diff --git a/.ci/vpntools-check.sh b/.ci/vpntools-check.sh
new file mode 100755
index 00000000..c5deda52
--- /dev/null
+++ b/.ci/vpntools-check.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -eux
+
+./build/vpncmd /tools /cmd:check
diff --git a/.cirrus.yml b/.cirrus.yml
index d5ee3c17..e05f1c0d 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -1,12 +1,30 @@
 FreeBSD_task:
   freebsd_instance:
-    image: freebsd-12-0-release-amd64
+    image: freebsd-12-1-release-amd64
   env:
     ASSUME_ALWAYS_YES: TRUE # required for unattanded "pkg" invocation
   install_script:
-    - pkg install cmake gmake openssl111 git
+    - pkg install cmake openssl111 git
     - git submodule update --init --recursive
   script:
     - ./configure
-    - gmake -j $(nproc || sysctl -n hw.ncpu || echo 4) -C tmp
+    - make -j $(sysctl -n hw.ncpu || echo 4) -C tmp
     - ldd build/vpnserver
+    - .ci/memory-leak-test.sh
+    - .ci/vpntools-check.sh
+
+FreeBSD_task:
+  freebsd_instance:
+    # 11-3-release doesn't boot: https://cirrus-ci.org/guide/FreeBSD/
+    image: freebsd-11-3-stable-amd64-v20191205
+  env:
+    ASSUME_ALWAYS_YES: TRUE # required for unattanded "pkg" invocation
+  install_script:
+    - pkg install cmake openssl111 git
+    - git submodule update --init --recursive
+  script:
+    - ./configure
+    - make -j $(sysctl -n hw.ncpu || echo 4) -C tmp
+    - ldd build/vpnserver
+    - .ci/memory-leak-test.sh
+    - .ci/vpntools-check.sh