diff --git a/.ci/integration.sh b/.ci/integration.sh
new file mode 100755
index 0000000000000000000000000000000000000000..0bf69b1949edbca174a96e9f987426082ad61612
--- /dev/null
+++ b/.ci/integration.sh
@@ -0,0 +1,34 @@
+#!/bin/sh -e
+
+set -x
+
+if [ "$(id -u)" = 0 ]; then
+	exec su "${TESTUSER:-build}" -c "sh -e $0"
+fi
+
+pmbootstrap() {
+	./pmbootstrap.py --details-to-stdout "$@"
+}
+
+# Make sure that the work folder format is up to date, and that there are no
+# mounts from aborted test cases (pmbootstrap#1595)
+echo "Initializing pmbootstrap"
+yes '' | ./pmbootstrap.py --details-to-stdout init
+
+pmbootstrap work_migrate
+pmbootstrap -q shutdown
+
+# TODO: make device configurable?
+device="qemu-amd64"
+# TODO: make UI configurable?
+ui="phosh"
+pmbootstrap config device "$device"
+pmbootstrap config ui "$ui"
+
+# NOTE: --no-image is used because building images makes pmb try to
+# "modprobe loop". This fails in CI.
+echo "Building $ui image for $device"
+pmbootstrap -y install --zap --password 147147 --no-image
+
+echo "Building $ui image for $device, with FDE"
+pmbootstrap -y install --zap --password 147147 --fde --no-image
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 45bc1df5f23b67c3c7c442562aff3648a3fb7885..941cf9cc7608654173f7a51fb7f65f15f18fefd0 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -95,3 +95,19 @@ deploy:
     - rsync -hrvz --delete -e "ssh -p ${SSH_PORT}" public/ "${SSH_HOST}":/var/www/docs.postmarketos.org/pmbootstrap/
   environment:
     name: deploy
+
+integration:
+  stage: test
+  before_script:
+    - *global_before_scripts
+    - apk upgrade -U
+    - apk add doas git losetup python3 openssl
+    - echo "permit nopass build" > /etc/doas.d/ci-user.conf
+  script:
+    - ".ci/integration.sh"
+  after_script:
+    - "cp /home/build/.local/var/pmbootstrap/log.txt ."
+  artifacts:
+    when: on_failure
+    paths:
+      - "log.txt"