diff --git a/.github/workflows/garm_e2e_test_run.yaml b/.github/workflows/garm_e2e_test_run.yaml
new file mode 100644
index 00000000..1cf66574
--- /dev/null
+++ b/.github/workflows/garm_e2e_test_run.yaml
@@ -0,0 +1,42 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+#
+# The job a GARM-spawned runner executes. Reaching it at all is most of the
+# assertion: it only runs if a VM was booted from the published image and its
+# runner registered and claimed the job. The steps cover what that does not —
+# that the runner is usable for real work. Validating the image itself is the
+# image build's concern, not this workflow's.
+
+name: GARM E2E test run
+
+on:
+  workflow_dispatch:
+    inputs:
+      runner-label:
+        description: "Self-hosted runner label to target"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  e2e-test:
+    name: GARM E2E test
+    # A single combined label, matching this repo's runner naming
+    # (e.g. self-hosted-linux-amd64-noble-medium) and how GitHub routes a job to a
+    # GARM scale set — by its name as one label.
+    runs-on: "${{ inputs.runner-label }}"
+    timeout-minutes: 10
+    steps:
+      - name: Report runner identity
+        run: |
+          echo "=== GARM E2E test run ==="
+          echo "Runner: $(hostname)"
+          echo "Kernel: $(uname -sr)"
+          echo "User:   $(whoami)"
+          echo "Home:   $HOME"
+      - name: Assert egress
+        run: |
+          curl -sSf --max-time 30 -o /dev/null https://github.com
+          echo "Egress reached github.com"