diff --git a/.github/workflows/genesis-openembedded.yml b/.github/workflows/genesis-openembedded.yml
index d419823..5e9db94 100644
--- a/.github/workflows/genesis-openembedded.yml
+++ b/.github/workflows/genesis-openembedded.yml
@@ -23,7 +23,26 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             apt-utils bats createrepo-c dpkg-dev gnupg \
             libfile-slurper-perl \
-            libparallel-forkmanager-perl libperl-critic-perl rpm rpm2cpio cpio
+            libparallel-forkmanager-perl libperl-critic-perl rpm rpm2cpio cpio \
+            grub-common curl ca-certificates
+
+      - name: Install the arm64-efi grub modules
+        # t/aarch64_target.t runs the spec's own grub2-mkimage command, and it skips when the
+        # arm64-efi modules are absent -- which is a skip exactly where the suite runs, so it
+        # measures nothing. grub-efi-arm64-bin is Architecture: arm64 and cannot be installed on
+        # the amd64 runner, but the modules inside it are target code, not host code, so
+        # extracting the deb puts them in place without enabling a foreign architecture.
+        run: |
+          set -euo pipefail
+          base=http://ports.ubuntu.com/ubuntu-ports/pool/main/g/grub2-unsigned
+          deb=$(curl -sS "$base/" | grep -oE 'grub-efi-arm64-bin_[^"]*_arm64\.deb' | sort -u | tail -1)
+          [ -n "$deb" ] || { echo "no grub-efi-arm64-bin deb found under $base" >&2; exit 1; }
+          curl -sSO "$base/$deb"
+          sudo dpkg -x "$deb" /
+          # The modules are what the test needs; say so on the branch that earned it.
+          n=$(ls /usr/lib/grub/arm64-efi 2>/dev/null | wc -l)
+          [ "$n" -gt 0 ] || { echo "the deb extracted no arm64-efi modules" >&2; exit 1; }
+          echo "installed $n arm64-efi grub modules from $deb"
 
       - name: Run static checks
         run: |
@@ -75,6 +94,8 @@ jobs:
           prove -v -It/lib t/genesis_openembedded_release.t
           sudo -E prove -v -It/lib t/genesis_openembedded_consumer.t
           prove -v t/riscv64_perl_cell.t
+          prove -v t/aarch64_target.t
+          prove -v t/aarch64_cross_build.t
           sudo -E prove -v -It/lib t/common-repo-gate.t
           prove -v t/openeuler.t
           prove -v t/openeuler_mock_template_include.t
diff --git a/t/aarch64_target.t b/t/aarch64_target.t
index b5d89ab..f88c92c 100644
--- a/t/aarch64_target.t
+++ b/t/aarch64_target.t
@@ -130,11 +130,17 @@ my $grub_spec = slurp($grub_spec_file);
     # build does not carry, or efi_uga, makes grub2-mkimage fail.
   SKIP: {
         my $moddir = '/usr/lib/grub/arm64-efi';
-        skip 'grub2-mkimage or the arm64-efi grub modules are not installed', 4
-            unless -d $moddir && system('command -v grub2-mkimage >/dev/null 2>&1') == 0;
+        # Debian and Ubuntu name the tool grub-mkimage and EL names it grub2-mkimage. The CI
+        # runner is Ubuntu, so looking only for the EL name skips the checks exactly where the
+        # suite runs, which measures nothing.
+        my ($mkimage) = grep { system("command -v $_ >/dev/null 2>&1") == 0 }
+                        qw(grub2-mkimage grub-mkimage);
+        skip 'no grub2-mkimage or grub-mkimage, or the arm64-efi grub modules are not installed', 4
+            unless -d $moddir && $mkimage;
         skip 'no grub2-mkimage command in the spec', 4 if $cmd eq '';
         my $tmp = tempdir(CLEANUP => 1);
         my $run = $cmd;
+        $run =~ s/\Agrub2-mkimage\b/$mkimage/;
         $run =~ s/(?<=\s-o\s)\S+/$tmp\/grubaa64.efi/;
         is(system("$run >/dev/null 2>&1"), 0, "the spec's grub2-mkimage command succeeds");
         my $image = '';