diff --git a/.jenkins.d/00-deps.sh b/.jenkins.d/00-deps.sh
index 7f56844..54476fe 100755
--- a/.jenkins.d/00-deps.sh
+++ b/.jenkins.d/00-deps.sh
@@ -1,49 +1,44 @@
 #!/usr/bin/env bash
-set -ex
+set -eo pipefail
 
-if has macos $NODE_LABELS; then
-    FORMULAE=(boost openssl pkg-config)
-    if [[ $JOB_NAME == *"Docs" ]]; then
+APT_PKGS=(build-essential pkg-config python3-minimal
+          libboost-all-dev libssl-dev libsqlite3-dev)
+FORMULAE=(boost openssl pkg-config)
+PIP_PKGS=()
+case $JOB_NAME in
+    *code-coverage)
+        APT_PKGS+=(lcov python3-pip)
+        PIP_PKGS+=('gcovr~=5.1')
+        ;;
+    *Docs)
+        APT_PKGS+=(doxygen graphviz python3-pip)
         FORMULAE+=(doxygen graphviz)
-    fi
+        PIP_PKGS+=(sphinx sphinxcontrib-doxylink)
+        ;;
+esac
 
+set -x
+
+if [[ $ID == macos ]]; then
     if [[ -n $GITHUB_ACTIONS ]]; then
-        # GitHub Actions runners have a large number of pre-installed
-        # Homebrew packages. Don't waste time upgrading all of them.
-        brew list --versions "${FORMULAE[@]}" || brew update
-        for FORMULA in "${FORMULAE[@]}"; do
-            brew list --versions "$FORMULA" || brew install "$FORMULA"
-        done
-        # Ensure /usr/local/opt/openssl exists
-        brew reinstall openssl
-    else
-        brew update
-        brew upgrade
-        brew install "${FORMULAE[@]}"
-        brew cleanup
+        export HOMEBREW_NO_INSTALL_UPGRADE=1
+    fi
+    brew update
+    brew install --formula "${FORMULAE[@]}"
+
+    if (( ${#PIP_PKGS[@]} )); then
+        pip3 install --upgrade --upgrade-strategy=eager "${PIP_PKGS[@]}"
     fi
 
-    if [[ $JOB_NAME == *"Docs" ]]; then
-        pip3 install --upgrade --upgrade-strategy=eager sphinx sphinxcontrib-doxylink
-    fi
-
-elif has Ubuntu $NODE_LABELS; then
+elif [[ $ID_LIKE == *debian* ]]; then
     sudo apt-get -qq update
-    sudo apt-get -qy install build-essential pkg-config python3-minimal \
-                             libboost-all-dev libssl-dev libsqlite3-dev
+    sudo apt-get -qy install "${APT_PKGS[@]}"
 
-    case $JOB_NAME in
-        *code-coverage)
-            sudo apt-get -qy install lcov python3-pip
-            pip3 install --user --upgrade --upgrade-strategy=eager 'gcovr~=5.1'
-            ;;
-        *Docs)
-            sudo apt-get -qy install doxygen graphviz python3-pip
-            pip3 install --user --upgrade --upgrade-strategy=eager sphinx sphinxcontrib-doxylink
-            ;;
-    esac
+    if (( ${#PIP_PKGS[@]} )); then
+        pip3 install --user --upgrade --upgrade-strategy=eager "${PIP_PKGS[@]}"
+    fi
 
-elif has CentOS $NODE_LABELS; then
+elif [[ $ID_LIKE == *fedora* ]]; then
     sudo dnf -y install gcc-c++ libasan pkgconf-pkg-config python3 \
                         boost-devel openssl-devel sqlite-devel
 fi
diff --git a/.jenkins.d/01-ndn-cxx.sh b/.jenkins.d/01-ndn-cxx.sh
deleted file mode 100755
index 6f50dba..0000000
--- a/.jenkins.d/01-ndn-cxx.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-sudo rm -f /usr/local/bin/ndnsec*
-sudo rm -fr /usr/local/include/ndn-cxx
-sudo rm -f /usr/local/lib{,64}/libndn-cxx*
-sudo rm -f /usr/local/lib{,64}/pkgconfig/libndn-cxx.pc
diff --git a/.jenkins.d/09-cleanup.sh b/.jenkins.d/09-cleanup.sh
new file mode 100755
index 0000000..18a1c04
--- /dev/null
+++ b/.jenkins.d/09-cleanup.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -exo pipefail
+
+PROJ=ndn-cxx
+
+sudo rm -f /usr/local/bin/ndnsec*
+sudo rm -fr /usr/local/include/"$PROJ"
+sudo rm -f /usr/local/lib{,64}/lib"$PROJ"*
+sudo rm -f /usr/local/lib{,64}/pkgconfig/{,lib}"$PROJ".pc
diff --git a/.jenkins.d/10-build.sh b/.jenkins.d/10-build.sh
index f703092..82ec98e 100755
--- a/.jenkins.d/10-build.sh
+++ b/.jenkins.d/10-build.sh
@@ -1,8 +1,5 @@
 #!/usr/bin/env bash
-set -ex
-
-git submodule sync
-git submodule update --init
+set -eo pipefail
 
 if [[ -z $DISABLE_ASAN ]]; then
     ASAN="--with-sanitizer=address"
@@ -10,24 +7,26 @@
 if [[ $JOB_NAME == *"code-coverage" ]]; then
     COVERAGE="--with-coverage"
 fi
-if has macos-12 $NODE_LABELS; then
+if [[ $ID == macos && ${VERSION_ID%%.*} -ge 12 ]]; then
     KEYCHAIN="--without-osx-keychain"
 fi
 if [[ -n $DISABLE_PCH ]]; then
     PCH="--without-pch"
 fi
 
+set -x
+
 if [[ $JOB_NAME != *"code-coverage" && $JOB_NAME != *"limited-build" ]]; then
     # Build static library in release mode with tests and without precompiled headers
     ./waf --color=yes configure --enable-static --disable-shared --with-tests --without-pch
-    ./waf --color=yes build -j$WAF_JOBS
+    ./waf --color=yes build
 
     # Cleanup
     ./waf --color=yes distclean
 
     # Build static and shared library in release mode without tests
     ./waf --color=yes configure --enable-static --enable-shared $PCH
-    ./waf --color=yes build -j$WAF_JOBS
+    ./waf --color=yes build
 
     # Cleanup
     ./waf --color=yes distclean
@@ -35,16 +34,16 @@
 
 # Build shared library in debug mode with tests and examples
 ./waf --color=yes configure --disable-static --enable-shared --debug --with-tests --with-examples $ASAN $COVERAGE $KEYCHAIN $PCH
-./waf --color=yes build -j$WAF_JOBS
+./waf --color=yes build
 
 # (tests will be run against the debug version)
 
 # Install
-sudo_preserve_env PATH -- ./waf --color=yes install
+sudo ./waf --color=yes install
 
-if has CentOS $NODE_LABELS; then
+if [[ $ID_LIKE == *fedora* ]]; then
     sudo tee /etc/ld.so.conf.d/ndn.conf >/dev/null <<< /usr/local/lib64
 fi
-if has Linux $NODE_LABELS; then
+if [[ $ID_LIKE == *linux* ]]; then
     sudo ldconfig
 fi
diff --git a/.jenkins.d/20-tests.sh b/.jenkins.d/20-tests.sh
index abd520a..ea1ec19 100755
--- a/.jenkins.d/20-tests.sh
+++ b/.jenkins.d/20-tests.sh
@@ -1,12 +1,5 @@
 #!/usr/bin/env bash
-set -ex
-
-# Prepare environment
-rm -rf ~/.ndn
-
-if has macos-10.15 $NODE_LABELS; then
-    security unlock-keychain -p named-data
-fi
+set -eo pipefail
 
 # https://github.com/google/sanitizers/wiki/AddressSanitizerFlags
 ASAN_OPTIONS="color=always"
@@ -18,10 +11,20 @@
 ASAN_OPTIONS+=":strip_path_prefix=${PWD}/"
 export ASAN_OPTIONS
 
+# https://www.boost.org/doc/libs/release/libs/test/doc/html/boost_test/runtime_config/summary.html
 export BOOST_TEST_BUILD_INFO=1
 export BOOST_TEST_COLOR_OUTPUT=1
 export BOOST_TEST_DETECT_MEMORY_LEAK=0
 export BOOST_TEST_LOGGER=HRF,test_suite,stdout:XML,all,build/xunit-log.xml
 
+set -x
+
+# Prepare environment
+rm -rf ~/.ndn
+
+if [[ $ID == macos && ${VERSION_ID%%.*} -lt 11 ]]; then
+    security unlock-keychain -p named-data
+fi
+
 # Run unit tests
 ./build/unit-tests
diff --git a/.jenkins.d/30-coverage.sh b/.jenkins.d/30-coverage.sh
index 46509a0..4ee9510 100755
--- a/.jenkins.d/30-coverage.sh
+++ b/.jenkins.d/30-coverage.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -ex
+set -exo pipefail
 
 if [[ $JOB_NAME == *"code-coverage" ]]; then
     # Generate an XML report (Cobertura format) and a detailed HTML report using gcovr
diff --git a/.jenkins.d/40-headers-check.sh b/.jenkins.d/40-headers-check.sh
index e3493f4..8ee3339 100755
--- a/.jenkins.d/40-headers-check.sh
+++ b/.jenkins.d/40-headers-check.sh
@@ -1,9 +1,7 @@
 #!/usr/bin/env bash
-
+set -eo pipefail
 # It's intentional not to use `set -x`, because this script explicitly prints useful information
 # and should not run in trace mode.
-# It's intentional not to use `set -e`, because this script wants to check all headers
-# (similar to running all test cases), instead of failing at the first error.
 
 PROJ=ndn-cxx
 PCFILE=libndn-cxx
@@ -13,7 +11,7 @@
   exit 0
 fi
 
-if has CentOS $NODE_LABELS; then
+if [[ $ID_LIKE == *fedora* ]]; then
   export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig
 fi
 
@@ -28,9 +26,8 @@
 NERRORS=0
 while IFS= read -r -d '' H; do
   echo "Checking header ${H#${INCLUDEDIR}/}"
-  "$CXX" -xc++ $STD $CXXFLAGS -c -o /dev/null "$H"
-  [[ $? -eq 0 ]] || ((NERRORS++))
-  ((NCHECKED++))
+  "$CXX" -xc++ $STD $CXXFLAGS -c -o /dev/null "$H" || : $((NERRORS++))
+  : $((NCHECKED++))
 done < <(find "$INCLUDEDIR" -name '*.hpp' -type f -print0 2>/dev/null)
 
 if [[ $NCHECKED -eq 0 ]]; then
diff --git a/.jenkins.d/README.md b/.jenkins.d/README.md
index d382757..385af34 100644
--- a/.jenkins.d/README.md
+++ b/.jenkins.d/README.md
@@ -2,27 +2,35 @@
 
 ## Environment Variables
 
-- `NODE_LABELS`: space-separated list of platform properties. The included values are used by
-  the build scripts to select the proper behavior for different operating systems and versions.
+- `ID`: lower-case string that identifies the operating system, for example: `ID=ubuntu`,
+  `ID=centos`. See [os-release(5)] for more information. On macOS, where `os-release` is
+  not available, we emulate it by setting `ID=macos`.
 
-  The list should normally contain `[OS_TYPE]`, `[DISTRO_TYPE]`, and `[DISTRO_VERSION]`.
+- `ID_LIKE`: space-separated list of operating system identifiers that are closely related
+  to the running OS. See [os-release(5)] for more information. The listed values are used
+  by the CI scripts to select the proper behavior for different platforms and OS flavors.
 
-  Example values:
+  Examples:
 
-  - `[OS_TYPE]`: `Linux`, `macos`
-  - `[DISTRO_TYPE]`: `Ubuntu`, `CentOS`
-  - `[DISTRO_VERSION]`: `ubuntu-20.04`, `ubuntu-22.04`, `centos-9`, `macos-10.15`, `macos-11`
+  - On CentOS, `ID_LIKE="centos rhel fedora linux"`
+  - On Ubuntu, `ID_LIKE="ubuntu debian linux"`
 
-- `JOB_NAME`: optional variable that defines the type of build job. Depending on the job type,
-  the build scripts can perform different tasks.
+- `VERSION_ID`: identifies the operating system version, excluding any release code names.
+  See [os-release(5)] for more information. Examples: `VERSION_ID=42`, `VERSION_ID=22.04`.
 
-  Possible values:
+- `JOB_NAME`: defines the type of the current CI job. Depending on the job type, the CI
+  scripts can perform different tasks.
+
+  Supported values:
 
   - empty: default build task
-  - `code-coverage`: debug build with tests and code coverage analysis (Ubuntu Linux is assumed)
+  - `code-coverage`: debug build with tests and code coverage analysis
   - `limited-build`: only a single debug build with tests
 
-- `CACHE_DIR`: directory containing cached files from previous builds, e.g., a compiled version
-  of ndn-cxx. If not set, `/tmp` is used.
+- `CACHE_DIR`: directory containing cached files from previous builds, e.g., a compiled
+  version of ndn-cxx. If not set, `/tmp` is used.
 
-- `WAF_JOBS`: number of parallel build threads used by waf, defaults to 1.
+- `DISABLE_ASAN`: disable building with AddressSanitizer. This is automatically set for
+  the `code-coverage` job type.
+
+[os-release(5)]: https://www.freedesktop.org/software/systemd/man/os-release.html
diff --git a/.jenkins.d/util.sh b/.jenkins.d/util.sh
deleted file mode 100644
index 8077a74..0000000
--- a/.jenkins.d/util.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-has() {
-    local saved_xtrace
-    [[ $- == *x* ]] && saved_xtrace=-x || saved_xtrace=+x
-    set +x
-
-    local p=$1
-    shift
-    local i ret=1
-    for i in "$@"; do
-        if [[ "${i}" == "${p}" ]]; then
-            ret=0
-            break
-        fi
-    done
-
-    set ${saved_xtrace}
-    return ${ret}
-}
-export -f has
-
-sudo_preserve_env() {
-    local saved_xtrace
-    [[ $- == *x* ]] && saved_xtrace=-x || saved_xtrace=+x
-    set +x
-
-    local vars=()
-    while [[ $# -gt 0 ]]; do
-        local arg=$1
-        shift
-        case ${arg} in
-            --) break ;;
-            *)  vars+=("${arg}=${!arg}") ;;
-        esac
-    done
-
-    set ${saved_xtrace}
-    sudo env "${vars[@]}" "$@"
-}
-export -f sudo_preserve_env