diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 768177d2ba5..960869a73ab 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -315,10 +315,8 @@ jobs:
     - name: Install test dependencies
       run: |
         sudo apt-get update
-        sudo apt-get install -y --no-install-recommends ovmf qemu-system-x86 qemu-utils w3m
-        sudo modprobe kvm
-        # `sudo usermod -aG kvm $(whoami)` does not take an effect on GHA
-        sudo chown $(whoami) /dev/kvm
+        sudo ./hack/install-qemu.sh
+        sudo apt-get install -y --no-install-recommends w3m
     - name: Install ansible-playbook
       run: |
         sudo apt-get install -y --no-install-recommends ansible
@@ -360,10 +358,7 @@ jobs:
     - name: Install test dependencies
       run: |
         sudo apt-get update
-        sudo apt-get install -y --no-install-recommends ovmf qemu-system-x86 qemu-utils
-        sudo modprobe kvm
-        # `sudo usermod -aG kvm $(whoami)` does not take an effect on GHA
-        sudo chown $(whoami) /dev/kvm
+        sudo ./hack/install-qemu.sh
     - name: Cache image used by templates/default.yaml
       uses: ./.github/actions/setup_cache_for_template
       with:
@@ -407,10 +402,7 @@ jobs:
     - name: Install test dependencies
       run: |
         sudo apt-get update
-        sudo apt-get install -y --no-install-recommends ovmf qemu-system-x86 qemu-utils
-        sudo modprobe kvm
-        # `sudo usermod -aG kvm $(whoami)` does not take an effect on GHA
-        sudo chown $(whoami) /dev/kvm
+        sudo ./hack/install-qemu.sh
     - name: "Show cache"
       run: ./hack/debug-cache.sh
     - name: "Test"
@@ -615,10 +607,6 @@ jobs:
     - name: Install test dependencies
       run: |
         sudo apt-get update
-        sudo apt-get install -y --no-install-recommends ovmf qemu-system-x86 qemu-utils
-        qemu-system-x86_64 --version
-        sudo modprobe kvm
-        # `sudo usermod -aG kvm $(whoami)` does not take an effect on GHA
-        sudo chown $(whoami) /dev/kvm
+        sudo ./hack/install-qemu.sh
     - name: Smoke test
       run: limactl start --tty=false
diff --git a/hack/install-qemu.sh b/hack/install-qemu.sh
new file mode 100755
index 00000000000..6358f0cc3f1
--- /dev/null
+++ b/hack/install-qemu.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# SPDX-FileCopyrightText: Copyright The Lima Authors
+# SPDX-License-Identifier: Apache-2.0
+
+# Install qemu on GitHub Actions runner.
+# Not expected to be used outside GitHub Actions.
+
+set -eux
+
+# apt-get update has to be run beforehand
+apt-get install -y --no-install-recommends ovmf qemu-system-x86 qemu-utils
+modprobe kvm
+# `usermod -aG kvm ${SUDO_USER}` does not take an effect on GHA
+chown "${SUDO_USER}" /dev/kvm
+qemu-system-x86_64 --version