diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 1e12b25a1485..cebf29d3a007 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -434,6 +434,78 @@ jobs:
             rm ~/.ssh/id_rsa
             rm ~/.ssh/known_hosts
 
+  define-portability-test-configs:
+    runs-on: ubuntu-slim
+    outputs:
+      apptainer_configs: ${{ steps.configs.outputs.apptainer_configs }}
+      vagrant_configs: ${{ steps.configs.outputs.vagrant_configs }}
+    env:
+      PORTABILITY_TEST_DIR: "util/devel/test/portability"
+    steps:
+      - name: sparse check out ${{ env.PORTABILITY_TEST_DIR }}
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          sparse-checkout: ${{ env.PORTABILITY_TEST_DIR }}
+      - name: get list of current Apptainer and Vagrant configs
+        id: configs
+        run: |
+          cd ${{ env.PORTABILITY_TEST_DIR }}
+
+          pushd apptainer/current
+          apptainer_configs=$(find . -type d -mindepth 1 -maxdepth 1 -exec basename {} \; | awk '{ printf "%s%s", sep, "\""$0"\"", sep=", "}')
+          echo "apptainer_configs=[$apptainer_configs]" >> "$GITHUB_OUTPUT"
+          popd
+
+          pushd vagrant/current
+          vagrant_configs=$(find . -type d -mindepth 1 -maxdepth 1 -exec basename {} \; | awk '{ printf "%s%s", sep, "\""$0"\"", sep=", "}')
+          echo "vagrant_configs=[$vagrant_configs]" >> "$GITHUB_OUTPUT"
+          popd
+
+  portability-tests-apptainer:
+    needs:
+      - should-run-extended-checks
+      - define-portability-test-configs
+    if: needs.should-run-extended-checks.outputs.run-all == 'true'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        apptainer_config: ${{ fromJSON(needs.define-portability-test-configs.outputs.apptainer_configs) }}
+    env:
+      apptainer_config: ${{ matrix.apptainer_config }}
+    steps:
+      - name: install Apptainer
+        run: |
+          sudo add-apt-repository -y ppa:apptainer/ppa
+          sudo apt update
+          sudo apt install -y apptainer
+      - name: print Apptainer version
+        run: |
+          apptainer --version
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: set vars to work from correct branch
+        run: |
+          {
+            echo "GIT_REPO_URL=$PWD"
+            echo "GIT_COMMIT=${{ github.sha }}"
+          } >> "$GITHUB_ENV"
+      - name: test Apptainer config ${{ env.APPTAINER_IMAGE }}
+        run: |
+          export APPTAINER_IMAGE=$apptainer_config
+          MAKEJ="-j$(./util/buildRelease/chpl-make-cpu_count)"
+          export MAKEJ
+
+          cd ./util/devel/test/portability/apptainer
+
+          ./chapel-quickstart-fresh.sh
+          # Default config requires LLVM
+          if [[ "$APPTAINER_IMAGE" != *"nollvm" ]]; then
+              ./chapel-default-fresh.sh
+          fi
+
   run-shellcheck:
     runs-on: ubuntu-slim
     steps:
@@ -828,6 +900,7 @@ jobs:
       - check_large_files
       - check-release-files
       - publish-docs
+      - portability-tests-apptainer
       - run-shellcheck
       - check-format
       - gcc-version-tests
diff --git a/util/devel/test/portability/provision-scripts/chapel-update.sh b/util/devel/test/portability/provision-scripts/chapel-update.sh
index d9f053f7b586..339eb13abc5e 100755
--- a/util/devel/test/portability/provision-scripts/chapel-update.sh
+++ b/util/devel/test/portability/provision-scripts/chapel-update.sh
@@ -8,8 +8,9 @@ do
     echo chapel directory already exists - updating
     cd chapel && git checkout main && git pull --ff-only && cd .. && echo UPDATED
   else
-    echo cloning chapel
-    git clone --reference-if-able "${REPO_CACHE_PATH:-/missing}/chapel.git" --depth 1 https://github.com/chapel-lang/chapel && echo CLONED
+    ref="${GIT_COMMIT:-HEAD}"
+    echo "cloning chapel and checking out ref $ref"
+    git clone --reference-if-able "${REPO_CACHE_PATH:-/missing}/chapel.git" --depth 1 "${GIT_REPO_URL:-https://github.com/chapel-lang/chapel}" && git reset --hard "$ref" && echo CLONED
   fi
 
   if [ $? -eq 0 ]