diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index 2594b72194..8a736c9c17 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -1,6 +1,7 @@
 # Runs quality assurance checks
 name: "qa"
 on:
+  pull_request:
   push:
     branches:
       - "release/**"
diff --git a/QA/common.py b/QA/common.py
index 656cb0027a..64d3181d8c 100644
--- a/QA/common.py
+++ b/QA/common.py
@@ -9,17 +9,28 @@
 
 
 def execute(args):
-    """ Execute a specified command """
+    """Execute a specified command"""
     subprocess.run(args)
 
 
 def execute_jafar_and_miniooni(ooni_exe, outfile, experiment, tag, args):
-    """ Executes jafar and miniooni. Returns the test keys. """
+    """Executes jafar and miniooni. Returns the test keys."""
     tmpoutfile = "/tmp/{}".format(outfile)
     with contextlib.suppress(FileNotFoundError):
         os.remove(tmpoutfile)  # just in case
     execute(
         [
+            # Disable ASLR
+            "setarch",
+            "--addr-no-randomize",
+            # Run cachegrind
+            "valgrind",
+            "--tool=cachegrind",
+            "--I1=32768,8,64",
+            "--D1=32768,8,64",
+            "--LL=8388608,16,64",
+            "--cachegrind-out-file=cachegrind.out",
+            # Run jafar
             "./jafar",
             "-main-command",
             "./QA/minioonilike.py {} -n -o '{}' --home /tmp {}".format(
@@ -40,17 +51,17 @@ def execute_jafar_and_miniooni(ooni_exe, outfile, experiment, tag, args):
 
 
 def read_result(outfile):
-    """ Reads the result of an experiment """
+    """Reads the result of an experiment"""
     return json.load(open(outfile, "rb"))
 
 
 def test_keys(result):
-    """ Returns just the test keys of a specific result """
+    """Returns just the test keys of a specific result"""
     return result["test_keys"]
 
 
 def check_maybe_binary_value(value):
-    """ Make sure a maybe binary value is correct """
+    """Make sure a maybe binary value is correct"""
     assert isinstance(value, str) or (
         isinstance(value, dict)
         and value["format"] == "base64"
@@ -59,8 +70,8 @@ def check_maybe_binary_value(value):
 
 
 def with_free_port(func):
-    """ This function executes |func| passing it a port number on localhost
-        which is bound but not listening for new connections """
+    """This function executes |func| passing it a port number on localhost
+    which is bound but not listening for new connections"""
     # See <https://stackoverflow.com/a/45690594>
     with contextlib.closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
         sock.bind(("127.0.0.1", 0))
diff --git a/QA/rundocker.bash b/QA/rundocker.bash
index 77ec540b55..45403950fa 100755
--- a/QA/rundocker.bash
+++ b/QA/rundocker.bash
@@ -8,7 +8,7 @@ GOVERSION=$(cat GOVERSION)
 
 cat > QA/Dockerfile << EOF
 FROM golang:$GOVERSION-alpine
-RUN apk add gcc go git musl-dev iptables tmux bind-tools curl sudo python3
+RUN apk add gcc go git musl-dev iptables tmux bind-tools curl sudo python3 util-linux valgrind
 EOF
 
 $DOCKER build -t jafar-qa ./QA/