diff --git a/.github/workflows/ci_linux.yml b/.github/workflows/ci_linux.yml
index 02ed59ba..45ea2557 100644
--- a/.github/workflows/ci_linux.yml
+++ b/.github/workflows/ci_linux.yml
@@ -1,18 +1,28 @@
 name: CI on Linux
 
 on:
+  # Trigger builds on pull requests
   pull_request:
     paths-ignore:
       - "**.md"
+
+  # Trigger builds AND tests on push to main
   push:
+    branches:
+      - main
     paths-ignore:
       - "**.md"
+
+  # Add manual trigger via Actions UI for running BOTH build and test
+  workflow_dispatch:
+
 env:
   RUST_LOG: info
   RUST_BACKTRACE: 1
+
 jobs:
   build:
-    name: ${{ matrix.variance.name }}
+    name: Build / ${{ matrix.variance.name }}
     runs-on: ubuntu-latest
     container:
       image: ${{ matrix.variance.image }}
@@ -22,15 +32,32 @@ jobs:
         variance:
           # - name: Ubuntu-22.04/CUDA-11.8.0
           #   image: "ghcr.io/rust-gpu/rust-cuda-ubuntu22-cuda11:latest"
-          - name: Ubuntu-22.04/CUDA-12.8.1
+          - name: Ubuntu-22.04 / CUDA-12.8.1
             image: "ghcr.io/rust-gpu/rust-cuda-ubuntu22-cuda12:latest"
-          - name: Ubuntu-24.04/CUDA-12.8.1
+          - name: Ubuntu-24.04 / CUDA-12.8.1
             image: "ghcr.io/rust-gpu/rust-cuda-ubuntu24-cuda12:latest"
-          - name: RockyLinux-9/CUDA-12.8.1
+          - name: RockyLinux-9 / CUDA-12.8.1
             image: "ghcr.io/rust-gpu/rust-cuda-rockylinux9-cuda12:latest"
+    outputs:
+      # Output the result of the permission check
+      actor_has_write_permission: ${{ steps.check_access.outputs.require-result }}
+      # Output the build artifact details so the test job can use them
+      artifact_name: ${{ steps.artifact_details.outputs.name }}
+      artifact_path: ${{ steps.artifact_details.outputs.path }}
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+
+      - name: Check access permissions
+        id: check_access
+        uses: actions-cool/check-user-permission@v2
+        with:
+          require: write
+          username: ${{ github.triggering_actor }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Verify CUDA, Rust installation
         run: |
           nvcc --version
@@ -38,18 +65,91 @@ jobs:
       - name: Load Rust cache
         uses: Swatinem/rust-cache@v2
         with:
-          key: ${{ matrix.variance.name }}
+          key: ${{ matrix.variance.name }}-${{ github.sha }}
+
       - name: Rustfmt
         run: cargo fmt --all -- --check
+
       - name: Clippy
         env:
           RUSTFLAGS: -Dwarnings
         run: cargo clippy --workspace --exclude "optix*" --exclude "path_tracer" --exclude "denoiser" --exclude "ex*" --exclude "cudnn*"
+
       - name: Build all bindings
         run: cargo build --all-features -p cust_raw
-      - name: Build
+
+      - name: Build workspace
         run: cargo build --workspace --exclude "optix*" --exclude "path_tracer" --exclude "denoiser" --exclude "ex*" --exclude "cudnn*"
+
       - name: Check documentation
         env:
           RUSTDOCFLAGS: -Dwarnings
         run: cargo doc --workspace --all-features --document-private-items --no-deps --exclude "optix*" --exclude "path_tracer" --exclude "denoiser" --exclude "ex*" --exclude "cudnn*" --exclude "cust_raw"
+
+      - name: Prepare artifact details
+        id: artifact_details
+        run: |
+          SANITIZED_NAME=$(echo '${{ matrix.variance.name }}' | sed 's/[^a-zA-Z0-9.-]/-/g')
+          ARTIFACT_NAME="target_debug-${SANITIZED_NAME}-${{ github.run_id }}"
+          ARTIFACT_PATH="target/debug"
+          echo "name=${ARTIFACT_NAME}" >> $GITHUB_OUTPUT
+          echo "path=${ARTIFACT_PATH}" >> $GITHUB_OUTPUT
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.artifact_details.outputs.name }}
+          path: ${{ steps.artifact_details.outputs.path }}
+          retention-days: 1
+
+  test:
+    name: Test / ${{ matrix.variance.name }}
+    # Depends on the build job
+    needs: build
+    # Run ONLY IF:
+    # - The corresponding 'build' job succeeded AND
+    # - EITHER:
+    #   - Event is 'push' to 'main'
+    #   - OR Event is 'workflow_dispatch'
+    #   - OR Event is 'pull_request' AND the 'actor_has_write_permission' output from build is 'true'
+    if: >
+      needs.build.result == 'success' &&
+      (
+        (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+        github.event_name == 'workflow_dispatch' ||
+        (github.event_name == 'pull_request' && needs.build.outputs.actor_has_write_permission == 'true')
+      )
+    runs-on: ubuntu-latest
+    # Use the exact same container image as the build job
+    container:
+      image: ${{ matrix.variance.image }}
+    strategy:
+      # Save some credits
+      fail-fast: true
+      matrix:
+        variance:
+          # Must match the build job's matrix definition
+          # - name: Ubuntu-22.04 / CUDA-11.8.0 image:
+          #   "ghcr.io/rust-gpu/rust-cuda-ubuntu22-cuda11:latest"
+          - name: Ubuntu-22.04 / CUDA-12.8.1
+            image: "ghcr.io/rust-gpu/rust-cuda-ubuntu22-cuda12:latest"
+          - name: Ubuntu-24.04 / CUDA-12.8.1
+            image: "ghcr.io/rust-gpu/rust-cuda-ubuntu24-cuda12:latest"
+          - name: RockyLinux-9 / CUDA-12.8.1
+            image: "ghcr.io/rust-gpu/rust-cuda-rockylinux9-cuda12:latest"
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.build.outputs.artifact_name }}
+          path: ${{ needs.build.outputs.artifact_path }}
+
+      - name: List downloaded files
+        run: ls -lR ${{ needs.build.outputs.artifact_path }}
+
+      - name: Run remote tests
+        env:
+          MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
+          MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
+        run: |
+          echo "Stubbed out"
diff --git a/.github/workflows/ci_windows.yml b/.github/workflows/ci_windows.yml
index d7751250..f446987e 100644
--- a/.github/workflows/ci_windows.yml
+++ b/.github/workflows/ci_windows.yml
@@ -14,7 +14,7 @@ env:
 
 jobs:
   rust:
-    name: ${{ matrix.os }}/CUDA-${{ matrix.cuda }}
+    name: Build / ${{ matrix.os }} / CUDA-${{ matrix.cuda }}
     runs-on: ${{ matrix.os }}
     env:
       LLVM_LINK_STATIC: 1