@@ -303,6 +303,22 @@ jobs:
           {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"driver-podman"}
         ]
 
+  # Run the tests in tests/plans/cpu-tests.yaml. The plan decides which suites
+  # run in which environments, so adding coverage means editing the plan, not
+  # this workflow. Not yet in core-e2e-result.needs: it starts out advisory.
+  plan-cpu-tests:
+    needs: [pr_metadata, prepare-integration]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/e2e-suites.yml
+    with:
+      plan: cpu-tests
+      source-sha: ${{ needs.prepare-integration.outputs.source_sha }}
+      integration-inputs-artifact-id: ${{ needs.prepare-integration.outputs.integration_inputs_artifact_id }}
+
   docker-e2e:
     needs: [pr_metadata, build-binaries, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
 
@@ -0,0 +1,153 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Runs a test plan (tests/plans/<plan>.yaml) on CI. The plan decides which
+# suites run in which environments; this workflow keeps no list of either.
+# `openshell-test-runner test --emit-github-matrix` turns the plan into one job per
+# environment, and each job runs the plan's tests in that environment with
+# `openshell-test-runner test --env <id> --strict`.
+#
+# Modeled on the E2E Suites workflow in NVIDIA/OpenShell#4629 by Evan Lezar.
+
+name: E2E Suites
+
+on:
+  workflow_call:
+    inputs:
+      plan:
+        description: Plan to run, the file stem of a plan in tests/plans/
+        required: true
+        type: string
+      source-sha:
+        description: Source revision of the prepared candidate artifacts
+        required: true
+        type: string
+      integration-inputs-artifact-id:
+        description: Immutable ID of the prepared integration inputs artifact
+        required: true
+        type: string
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+
+# github.workflow is the caller's name here, so scope the group to this plan to
+# avoid colliding with (and cancelling) the calling workflow's other jobs.
+concurrency:
+  group: ${{ github.workflow }}-e2e-suites-${{ inputs.plan }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  plan:
+    name: Plan ${{ inputs.plan }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs['source-sha'] }}
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-nix
+        with:
+          prepare-shell: "true"
+
+      - name: Generate the job matrix from the plan
+        id: matrix
+        shell: nix develop -c bash -euo pipefail {0}
+        env:
+          PLAN: ${{ inputs.plan }}
+        run: |
+          matrix=$(cargo run --locked --quiet \
+            --manifest-path tests/runner/Cargo.toml --bin openshell-test-runner -- \
+            test --plan "tests/plans/${PLAN}.yaml" --emit-github-matrix)
+          echo "$matrix"
+          echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
+
+  suites:
+    name: E2E suites (${{ matrix.plan }}, ${{ matrix.environment }})
+    needs: plan
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs['source-sha'] }}
+          persist-credentials: false
+
+      - name: Enable KVM access
+        run: |
+          set -euo pipefail
+          if [[ ! -c /dev/kvm ]]; then
+            echo "::error::The runner did not expose /dev/kvm"
+            exit 1
+          fi
+          sudo chmod 0666 /dev/kvm
+          exec 3<>/dev/kvm
+          exec 3>&-
+
+      - uses: ./.github/actions/setup-nix
+
+      - name: Cache tmachine disks
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ~/.cache/tmachine
+          # tmachine keys its disk layers on a hash of the Ansible tree.
+          # actions/cache doesn't save after an exact key hit, so a fixed key
+          # would rebuild the changed layers on every run. Key on the playbooks
+          # and fall back to the newest entry for the same runner.
+          key: tmachine-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('tests/tmachine/ansible/**', 'tests/tmachine/images.nix') }}
+          restore-keys: |
+            tmachine-${{ runner.os }}-${{ runner.arch }}-
+
+      - name: Download integration inputs
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          artifact-ids: ${{ inputs['integration-inputs-artifact-id'] }}
+          path: artifacts
+
+      - name: Run the plan in this environment
+        env:
+          PLAN: ${{ matrix.plan }}
+          ENVIRONMENT: ${{ matrix.environment }}
+        run: |
+          # Retry dependency preparation, then run the plan once. The runner
+          # builds the suites for the guest, so it needs no prepared archives.
+          # --strict fails the job instead of skipping an environment or a
+          # selection that would run no tests.
+          nix build --no-link .#openshell-test-runner || nix build --no-link .#openshell-test-runner
+          nix run .#openshell-test-runner -- test \
+            --plan "tests/plans/${PLAN}.yaml" \
+            --env "${ENVIRONMENT}" \
+            --strict \
+            --results artifacts/test-results
+
+      # The results directory holds each family's JUnit report (junit.xml),
+      # the nextest log, and the guest's diagnostics when a run failed.
+      - name: Upload results
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: e2e-results-${{ matrix.plan }}-${{ matrix.environment }}
+          path: artifacts/test-results
+          if-no-files-found: ignore
+          retention-days: 7
+
+  result:
+    name: E2E suites result (${{ inputs.plan }})
+    needs: [plan, suites]
+    if: always()
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/check-job-results
+        with:
+          results: ${{ toJSON(needs) }}