diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 0d07c63..152f079 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -9,6 +9,9 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    outputs:
+      drvpath: ${{ steps.test-derivation.outputs.drvpath }}
+
     steps:
 
     - uses: actions/checkout@v3
@@ -22,6 +25,18 @@ jobs:
 
     - name: check flake (runs tests)
       run: NIXPKGS_ALLOW_UNFREE=1 nix flake check --impure --log-format internal-json
+    
+    - name: get test derivation path
+      id: test-derivation
+      run: |
+        drvpath=$(ls -d /nix/store/*-vm-test-run-kolide-launcher)
+        echo "drvpath=${drvpath}" >> "$GITHUB_OUTPUT" 
+    
+    - name: upload test screenshot
+      uses: actions/upload-artifact@v4
+      with:
+        path: ${{ steps.test-derivation.outputs.drvpath }}/test.png
+        retention-days: 1
 
     - name: show flake output attributes
       run: nix flake show
diff --git a/tests/kolide-launcher.nix b/tests/kolide-launcher.nix
index 6a09979..cd5f5ac 100644
--- a/tests/kolide-launcher.nix
+++ b/tests/kolide-launcher.nix
@@ -24,11 +24,18 @@ pkgs.nixosTest {
   testScript = { nodes, ... }: ''
     machine.start()
 
-    with subtest("launcher starts"):
-      machine.wait_for_file("/var/lib/kolide-k2/k2device.kolide.com/debug.json")
+    # TODO: currently launcher will shut itself down if its secret file doesn't exist,
+    # so we don't get all the way through setup and launcher doesn't stay running.
+    # In the future, we'll want to validate setup and that the service is running.
 
     with subtest("kolide-launcher service starts"):
       machine.wait_for_unit("kolide-launcher.service")
+      machine.systemctl("status kolide-launcher.service")
+
+    machine.screenshot("test.png")
+
+    with subtest("launcher set up correctly"):
+      machine.wait_for_file("/var/lib/kolide-k2/k2device.kolide.com/debug.json")
 
     machine.shutdown()
   '';