diff --git a/.github/workflows/php.yml b/.github/workflows/php.yml
index 0c25c95..039397d 100644
--- a/.github/workflows/php.yml
+++ b/.github/workflows/php.yml
@@ -17,8 +17,7 @@ jobs:
         env:
           POSTGRES_DB: forge
           POSTGRES_USER: forge
-          # HACK: TestBench seems to assume blank password, at least w/GHA.
-          POSTGRES_HOST_AUTH_METHOD: trust
+          POSTGRES_PASSWORD: secret
         options: >-
           --health-cmd pg_isready
           --health-interval 10s
@@ -34,7 +33,7 @@ jobs:
       run: |
         sudo /etc/init.d/mysql start
         mysql -e 'CREATE DATABASE forge;' --user=root --password=root
-        mysql -e "CREATE USER 'forge'@'localhost' IDENTIFIED BY '';" --user=root --password=root
+        mysql -e "CREATE USER 'forge'@'localhost' IDENTIFIED BY 'secret';" --user=root --password=root
         mysql -e "GRANT ALL PRIVILEGES ON *.* TO 'forge'@'localhost';" --user=root --password=root
 
     - uses: actions/checkout@v2
@@ -55,4 +54,4 @@ jobs:
       run: composer install --prefer-dist --no-progress
 
     - name: Run test suite
-      run: composer run-script test
+      run: vendor/bin/phpunit --configuration phpunit.xml.github
diff --git a/phpunit.xml.github b/phpunit.xml.github
new file mode 100644
index 0000000..19df89c
--- /dev/null
+++ b/phpunit.xml.github
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit bootstrap="vendor/autoload.php"
+         backupGlobals="false"
+         backupStaticAttributes="false"
+         colors="true"
+         verbose="true"
+         convertErrorsToExceptions="true"
+         convertNoticesToExceptions="true"
+         convertWarningsToExceptions="true"
+         processIsolation="false"
+         stopOnFailure="false">
+    <testsuites>
+        <testsuite name="MigrationSnapshot Test Suite">
+            <directory>tests</directory>
+        </testsuite>
+    </testsuites>
+    <filter>
+        <whitelist>
+            <directory suffix=".php">src/</directory>
+        </whitelist>
+    </filter>
+    <logging>
+        <log type="tap" target="build/report.tap"/>
+        <log type="junit" target="build/report.junit.xml"/>
+        <log type="coverage-html" target="build/coverage"/>
+        <log type="coverage-text" target="build/coverage.txt"/>
+        <log type="coverage-clover" target="build/logs/clover.xml"/>
+    </logging>
+
+    <php>
+        <env name="DB_PASSWORD" value="secret"/>
+    </php>
+</phpunit>