diff --git a/Makefile b/Makefile
index 1f3b585..3aded89 100644
--- a/Makefile
+++ b/Makefile
@@ -16,8 +16,10 @@ all: build
 build:
 	CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build $(GOFLAGS) -o $(DIST)/$(BINARY) $(PKG)
 
+# -count=1: the tests build via `make build`, and the Makefile is not a go test
+# cache input, so a cached PASS would outlive a broken build recipe.
 test:
-	go test -v ./...
+	go test -race -count=1 -v ./...
 
 lint:
 	golangci-lint run ./...
diff --git a/build_test.go b/build_test.go
index e9ef0ea..05a7a73 100644
--- a/build_test.go
+++ b/build_test.go
@@ -18,30 +18,24 @@ import (
 	"testing"
 )
 
-const (
-	upstreamPkg    = "github.com/tailscale/go-cache-plugin/cmd/go-cache-plugin"
-	upstreamModule = "github.com/tailscale/go-cache-plugin"
-)
+const upstreamModule = "github.com/tailscale/go-cache-plugin"
 
 var pluginBin string
 
+// Build via the Makefile: the tests below must check the artifact release.yaml
+// actually ships, not a second build recipe kept in sync here.
 func TestMain(m *testing.M) {
-	dir, err := os.MkdirTemp("", "go-cache-plugin-test")
+	if out, err := exec.Command("make", "build").CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "make build: %v\n%s", err, out)
+		os.Exit(1)
+	}
+	abs, err := filepath.Abs(filepath.Join("dist", "go-cache-plugin"))
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
-	pluginBin = filepath.Join(dir, "go-cache-plugin")
-	build := exec.Command("go", "build", "-ldflags=-s -w", "-o", pluginBin, upstreamPkg)
-	build.Env = append(os.Environ(), "CGO_ENABLED=0")
-	if out, err := build.CombinedOutput(); err != nil {
-		fmt.Fprintf(os.Stderr, "building %s: %v\n%s", upstreamPkg, err, out)
-		_ = os.RemoveAll(dir)
-		os.Exit(1)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(dir)
-	os.Exit(code)
+	pluginBin = abs
+	os.Exit(m.Run())
 }
 
 // A dynamically linked binary will not run on the estate's Alpine-based CI