diff --git a/.github/scripts/setup.sh b/.github/scripts/setup.sh
index 2409cdf0d..a719c5208 100755
--- a/.github/scripts/setup.sh
+++ b/.github/scripts/setup.sh
@@ -52,9 +52,11 @@ sudo apt-get -qq install --no-install-recommends --allow-unauthenticated -yy \
      sudo \
      tcl \
      tclsh \
+     tshark \
      unzip \
      valgrind \
      wget \
+     wireshark-common \
      xsltproc \
      systemtap-sdt-dev \
      zlib1g-dev
@@ -97,3 +99,14 @@ export PROTOC=/usr/local/bin/protoc
 export PATH=$PATH:/usr/local/bin
 env
 ls -lha /usr/local/bin
+
+# wireshark-common normally does this, but GH runners are special, so we
+# do it explicitly
+sudo groupadd -f wireshark
+sudo chgrp wireshark /usr/bin/dumpcap
+sudo chmod 750 /usr/bin/dumpcap
+sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
+
+# Add ourselves to the wireshark group (still need "sg wireshark..." for it to take effect)
+sudo usermod -aG wireshark "$(id -nu)"
+
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7dda61720..b9a93a23e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -323,7 +323,7 @@ jobs:
         run: |
           env
           cat config.vars
-          uv run eatmydata pytest tests/test_downgrade.py -n ${PYTEST_PAR} ${PYTEST_OPTS}
+          sg wireshark "uv run eatmydata pytest tests/test_downgrade.py -n ${PYTEST_PAR} ${PYTEST_OPTS}"
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@v4
@@ -438,7 +438,7 @@ jobs:
         run: |
           env
           cat config.vars
-          VALGRIND=0 uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}
+          VALGRIND=0 sg wireshark "uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}"
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@v4
@@ -526,7 +526,7 @@ jobs:
           TEST_DEBUG: 1
           PYTEST_PAR: 2
         run: |
-          VALGRIND=1 uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}  ${{ matrix.PYTEST_OPTS }}
+          VALGRIND=1 sg wireshark "uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}  ${{ matrix.PYTEST_OPTS }}"
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@v4
@@ -617,7 +617,7 @@ jobs:
         env:
           PYTEST_PAR: 2
         run: |
-          uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}  ${{ matrix.PYTEST_OPTS }}
+          sg wireshark "uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}  ${{ matrix.PYTEST_OPTS }}"
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@v4
@@ -748,7 +748,7 @@ jobs:
         run: |
           env
           cat config.vars
-          VALGRIND=0 uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}
+          VALGRIND=0 sg wireshark "uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}"
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@v4