diff --git a/.github/workflows/trybot.yml b/.github/workflows/trybot.yml
index b815e617ebbd..f6b06aa9be68 100644
--- a/.github/workflows/trybot.yml
+++ b/.github/workflows/trybot.yml
@@ -182,6 +182,15 @@ jobs:
         run: go test -race ./...
         env:
           GORACE: atexit_sleep_ms=10
+      - if: |-
+          ((github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-branch.')) && (! (contains(github.event.head_commit.message, '
+          Dispatch-Trailer: {"type":"')))) && (matrix.go-version == '1.21.x' && matrix.runner == 'ubuntu-22.04')
+        name: End-to-end test
+        run: |-
+          cd internal/e2e
+          go test
+        env:
+          GITHUB_TOKEN: ${{ secrets.E2E_GITHUB_TOKEN }}
       - if: (matrix.go-version == '1.21.x' && matrix.runner == 'ubuntu-22.04')
         name: Check
         run: go vet ./...
diff --git a/internal/ci/github/trybot.cue b/internal/ci/github/trybot.cue
index f6f712f91133..038307e315d1 100644
--- a/internal/ci/github/trybot.cue
+++ b/internal/ci/github/trybot.cue
@@ -75,6 +75,7 @@ workflows: trybot: _repo.bashWorkflow & {
 				_goTestRace & {
 					if: _isLatestLinux
 				},
+				_e2eTest,
 				_goCheck,
 				_repo.checkGitClean,
 			]
@@ -114,6 +115,19 @@ workflows: trybot: _repo.bashWorkflow & {
 		run:  "go test ./..."
 	}
 
+	_e2eTest: json.#step & {
+		name: "End-to-end test"
+		// The end-to-end tests require the GITHUB_TOKEN secret and are a bit slow,
+		// so we only run them on pushes to protected branches and on one environment.
+		if: "\(_repo.isProtectedBranch) && \(_isLatestLinux)"
+		// Note that Actions runs with a default GITHUB_TOKEN, which we override here.
+		env: GITHUB_TOKEN: "${{ secrets.E2E_GITHUB_TOKEN }}"
+		run:  """
+			cd internal/e2e
+			go test
+			"""
+	}
+
 	_goCheck: json.#step & {
 		// These checks can vary between platforms, as different code can be built
 		// based on GOOS and GOARCH build tags.