diff --git a/.github/workflows/just-nut.yml b/.github/workflows/just-nut.yml
index 2d2e4a07..cb0ea5a1 100644
--- a/.github/workflows/just-nut.yml
+++ b/.github/workflows/just-nut.yml
@@ -25,6 +25,16 @@ on:
         description: 'install JIT plugin before running tests'
         type: boolean
         default: false
+      devhub-environment:
+        required: false
+        description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.'
+        type: string
+        default: ''
+      max-retries:
+        required: false
+        description: 'Maximum number of retry attempts for the NUT command (default: 3)'
+        type: number
+        default: 3
   workflow_call:
     inputs:
       channel-or-version:
@@ -50,11 +60,22 @@ on:
         description: 'install JIT plugin before running tests'
         type: boolean
         default: false
+      devhub-environment:
+        required: false
+        description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.'
+        type: string
+        default: ''
+      max-retries:
+        required: false
+        description: 'Maximum number of retry attempts for the NUT command (default: 3)'
+        type: number
+        default: 3
 
 jobs:
   just-nut:
     name: ${{inputs.repository}}
     runs-on: ${{inputs.os}}
+    environment: ${{ inputs.devhub-environment || '' }}
     env:
       GITHUB_TOKEN: ${{ secrets.SVC_CLI_BOT_GITHUB_TOKEN }}
       TESTKIT_EXECUTABLE_PATH: sf
@@ -99,5 +120,6 @@ jobs:
       - name: Run NUT (with retries)
         uses: salesforcecli/github-workflows/.github/actions/retry@main
         with:
+          max_attempts: ${{ inputs.max-retries }}
           retry_wait_seconds: 1800
           command: ${{ inputs.command }}
diff --git a/.github/workflows/just-nuts.yml b/.github/workflows/just-nuts.yml
index d983dbf4..626e871f 100644
--- a/.github/workflows/just-nuts.yml
+++ b/.github/workflows/just-nuts.yml
@@ -7,12 +7,22 @@ on:
         required: true
         description: Version or channel of the CLI to test against (nightly, latest-rc, 2.1.1)
         type: string
+      devhub-environment:
+        required: false
+        description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.'
+        type: string
+        default: ''
   workflow_call:
     inputs:
       channel-or-version:
         required: true
         description: Version or channel of the CLI to test against (nightly, latest-rc, 2.1.1)
         type: string
+      devhub-environment:
+        required: false
+        description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.'
+        type: string
+        default: ''
 
 jobs:
   # plugins that use yarn:test:nuts
@@ -40,6 +50,7 @@ jobs:
       repository: ${{ matrix.repository }}
       channel-or-version: ${{ inputs.channel-or-version }}
       os: ${{ matrix.os }}
+      devhub-environment: ${{ inputs.devhub-environment }}
     secrets: inherit
 
   jit:
@@ -66,6 +77,7 @@ jobs:
       channel-or-version: ${{ inputs.channel-or-version }}
       os: ${{ matrix.os }}
       jit: true
+      devhub-environment: ${{ inputs.devhub-environment }}
     secrets: inherit
 
   packaging:
@@ -83,6 +95,7 @@ jobs:
       channel-or-version: ${{ inputs.channel-or-version }}
       os: ${{ matrix.os }}
       command: ${{ matrix.command }}
+      devhub-environment: ${{ inputs.devhub-environment }}
     secrets: inherit
 
   deploy-retrieve:
@@ -111,6 +124,7 @@ jobs:
       channel-or-version: ${{ inputs.channel-or-version }}
       os: ${{ matrix.os }}
       command: ${{ matrix.command }}
+      devhub-environment: ${{ inputs.devhub-environment }}
     secrets: inherit
 
   data:
@@ -134,4 +148,5 @@ jobs:
       channel-or-version: ${{ inputs.channel-or-version }}
       os: ${{ matrix.os }}
       command: ${{ matrix.command }}
+      devhub-environment: ${{ inputs.devhub-environment }}
     secrets: inherit