diff --git a/.claude/skills/backport-failed/SKILL.md b/.claude/skills/backport-failed/SKILL.md
index 414293b6736..37fcfa4fd85 100644
--- a/.claude/skills/backport-failed/SKILL.md
+++ b/.claude/skills/backport-failed/SKILL.md
@@ -1,13 +1,6 @@
 ---
 name: backport-failed
-description: Recover from a patchback auto-backport failure. Given a merged PR number, parse the patchback comments to find which target branches failed, cherry-pick the merge commit onto each failed branch, resolve conflicts, push to the user's fork, and open backport PRs that exactly match patchback's title and body shape so they look indistinguishable from successful auto-backports.
-user-invocable: true
-allowed-tools:
-  - Bash
-  - Read
-  - Edit
-  - Write
-  - AskUserQuestion
+description: Create a manual backport to recover from a Patchback auto-backport failure.
 ---
 
 # /backport-failed — Manual recovery for failed patchback backports
diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index ef40c7aa512..c7664dad86f 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -80,12 +80,9 @@ jobs:
         path: ~/.cache/pip
         restore-keys: |
             pip-lint-
-    - name: Update pip, wheel, setuptools, build, twine
-      run: |
-        python -m pip install -U pip wheel setuptools build twine
     - name: Install dependencies
       run: |
-        python -m pip install -r requirements/lint.in -c requirements/lint.txt
+        python -m pip install -U pip wheel setuptools build twine -r requirements/lint.in -c requirements/lint.txt
     - name: Install self
       run: |
         python -m pip install . -c requirements/runtime-deps.txt
@@ -198,14 +195,11 @@ jobs:
         python-version: ${{ matrix.pyver }}
         activate-environment: true
         enable-cache: true
-    - name: Update pip, wheel, setuptools, build, twine
-      run: |
-        uv pip install -U pip wheel setuptools build twine
     - name: Install dependencies
       env:
         DEPENDENCY_GROUP: test${{ endsWith(matrix.pyver, 't') && '-ft' || '' }}
       run: |
-        uv pip install -r requirements/${{ env.DEPENDENCY_GROUP }}.in -c requirements/${{ env.DEPENDENCY_GROUP }}.txt
+        uv pip install -U pip wheel setuptools build twine -r requirements/${{ env.DEPENDENCY_GROUP }}.in -c requirements/${{ env.DEPENDENCY_GROUP }}.txt
     - name: Set PYTHON_GIL=0 for free-threading builds
       if: ${{ endsWith(matrix.pyver, 't') }}
       run: echo "PYTHON_GIL=0" >> $GITHUB_ENV
@@ -303,14 +297,11 @@ jobs:
         python-version: ${{ matrix.pyver }}
         activate-environment: true
         enable-cache: true
-    - name: Update pip, wheel, setuptools, build, twine
-      run: |
-        uv pip install -U pip wheel setuptools build twine
     - name: Install dependencies
       env:
         DEPENDENCY_GROUP: test${{ endsWith(matrix.pyver, 't') && '-ft' || '' }}
       run: |
-        uv pip install -r requirements/${{ env.DEPENDENCY_GROUP }}.in -c requirements/${{ env.DEPENDENCY_GROUP }}.txt
+        uv pip install -U pip wheel setuptools build twine -r requirements/${{ env.DEPENDENCY_GROUP }}.in -c requirements/${{ env.DEPENDENCY_GROUP }}.txt
     - name: Restore llhttp generated files
       if: ${{ matrix.no-extensions == '' }}
       uses: actions/download-artifact@v8
@@ -375,12 +366,9 @@ jobs:
         python-version: 3.13.2
         cache: pip
         cache-dependency-path: requirements/*.txt
-    - name: Update pip, wheel, setuptools, build, twine
-      run: |
-        python -m pip install -U pip wheel setuptools build twine
     - name: Install dependencies
       run: |
-        python -m pip install -r requirements/test.in -c requirements/test.txt
+        python -m pip install -U pip wheel setuptools build twine -r requirements/test.in -c requirements/test.txt
     - name: Restore llhttp generated files
       uses: actions/download-artifact@v8
       with:
@@ -419,12 +407,9 @@ jobs:
       uses: actions/setup-python@v6
       with:
         python-version: '3.12'
-    - name: Update pip, wheel, setuptools, build, twine
-      run: |
-        python -m pip install -U pip wheel setuptools build twine
     - name: Install dependencies
       run: |
-        python -Im pip install -r requirements/test.in -c requirements/test.txt
+        python -Im pip install -U pip wheel setuptools build twine -r requirements/test.in -c requirements/test.txt
     - name: Uninstall blocbuster
       run: python -m pip uninstall blockbuster -y
     - name: Restore llhttp generated files
@@ -508,13 +493,10 @@ jobs:
         submodules: true
     - name: Setup Python
       uses: actions/setup-python@v6
-    - name: Update pip, wheel, setuptools, build, twine
-      run: |
-        python -m pip install -U pip wheel setuptools build twine
-    - name: Install cython
+    - name: Install build tooling and cython
       run: >-
         python -m
-        pip install -r requirements/cython.in -c requirements/cython.txt
+        pip install -U pip wheel setuptools build twine -r requirements/cython.in -c requirements/cython.txt
     - name: Restore llhttp generated files
       uses: actions/download-artifact@v8
       with:
@@ -601,13 +583,10 @@ jobs:
       uses: actions/setup-python@v6
       with:
         python-version: 3.x
-    - name: Update pip, wheel, setuptools, build, twine
-      run: |
-        python -m pip install -U pip wheel setuptools build twine
-    - name: Install cython
+    - name: Install build tooling and cython
       run: >-
         python -m
-        pip install -r requirements/cython.in -c requirements/cython.txt
+        pip install -U pip wheel setuptools build twine -r requirements/cython.in -c requirements/cython.txt
     - name: Restore llhttp generated files
       uses: actions/download-artifact@v8
       with:
diff --git a/CHANGES/12540.bugfix.rst b/CHANGES/12540.bugfix.rst
new file mode 100644
index 00000000000..dfd98129e4b
--- /dev/null
+++ b/CHANGES/12540.bugfix.rst
@@ -0,0 +1 @@
+Fixed per-request ``cookies`` not being dropped on cross-origin redirects -- by :user:`Dreamsorcerer`.
diff --git a/CHANGES/12641.contrib.rst b/CHANGES/12641.contrib.rst
new file mode 100644
index 00000000000..626500a41b3
--- /dev/null
+++ b/CHANGES/12641.contrib.rst
@@ -0,0 +1,5 @@
+Made the ``pip`` command used by the ``Makefile`` configurable via a
+``PIP`` variable; downstream consumers can now run, for example,
+``make .develop PIP="uv pip"`` to install via ``uv`` without us
+maintaining a parallel target
+-- by :user:`bdraco`.
diff --git a/CHANGES/12643.contrib.rst b/CHANGES/12643.contrib.rst
new file mode 100644
index 00000000000..8477457ce16
--- /dev/null
+++ b/CHANGES/12643.contrib.rst
@@ -0,0 +1,5 @@
+Merged the "Update pip, wheel, setuptools, build, twine" step into
+the following ``Install dependencies`` (or ``Install cython``) step
+in every job in :file:`.github/workflows/ci-cd.yml`, so each job now
+runs a single ``pip``/``uv pip install`` invocation instead of two
+-- by :user:`bdraco`.
diff --git a/Makefile b/Makefile
index f0003454b0c..8f74b0740d6 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,7 @@ to-hash-one = $(dir $1).hash/$(addsuffix .hash,$(notdir $1))
 to-hash = $(foreach fname,$1,$(call to-hash-one,$(fname)))
 
 CYTHON_EXTRA ?=
+PIP ?= python -m pip
 CYS := $(wildcard aiohttp/*.pyx) $(wildcard aiohttp/*.pyi)  $(wildcard aiohttp/*.pxd) $(wildcard aiohttp/_websocket/*.pyx) $(wildcard aiohttp/_websocket/*.pyi) $(wildcard aiohttp/_websocket/*.pxd)
 PYXS := $(wildcard aiohttp/*.pyx) $(wildcard aiohttp/_websocket/*.pyx)
 CS := $(wildcard aiohttp/*.c) $(wildcard aiohttp/_websocket/*.c)
@@ -48,10 +49,10 @@ endif
 .SECONDARY: $(call to-hash,$(ALLS))
 
 .update-pip:
-	@python -m pip install --upgrade pip
+	@$(PIP) install --upgrade pip
 
 .install-cython: .update-pip $(call to-hash,requirements/cython.txt)
-	@python -m pip install -r requirements/cython.in -c requirements/cython.txt
+	@$(PIP) install -r requirements/cython.in -c requirements/cython.txt
 	@touch .install-cython
 
 aiohttp/_find_header.c: $(call to-hash,aiohttp/hdrs.py ./tools/gen.py)
@@ -86,7 +87,7 @@ cythonize: .install-cython $(PYXS:.pyx=.c) aiohttp/_websocket/reader_c.c
 cythonize-nodeps: $(PYXS:.pyx=.c) aiohttp/_websocket/reader_c.c
 
 .install-deps: .install-cython $(PYXS:.pyx=.c) aiohttp/_websocket/reader_c.c $(call to-hash,$(CYS) $(REQS))
-	@python -m pip install -r requirements/dev.in -c requirements/dev.txt
+	@$(PIP) install -r requirements/dev.in -c requirements/dev.txt
 	@touch .install-deps
 
 .PHONY: lint
@@ -101,7 +102,7 @@ mypy:
 	mypy
 
 .develop: .install-deps generate-llhttp $(call to-hash,$(PYS) $(CYS) $(CS))
-	python -m pip install -e . -c requirements/runtime-deps.txt
+	$(PIP) install -e . -c requirements/runtime-deps.txt
 	@touch .develop
 
 .PHONY: test
@@ -178,7 +179,7 @@ doc-spelling:
 
 .PHONY: install
 install: .update-pip
-	@python -m pip install -r requirements/dev.in -c requirements/dev.txt
+	@$(PIP) install -r requirements/dev.in -c requirements/dev.txt
 
 .PHONY: install-dev
 install-dev: .develop
diff --git a/aiohttp/client.py b/aiohttp/client.py
index 7c2535fc8ee..4852b5b706b 100644
--- a/aiohttp/client.py
+++ b/aiohttp/client.py
@@ -857,6 +857,7 @@ async def _connect_and_send_request(
                             ) from origin_val_err
 
                         if url.origin() != redirect_origin:
+                            cookies = None
                             headers.pop(hdrs.AUTHORIZATION, None)
                             headers.pop(hdrs.COOKIE, None)
                             headers.pop(hdrs.PROXY_AUTHORIZATION, None)
diff --git a/tests/test_client_functional.py b/tests/test_client_functional.py
index 6f554250805..4be1fb29308 100644
--- a/tests/test_client_functional.py
+++ b/tests/test_client_functional.py
@@ -3481,8 +3481,8 @@ async def close(self) -> None:
             headers={
                 "Authorization": "Basic dXNlcjpwYXNz",
                 "Proxy-Authorization": "Basic dXNlcjpwYXNz",
-                "Cookie": "a=b",
             },
+            cookies={"a": "b"},
         ) as resp:
             assert resp.status == 200