diff --git a/.circleci/config.yml b/.circleci/config.yml
index 7a5c60f13c..ea6014351d 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -62,6 +62,23 @@ jobs:
             cd tests
             WX_TEST_WEBREQUEST_URL="0" ./test
 
+      - run:
+          name: Run GUI tests
+          command: |
+            cat > /usr/local/bin/bwrap \<<'EOF'
+            #!/bin/sh
+            # glycin's loader sandbox needs user namespaces unavailable in this container;
+            # run glycin image loaders unsandboxed, pass everything else to the real bwrap.
+            for a in "$@"; do case "$a" in /usr/libexec/glycin-loaders/*)
+              while [ $# -gt 0 ]; do case "$1" in /usr/libexec/glycin-loaders/*) exec "$@";; esac; shift; done;;
+            esac; done
+            exec /usr/bin/bwrap "$@"
+            EOF
+            chmod +x /usr/local/bin/bwrap
+
+            cd tests
+            wlheadless-run -- ./test_gui
+
       - run:
           name: Show ccache statistics
           when: always
diff --git a/build/tools/before_install.sh b/build/tools/before_install.sh
index 9d2e9ae35b..3e106f906b 100755
--- a/build/tools/before_install.sh
+++ b/build/tools/before_install.sh
@@ -128,7 +128,7 @@ case $(uname -s) in
         fi
 
         if [ -f /etc/redhat-release ]; then
-            dnf install -y ${WX_EXTRA_PACKAGES} gawk expat-devel findutils g++ git-core gspell-devel gstreamer1-plugins-base-devel gtk3-devel make libayatana-appindicator-gtk3-devel libcurl-devel libjpeg-devel libnotify-devel libpng-devel libSM-devel libsecret-devel libtiff-devel SDL-devel wayland-protocols-devel webkit2gtk4.1-devel zlib-devel
+            dnf install -y ${WX_EXTRA_PACKAGES} gawk expat-devel findutils g++ git-core gspell-devel gstreamer1-plugins-base-devel gtk3-devel make libayatana-appindicator-gtk3-devel libcurl-devel libjpeg-devel libnotify-devel libpng-devel libSM-devel libsecret-devel libtiff-devel SDL-devel wayland-protocols-devel webkit2gtk4.1-devel weston xwayland-run zlib-devel
         fi
         ;;