diff --git a/.github/workflows/CI-unixish.yml b/.github/workflows/CI-unixish.yml
index 9778f68a..b4089ee1 100644
--- a/.github/workflows/CI-unixish.yml
+++ b/.github/workflows/CI-unixish.yml
@@ -100,9 +100,10 @@ jobs:
       if: matrix.os == 'ubuntu-24.04'
       run: |
           make clean
-          make -j$(nproc)
+          make -j$(nproc) CXXOPTS="-O1"
           valgrind --leak-check=full --num-callers=50 --show-reachable=yes --track-origins=yes --gen-suppressions=all --error-exitcode=42 ./testrunner
-          valgrind --leak-check=full --num-callers=50 --show-reachable=yes --track-origins=yes --gen-suppressions=all --error-exitcode=42 ./simplecpp simplecpp.cpp -e
+          # TODO: run Python tests with valgrind
+          VALGRIND_TOOL=memcheck ./selfcheck.sh
 
     - name: Run with libstdc++ debug mode
       if: matrix.os == 'ubuntu-24.04' && matrix.compiler == 'g++'
@@ -146,10 +147,13 @@ jobs:
         tar xvf 1.5.1.tar.gz
         make clean
         make -j$(nproc) CXXOPTS="-O2 -g3"
-        valgrind --tool=callgrind ./simplecpp -e simplecpp-1.5.1/simplecpp.cpp 2>callgrind.log || (cat callgrind.log && false)
+        VALGRIND_TOOL=callgrind SIMPLECPP_PATH=simplecpp-1.5.1 ./selfcheck.sh >callgrind.log || (cat callgrind.log && false)
         cat callgrind.log
-        callgrind_annotate --auto=no > callgrind.annotated.log
-        head -50 callgrind.annotated.log
+        for f in callgrind.out.*;
+        do
+          callgrind_annotate --auto=no $f > $f.annotated.log
+          head -50 $f.annotated.log
+        done
 
     - uses: actions/upload-artifact@v4
       if: matrix.os == 'ubuntu-24.04'
diff --git a/selfcheck.sh b/selfcheck.sh
index cc77981d..e708023a 100755
--- a/selfcheck.sh
+++ b/selfcheck.sh
@@ -1,7 +1,28 @@
 #!/bin/bash
 
-output=$(./simplecpp simplecpp.cpp -e -f 2>&1)
+if [ -z "$SIMPLECPP_PATH" ]; then
+  SIMPLECPP_PATH=.
+fi
+
+if [ -n "$VALGRIND_TOOL" ]; then
+  if [ "$VALGRIND_TOOL" = "memcheck" ]; then
+    VALGRIND_OPTS="--error-limit=yes --leak-check=full --num-callers=50 --show-reachable=yes --track-origins=yes --gen-suppressions=all --error-exitcode=42"
+  elif [ "$VALGRIND_TOOL" = "callgrind" ]; then
+    VALGRIND_OPTS="--tool=callgrind"
+  else
+    echo "unsupported valgrind tool '$VALGRIND_TOOL'"
+    exit 1
+  fi
+  VALGRIND_CMD="valgrind --tool=$VALGRIND_TOOL --log-fd=9 $VALGRIND_OPTS"
+  VALGRIND_REDIRECT="valgrind_$VALGRIND_TOOL.log"
+else
+  VALGRIND_CMD=
+  VALGRIND_REDIRECT="/dev/null"
+fi
+
+output=$($VALGRIND_CMD ./simplecpp "$SIMPLECPP_PATH/simplecpp.cpp" -e -f 2>&1 9> "$VALGRIND_REDIRECT")
 ec=$?
+cat "$VALGRIND_REDIRECT"
 errors=$(echo "$output" | grep -v 'Header not found: <')
 if [ $ec -ne 0 ]; then
   # only fail if we got errors which do not refer to missing system includes
@@ -104,8 +125,9 @@ else
 fi
 
 # run with -std=gnuc++* so __has_include(...) is available
-./simplecpp simplecpp.cpp -e -f -std=gnu++11 $defs $inc
+$VALGRIND_CMD ./simplecpp "$SIMPLECPP_PATH/simplecpp.cpp" -e -f -std=gnu++11 $defs $inc 9> "$VALGRIND_REDIRECT"
 ec=$?
+cat "$VALGRIND_REDIRECT"
 if [ $ec -ne 0 ]; then
   exit $ec
 fi