="cse" task setup-test
+task build-kms-test
 
 . ${DRIVERS_TOOLS}/.evergreen/secrets_handling/setup-secrets.sh drivers/atlas_connect
 export MONGODB_URI="$ATLAS_FREE"
diff --git a/etc/run-enterprise-gssapi-test.sh b/etc/run-enterprise-gssapi-test.sh
deleted file mode 100755
index 6339d512ff..0000000000
--- a/etc/run-enterprise-gssapi-test.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-# run-enterprise-gssapi-test
-# Runs the enterprise auth tests with gssapi credentials.
-set -eu
-
-. ${DRIVERS_TOOLS}/.evergreen/secrets_handling/setup-secrets.sh drivers/enterprise_auth
-if [ "Windows_NT" = "${OS:-}" ]; then
-    export MONGODB_URI="mongodb://${PRINCIPAL/@/%40}:${SASL_PASS}@${SASL_HOST}:${SASL_PORT}/kerberos?authMechanism=GSSAPI"
-else
-    echo ${KEYTAB_BASE64} | base64 -d > ${PROJECT_DIRECTORY}/.evergreen/drivers.keytab
-    mkdir -p ~/.krb5
-    cat .evergreen/krb5.config | tee -a ~/.krb5/config
-    kinit -k -t ${PROJECT_DIRECTORY}/.evergreen/drivers.keytab -p "${PRINCIPAL}"
-    export MONGODB_URI="mongodb://${PRINCIPAL/@/%40}@${SASL_HOST}:${SASL_PORT}/kerberos?authMechanism=GSSAPI"
-fi
-export MONGO_GO_DRIVER_COMPRESSOR="${MONGO_GO_DRIVER_COMPRESSOR:-}"
-
-task --silent evg-test-enterprise-auth
diff --git a/etc/run-enterprise-plain-test.sh b/etc/run-enterprise-plain-test.sh
deleted file mode 100755
index f3b31f07c7..0000000000
--- a/etc/run-enterprise-plain-test.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-# run-enterprise-gssapi-test
-# Runs the enterprise auth tests with plain credentials.
-set -eu
-. ${DRIVERS_TOOLS}/.evergreen/secrets_handling/setup-secrets.sh drivers/enterprise_auth
-export MONGODB_URI="mongodb://${SASL_USER}:${SASL_PASS}@${SASL_HOST}:${SASL_PORT}/ldap?authMechanism=PLAIN"
-export MONGO_GO_DRIVER_COMPRESSOR="${MONGO_GO_DRIVER_COMPRESSOR:-}"
-task --silent evg-test-enterprise-auth
diff --git a/.evergreen/run-fuzz.sh b/etc/run-fuzz.sh
similarity index 98%
rename from .evergreen/run-fuzz.sh
rename to etc/run-fuzz.sh
index bb914d9027..fefd088796 100755
--- a/.evergreen/run-fuzz.sh
+++ b/etc/run-fuzz.sh
@@ -44,6 +44,7 @@ do
 			for CORPUS_FILE in $PARENTDIR/testdata/fuzz/$FUNC/*
 			do
 				# Check to see if the value for CORPUS_FILE is in cset.
+				# shellcheck disable=SC2076
 				if [[ ! " ${cset[*]} " =~ " ${CORPUS_FILE} " ]]; then
 					# Create the directory if it doesn't exist.
 					if [ ! -d $PROJECT_DIRECTORY/fuzz/$FUNC ]; then
diff --git a/etc/run-mongodb-aws-ecs-test.sh b/etc/run-mongodb-aws-ecs-test.sh
new file mode 100755
index 0000000000..4e4b794da9
--- /dev/null
+++ b/etc/run-mongodb-aws-ecs-test.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+set -eu
+
+if [ "${SKIP_ECS_AUTH_TEST:-}" = "true" ]; then
+    echo "This platform does not support the ECS auth test, skipping..."
+    exit 0
+fi
+
+task build-aws-ecs-test
+
+AUTH_AWS_DIR=${DRIVERS_TOOLS}/.evergreen/auth_aws
+ECS_SRC_DIR=$AUTH_AWS_DIR/src
+
+# pack up project directory to ssh it to the container
+mkdir -p $ECS_SRC_DIR/.evergreen
+cp ${PROJECT_DIRECTORY}/main $ECS_SRC_DIR
+cp ${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-ecs-test.sh $ECS_SRC_DIR/.evergreen
+tar -czf $ECS_SRC_DIR/src.tgz -C ${PROJECT_DIRECTORY} .
+
+export PROJECT_DIRECTORY="$ECS_SRC_DIR"
+$AUTH_AWS_DIR/aws_setup.sh ecs
diff --git a/.evergreen/run-mongodb-aws-test.sh b/etc/run-mongodb-aws-test.sh
similarity index 100%
rename from .evergreen/run-mongodb-aws-test.sh
rename to etc/run-mongodb-aws-test.sh
diff --git a/etc/run-serverless-test.sh b/etc/run-serverless-test.sh
deleted file mode 100755
index 25d3eaac1f..0000000000
--- a/etc/run-serverless-test.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-# run-serverless-test
-# Runs the serverless tests.
-source ${DRIVERS_TOOLS}/.evergreen/serverless/secrets-export.sh
-AUTH="auth" \
-    SSL="ssl" \
-    MONGODB_URI="${SERVERLESS_URI}" \
-    SERVERLESS="serverless" \
-    TASKFILE_TARGET=evg-test-serverless \
-    sh ${PROJECT_DIRECTORY}/.evergreen/run-tests.sh
diff --git a/etc/setup-test.sh b/etc/setup-test.sh
new file mode 100755
index 0000000000..a1d7263376
--- /dev/null
+++ b/etc/setup-test.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+#
+# Set up test environment and write .test.env file.
+set -eu
+
+OS=${OS:-""}
+SSL=${SSL:-nossl}
+GO_BUILD_TAGS=${GO_BUILD_TAGS:-}
+RACE=${RACE:-}
+
+# Handle special cases first.
+case ${1:-} in
+    enterprise-plain)
+        . $DRIVERS_TOOLS/.evergreen/secrets_handling/setup-secrets.sh drivers/enterprise_auth
+        MONGODB_URI="mongodb://${SASL_USER}:${SASL_PASS}@${SASL_HOST}:${SASL_PORT}/ldap?authMechanism=PLAIN"
+        rm secrets-export.sh
+        AUTH="auth"
+        ;;
+    enterprise-gssapi)
+        . $DRIVERS_TOOLS/.evergreen/secrets_handling/setup-secrets.sh drivers/enterprise_auth
+        if [ "Windows_NT" = "${OS:-}" ]; then
+            MONGODB_URI="mongodb://${PRINCIPAL/@/%40}:${SASL_PASS}@${SASL_HOST}:${SASL_PORT}/kerberos?authMechanism=GSSAPI"
+        else
+            echo ${KEYTAB_BASE64} | base64 -d > ${PROJECT_DIRECTORY}/.evergreen/drivers.keytab
+            mkdir -p ~/.krb5
+            cat .evergreen/krb5.config | tee -a ~/.krb5/config
+            kinit -k -t .evergreen/drivers.keytab -p "${PRINCIPAL}"
+            MONGODB_URI="mongodb://${PRINCIPAL/@/%40}@${SASL_HOST}:${SASL_PORT}/kerberos?authMechanism=GSSAPI"
+        fi
+        rm secrets-export.sh
+        AUTH="auth"
+        ;;
+    serverless)
+        . $DRIVERS_TOOLS/.evergreen/serverless/secrets-export.sh
+        MONGODB_URI="${SERVERLESS_URI}"
+        SERVERLESS="serverless"
+        AUTH="auth"
+        ;;
+    atlas-connect)
+        . $DRIVERS_TOOLS/.evergreen/secrets_handling/setup-secrets.sh drivers/atlas_connect
+        ;;
+esac
+
+# Handle encryption.
+if [[ "${GO_BUILD_TAGS}" =~ cse ]]; then
+    # Install libmongocrypt if needed.
+    task install-libmongocrypt
+
+    # Handle libmongocrypt paths.
+    PKG_CONFIG_PATH=$(pwd)/install/libmongocrypt/lib64/pkgconfig
+    LD_LIBRARY_PATH=$(pwd)/install/libmongocrypt/lib64
+
+    if [ "$(uname -s)" = "Darwin" ]; then
+    PKG_CONFIG_PATH=$(pwd)/install/libmongocrypt/lib/pkgconfig
+    DYLD_FALLBACK_LIBRARY_PATH=$(pwd)/install/libmongocrypt/lib
+    fi
+
+    if [ "${SKIP_CRYPT_SHARED_LIB:-''}" = "true" ]; then
+        CRYPT_SHARED_LIB_PATH=""
+        echo "crypt_shared library is skipped"
+    elif [ -z "${CRYPT_SHARED_LIB_PATH:-}" ]; then
+        echo "crypt_shared library path is empty"
+    else
+        echo "crypt_shared library will be loaded from path: $CRYPT_SHARED_LIB_PATH"
+    fi
+fi
+
+# Handle the build tags argument.
+if [ -n "${GO_BUILD_TAGS}" ]; then
+    BUILD_TAGS="${RACE} --tags=${GO_BUILD_TAGS}"
+else
+    BUILD_TAGS="${RACE}"
+fi
+
+# Handle certificates.
+if [ "$SSL" != "nossl" ] && [ -z "${SERVERLESS+x}" ]; then
+    MONGO_GO_DRIVER_CA_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/ca.pem"
+    MONGO_GO_DRIVER_KEY_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/client.pem"
+    MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/client-pkcs8-encrypted.pem"
+    MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE="$DRIVERS_TOOLS/.evergreen/x509gen/client-pkcs8-unencrypted.pem"
+
+    if [ "Windows_NT" = "$OS" ]; then
+        MONGO_GO_DRIVER_CA_FILE=$(cygpath -m $MONGO_GO_DRIVER_CA_FILE)
+        MONGO_GO_DRIVER_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_KEY_FILE)
+        MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE)
+        MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE=$(cygpath -m $MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE)
+    fi
+fi
+
+cat <<EOT > .test.env
+AUTH="${AUTH:-}"
+SSL="${SSL}"
+MONGO_GO_DRIVER_CA_FILE="${MONGO_GO_DRIVER_CA_FILE:-}"
+MONGO_GO_DRIVER_KEY_FILE="${MONGO_GO_DRIVER_KEY_FILE:-}"
+MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE="${MONGO_GO_DRIVER_PKCS8_ENCRYPTED_KEY_FILE:-}"
+MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE="${MONGO_GO_DRIVER_PKCS8_UNENCRYPTED_KEY_FILE:-}"
+TOPOLOGY="${TOPOLOGY:-}"
+SERVERLESS="${SERVERLESS:-}"
+REQUIRE_API_VERSION="${REQUIRE_API_VERSION:-}"
+LOAD_BALANCER="${LOAD_BALANCER:-}"
+MONGO_GO_DRIVER_COMPRESSOR="${MONGO_GO_DRIVER_COMPRESSOR:-}"
+BUILD_TAGS="${BUILD_TAGS}"
+CRYPT_SHARED_LIB_PATH="${CRYPT_SHARED_LIB_PATH:-}"
+PKG_CONFIG_PATH="${PKG_CONFIG_PATH:-}"
+LD_LIBRARY_PATH="${LD_LIBRARY_PATH:-}"
+MACOS_LIBRARY_PATH="${DYLD_FALLBACK_LIBRARY_PATH:-}"
+SKIP_CSOT_TESTS=${SKIP_CSOT_TESTS:-}
+EOT
+
+if [ -n "${MONGODB_URI:-}" ]; then
+    echo "MONGODB_URI=\"${MONGODB_URI}\"" >> .test.env
+fi
+
+if [ -n "${SERVERLESS:-}" ]; then
+    echo "SERVERLESS_ATLAS_USER=$SERVERLESS_ATLAS_USER" >> .test.env
+    echo "SERVERLESS_ATLAS_PASSWORD=$SERVERLESS_ATLAS_PASSWORD" >> .test.env
+fi
+
+# Add secrets to the test file.
+if [ -f "secrets-export.sh" ]; then
+    while read p; do
+        if [[ "$p" =~ ^export ]]; then
+            echo "$p" | sed 's/export //' >> .test.env
+        fi
+    done <secrets-export.sh
+fi