diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index 411d78e1..1ac6c64b 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -38,3 +38,19 @@ jobs:
           if-no-files-found: error
           path: |
             *.deb
+
+  build-iso:
+    strategy:
+      fail-fast: false
+      matrix:
+        host_release:
+          - bookworm
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - run: ./test/gha-build-iso.sh
+        name: "Build ISO on ${{matrix.host_release}}"
+        env:
+          HOST_RELEASE: ${{matrix.host_release}}
diff --git a/test/gha-build-iso.sh b/test/gha-build-iso.sh
new file mode 100755
index 00000000..80ccae1a
--- /dev/null
+++ b/test/gha-build-iso.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Entrypoint for GitHub Actions to build an ISO with a minimal setup,
+# just to validate grml-live itself.
+
+set -euxo pipefail
+
+cat >build-gha-ci-test-config <<EOT
+---
+last_release: 2024.02
+EOT
+
+# Install as little Debian packages as possible,
+# we do not want to test *Debian*.
+cat > etc/grml/fai/config/package_config/GRML_GHACI <<EOT
+PACKAGES install AMD64
+linux-image-amd64
+
+PACKAGES install ARM64
+linux-image-arm64
+EOT
+
+docker run -i --rm --volume "${PWD}:/source" -e SKIP_SOURCES=1 -e DO_DAILY_UPLOAD=0 -w /source debian:"$HOST_RELEASE" bash -c \
+    "apt-get update -qq && apt-get satisfy -q -y --no-install-recommends 'git, ca-certificates' && /source/build-driver/build /source daily /source/build-gha-ci-test-config ghaci amd64 testing"