diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a9eb85e..d842d9e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,3 +1,5 @@
+name: Run tests
+
 on:
   pull_request:
   push:
@@ -8,7 +10,7 @@ on:
 
 jobs:
   test:
-    name: Run tests
+    name: Run unit and integration tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -20,3 +22,21 @@ jobs:
         run: |
           go install
           python3 tests/test_archives.py
+
+  container-test:
+    name: Run provisioning in a container
+    runs-on: ubuntu-latest
+    container:
+      image: ubuntu:mantic
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup container
+        run: |
+          apt update
+          apt install -y ca-certificates curl gnupg2 golang
+          go install
+
+      - name: Provision
+        run: |
+          ~/go/bin/fup -f contrib/test.yml -b
diff --git a/contrib/test.yml b/contrib/test.yml
new file mode 100644
index 0000000..11f311e
--- /dev/null
+++ b/contrib/test.yml
@@ -0,0 +1,46 @@
+settings:
+  extract_dir: ext
+  versions:
+    chezmoi: 2.42.2
+
+preflight:
+  - task: Enable Docker repo (Debian|Ubuntu)
+    when: is-debian is-ubuntu
+    unless:
+      stat: /etc/apt/sources.list.d/docker.list
+    steps:
+      - name: shell
+        shell: bash
+        cmd: |
+          set -euEo pipefail
+          mkdir -p /etc/apt/keyrings
+          curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+          chmod a+r /etc/apt/keyrings/docker.gpg
+          echo "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" > /etc/apt/sources.list.d/docker.list
+          apt update
+
+packages:
+  debian|ubuntu:
+    - docker-buildx-plugin
+    - docker-ce
+    - docker-ce-cli
+    - docker-compose-plugin
+
+archives:
+  - url: https://github.com/twpayne/chezmoi/releases/download/v${version}/chezmoi_${version}_linux_amd64.tar.gz
+    name: chezmoi
+    unless:
+      cmd: chezmoi --version
+      post: split 2 | cut 1 | cut -1
+
+tasks:
+  - task: Clone chezmoi
+    unless:
+      stat: ~/.local/share/chezmoi
+    steps:
+      - name: git
+        repo:
+          name: https://gitlab.com/femnad/chezmoi.git
+        dir: ~/.local/share/chezmoi
+      - name: cmd
+        cmd: ~/bin/chezmoi apply --force
diff --git a/main.go b/main.go
index 5e7451f..976725e 100644
--- a/main.go
+++ b/main.go
@@ -54,7 +54,7 @@ func main() {
 
 	err = p.Apply()
 	if err != nil {
-		fmt.Printf("Some provisioners had errors: %v", err)
+		fmt.Printf("Some provisioners had errors: %v\n", err)
 		os.Exit(1)
 	}
 }
diff --git a/precheck/fact.go b/precheck/fact.go
index e7b4b07..7f00621 100644
--- a/precheck/fact.go
+++ b/precheck/fact.go
@@ -75,12 +75,17 @@ func neovimReady() (bool, error) {
 }
 
 func sshReady() (bool, error) {
-	resp, _ := marecmd.RunFormatError(marecmd.Input{Command: "ssh-add -l"})
-	if resp.Code == 1 {
+	resp, err := marecmd.RunFormatError(marecmd.Input{Command: "ssh-add -l"})
+	if err != nil {
+		internal.Log.Debugf("error checking ssh-add output: %v", err)
 		return false, nil
 	}
 
 	output := strings.TrimSpace(resp.Stdout)
+	if output == "" {
+		return false, nil
+	}
+
 	for _, line := range strings.Split(output, "\n") {
 		fields := strings.Split(line, " ")
 		if len(fields) != 4 {