diff --git a/.github/workflows/integ.yml b/.github/workflows/integ.yml
new file mode 100644
index 0000000..acf4706
--- /dev/null
+++ b/.github/workflows/integ.yml
@@ -0,0 +1,40 @@
+name: Integration Tests
+
+on:
+  workflow_dispatch:
+  push:
+    branches: ["master"]
+  pull_request_target:
+    types: [labeled]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  test:
+    if: |
+      github.event_name != 'pull_request_target' ||
+      contains(github.event.pull_request.labels.*.name, 'safe-to-test')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Python
+        uses: actions/setup-python@v6
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.ROLE_ARN }}
+          role-session-name: python-caching-${{ github.run_id }}
+          aws-region: us-west-2
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt -r dev-requirements.txt
+          pip install -e .
+      - name: Run integ tests
+        run: |
+          pytest --no-cov test/integ/
\ No newline at end of file
diff --git a/.github/workflows/pr_sync.yml b/.github/workflows/pr_sync.yml
new file mode 100644
index 0000000..bca8647
--- /dev/null
+++ b/.github/workflows/pr_sync.yml
@@ -0,0 +1,31 @@
+name: Remove safe-to-test label when new commits are pushed
+
+on:
+  pull_request_target:
+    types: [synchronize]
+
+jobs:
+  remove-label:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+      contents: read
+    if: |
+      contains(github.event.pull_request.labels.*.name, 'safe-to-test')
+
+    steps:
+      - name: Remove label
+        run: |
+          echo "Removing label '$LABEL_NAME' from PR #$PR_NUMBER on repo $REPO" 
+          gh_status=$(gh api "repos/$REPO/issues/$PR_NUMBER/labels/$LABEL_NAME" -X DELETE | jq 'if type == "object" then .status else empty end' --raw-output)
+          case $gh_status in
+            "") echo "Label removed" ;;
+            404) echo "Label not found — ignoring" ;;
+            *) echo "unexpected HTTP $gh_status" && exit 1 ;;
+          esac
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          LABEL_NAME: safe-to-test
+          REPO: ${{ github.event.pull_request.base.repo.full_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}