diff --git a/.github/workflows/python-sanity.yml b/.github/workflows/python-sanity.yml
index 36ed1db..531c538 100644
--- a/.github/workflows/python-sanity.yml
+++ b/.github/workflows/python-sanity.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 06633e6..1690ef0 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,6 +15,21 @@ jobs:
   testsuite:
     runs-on: arc-vm-nvmetcli-cph
     timeout-minutes: 1200
+
+    env:
+      CHECKOUT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        container:
+          - ghcr.io/linux-nvme/nvmetcli-debian-containerdisk:next
+          - ghcr.io/linux-nvme/nvmetcli-fedora-containerdisk:next
+          - ghcr.io/linux-nvme/nvmetcli-tumbleweed-containerdisk:next
+
+    name: >
+      testsuite (${{ matrix.container }})
+
     steps:
       - name: Checkout blktests-ci
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -24,15 +39,12 @@ jobs:
       - name: Run in VM
         uses: ./.github/actions/kubevirt-action
         with:
-          container_disk_image: "quay.io/containerdisks/fedora:44"
-          host_devices: "nvme-wdc-zn540"
+          container_disk_image: ${{ matrix.container }}
           run_cmds: |
-            sudo dnf install -y git make python3-configshell python3-kmod \
-                                python3-devel python3-nose2 systemd-units
-
             git clone https://github.com/${{ github.repository }} nvmetcli
+            git config --global --add safe.directory nvmetcli
             cd nvmetcli
-            git checkout ${{ github.sha }}
+            git checkout "${CHECKOUT_SHA}"
 
             sudo modprobe nvmet
             sudo make test
diff --git a/Makefile b/Makefile
index 092d53c..57ff7e4 100644
--- a/Makefile
+++ b/Makefile
@@ -19,7 +19,7 @@ all:
 	@echo "  make uninstalldoc  - Uninstall man pages (need sudo)."
 
 test:
-	@nose2 -C --coverage ./nvmet
+	@python3 -m nose2 -C --coverage ./nvmet
 
 doc: ${NAME}
 	${MAKE} -C ${DOCDIR}