diff --git a/ci/build-check-sanitized.sh b/ci/build-check-sanitized.sh
new file mode 100755
index 00000000..39c06f43
--- /dev/null
+++ b/ci/build-check-sanitized.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/bash
+# Build with ASAN and UBSAN + unit tests.
+
+set -xeuo pipefail
+
+dn=$(dirname $0)
+. ${dn}/libbuild.sh
+export CFLAGS='-fsanitize=address -fsanitize=undefined -fsanitize-undefined-trap-on-error'
+# We leak global state in a few places, fixing that is hard.
+export ASAN_OPTIONS='detect_leaks=0'
+${dn}/build.sh
+make check
diff --git a/ci/installdeps.sh b/ci/installdeps.sh
index 7d7c723e..6880d91d 100755
--- a/ci/installdeps.sh
+++ b/ci/installdeps.sh
@@ -7,7 +7,7 @@ set -xeuo pipefail
 # cosa buildroot container
 # https://github.com/coreos/coreos-assembler/pull/730
 # And using `yum` at all means we can flake on fetching rpm metadata
-if [ -n "${SKIP_INSTALLDEPS:-}" ]; then
+if [ -n "${SKIP_INSTALLDEPS:-}" ] || test "$(id -u)" != 0; then
     exit 0
 fi