diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 152f079..db045a7 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -19,22 +19,27 @@ jobs:
     - uses: cachix/install-nix-action@v22
       with:
         extra_nix_config: "system-features = nixos-test benchmark big-parallel kvm"
+        nix_path: nixpkgs=channel:nixos-23.05
 
     - name: build
       run: NIXPKGS_ALLOW_UNFREE=1 nix build --impure
 
     - name: check flake (runs tests)
       run: NIXPKGS_ALLOW_UNFREE=1 nix flake check --impure --log-format internal-json
+      timeout-minutes: 15
     
     - name: get test derivation path
       id: test-derivation
+      if: always()
       run: |
         drvpath=$(ls -d /nix/store/*-vm-test-run-kolide-launcher)
         echo "drvpath=${drvpath}" >> "$GITHUB_OUTPUT" 
     
     - name: upload test screenshot
       uses: actions/upload-artifact@v4
+      if: always()
       with:
+        name: test-screenshot
         path: ${{ steps.test-derivation.outputs.drvpath }}/test.png
         retention-days: 1
 
diff --git a/tests/kolide-launcher.nix b/tests/kolide-launcher.nix
index cd5f5ac..53dc4e1 100644
--- a/tests/kolide-launcher.nix
+++ b/tests/kolide-launcher.nix
@@ -15,28 +15,68 @@ pkgs.nixosTest {
     imports = [
       flake.nixosModules.kolide-launcher
     ];
-    config = {
-      services.kolide-launcher.enable = true;
-      system.stateVersion = "23.05";
+
+    users.users.alice = {
+      isNormalUser = true;
+      description = "Alice Test";
+      password = "alicetest";
+      uid = 1000;
+    };
+
+    services.xserver.enable = true;
+    services.xserver.displayManager = {
+      lightdm.enable = true;
+      autoLogin = {
+        enable = true;
+        user = "alice";
+      };
     };
+    services.xserver.desktopManager.mate.enable = true;
+
+    # This just quiets some log spam we don't care about
+    hardware.pulseaudio.enable = true;
+
+    services.kolide-launcher.enable = true;
+    system.stateVersion = "23.05";
   };
 
-  testScript = { nodes, ... }: ''
-    machine.start()
+  testScript = { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    ''
+      machine.start()
+
+      # TODO: currently launcher will shut itself down if its secret file doesn't exist,
+      # so we don't get all the way through setup and launcher doesn't stay running.
+      # In the future, we'll want to validate setup and that the service is running.
+
+      with subtest("kolide-launcher service starts"):
+        machine.wait_for_unit("kolide-launcher.service")
+        machine.sleep(10)
+        machine.systemctl("stop kolide-launcher.service")
 
-    # TODO: currently launcher will shut itself down if its secret file doesn't exist,
-    # so we don't get all the way through setup and launcher doesn't stay running.
-    # In the future, we'll want to validate setup and that the service is running.
+      with subtest("launcher set up correctly"):
+        machine.wait_for_file("/var/lib/kolide-k2/k2device.kolide.com/debug.json")
 
-    with subtest("kolide-launcher service starts"):
-      machine.wait_for_unit("kolide-launcher.service")
-      machine.systemctl("status kolide-launcher.service")
+      with subtest("get a screenshot"):
+        machine.wait_for_unit("display-manager.service")
 
-    machine.screenshot("test.png")
+        machine.wait_for_file("${user.home}/.Xauthority")
+        machine.succeed("xauth merge ${user.home}/.Xauthority")
 
-    with subtest("launcher set up correctly"):
-      machine.wait_for_file("/var/lib/kolide-k2/k2device.kolide.com/debug.json")
+        machine.wait_until_succeeds("pgrep marco")
+        machine.wait_for_window("marco")
+        machine.wait_until_succeeds("pgrep mate-panel")
+        machine.wait_for_window("Top Panel")
+        machine.wait_for_window("Bottom Panel")
+        machine.wait_until_succeeds("pgrep caja")
+        machine.wait_for_window("Caja")
+        machine.succeed("su - ${user.name} -c 'DISPLAY=:0.0 mate-terminal >&2 &'")
+        machine.wait_for_window("Terminal")
+        machine.sleep(20)
+        machine.screenshot("test.png")
 
-    machine.shutdown()
-  '';
+      machine.shutdown()
+    '';
 }