diff --git a/private/buf/bufctl/controller.go b/private/buf/bufctl/controller.go
index eb679c4d3f..bf491f0cf7 100644
--- a/private/buf/bufctl/controller.go
+++ b/private/buf/bufctl/controller.go
@@ -94,9 +94,8 @@ type Controller interface {
 	GetTargetImageWithConfigs(
 		ctx context.Context,
 		input string,
-		wasmRuntime wasm.Runtime,
 		options ...FunctionOption,
-	) ([]ImageWithConfig, bufcheck.RunnerProvider, error)
+	) ([]ImageWithConfig, error)
 	// GetImportableImageFileInfos gets the importable .proto FileInfos for the given input.
 	//
 	// This includes all files that can be possible imported. For example, if a Module
@@ -131,11 +130,25 @@ type Controller interface {
 		defaultMessageEncoding buffetch.MessageEncoding,
 		options ...FunctionOption,
 	) error
-	GetCheckRunnerProviderForWorkspace(
+	// NewCheckClient returns a new CheckClient for the given input.
+	//
+	// CheckClients are bound to a specific input to ensure that the correct
+	// plugin dependencies are used.
+	NewCheckClient(
+		ctx context.Context,
+		input string,
+		wasmRuntime wasm.Runtime,
+		options ...FunctionOption,
+	) (bufcheck.Client, error)
+	// NewCheckClientForWorkspace returns a new CheckClient for the given Workspace.
+	//
+	// CheckClients are bound to a specific Workspace to ensure that the correct
+	// plugin dependencies are used.
+	NewCheckClientForWorkspace(
 		ctx context.Context,
 		workspace bufworkspace.Workspace,
 		wasmRuntime wasm.Runtime,
-	) (bufcheck.RunnerProvider, error)
+	) (bufcheck.Client, error)
 }
 
 func NewController(
@@ -345,9 +358,8 @@ func (c *controller) GetImageForWorkspace(
 func (c *controller) GetTargetImageWithConfigs(
 	ctx context.Context,
 	input string,
-	wasmRuntime wasm.Runtime,
 	options ...FunctionOption,
-) (_ []ImageWithConfig, _ bufcheck.RunnerProvider, retErr error) {
+) (_ []ImageWithConfig, retErr error) {
 	defer c.handleFileAnnotationSetRetError(&retErr)
 	functionOptions := newFunctionOptions(c)
 	for _, option := range options {
@@ -355,69 +367,42 @@ func (c *controller) GetTargetImageWithConfigs(
 	}
 	ref, err := c.buffetchRefParser.GetRef(ctx, input)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 	switch t := ref.(type) {
 	case buffetch.ProtoFileRef:
 		workspace, err := c.getWorkspaceForProtoFileRef(ctx, t, functionOptions)
 		if err != nil {
-			return nil, nil, err
-		}
-		imageWithConfigs, err := c.buildTargetImageWithConfigs(ctx, workspace, functionOptions)
-		if err != nil {
-			return nil, nil, err
-		}
-		checkRunnerProvider, err := c.GetCheckRunnerProviderForWorkspace(ctx, workspace, wasmRuntime)
-		if err != nil {
-			return nil, nil, err
+			return nil, err
 		}
-		return imageWithConfigs, checkRunnerProvider, nil
+		return c.buildTargetImageWithConfigs(ctx, workspace, functionOptions)
 	case buffetch.SourceRef:
 		workspace, err := c.getWorkspaceForSourceRef(ctx, t, functionOptions)
 		if err != nil {
-			return nil, nil, err
-		}
-		imageWithConfigs, err := c.buildTargetImageWithConfigs(ctx, workspace, functionOptions)
-		if err != nil {
-			return nil, nil, err
-		}
-		checkRunnerProvider, err := c.GetCheckRunnerProviderForWorkspace(ctx, workspace, wasmRuntime)
-		if err != nil {
-			return nil, nil, err
+			return nil, err
 		}
-		return imageWithConfigs, checkRunnerProvider, nil
+		return c.buildTargetImageWithConfigs(ctx, workspace, functionOptions)
 	case buffetch.ModuleRef:
 		workspace, err := c.getWorkspaceForModuleRef(ctx, t, functionOptions)
 		if err != nil {
-			return nil, nil, err
-		}
-		imageWithConfigs, err := c.buildTargetImageWithConfigs(ctx, workspace, functionOptions)
-		if err != nil {
-			return nil, nil, err
-		}
-		checkRunnerProvider, err := c.GetCheckRunnerProviderForWorkspace(ctx, workspace, wasmRuntime)
-		if err != nil {
-			return nil, nil, err
+			return nil, err
 		}
-		return imageWithConfigs, checkRunnerProvider, nil
+		return c.buildTargetImageWithConfigs(ctx, workspace, functionOptions)
 	case buffetch.MessageRef:
 		image, err := c.getImageForMessageRef(ctx, t, functionOptions)
 		if err != nil {
-			return nil, nil, err
+			return nil, err
 		}
 		bucket, err := c.storageosProvider.NewReadWriteBucket(
 			".",
 			storageos.ReadWriteBucketWithSymlinksIfSupported(),
 		)
 		if err != nil {
-			return nil, nil, err
+			return nil, err
 		}
-		var (
-			lintConfig        = bufconfig.DefaultLintConfigV1
-			breakingConfig    = bufconfig.DefaultBreakingConfigV1
-			pluginConfigs     []bufconfig.PluginConfig
-			pluginKeyProvider = bufplugin.NopPluginKeyProvider
-		)
+		lintConfig := bufconfig.DefaultLintConfigV1
+		breakingConfig := bufconfig.DefaultBreakingConfigV1
+		var pluginConfigs []bufconfig.PluginConfig
 		bufYAMLFile, err := bufconfig.GetBufYAMLFileForPrefixOrOverride(
 			ctx,
 			bucket,
@@ -426,7 +411,7 @@ func (c *controller) GetTargetImageWithConfigs(
 		)
 		if err != nil {
 			if !errors.Is(err, fs.ErrNotExist) {
-				return nil, nil, err
+				return nil, err
 			}
 			// We did not find a buf.yaml in our current directory, and there was no config override.
 			// Use the defaults.
@@ -435,7 +420,7 @@ func (c *controller) GetTargetImageWithConfigs(
 			if topLevelLintConfig := bufYAMLFile.TopLevelLintConfig(); topLevelLintConfig == nil {
 				// Ensure that this is a v2 config
 				if fileVersion := bufYAMLFile.FileVersion(); fileVersion != bufconfig.FileVersionV2 {
-					return nil, nil, syserror.Newf("non-v2 version with no top-level lint config: %s", fileVersion)
+					return nil, syserror.Newf("non-v2 version with no top-level lint config: %s", fileVersion)
 				}
 				// v2 config without a top-level lint config, use v2 default
 				lintConfig = bufconfig.DefaultLintConfigV2
@@ -444,62 +429,25 @@ func (c *controller) GetTargetImageWithConfigs(
 			}
 			if topLevelBreakingConfig := bufYAMLFile.TopLevelBreakingConfig(); topLevelBreakingConfig == nil {
 				if fileVersion := bufYAMLFile.FileVersion(); fileVersion != bufconfig.FileVersionV2 {
-					return nil, nil, syserror.Newf("non-v2 version with no top-level breaking config: %s", fileVersion)
+					return nil, syserror.Newf("non-v2 version with no top-level breaking config: %s", fileVersion)
 				}
 				// v2 config without a top-level breaking config, use v2 default
 				breakingConfig = bufconfig.DefaultBreakingConfigV2
 			} else {
 				breakingConfig = topLevelBreakingConfig
 			}
-
-			if functionOptions.configOverride != "" {
-				// To support remote plugins in the override, we need to resolve the remote
-				// Refs to PluginKeys. A buf.lock file is not required for this operation.
-				// We use the BSR to resolve any remote plugin Refs.
-				pluginKeyProvider = c.pluginKeyProvider
-			} else if bufYAMLFile.FileVersion() == bufconfig.FileVersionV2 {
-				var pluginKeys []bufplugin.PluginKey
-				if bufLockFile, err := bufconfig.GetBufLockFileForPrefix(
-					ctx,
-					bucket,
-					// buf.lock files live next to the buf.yaml
-					".",
-				); err != nil {
-					if !errors.Is(err, fs.ErrNotExist) {
-						return nil, nil, err
-					}
-					// We did not find a buf.lock in our current directory.
-					// Remote plugins are not available.
-					pluginKeys = nil
-				} else {
-					pluginKeys = bufLockFile.RemotePluginKeys()
-				}
-				pluginKeyProvider, err = newStaticPluginKeyProviderForPluginConfigs(
-					pluginConfigs,
-					pluginKeys,
-				)
-				if err != nil {
-					return nil, nil, err
-				}
-			}
 		}
-		imageWithConfigs := []ImageWithConfig{
+		return []ImageWithConfig{
 			newImageWithConfig(
 				image,
 				lintConfig,
 				breakingConfig,
 				pluginConfigs,
 			),
-		}
-		checkRunnerProvider := bufcheck.NewLocalRunnerProvider(
-			wasmRuntime,
-			pluginKeyProvider,
-			c.pluginDataProvider,
-		)
-		return imageWithConfigs, checkRunnerProvider, nil
+		}, nil
 	default:
 		// This is a system error.
-		return nil, nil, syserror.Newf("invalid Ref: %T", ref)
+		return nil, syserror.Newf("invalid Ref: %T", ref)
 	}
 }
 
@@ -780,11 +728,69 @@ func (c *controller) PutMessage(
 	return errors.Join(err, writeCloser.Close())
 }
 
-func (c *controller) GetCheckRunnerProviderForWorkspace(
+func (c *controller) NewCheckClient(
+	ctx context.Context,
+	input string,
+	wasmRuntime wasm.Runtime,
+	options ...FunctionOption,
+) (_ bufcheck.Client, retErr error) {
+	defer c.handleFileAnnotationSetRetError(&retErr)
+	functionOptions := newFunctionOptions(c)
+	for _, option := range options {
+		option(functionOptions)
+	}
+	ref, err := c.buffetchRefParser.GetRef(ctx, input)
+	if err != nil {
+		return nil, err
+	}
+	switch t := ref.(type) {
+	case buffetch.ProtoFileRef:
+		workspace, err := c.getWorkspaceForProtoFileRef(ctx, t, functionOptions)
+		if err != nil {
+			return nil, err
+		}
+		return c.NewCheckClientForWorkspace(ctx, workspace, wasmRuntime)
+	case buffetch.SourceRef:
+		workspace, err := c.getWorkspaceForSourceRef(ctx, t, functionOptions)
+		if err != nil {
+			return nil, err
+		}
+		return c.NewCheckClientForWorkspace(ctx, workspace, wasmRuntime)
+	case buffetch.ModuleRef:
+		workspace, err := c.getWorkspaceForModuleRef(ctx, t, functionOptions)
+		if err != nil {
+			return nil, err
+		}
+		return c.NewCheckClientForWorkspace(ctx, workspace, wasmRuntime)
+	case buffetch.MessageRef:
+		// MessageRefs do not resolve to a Workspace, so we resolve the
+		// PluginKeyProvider by the buf.yaml provided in the current directory.
+		// This follows the logic in GetTargetImageWithConfigs.
+		pluginKeyProvider, err := c.getPluginKeyProviderForDirPath(ctx, ".", functionOptions)
+		if err != nil {
+			return nil, err
+		}
+		pluginRunnerProvider := bufcheck.NewLocalRunnerProvider(
+			wasmRuntime,
+			pluginKeyProvider,
+			c.pluginDataProvider,
+		)
+		return bufcheck.NewClient(
+			c.logger,
+			pluginRunnerProvider,
+			bufcheck.ClientWithStderr(c.container.Stderr()),
+		)
+	default:
+		// This is a system error.
+		return nil, syserror.Newf("invalid Ref: %T", ref)
+	}
+}
+
+func (c *controller) NewCheckClientForWorkspace(
 	ctx context.Context,
 	workspace bufworkspace.Workspace,
 	wasmRuntime wasm.Runtime,
-) (_ bufcheck.RunnerProvider, retErr error) {
+) (_ bufcheck.Client, retErr error) {
 	pluginKeyProvider, err := newStaticPluginKeyProviderForPluginConfigs(
 		workspace.PluginConfigs(),
 		workspace.RemotePluginKeys(),
@@ -792,11 +798,16 @@ func (c *controller) GetCheckRunnerProviderForWorkspace(
 	if err != nil {
 		return nil, err
 	}
-	return bufcheck.NewLocalRunnerProvider(
+	pluginRunnerProvider := bufcheck.NewLocalRunnerProvider(
 		wasmRuntime,
 		pluginKeyProvider,
 		c.pluginDataProvider,
-	), nil
+	)
+	return bufcheck.NewClient(
+		c.logger,
+		pluginRunnerProvider,
+		bufcheck.ClientWithStderr(c.container.Stderr()),
+	)
 }
 
 func (c *controller) getImage(
@@ -1278,6 +1289,70 @@ func (c *controller) handleFileAnnotationSetRetError(retErrAddr *error) {
 	}
 }
 
+// getPluginKeyProviderForDirPath creates a new PluginKeyProvider for the directory path.
+//
+// The directory path is resolved to a buf.yaml file and a buf.lock file. If the
+// buf.yaml file is found, the PluginConfigs from the buf.yaml file and the PluginKeys
+// from the buf.lock file are resolved to create the PluginKeyProvider.
+//
+// If a config override is provided, the PluginConfig remote Refs use the BSR
+// to resolve the PluginKeys. No buf.lock is required.
+// If the buf.yaml file is not found, the bufplugin.NopPluginKeyProvider is returned.
+// If the buf.lock file is not found, the bufplugin.NopPluginKeyProvider is returned.
+func (c *controller) getPluginKeyProviderForDirPath(
+	ctx context.Context,
+	dirPath string,
+	functionOptions *functionOptions,
+) (_ bufplugin.PluginKeyProvider, retErr error) {
+	// If there is a config override, we do not use the buf.lock file.
+	// Remote plugins are available, use the BSR to resolve any plugin Refs.
+	if functionOptions.configOverride != "" {
+		return c.pluginKeyProvider, nil
+	}
+	var (
+		pluginConfigs []bufconfig.PluginConfig
+		pluginKeys    []bufplugin.PluginKey
+	)
+	bucket, err := c.storageosProvider.NewReadWriteBucket(
+		dirPath,
+		storageos.ReadWriteBucketWithSymlinksIfSupported(),
+	)
+	if err != nil {
+		return nil, err
+	}
+	bufYAMLFile, err := bufconfig.GetBufYAMLFileForPrefix(ctx, bucket, ".")
+	if err != nil {
+		if !errors.Is(err, fs.ErrNotExist) {
+			return nil, err
+		}
+		// We did not find a buf.yaml in our current directory,
+		// and there was no config override.
+		// Remote plugins are not available.
+		return bufplugin.NopPluginKeyProvider, nil
+	}
+	pluginConfigs = bufYAMLFile.PluginConfigs()
+	if len(pluginConfigs) == 0 || bufYAMLFile.FileVersion() != bufconfig.FileVersionV2 {
+		// No plugins were found or are supported by the current version.
+		return bufplugin.NopPluginKeyProvider, nil
+	}
+	bufLockFile, err := bufconfig.GetBufLockFileForPrefix(
+		ctx,
+		bucket,
+		// buf.lock files live next to the buf.yaml
+		".",
+	)
+	if err != nil {
+		if !errors.Is(err, fs.ErrNotExist) {
+			return nil, err
+		}
+		// We did not find a buf.lock in our current directory.
+		// Remote plugins are not available.
+		return bufplugin.NopPluginKeyProvider, nil
+	}
+	pluginKeys = bufLockFile.RemotePluginKeys()
+	return newStaticPluginKeyProviderForPluginConfigs(pluginConfigs, pluginKeys)
+}
+
 func getImageFileInfosForModuleSet(ctx context.Context, moduleSet bufmodule.ModuleSet) ([]bufimage.ImageFileInfo, error) {
 	// Sorted.
 	fileInfos, err := bufmodule.GetFileInfos(
diff --git a/private/buf/buflsp/file.go b/private/buf/buflsp/file.go
index 816d05ff99..dacb2ebab1 100644
--- a/private/buf/buflsp/file.go
+++ b/private/buf/buflsp/file.go
@@ -371,23 +371,11 @@ func (f *file) FindModule(ctx context.Context) {
 		f.lsp.logger.Warn("could not load workspace", slog.String("uri", string(f.uri)), slogext.ErrorAttr(err))
 		return
 	}
-	// Get the bufcheck.RunnerProvider for this workspace.
-	checkRunnerProvider, err := f.lsp.controller.GetCheckRunnerProviderForWorkspace(
-		ctx,
-		workspace,
-		f.lsp.wasmRuntime,
-	)
-	if err != nil {
-		f.lsp.logger.Warn("could not get check runner provider", slogext.ErrorAttr(err))
-		return
-	}
-	checkClient, err := bufcheck.NewClient(
-		f.lsp.logger,
-		checkRunnerProvider,
-		bufcheck.ClientWithStderr(f.lsp.container.Stderr()),
-	)
+
+	// Get the check client for this workspace.
+	checkClient, err := f.lsp.controller.NewCheckClientForWorkspace(ctx, workspace, f.lsp.wasmRuntime)
 	if err != nil {
-		f.lsp.logger.Warn("could not create check client", slogext.ErrorAttr(err))
+		f.lsp.logger.Warn("could not get check client", slogext.ErrorAttr(err))
 		return
 	}
 
diff --git a/private/buf/bufworkspace/workspace_provider.go b/private/buf/bufworkspace/workspace_provider.go
index 4ff6bd7480..e2a191eb62 100644
--- a/private/buf/bufworkspace/workspace_provider.go
+++ b/private/buf/bufworkspace/workspace_provider.go
@@ -184,9 +184,8 @@ func (w *workspaceProvider) GetWorkspaceForModuleKey(
 		}
 		if bufYAMLFile.FileVersion() == bufconfig.FileVersionV2 {
 			pluginConfigs = bufYAMLFile.PluginConfigs()
-			// To support remote plugins in the override, we need to resolve the remote
-			// Refs to PluginKeys. A buf.lock file is not required for this operation.
-			// We use the BSR to resolve any remote plugin Refs.
+			// To support remote plugins when using a config override, we need to resolve the remote
+			// Refs to PluginKeys. We use the pluginKeyProvider to resolve any remote plugin Refs.
 			remotePluginRefs := slicesext.Filter(
 				slicesext.Map(pluginConfigs, func(pluginConfig bufconfig.PluginConfig) bufparse.Ref {
 					return pluginConfig.Ref()
diff --git a/private/buf/cmd/buf/command/breaking/breaking.go b/private/buf/cmd/buf/command/breaking/breaking.go
index 1fb67d465f..f1fbc79eb7 100644
--- a/private/buf/cmd/buf/command/breaking/breaking.go
+++ b/private/buf/cmd/buf/command/breaking/breaking.go
@@ -161,23 +161,11 @@ func run(
 	if err != nil {
 		return err
 	}
-	wasmRuntimeCacheDir, err := bufcli.CreateWasmRuntimeCacheDir(container)
-	if err != nil {
-		return err
-	}
-	wasmRuntime, err := wasm.NewRuntime(ctx, wasm.WithLocalCacheDir(wasmRuntimeCacheDir))
-	if err != nil {
-		return err
-	}
-	defer func() {
-		retErr = errors.Join(retErr, wasmRuntime.Close(ctx))
-	}()
 	// Do not exclude imports here. bufcheck's Client requires all imports.
 	// Use bufcheck's BreakingWithExcludeImports.
-	imageWithConfigs, checkRunnerProvider, err := controller.GetTargetImageWithConfigs(
+	imageWithConfigs, err := controller.GetTargetImageWithConfigs(
 		ctx,
 		input,
-		wasmRuntime,
 		bufctl.WithTargetPaths(flags.Paths, flags.ExcludePaths),
 		bufctl.WithConfigOverride(flags.Config),
 	)
@@ -195,10 +183,9 @@ func run(
 	}
 	// Do not exclude imports here. bufcheck's Client requires all imports.
 	// Use bufcheck's BreakingWithExcludeImports.
-	againstImageWithConfigs, _, err := controller.GetTargetImageWithConfigs(
+	againstImageWithConfigs, err := controller.GetTargetImageWithConfigs(
 		ctx,
 		flags.Against,
-		wasmRuntime,
 		bufctl.WithTargetPaths(externalPaths, flags.ExcludePaths),
 		bufctl.WithConfigOverride(flags.AgainstConfig),
 	)
@@ -218,23 +205,37 @@ func run(
 			len(againstImageWithConfigs),
 		)
 	}
+	wasmRuntimeCacheDir, err := bufcli.CreateWasmRuntimeCacheDir(container)
+	if err != nil {
+		return err
+	}
+	wasmRuntime, err := wasm.NewRuntime(ctx, wasm.WithLocalCacheDir(wasmRuntimeCacheDir))
+	if err != nil {
+		return err
+	}
+	defer func() {
+		retErr = errors.Join(retErr, wasmRuntime.Close(ctx))
+	}()
+	// Get the check client for the input images.
+	checkClient, err := controller.NewCheckClient(
+		ctx,
+		input,
+		wasmRuntime,
+		bufctl.WithTargetPaths(flags.Paths, flags.ExcludePaths),
+		bufctl.WithConfigOverride(flags.Config),
+	)
+	if err != nil {
+		return err
+	}
 	var allFileAnnotations []bufanalysis.FileAnnotation
 	for i, imageWithConfig := range imageWithConfigs {
-		client, err := bufcheck.NewClient(
-			container.Logger(),
-			checkRunnerProvider,
-			bufcheck.ClientWithStderr(container.Stderr()),
-		)
-		if err != nil {
-			return err
-		}
 		breakingOptions := []bufcheck.BreakingOption{
 			bufcheck.WithPluginConfigs(imageWithConfig.PluginConfigs()...),
 		}
 		if flags.ExcludeImports {
 			breakingOptions = append(breakingOptions, bufcheck.BreakingWithExcludeImports())
 		}
-		if err := client.Breaking(
+		if err := checkClient.Breaking(
 			ctx,
 			imageWithConfig.BreakingConfig(),
 			imageWithConfig,
diff --git a/private/buf/cmd/buf/command/config/internal/internal.go b/private/buf/cmd/buf/command/config/internal/internal.go
index e324ae888f..c84dfba6c2 100644
--- a/private/buf/cmd/buf/command/config/internal/internal.go
+++ b/private/buf/cmd/buf/command/config/internal/internal.go
@@ -22,9 +22,9 @@ import (
 
 	"buf.build/go/bufplugin/check"
 	"github.com/bufbuild/buf/private/buf/bufcli"
+	"github.com/bufbuild/buf/private/buf/bufctl"
 	"github.com/bufbuild/buf/private/bufpkg/bufcheck"
 	"github.com/bufbuild/buf/private/bufpkg/bufconfig"
-	"github.com/bufbuild/buf/private/bufpkg/bufplugin"
 	"github.com/bufbuild/buf/private/pkg/app/appcmd"
 	"github.com/bufbuild/buf/private/pkg/app/appext"
 	"github.com/bufbuild/buf/private/pkg/normalpath"
@@ -166,6 +166,23 @@ func lsRun(
 	if flags.Version != "" {
 		configOverride = fmt.Sprintf(`{"version":"%s"}`, flags.Version)
 	}
+	bufYAMLFile, err := bufcli.GetBufYAMLFileForDirPathOrOverride(ctx, ".", configOverride)
+	if err != nil {
+		if !errors.Is(err, fs.ErrNotExist) {
+			return err
+		}
+		bufYAMLFile, err = bufconfig.NewBufYAMLFile(
+			bufconfig.FileVersionV2,
+			[]bufconfig.ModuleConfig{
+				bufconfig.DefaultModuleConfigV2,
+			},
+			nil,
+			nil,
+		)
+		if err != nil {
+			return err
+		}
+	}
 	wasmRuntimeCacheDir, err := bufcli.CreateWasmRuntimeCacheDir(container)
 	if err != nil {
 		return err
@@ -177,25 +194,19 @@ func lsRun(
 	defer func() {
 		retErr = errors.Join(retErr, wasmRuntime.Close(ctx))
 	}()
-	bufYAMLFile, checkRunnerProvider, err := getBufYAMLFileAndRunnerProviderForDirPathOrOverride(
-		ctx,
-		container,
-		".", // Dir path.
-		configOverride,
-		wasmRuntime,
-	)
+	controller, err := bufcli.NewController(container)
 	if err != nil {
 		return err
 	}
-	client, err := bufcheck.NewClient(
-		container.Logger(),
-		checkRunnerProvider,
-		bufcheck.ClientWithStderr(container.Stderr()),
+	checkClient, err := controller.NewCheckClient(
+		ctx,
+		".",
+		wasmRuntime,
+		bufctl.WithConfigOverride(flags.Config),
 	)
 	if err != nil {
 		return err
 	}
-
 	var rules []bufcheck.Rule
 	if flags.ConfiguredOnly {
 		moduleConfigs := bufYAMLFile.ModuleConfigs()
@@ -236,7 +247,7 @@ func lsRun(
 		configuredRuleOptions := []bufcheck.ConfiguredRulesOption{
 			bufcheck.WithPluginConfigs(bufYAMLFile.PluginConfigs()...),
 		}
-		rules, err = client.ConfiguredRules(
+		rules, err = checkClient.ConfiguredRules(
 			ctx,
 			ruleType,
 			checkConfig,
@@ -249,7 +260,7 @@ func lsRun(
 		allRulesOptions := []bufcheck.AllRulesOption{
 			bufcheck.WithPluginConfigs(bufYAMLFile.PluginConfigs()...),
 		}
-		rules, err = client.AllRules(
+		rules, err = checkClient.AllRules(
 			ctx,
 			ruleType,
 			bufYAMLFile.FileVersion(),
@@ -286,82 +297,3 @@ func getModuleConfigForModulePath(moduleConfigs []bufconfig.ModuleConfig, module
 		return nil, fmt.Errorf("multiple modules found for %q", modulePath)
 	}
 }
-
-func getBufYAMLFileAndRunnerProviderForDirPathOrOverride(
-	ctx context.Context,
-	container appext.Container,
-	dirPath string,
-	configOverride string,
-	wasmRuntime wasm.Runtime,
-) (bufconfig.BufYAMLFile, bufcheck.RunnerProvider, error) {
-	bufYAMLFile, err := bufcli.GetBufYAMLFileForDirPathOrOverride(ctx, dirPath, configOverride)
-	if err != nil {
-		if !errors.Is(err, fs.ErrNotExist) {
-			return nil, nil, err
-		}
-		bufYAMLFile, err = bufconfig.NewBufYAMLFile(
-			bufconfig.FileVersionV2,
-			[]bufconfig.ModuleConfig{
-				bufconfig.DefaultModuleConfigV2,
-			},
-			nil,
-			nil,
-		)
-		if err != nil {
-			return nil, nil, err
-		}
-		// The buf.lock file was not found, no plugins are configured.
-		return bufYAMLFile, bufcheck.NewLocalRunnerProvider(
-			wasmRuntime,
-			bufplugin.NopPluginKeyProvider,
-			bufplugin.NopPluginDataProvider,
-		), nil
-	}
-	pluginConfigs := bufYAMLFile.PluginConfigs()
-	if bufYAMLFile.FileVersion() != bufconfig.FileVersionV2 || len(pluginConfigs) == 0 {
-		// The buf.yaml file was found, but no plugins were configured.
-		return bufYAMLFile, bufcheck.NewLocalRunnerProvider(
-			wasmRuntime,
-			bufplugin.NopPluginKeyProvider,
-			bufplugin.NopPluginDataProvider,
-		), nil
-	}
-	if configOverride != "" {
-		// To support remote plugins in the override, we need to resolve the remote
-		// Refs to PluginKeys. A buf.lock file is not required for this operation.
-		// We use the BSR to resolve any remote plugin Refs.
-		pluginKeyProvider, err := bufcli.NewPluginKeyProvider(container)
-		if err != nil {
-			return nil, nil, err
-		}
-		pluginDataProvider, err := bufcli.NewPluginDataProvider(container)
-		if err != nil {
-			return nil, nil, err
-		}
-		return bufYAMLFile, bufcheck.NewLocalRunnerProvider(
-			wasmRuntime,
-			pluginKeyProvider,
-			pluginDataProvider,
-		), nil
-	}
-	// If we have a v2 buf.yaml file, we need to use the Controller to get the
-	// CheckRunnerProvider for the Workspace. We use the Workspace to avoid
-	// re-validating the buf.lock plugins.
-	controller, err := bufcli.NewController(container)
-	if err != nil {
-		return nil, nil, err
-	}
-	workspace, err := controller.GetWorkspace(ctx, dirPath)
-	if err != nil {
-		return nil, nil, err
-	}
-	runnerProvider, err := controller.GetCheckRunnerProviderForWorkspace(
-		ctx,
-		workspace,
-		wasmRuntime,
-	)
-	if err != nil {
-		return nil, nil, err
-	}
-	return bufYAMLFile, runnerProvider, nil
-}
diff --git a/private/buf/cmd/buf/command/lint/lint.go b/private/buf/cmd/buf/command/lint/lint.go
index 3d2a6274df..9ff5162acb 100644
--- a/private/buf/cmd/buf/command/lint/lint.go
+++ b/private/buf/cmd/buf/command/lint/lint.go
@@ -121,6 +121,15 @@ func run(
 	if err != nil {
 		return err
 	}
+	imageWithConfigs, err := controller.GetTargetImageWithConfigs(
+		ctx,
+		input,
+		bufctl.WithTargetPaths(flags.Paths, flags.ExcludePaths),
+		bufctl.WithConfigOverride(flags.Config),
+	)
+	if err != nil {
+		return err
+	}
 	wasmRuntimeCacheDir, err := bufcli.CreateWasmRuntimeCacheDir(container)
 	if err != nil {
 		return err
@@ -132,7 +141,7 @@ func run(
 	defer func() {
 		retErr = errors.Join(retErr, wasmRuntime.Close(ctx))
 	}()
-	imageWithConfigs, checkRunnerProvider, err := controller.GetTargetImageWithConfigs(
+	checkClient, err := controller.NewCheckClient(
 		ctx,
 		input,
 		wasmRuntime,
@@ -144,18 +153,10 @@ func run(
 	}
 	var allFileAnnotations []bufanalysis.FileAnnotation
 	for _, imageWithConfig := range imageWithConfigs {
-		client, err := bufcheck.NewClient(
-			container.Logger(),
-			checkRunnerProvider,
-			bufcheck.ClientWithStderr(container.Stderr()),
-		)
-		if err != nil {
-			return err
-		}
 		lintOptions := []bufcheck.LintOption{
 			bufcheck.WithPluginConfigs(imageWithConfig.PluginConfigs()...),
 		}
-		if err := client.Lint(
+		if err := checkClient.Lint(
 			ctx,
 			imageWithConfig.LintConfig(),
 			imageWithConfig,