diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 09abd42..8b77fcf 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -48,17 +48,10 @@ jobs:
         with:
           pattern: ${{ needs.build.outputs.artifact-prefix }}-*-${{ matrix.platform.arch }}
           merge-multiple: true
+      - name: Install dependencies
+        run: |
+          go install github.com/canonical/spread/cmd/spread@latest
       - name: Run tests
         run: |
-          # lxd is necessary for spread
-          sudo snap install lxd
-          sudo adduser "$USER" lxd
-          # `newgrp` does not work in GitHub Actions; use `sudo --user` instead
-          sudo --user "$USER" --preserve-env --preserve-env=PATH -- env -- lxd waitready
-          sudo --user "$USER" --preserve-env --preserve-env=PATH -- env -- lxd init --auto
-          # Workaround for Docker & LXD on same machine
-          sudo iptables -F FORWARD
-          sudo iptables -P FORWARD ACCEPT
-
-          sudo snap install rockcraft --classic --edge
-          sudo --user "$USER" --preserve-env --preserve-env=PATH -- env -- rockcraft test
+          ROCK_FILENAME=$(ls -- *.rock)
+          CRAFT_ARTIFACT="$(pwd)/$ROCK_FILENAME" "$HOME/go/bin/spread" -v github-ci:
diff --git a/spread.yaml b/spread.yaml
index 87054c1..88d192a 100644
--- a/spread.yaml
+++ b/spread.yaml
@@ -1,30 +1,39 @@
 project: mysql-rock
 
+path: /home/ubuntu/mysql-rock
+
+environment:
+  CRAFT_ARTIFACT: $(HOST:printenv CRAFT_ARTIFACT)
+
 backends:
-  craft:
-    type: craft
+  lxd-vm:
+    type: adhoc
+    allocate: ADDRESS $(./spread/.extension allocate lxd-vm)
+    discard: ./spread/.extension discard lxd-vm
     systems:
       - ubuntu-24.04
 
+  github-ci:
+    type: adhoc
+    manual: true
+    allocate: ADDRESS $(./spread/.extension allocate ci)
+    discard: ./spread/.extension discard ci
+    environment:
+      CI: '$(HOST: echo $CI)'
+    systems:
+      - ubuntu-24.04:
+          username: runner
+
 suites:
   spread/tests/:
     summary: General integration tests
 
     prepare: |
-      # For 'rockcraft.skopeo'
-      snap install rockcraft --classic --edge
-      snap install docker
-
-      # Wait for docker daemon to come online
-      apt install -y retry
-      retry --times=10 --delay 2 -- docker run hello-world
-
-      # Load the rock into docker
-      rockcraft.skopeo --insecure-policy copy "oci-archive:$CRAFT_ARTIFACT" docker-daemon:mysql:spreadtest
-
-      # Install mysql client
       apt update
-      apt install -y mysql-client
+      apt install -y retry mysql-client skopeo
+      snap install docker
+      retry --times=10 --delay=2 -- docker run hello-world
+      skopeo --insecure-policy copy "oci-archive:${SPREAD_PATH}/$(basename "${CRAFT_ARTIFACT}")" docker-daemon:mysql:spreadtest
     prepare-each: |
       docker run -d --rm -e MYSQL_ROOT_PASSWORD=myS3cr3tp@ss -p 3432:3306 --name "${SPREAD_TASK//\//_}" mysql:spreadtest
       # wait for initialization
@@ -32,7 +41,7 @@ suites:
     restore-each: |
       docker kill "${SPREAD_TASK//\//_}" || true
     restore: |
-      docker image rm --force mysql:spreadtest
+      docker image rm --force mysql:spreadtest || true
 
 exclude:
   - .git
diff --git a/spread/.extension b/spread/.extension
index 031b578..8a63f35 100755
--- a/spread/.extension
+++ b/spread/.extension
@@ -95,8 +95,21 @@ allocate_lxdvm() {
 }
 
 discard_lxdvm() {
-    instance_name="$(lxc ls -f csv | grep ",$SPREAD_SYSTEM_ADDRESS " | cut -f1 -d",")"
-    lxc delete -f "$instance_name"
+    instance_name="$(lxc ls -f json |
+  jq -r --arg addr "$SPREAD_SYSTEM_ADDRESS" '
+    .[] |
+    select(.type == "virtual-machine") |
+    .name as $name |
+    .state.network |
+    to_entries[] |
+    select(.key != "docker0" and .key != "lo") |
+    .value.addresses[] |
+    select(.family == "inet" and .scope == "global" and .address == $addr) |
+    $name
+  ' | head -1)"
+    if [ -n "$instance_name" ]; then
+        lxc delete -f "$instance_name" || true
+    fi
 }
 
 allocate_ci() {
@@ -104,14 +117,15 @@ allocate_ci() {
         echo "This backend is intended to be used only in CI systems."
         exit 1
     fi
-    sudo sed -i 's/^\s*#\?\s*\(PermitRootLogin\|PasswordAuthentication\)\>.*/\1 yes/' /etc/ssh/sshd_config
-    if [ -d /etc/ssh/sshd_config.d ]; then echo -e 'PermitRootLogin yes\nPasswordAuthentication yes' | sudo tee /etc/ssh/sshd_config.d/00-spread.conf; fi
-    sudo systemctl daemon-reload
-    sudo systemctl restart ssh
+    sudo tee /etc/ssh/sshd_config.d/10-spread-github-ci.conf << 'EOF'
+    PasswordAuthentication yes
+    PermitEmptyPasswords yes
+EOF
 
-    echo "root:${SPREAD_PASSWORD}" | sudo chpasswd || true
+    sudo passwd --delete "$USER"
+
+    sudo systemctl reload ssh || sudo systemctl restart ssh
 
-    # Print the instance address to stdout
     echo localhost >&3
 }
 
diff --git a/spread/tests/smoke/task.yaml b/spread/tests/smoke/task.yaml
index 197f627..04a8eac 100644
--- a/spread/tests/smoke/task.yaml
+++ b/spread/tests/smoke/task.yaml
@@ -21,4 +21,3 @@ execute: |
 
   docker exec -t "${SPREAD_TASK//\//_}" pebble logs
   docker exec -t "${SPREAD_TASK//\//_}" pebble services
-
diff --git a/spread/tests/versions/task.yaml b/spread/tests/versions/task.yaml
index 59f70ed..459fd3b 100644
--- a/spread/tests/versions/task.yaml
+++ b/spread/tests/versions/task.yaml
@@ -9,4 +9,3 @@ execute: |
         --port=3432 \
         --user=root \
         --execute="select @@version;" | grep -q -e "^${ROCK_VERSION}"
-