diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index b233711..8c759b1 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -1,5 +1,7 @@
 name: QA
 on: [ pull_request ]
+permissions:
+  contents: read
 jobs:
   flake-check:
     name: Nix Flake Checks
@@ -9,11 +11,15 @@ jobs:
       - uses: cachix/install-nix-action@v31
       - name: Nix Flake Checks
         run: nix flake check --all-systems
-  nixos-tests:
+  nixos-basic-test:
     runs-on: large_runner_16core_64gb
     steps:
       - uses: actions/checkout@v6
       - uses: cachix/install-nix-action@v31
+      - uses: cachix/cachix-action@v17
+        with:
+          name: openstack-nix
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
       - name: Build
         run: |
           set -euxo pipefail
@@ -24,6 +30,24 @@ jobs:
       - name: Basic setup
         run: |
           nix run .#tests.x86_64-linux.openstack-default-setup.driver
+  nixos-live-migration-test:
+    runs-on: large_runner_16core_64gb
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: cachix/install-nix-action@v31
+      - uses: cachix/cachix-action@v17
+        with:
+          name: openstack-nix
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+      - name: Build
+        run: |
+          set -euxo pipefail
+          nix build --show-trace \
+            --option max-jobs 1 \
+            --option cores 4 \
+            .#tests.x86_64-linux.openstack-live-migration.driver
       - name: Live migration
         run: |
           nix run .#tests.x86_64-linux.openstack-live-migration.driver