diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ab49afc4a..e7c0a551e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -26,6 +26,11 @@ jobs:
     - run: ./format --ci
     - run: nix-shell --show-trace . -A install
     - run: yes | home-manager -I home-manager=. uninstall
-    - run: nix-shell -j auto --show-trace --arg enableBig false --pure tests -A run.all
+    - name: Run tests
+      run: nix-build -j auto --show-trace --arg enableBig false --pure --option allow-import-from-derivation false tests -A build.all
+      env:
+        GC_INITIAL_HEAP_SIZE: 4294967296
+    - name: Run tests (with IFD)
+      run: nix-build -j auto --show-trace --arg enableBig false --pure --arg enableLegacyIfd true tests -A build.all
       env:
         GC_INITIAL_HEAP_SIZE: 4294967296
diff --git a/docs/manual/contributing/tests.md b/docs/manual/contributing/tests.md
index 41eec3447..f7413eb4d 100644
--- a/docs/manual/contributing/tests.md
+++ b/docs/manual/contributing/tests.md
@@ -13,20 +13,20 @@ functions available in test scripts, you can look at NMT's
 The full Home Manager test suite can be run by executing
 
 ``` shell
-$ nix-shell --pure tests -A run.all
+$ nix-build --pure --option allow-import-from-derivation false tests -A build.all
 ```
 
 in the project root. List all test cases through
 
 ``` shell
-$ nix-shell --pure tests -A list
+$ nix-build --pure tests --option allow-import-from-derivation false -A list
 ```
 
 and run an individual test, for example `alacritty-empty-settings`,
 through
 
 ``` shell
-$ nix-shell --pure tests -A run.alacritty-empty-settings
+$ nix-build --pure tests --option allow-import-from-derivation false -A build.alacritty-empty-settings
 ```
 
 However, those invocations will impurely source the system's Nixpkgs,
@@ -34,11 +34,17 @@ and may cause failures. To run against the Nixpkgs from the `flake.lock` file,
 use instead e.g.
 
 ``` shell
-$ nix build --reference-lock-file flake.lock ./tests#test-all
+$ nix build --reference-lock-file flake.lock --option allow-import-from-derivation false ./tests#test-all
 ```
 
 or
 
 ``` shell
-$ nix build --reference-lock-file flake.lock ./tests#test-alacritty-empty-settings
+$ nix build --reference-lock-file flake.lock --option allow-import-from-derivation false ./tests#test-alacritty-empty-settings
+```
+
+Some tests may be marked with `enableLegacyIfd`, those may be run by run with e.g.
+
+``` shell
+$ nix-build --pure tests --arg enableLegacyIfd true -A build.mytest
 ```
diff --git a/tests/big-test.nix b/tests/big-test.nix
index 5396f170e..233ae7340 100644
--- a/tests/big-test.nix
+++ b/tests/big-test.nix
@@ -10,4 +10,14 @@
       packages or tests that take long to run.
     '';
   };
+
+  options.test.enableLegacyIfd = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    description = ''
+      Whether to enable tests that use import-from-derivation (IFD). Use of IFD
+      in Home Manager is deprecated, and this option should not be used for new
+      tests.
+    '';
+  };
 }
diff --git a/tests/modules/programs/kitty/theme-to-themeFile.nix b/tests/modules/programs/kitty/theme-to-themeFile.nix
index 5506dbdb7..849be1e2e 100644
--- a/tests/modules/programs/kitty/theme-to-themeFile.nix
+++ b/tests/modules/programs/kitty/theme-to-themeFile.nix
@@ -1,11 +1,12 @@
 {
+  config,
   lib,
   options,
   realPkgs,
   ...
 }:
 
-{
+lib.mkIf config.test.enableLegacyIfd {
   programs.kitty = {
     enable = true;
     theme = "Space Gray Eighties";
diff --git a/tests/modules/services/podman-linux/build.nix b/tests/modules/services/podman-linux/build.nix
index f54f7f8b3..a70c1e53f 100644
--- a/tests/modules/services/podman-linux/build.nix
+++ b/tests/modules/services/podman-linux/build.nix
@@ -1,6 +1,11 @@
-{ pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+lib.mkIf config.test.enableLegacyIfd {
   imports = [ ./podman-stubs.nix ];
 
   services.podman = {
diff --git a/tests/modules/services/podman-linux/container.nix b/tests/modules/services/podman-linux/container.nix
index 8f8768903..153d6e195 100644
--- a/tests/modules/services/podman-linux/container.nix
+++ b/tests/modules/services/podman-linux/container.nix
@@ -1,4 +1,6 @@
-{
+{ config, lib, ... }:
+
+lib.mkIf config.test.enableLegacyIfd {
   imports = [ ./podman-stubs.nix ];
 
   services.podman = {
diff --git a/tests/modules/services/podman-linux/image.nix b/tests/modules/services/podman-linux/image.nix
index 7d3159b7a..86dafdc0f 100644
--- a/tests/modules/services/podman-linux/image.nix
+++ b/tests/modules/services/podman-linux/image.nix
@@ -1,4 +1,6 @@
-{
+{ config, lib, ... }:
+
+lib.mkIf config.test.enableLegacyIfd {
   imports = [ ./podman-stubs.nix ];
 
   services.podman = {
diff --git a/tests/modules/services/podman-linux/integration.nix b/tests/modules/services/podman-linux/integration.nix
index 607e45890..fca0a5f15 100644
--- a/tests/modules/services/podman-linux/integration.nix
+++ b/tests/modules/services/podman-linux/integration.nix
@@ -1,6 +1,11 @@
-{ pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+lib.mkIf config.test.enableLegacyIfd {
   imports = [ ./podman-stubs.nix ];
 
   services.podman = {
diff --git a/tests/modules/services/podman-linux/manifest.nix b/tests/modules/services/podman-linux/manifest.nix
index 6ac4ba8ac..ea956967a 100644
--- a/tests/modules/services/podman-linux/manifest.nix
+++ b/tests/modules/services/podman-linux/manifest.nix
@@ -1,4 +1,6 @@
-{
+{ config, lib, ... }:
+
+lib.mkIf config.test.enableLegacyIfd {
   imports = [ ./podman-stubs.nix ];
 
   services.podman = {
diff --git a/tests/modules/services/podman-linux/network.nix b/tests/modules/services/podman-linux/network.nix
index 7e7becc77..904bab822 100644
--- a/tests/modules/services/podman-linux/network.nix
+++ b/tests/modules/services/podman-linux/network.nix
@@ -1,4 +1,6 @@
-{
+{ config, lib, ... }:
+
+lib.mkIf config.test.enableLegacyIfd {
   imports = [ ./podman-stubs.nix ];
 
   services.podman = {
diff --git a/tests/modules/services/podman-linux/volume.nix b/tests/modules/services/podman-linux/volume.nix
index 2c07c9a0f..83e3007f3 100644
--- a/tests/modules/services/podman-linux/volume.nix
+++ b/tests/modules/services/podman-linux/volume.nix
@@ -1,4 +1,6 @@
-{
+{ config, lib, ... }:
+
+lib.mkIf config.test.enableLegacyIfd {
   imports = [ ./podman-stubs.nix ];
 
   services.podman = {