diff --git a/.github/workflows/ci.yml b/.github/workflows/ci-main.yml
similarity index 83%
rename from .github/workflows/ci.yml
rename to .github/workflows/ci-main.yml
index d2c50bd7c..4c66b23bc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci-main.yml
@@ -42,14 +42,15 @@ jobs:
           restore-keys: |
             docker-cache-${{ steps.cache-key.outputs.key }}-
 
-      - name: Build docker image
-        run: docker-compose -f docker/docker-compose.centos-6.yaml -f docker/docker-compose.centos-6.18.yaml build
-
-      - name: Execute project build
+      - name: Build project without leak detection
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
         run: docker-compose -f docker/docker-compose.centos-6.yaml -f docker/docker-compose.centos-6.18.yaml run build
 
-      # Deploy if this was a push to the main branch
-      - name: Deploy to sonatype
+      - name: Build project with leak detection
+        if: ${{ github.event_name == 'pull_request' }}
+        run: docker-compose -f docker/docker-compose.centos-6.yaml -f docker/docker-compose.centos-6.18.yaml run build-leak
+
+      - name: Deploy project snapshot to sonatype
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
         run: docker-compose -f docker/docker-compose.centos-6.yaml -f docker/docker-compose.centos-6.18.yaml run deploy
 
diff --git a/docker/docker-compose.centos-6.18.yaml b/docker/docker-compose.centos-6.18.yaml
index 7d64d4e1b..ab4776467 100644
--- a/docker/docker-compose.centos-6.18.yaml
+++ b/docker/docker-compose.centos-6.18.yaml
@@ -11,6 +11,9 @@ services:
   build:
     image: netty-codec-quic-centos6:centos-6-1.8
 
+  build-leak:
+    image: netty-codec-quic-centos6:centos-6-1.8
+
   build-clean:
     image: netty-codec-quic-centos6:centos-6-1.8
 
diff --git a/docker/docker-compose.centos-6.yaml b/docker/docker-compose.centos-6.yaml
index 5918aa021..4ba540b43 100644
--- a/docker/docker-compose.centos-6.yaml
+++ b/docker/docker-compose.centos-6.yaml
@@ -21,6 +21,12 @@ services:
     <<: *common
     command: /bin/bash -cl "mvn clean package -DquicheCheckoutDir=/root/source/quiche"
 
+
+  build-leak:
+    <<: *common
+    command: /bin/bash -cl "mvn -Pleak clean package -DquicheCheckoutDir=/root/source/quiche"
+
+
   build-clean:
     <<: *common
     command: /bin/bash -cl "mvn clean package"
diff --git a/pom.xml b/pom.xml
index a6016be57..bd296ba97 100644
--- a/pom.xml
+++ b/pom.xml
@@ -87,6 +87,7 @@
          Symbol not found: ___isPlatformVersionAtLeast
     -->
     <macosxDeploymentTarget>10.12</macosxDeploymentTarget>
+    <test.argLine>-D_</test.argLine>
   </properties>
 
   <profiles>
@@ -113,7 +114,14 @@
         <extraLdflags>-Wl,--strip-debug -Wl,--exclude-libs,ALL -lrt</extraLdflags>
       </properties>
     </profile>
+    <profile>
+      <id>leak</id>
+      <properties>
+        <test.argLine>-Dio.netty.leakDetectionLevel=paranoid -Dio.netty.leakDetection.targetRecords=32</test.argLine>
+      </properties>
+    </profile>
   </profiles>
+
   <build>
     <extensions>
       <extension>
@@ -366,6 +374,7 @@
         </properties>
         <!-- Ensure the whole stacktrace is preserved when an exception is thrown. See https://issues.apache.org/jira/browse/SUREFIRE-1457 -->
         <trimStackTrace>false</trimStackTrace>
+        <argLine>${test.argLine}</argLine>
       </configuration>
       <dependencies>
         <dependency>