diff --git a/integ-test/build.gradle b/integ-test/build.gradle
index 8bf61e5ae11..64c04909390 100644
--- a/integ-test/build.gradle
+++ b/integ-test/build.gradle
@@ -535,6 +535,12 @@ testClusters {
         // Only /_cluster/health is registered; pin the allow-list to it for RestCommandSecurityIT.
         setting 'plugins.ppl.rest.allowed_endpoints', '/_cluster/health'
     }
+    // Long-lived local dev cluster with the security (FGAC) plugin, for `runWithSecurity`.
+    runWithSecurity {
+        testDistribution = 'archive'
+        plugin(getJobSchedulerPlugin())
+        plugin ":opensearch-sql-plugin"
+    }
     remoteIntegTestWithSecurity {
         testDistribution = 'archive'
         plugin(getJobSchedulerPlugin())
@@ -863,6 +869,15 @@ task integTestWithSecurity(type: RestIntegTestTask) {
     }
 }
 
+// analogous to the plugin project's `run` task but with a demo config for testing roles.
+task runWithSecurity(type: org.opensearch.gradle.testclusters.RunTask) {
+    useCluster testClusters.runWithSecurity
+    dependsOn ':opensearch-sql-plugin:bundlePlugin'
+    description = 'Run a local dev cluster with the opensearch-security (FGAC) plugin installed.'
+    group = 'verification'
+}
+configureSecurityPlugin(testClusters.runWithSecurity)
+
 yamlRestTest {
     systemProperty 'tests.security.manager', 'false'
 }
diff --git a/plugin/build.gradle b/plugin/build.gradle
index d0c825424be..b9791612d9c 100644
--- a/plugin/build.gradle
+++ b/plugin/build.gradle
@@ -364,3 +364,4 @@ testClusters.integTest {
 run {
     useCluster testClusters.integTest
 }
+