diff --git a/.license-scan-overrides.jsonl b/.license-scan-overrides.jsonl
index 58c4508..708e4f0 100644
--- a/.license-scan-overrides.jsonl
+++ b/.license-scan-overrides.jsonl
@@ -1,3 +1,4 @@
 {"name": "github.com/chzyer/logex", "licenceType": "MIT"}
+{"name": "github.com/hashicorp/vault/api/auth/approle", "licenceType": "MPL-2.0"}
 {"name": "github.com/jpillora/longestcommon", "licenceType": "MIT"}
 {"name": "github.com/spdx/tools-golang", "licenceTextOverrideFile": "vendor/github.com/spdx/tools-golang/LICENSE.code"}
diff --git a/Makefile b/Makefile
index d10d876..4c2f65e 100644
--- a/Makefile
+++ b/Makefile
@@ -42,7 +42,7 @@ install: FORCE build/go-makefile-maker
 	install -d -m 0755 "$(DESTDIR)$(PREFIX)/bin"
 	install -m 0755 build/go-makefile-maker "$(DESTDIR)$(PREFIX)/bin/go-makefile-maker"
 
-# which packages to test with "go test"
+# which packages to test with test runner
 GO_TESTPKGS := $(shell go list -f '{{if or .TestGoFiles .XTestGoFiles}}{{.ImportPath}}{{end}}' ./...)
 # which packages to measure coverage for
 GO_COVERPKGS := $(shell go list ./...)
@@ -59,8 +59,8 @@ run-golangci-lint: FORCE prepare-static-check
 	@golangci-lint run
 
 build/cover.out: FORCE | build
-	@printf "\e[1;36m>> go test\e[0m\n"
-	@env $(GO_TESTENV) go test $(GO_BUILDFLAGS) -ldflags '-s -w $(GO_LDFLAGS)' -shuffle=on -p 1 -coverprofile=$@ -covermode=count -coverpkg=$(subst $(space),$(comma),$(GO_COVERPKGS)) $(GO_TESTPKGS)
+	@printf "\e[1;36m>> Running tests\e[0m\n"
+	@env $(GO_TESTENV) go test -shuffle=on $(GO_BUILDFLAGS) -ldflags '-s -w $(GO_LDFLAGS)' -p 1 -coverprofile=$@ -covermode=count -coverpkg=$(subst $(space),$(comma),$(GO_COVERPKGS)) $(GO_TESTPKGS)
 
 build/cover.html: build/cover.out
 	@printf "\e[1;36m>> go tool cover > build/cover.html\e[0m\n"
diff --git a/internal/core/scan.go b/internal/core/scan.go
index 1c38ae9..353e944 100644
--- a/internal/core/scan.go
+++ b/internal/core/scan.go
@@ -36,6 +36,7 @@ type ScanResult struct {
 	GoVersion            string           // from "go" directive in go.mod, e.g. "1.21"
 	GoDirectDependencies []module.Version // from "require" directive(s) in go.mod without the "// indirect" comment
 	HasBinInfo           bool             // whether we can produce linker instructions for "github.com/sapcc/go-api-declarations/bininfo"
+	UseGinkgo            bool             // wether to use ginkgo test runner instead of go test
 	UsesPostgres         bool             // whether postgres is used
 	KubernetesController bool             // whether the repository contains a Kubernetes controller
 	KubernetesVersion    string           // version of kubernetes to use, derived from k8s.io/api
@@ -52,6 +53,7 @@ func Scan() ScanResult {
 		hasBinInfo           bool
 		kubernetesController bool
 		kubernetesVersion    string
+		useGinkgo            bool
 		usesPostgres         bool
 	)
 
@@ -67,6 +69,9 @@ func Scan() ScanResult {
 		if v.Mod.Path == "github.com/lib/pq" {
 			usesPostgres = true
 		}
+		if strings.HasPrefix(v.Mod.Path, "github.com/onsi/ginkgo") {
+			useGinkgo = true
+		}
 		if v.Mod.Path == "k8s.io/api" {
 			kubernetesVersion = strings.ReplaceAll(v.Mod.Version, "v0", "1")
 		}
@@ -80,6 +85,7 @@ func Scan() ScanResult {
 		ModulePath:           modFile.Module.Mod.Path,
 		GoDirectDependencies: goDeps,
 		HasBinInfo:           hasBinInfo,
+		UseGinkgo:            useGinkgo,
 		UsesPostgres:         usesPostgres,
 		KubernetesController: kubernetesController,
 		KubernetesVersion:    kubernetesVersion,
diff --git a/internal/makefile/makefile.go b/internal/makefile/makefile.go
index f5d62f4..6633dd6 100644
--- a/internal/makefile/makefile.go
+++ b/internal/makefile/makefile.go
@@ -123,6 +123,19 @@ endif
 		})
 	}
 
+	if sr.UseGinkgo {
+		prepare.addRule(rule{
+			description: "Install ginkgo required when using it as test runner. This is used in CI before dropping privileges, you should probably install all the tools using your package manager",
+			phony:       true,
+			recipe: []string{
+				`@if ! hash ginkgo 2>/dev/null; then` +
+					` printf "\e[1;36m>> Installing ginkgo...\e[0m\n";` +
+					` go install github.com/onsi/ginkgo/v2/ginkgo; fi`,
+			},
+			target: "install-ginkgo",
+		})
+	}
+
 	///////////////////////////////////////////////////////////////////////////
 	// Build
 	build := category{name: "build"}
@@ -172,7 +185,7 @@ endif
 	// Test
 	test := category{name: "test"}
 
-	test.addDefinition(`# which packages to test with "go test"`)
+	test.addDefinition(`# which packages to test with test runner`)
 	testPkgGreps := ""
 	if cfg.Test.Only != "" {
 		testPkgGreps += fmt.Sprintf(" | grep -E '%s'", cfg.Test.Only)
@@ -180,7 +193,12 @@ endif
 	if cfg.Test.Except != "" {
 		testPkgGreps += fmt.Sprintf(" | grep -Ev '%s'", cfg.Test.Except)
 	}
-	test.addDefinition(`GO_TESTPKGS := $(shell go list -f '{{if or .TestGoFiles .XTestGoFiles}}{{.ImportPath}}{{end}}' ./...%s)`, testPkgGreps)
+	pathVar := "ImportPath"
+	// ginkgo only understands relative names eg ./config or config but not example.com/package/config
+	if sr.UseGinkgo {
+		pathVar = "Dir"
+	}
+	test.addDefinition(`GO_TESTPKGS := $(shell go list -f '{{if or .TestGoFiles .XTestGoFiles}}{{.%s}}{{end}}' ./...%s)`, pathVar, testPkgGreps)
 
 	test.addDefinition(`# which packages to measure coverage for`)
 	coverPkgGreps := ""
@@ -236,7 +254,7 @@ endif
 		},
 	})
 
-	//add targets for `go test` incl. coverage report
+	//add targets for test runner incl. coverage report
 	testRule := rule{
 		description: "Run tests and generate coverage report.",
 		phony:       true,
@@ -244,11 +262,17 @@ endif
 		// We use order only prerequisite because this target is used in CI.
 		orderOnlyPrerequisites: []string{"build"},
 		recipe: []string{
-			`@printf "\e[1;36m>> go test\e[0m\n"`,
+			`@printf "\e[1;36m>> Running tests\e[0m\n"`,
 		},
 	}
-	goTest := fmt.Sprintf(`go test $(GO_BUILDFLAGS) -ldflags '%s $(GO_LDFLAGS)' -shuffle=on -p 1 -coverprofile=$@ -covermode=count -coverpkg=$(subst $(space),$(comma),$(GO_COVERPKGS)) $(GO_TESTPKGS)`,
-		makeDefaultLinkerFlags(path.Base(sr.MustModulePath()), sr))
+
+	testRunner := "go test -shuffle=on"
+	if sr.UseGinkgo {
+		testRunner = "ginkgo run --randomize-all"
+		testRule.prerequisites = append(testRule.prerequisites, "install-ginkgo")
+	}
+	goTest := fmt.Sprintf(`%s $(GO_BUILDFLAGS) -ldflags '%s $(GO_LDFLAGS)' -p 1 -coverprofile=$@ -covermode=count -coverpkg=$(subst $(space),$(comma),$(GO_COVERPKGS)) $(GO_TESTPKGS)`,
+		testRunner, makeDefaultLinkerFlags(path.Base(sr.MustModulePath()), sr))
 	if sr.KubernetesController {
 		testRule.prerequisites = append(testRule.prerequisites, "generate")
 		testRule.recipe = append(testRule.recipe, fmt.Sprintf(`KUBEBUILDER_ASSETS="$(shell setup-envtest use %s --bin-dir $(TESTBIN) -p path)" %s`, sr.KubernetesVersion, goTest))