diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 34e9af9d..9e1cc904 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,6 +44,33 @@ jobs:
           export DBUS_SESSION_BUS_ADDRESS="unix:path=$runtime_dir/bus"
           TINYBOX_REQUIRE_NATIVE_RESOURCE_TESTS=1 cargo test -j1 -p tinybox-module native_
           TINYBOX_REQUIRE_NATIVE_RESOURCE_TESTS=1 cargo test -j1 -p tinybox-module resource_aware_bus_exec_cancellation_reports_events_and_reaps_descendants
+  # The real-bubblewrap suites. They skip when bwrap cannot run (Ubuntu 24.04
+  # blocks unprivileged user namespaces by default), so this job makes bwrap
+  # usable and requires it: a skip here is a failure, not a pass.
+  bwrap-live:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          submodules: recursive
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249
+      - name: Make unprivileged bubblewrap usable
+        run: |
+          source scripts/ci/prepare-bwrap.sh
+      # The image ships passt (a podman Recommends). Without it this job keeps
+      # the default shared-network path covered; the pasta job covers the other.
+      - name: Remove pasta so the shared-network path is the one tested
+        run: |
+          if dpkg -s passt >/dev/null 2>&1; then sudo apt-get remove --yes passt; fi
+          if command -v pasta >/dev/null 2>&1; then echo "pasta still present" >&2; exit 1; fi
+      - name: Run the real-bubblewrap suites, refusing to skip
+        shell: bash
+        env:
+          TINYBOX_REQUIRE_BWRAP: "1"
+        run: |
+          set -euo pipefail
+          cargo test --locked -p tinybox-jail --test bwrap_isolation --test bwrap_fd_leak -- --nocapture
+          cargo test --locked -p tinybox-jail --lib bwrap
   docker-network-live:
     name: Docker Egress and denied network connectivity
     runs-on: ubuntu-22.04
diff --git a/scripts/ci/prepare-bwrap.sh b/scripts/ci/prepare-bwrap.sh
new file mode 100755
index 00000000..a55a01ee
--- /dev/null
+++ b/scripts/ci/prepare-bwrap.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Make unprivileged bubblewrap usable on a GitHub Linux runner: install it and
+# lift Ubuntu 24.04's AppArmor restriction on unprivileged user namespaces,
+# which otherwise makes every bwrap jail fail (and its tests skip).
+set -euo pipefail
+
+if ! command -v bwrap >/dev/null 2>&1; then
+    sudo apt-get update
+    sudo apt-get install --yes bubblewrap
+fi
+if sysctl -n kernel.apparmor_restrict_unprivileged_userns >/dev/null 2>&1; then
+    sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+fi
+bwrap --version
diff --git a/scripts/ci/prepare-rootless-native-resources.sh b/scripts/ci/prepare-rootless-native-resources.sh
index 8579c78d..cf631605 100644
--- a/scripts/ci/prepare-rootless-native-resources.sh
+++ b/scripts/ci/prepare-rootless-native-resources.sh
@@ -10,9 +10,7 @@ sudo systemctl start "user@${uid}.service"
 runtime_dir="/run/user/${uid}"
 export XDG_RUNTIME_DIR="$runtime_dir"
 export DBUS_SESSION_BUS_ADDRESS="unix:path=$runtime_dir/bus"
-if sysctl -n kernel.apparmor_restrict_unprivileged_userns >/dev/null 2>&1; then
-    sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-fi
+source "$(dirname "${BASH_SOURCE[0]}")/prepare-bwrap.sh"
 
 systemctl --user show-environment >/dev/null
 systemd-run --user --scope --quiet --property=CPUQuota=10% -- /bin/true