diff --git a/.github/workflows/pki-basic-test.yml b/.github/workflows/pki-basic-test.yml
new file mode 100644
index 00000000000..67c42f06701
--- /dev/null
+++ b/.github/workflows/pki-basic-test.yml
@@ -0,0 +1,57 @@
+name: Basic PKI CLI
+# https://github.com/dogtagpki/pki/wiki/PKI-CLI
+
+on: workflow_call
+
+env:
+  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    env:
+      SHARED: /tmp/workdir/pki
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v4
+
+      - name: Retrieve PKI images
+        uses: actions/cache@v4
+        with:
+          key: pki-images-${{ github.sha }}
+          path: pki-images.tar
+
+      - name: Load PKI images
+        run: docker load --input pki-images.tar
+
+      - name: Set up runner container
+        run: |
+          tests/bin/runner-init.sh \
+              --hostname=pki.example.com \
+              pki
+
+      - name: Check pki CLI help message
+        run: |
+          docker exec pki pki
+          docker exec pki pki --help
+
+      - name: Check pki CLI version
+        run: |
+          docker exec pki pki --version
+
+      - name: Check pki CLI with wrong command
+        run: |
+          docker exec pki pki wrong \
+              > >(tee stdout) 2> >(tee stderr >&2) || true
+
+          cat > expected << EOF
+          ERROR: Invalid module "wrong".
+          EOF
+
+          diff expected stderr
+
+      - name: Check pki CLI subcommand help message
+        run: |
+          docker exec pki pki --debug nss
+          docker exec pki pki nss --help
diff --git a/.github/workflows/server-basic-test.yml b/.github/workflows/server-basic-test.yml
index dea38c2291d..36fa29e64cc 100644
--- a/.github/workflows/server-basic-test.yml
+++ b/.github/workflows/server-basic-test.yml
@@ -1,4 +1,5 @@
 name: Basic server
+# https://github.com/dogtagpki/pki/wiki/PKI-Server-CLI
 
 on: workflow_call
 
@@ -30,12 +31,36 @@ jobs:
 
       - name: Set up server container
         run: |
-          tests/bin/runner-init.sh pki
-        env:
-          HOSTNAME: pki.example.com
+          tests/bin/runner-init.sh \
+              --hostname=pki.example.com \
+              --network=example \
+              --network-alias=pki.example.com \
+              pki
 
-      - name: Connect server container to network
-        run: docker network connect example pki --alias pki.example.com
+      - name: Check pki-server CLI help message
+        run: |
+          docker exec pki pki-server
+          docker exec pki pki-server --help
+
+      - name: Check pki-server CLI version
+        run: |
+          docker exec pki pki-server --version
+
+      - name: Check pki-server CLI with wrong command
+        run: |
+          docker exec pki pki-server wrong \
+              > >(tee stdout) 2> >(tee stderr >&2) || true
+
+          cat > expected << EOF
+          ERROR: Invalid module "wrong".
+          EOF
+
+          diff expected stderr
+
+      - name: Check pki-server CLI subcommand help message
+        run: |
+          docker exec pki pki-server --debug nss
+          docker exec pki pki-server nss --help
 
       - name: Create pki-tomcat server
         run: |
diff --git a/.github/workflows/tools-tests.yml b/.github/workflows/tools-tests.yml
index 1527f874560..a4d69b869a3 100644
--- a/.github/workflows/tools-tests.yml
+++ b/.github/workflows/tools-tests.yml
@@ -8,6 +8,11 @@ jobs:
     uses: ./.github/workflows/wait-for-build.yml
     secrets: inherit
 
+  pki-basic-test:
+    name: Basic PKI CLI
+    needs: build
+    uses: ./.github/workflows/pki-basic-test.yml
+
   PKICertImport-test:
     name: PKICertImport
     needs: build