diff --git a/BUILD b/BUILD
index 26a3338..bdcb638 100644
--- a/BUILD
+++ b/BUILD
@@ -1,22 +1,6 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@bazel_gazelle//:def.bzl", "gazelle")
 
 # gazelle:prefix git.monogon.dev/source/nexantic.git
 # gazelle:exclude core/generated
+# gazelle:exclude imports.go
 gazelle(name = "gazelle")
-
-go_library(
-    name = "go_default_library",
-    srcs = ["imports.go"],
-    importpath = "git.monogon.dev/source/nexantic.git",
-    visibility = ["//visibility:public"],
-    deps = [
-        "@com_github_kevinburke_go_bindata//:go_default_library",
-        "@com_github_lopezator_sqlboiler_crdb//:go_default_library",
-        "@com_github_rubenv_sql_migrate//sql-migrate:go_default_library",
-        "@com_github_volatiletech_sqlboiler//:go_default_library",
-        "@com_github_volatiletech_sqlboiler//queries/qmhelper:go_default_library",
-        "@com_github_volatiletech_sqlboiler//randomize:go_default_library",
-        "@com_github_volatiletech_sqlboiler//types:go_default_library",
-    ],
-)
diff --git a/WORKSPACE b/WORKSPACE
index 9401162..0c95a1c 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -96,7 +96,7 @@
 
 http_archive(
     name = "linux_kernel",
-    build_file = "@//core/build/linux_kernel_repo:BUILD",
+    build_file = "@//core/build/linux_kernel_repo:BUILD.repo",
     patch_args = ["-p1"],
     patches = [
         # Fix is in mainline, but upstream hasn't backported it to 4.19.
@@ -115,7 +115,7 @@
 # edk2-stable201908
 new_git_repository(
     name = "edk2",
-    build_file = "@//core/build/edk2:BUILD",
+    build_file = "@//core/build/edk2:BUILD.repo",
     commit = "37eef91017ad042035090cae46557f9d6e2d5917",
     init_submodules = True,
     remote = "https://github.com/tianocore/edk2",
diff --git a/build/Dockerfile b/build/Dockerfile
index cbd1712..f994bb5 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -24,7 +24,8 @@
 	swtpm-tools \
 	rsync \
 	qemu-system-x86-core \
-	postgresql
+	postgresql \
+	expect
 
 # Workaround for a binutils bugs in F30, which generates invalid ELF binaries
 # when linking statically with musl.
diff --git a/core/build/edk2/BUILD b/core/build/edk2/BUILD
index 7911678..e69de29 100644
--- a/core/build/edk2/BUILD
+++ b/core/build/edk2/BUILD
@@ -1,22 +0,0 @@
-genrule(
-    name = "firmware",
-    srcs = glob(["**"]),
-    outs = [
-        "OVMF_CODE.fd",
-        "OVMF_VARS.fd",
-    ],
-    cmd = """
-    (
-        # The edk2 build does not like Bazel's default genrule environment.
-        set +u
-
-        cd external/edk2
-        . edksetup.sh
-        make -C BaseTools/Source/C
-        build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -t GCC5 -a X64 -b RELEASE -p $$PWD/OvmfPkg/OvmfPkgX64.dsc
-    ) > /dev/null
-
-    cp external/edk2/Build/OvmfX64/RELEASE_GCC5/FV/{OVMF_CODE.fd,OVMF_VARS.fd} $(RULEDIR)
-    """,
-    visibility = ["//visibility:public"],
-)
diff --git a/core/build/edk2/BUILD.repo b/core/build/edk2/BUILD.repo
new file mode 100644
index 0000000..7911678
--- /dev/null
+++ b/core/build/edk2/BUILD.repo
@@ -0,0 +1,22 @@
+genrule(
+    name = "firmware",
+    srcs = glob(["**"]),
+    outs = [
+        "OVMF_CODE.fd",
+        "OVMF_VARS.fd",
+    ],
+    cmd = """
+    (
+        # The edk2 build does not like Bazel's default genrule environment.
+        set +u
+
+        cd external/edk2
+        . edksetup.sh
+        make -C BaseTools/Source/C
+        build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -t GCC5 -a X64 -b RELEASE -p $$PWD/OvmfPkg/OvmfPkgX64.dsc
+    ) > /dev/null
+
+    cp external/edk2/Build/OvmfX64/RELEASE_GCC5/FV/{OVMF_CODE.fd,OVMF_VARS.fd} $(RULEDIR)
+    """,
+    visibility = ["//visibility:public"],
+)
diff --git a/core/build/linux_kernel_repo/BUILD b/core/build/linux_kernel_repo/BUILD
index ed035ee..e69de29 100644
--- a/core/build/linux_kernel_repo/BUILD
+++ b/core/build/linux_kernel_repo/BUILD
@@ -1,14 +0,0 @@
-filegroup(
-    name = "all",
-    srcs = glob(["**"]),
-    visibility = ["//visibility:public"],
-)
-
-load("@rules_cc//cc:defs.bzl", "cc_binary")
-
-# Build gen_init_cpio separately for the initramfs generation stage
-cc_binary(
-    name = "gen_init_cpio",
-    srcs = ["usr/gen_init_cpio.c"],
-    visibility = ["//visibility:public"],
-)
diff --git a/core/build/linux_kernel_repo/BUILD.repo b/core/build/linux_kernel_repo/BUILD.repo
new file mode 100644
index 0000000..ed035ee
--- /dev/null
+++ b/core/build/linux_kernel_repo/BUILD.repo
@@ -0,0 +1,14 @@
+filegroup(
+    name = "all",
+    srcs = glob(["**"]),
+    visibility = ["//visibility:public"],
+)
+
+load("@rules_cc//cc:defs.bzl", "cc_binary")
+
+# Build gen_init_cpio separately for the initramfs generation stage
+cc_binary(
+    name = "gen_init_cpio",
+    srcs = ["usr/gen_init_cpio.c"],
+    visibility = ["//visibility:public"],
+)
diff --git a/core/scripts/BUILD b/core/scripts/BUILD
index 81a8d6c..ce5e9a5 100644
--- a/core/scripts/BUILD
+++ b/core/scripts/BUILD
@@ -8,3 +8,11 @@
     ],
     tags = ["local"],
 )
+
+sh_test(
+    name = "test_boot",
+    size = "small",
+    srcs = ["test_boot.sh"],
+    tags = ["local"],
+    deps = [":launch"],
+)
diff --git a/core/scripts/test_boot.sh b/core/scripts/test_boot.sh
new file mode 100755
index 0000000..f2df41a
--- /dev/null
+++ b/core/scripts/test_boot.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/expect -f
+
+set timeout 30
+
+spawn core/scripts/launch.sh
+
+expect "Network service got IP" {} default {
+  send_error "Failed while waiting for IP address"
+  exit 1
+}
+
+expect "Initialized encrypted storage" {
+  exit 0
+} default {
+  send_error "Failed while waiting for encrypted storage"
+  exit 1
+}
diff --git a/scripts/run_ci.sh b/scripts/run_ci.sh
index f9e0c12..e3efd27 100755
--- a/scripts/run_ci.sh
+++ b/scripts/run_ci.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
-# This script is executed by our CI
+# This helper scripts executes all Bazel tests in our CI environment.
+# https://phab.monogon.dev/harbormaster/plan/2/
 set -euo pipefail
 
 BUILD_ID=$1;
@@ -52,7 +53,7 @@
     --pod ${POD} \
     --name=${POD}-bazel \
     ${TAG} \
-    $@
+    bazel test //...
 
 function conduit() {
   # Get Phabricator host from Git origin