diff --git a/.github/tests/lockdown2/.env b/.github/tests/lockdown2/.env
new file mode 100644
index 0000000..7b6e741
--- /dev/null
+++ b/.github/tests/lockdown2/.env
@@ -0,0 +1 @@
+export EXTRA_HELM_ARGS="--values=examples/production/values.yaml"
diff --git a/.github/tests/lockdown2/post-install.sh b/.github/tests/lockdown2/post-install.sh
new file mode 100755
index 0000000..d93ebd9
--- /dev/null
+++ b/.github/tests/lockdown2/post-install.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
+k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
+
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### spire
+| workload | Status |
+| -------- | ------ |
+| spire-server | $("${k_rollout_status[@]}" spire-server statefulset spire-server) |
+| spire-spiffe-csi-driver | $("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver) |
+| spire-agent | $("${k_rollout_status[@]}" spire-system daemonset spire-agent) |
+| spire-spiffe-oidc-discovery-provider | $("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider) |
+EOF
+
+if [ $1 -ne 0 ]; then
+  echo
+  echo '```'
+  echo '==> Events of namespace spire-server'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-server'
+  kubectl --request-timeout=30s get events --output wide --namespace spire-server
+  echo '........................................................................................................................'
+  echo '<== Events of namespace spire-server'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-server'
+  kubectl --request-timeout=30s describe pods --namespace spire-server
+  echo '========================================================================================================================'
+  echo '==> Events of namespace spire-system'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-system'
+  kubectl --request-timeout=30s get events --output wide --namespace spire-system
+  echo '........................................................................................................................'
+  echo '<== Events of namespace spire-system'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system'
+  kubectl --request-timeout=30s describe pods --namespace spire-system
+  echo '========================================================================================================================'
+  kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done
+  kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done
+  echo '========================================================================================================================'
+  echo '```'
+fi | cat >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/tests/lockdown2/pre-install.sh b/.github/tests/lockdown2/pre-install.sh
new file mode 100755
index 0000000..8336be0
--- /dev/null
+++ b/.github/tests/lockdown2/pre-install.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+kubectl create namespace "spire-system"
+kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace "spire-server"
+kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
diff --git a/.github/tests/lockdown2/values.yaml b/.github/tests/lockdown2/values.yaml
new file mode 100644
index 0000000..3260fb5
--- /dev/null
+++ b/.github/tests/lockdown2/values.yaml
@@ -0,0 +1,5 @@
+spiffe-oidc-discovery-provider:
+  namespaceOverride: spire-server
+
+spire-server:
+  namespaceOverride: spire-server