diff --git a/.github/workflows/e2e_openssl.yml b/.github/workflows/e2e_openssl.yml
index 64eccd7c09..e9635570d5 100644
--- a/.github/workflows/e2e_openssl.yml
+++ b/.github/workflows/e2e_openssl.yml
@@ -64,7 +64,7 @@ jobs:
           cat ./workspace/just.perf | tee -a "${GITHUB_STEP_SUMMARY}"
       - name: E2E Test
         run: |
-          env K8S_NAMESPACE=$(cat ./workspace/just.namespace) go test -v -count=1 -tags e2e ./e2e/openssl
+          env K8S_NAMESPACE=$(cat ./workspace/just.namespace) nix shell .#e2e-test --command openssl.test
       - name: Undeploy
         if: always() && inputs.skip-undeploy != 'true'
         run: |
diff --git a/packages/by-name/compiled-go-test/package.nix b/packages/by-name/compiled-go-test/package.nix
new file mode 100644
index 0000000000..13e36400cb
--- /dev/null
+++ b/packages/by-name/compiled-go-test/package.nix
@@ -0,0 +1,79 @@
+{ buildGoModule }:
+{ ... }@args':
+let
+  args = args' // { "doCheck" = false; };
+in
+buildGoModule ({
+  # copy of buildGoModule.buildPhase with the following changes:
+  # - use `go test -c -o $GOPATH/bin/` instead of `go install` to build the binary of a test package
+  # original:
+  # https://github.com/NixOS/nixpkgs/blob/c44815411ae47dd8bbbb92d60c3a83abff28a9f3/pkgs/build-support/go/module.nix#L188-L266
+  buildPhase = ''
+    runHook preBuild
+
+    exclude='\(/_\|examples\|Godeps\|testdata'
+    if [[ -n "$excludedPackages" ]]; then
+      IFS=' ' read -r -a excludedArr <<<$excludedPackages
+      printf -v excludedAlternates '%s\\|' "''${excludedArr[@]}"
+      excludedAlternates=''${excludedAlternates%\\|} # drop final \| added by printf
+      exclude+='\|'"$excludedAlternates"
+    fi
+    exclude+='\)'
+
+    buildGoDir() {
+      local cmd="$1" dir="$2"
+
+      . $TMPDIR/buildFlagsArray
+
+      declare -a flags
+      flags+=($buildFlags "''${buildFlagsArray[@]}")
+      flags+=(''${tags:+-tags=''${tags// /,}})
+      flags+=(''${ldflags:+-ldflags="$ldflags"})
+      flags+=("-p" "$NIX_BUILD_CORES")
+
+      if [ "$cmd" = "test" ]; then
+        flags+=(-vet=off)
+        flags+=($checkFlags)
+      fi
+
+      local OUT
+      if ! OUT="$(go $cmd -c -o $GOPATH/bin/ "''${flags[@]}" $dir 2>&1)"; then
+        if ! echo "$OUT" | grep -qE '(no( buildable| non-test)?|build constraints exclude all) Go (source )?files'; then
+          echo "$OUT" >&2
+          return 1
+        fi
+      fi
+      if [ -n "$OUT" ]; then
+        echo "$OUT" >&2
+      fi
+      return 0
+    }
+
+    getGoDirs() {
+      local type;
+      type="$1"
+      if [ -n "$subPackages" ]; then
+        echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+      else
+        find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
+      fi
+    }
+
+    if (( "''${NIX_DEBUG:-0}" >= 1 )); then
+      buildFlagsArray+=(-x)
+    fi
+
+    if [ ''${#buildFlagsArray[@]} -ne 0 ]; then
+      declare -p buildFlagsArray > $TMPDIR/buildFlagsArray
+    else
+      touch $TMPDIR/buildFlagsArray
+    fi
+    if [ -z "$enableParallelBuilding" ]; then
+        export NIX_BUILD_CORES=1
+    fi
+    for pkg in $(getGoDirs ""); do
+      echo "Building subPackage $pkg"
+      buildGoDir test "$pkg"
+    done
+  '';
+} // args)
diff --git a/packages/by-name/e2e-test/package.nix b/packages/by-name/e2e-test/package.nix
new file mode 100644
index 0000000000..2f21c64426
--- /dev/null
+++ b/packages/by-name/e2e-test/package.nix
@@ -0,0 +1,50 @@
+{ lib
+, compiled-go-test
+, genpolicy-msft
+, genpolicy ? genpolicy-msft
+}:
+let
+  tests = [ "openssl" ];
+in
+
+compiled-go-test rec {
+  pname = "e2e-test";
+  version = builtins.readFile ../../../version.txt;
+
+  # The source of the main module of this repo. We filter for Go files so that
+  # changes in the other parts of this repo don't trigger a rebuild.
+  src =
+    let
+      inherit (lib) fileset path hasSuffix;
+      root = ../../../.;
+    in
+    fileset.toSource {
+      inherit root;
+      fileset = fileset.unions [
+        (path.append root "go.mod")
+        (path.append root "go.sum")
+        (lib.fileset.difference
+          (lib.fileset.fileFilter (file: lib.hasSuffix ".go" file.name) root)
+          (path.append root "service-mesh"))
+      ];
+    };
+
+  proxyVendor = true;
+  vendorHash = "sha256-VBCTnRx4BBvG/yedChE55ZQbsaFk2zDcXtXof9v3XNI=";
+  tags = [ "e2e" ];
+
+  subPackages = map (x: "e2e/" + x) tests;
+
+  prePatch = ''
+    install -D ${lib.getExe genpolicy} cli/assets/genpolicy
+    install -D ${genpolicy.settings}/genpolicy-settings.json cli/assets/genpolicy-settings.json
+    install -D ${genpolicy.rules}/genpolicy-rules.rego cli/assets/genpolicy-rules.rego
+  '';
+
+  CGO_ENABLED = 0;
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
+  ];
+}