diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3929c4ac22cac07c882f91927453387e54315426..bf823ea9813fb270969e794d45ddf81fa61101a8 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -34,12 +34,13 @@ variables:
   resource_group: $ENVIRONMENT_ID # never execute terraform in parallel on the same environment
   interruptible: false
 
-.e2e:
-  image: 'europe-north1-docker.pkg.dev/holi-shared/docker-hub-remote/archlinux:latest'
+.smoketest:
+  image: 'europe-north1-docker.pkg.dev/holi-shared/docker/holi-docker/holi-k6-builder'
   script:
-    - API_DOMAIN=`cat $API_DOMAIN_PATH`
-    - echo "e2e tests against $CI_ENVIRONMENT_SLUG environment go here and against $API_DOMAIN"
+    - API_DOMAIN=$(cat $API_DOMAIN_PATH)
     - terraform/environments/scripts/wait-for-ssl.sh "https://${API_DOMAIN}"
+    - BASE_URL="https://${API_DOMAIN}/graphql" /tmp/k6 run smoketest/main.js
+    # TODO should/could we roll back the service to the last working revision on test failure?
 
 # end job templates
 
@@ -48,7 +49,7 @@ variables:
 ## common steps
 
 cache_lint_test:
-  image: 'europe-north1-docker.pkg.dev/holi-shared/docker-hub-remote/denoland/deno:alpine-1.45.2'
+  image: 'europe-north1-docker.pkg.dev/holi-shared/docker-hub-remote/denoland/deno:2.0.0'
   stage: 'test'
   script:
     - deno cache --lock=deno.lock app/deps.ts app/dev_deps.ts
@@ -99,8 +100,8 @@ review_deploy:
     - production
     - /^noenv\/.*/
 
-review_e2e:
-  extends: .e2e
+review_smoketest:
+  extends: .smoketest
   needs: ['review_deploy']
   except:
     - main
@@ -157,19 +158,17 @@ staging_deploy:
   only:
     - main
 
-staging_trigger_unified-api_redeployment:
+staging_smoketest:
+  extends: .smoketest
   needs: ['staging_deploy']
-  trigger:
-    project: 'app/holi-unified-api'
-    branch: 'main'
   only:
     - main
 
-staging_e2e:
-  extends: .e2e
-  # if staging_e2e would actually run tests (other than ensuring SSL works), we'd have to
-  # wait for the unified-api pipeline to finish.
+staging_trigger_unified-api_redeployment:
   needs: ['staging_deploy']
+  trigger:
+    project: 'app/holi-unified-api'
+    branch: 'main'
   only:
     - main
 
@@ -188,6 +187,12 @@ production_deploy:
   only:
     - production
 
+production_smoketest:
+  extends: .smoketest
+  needs: ['production_deploy']
+  only:
+    - production
+
 production_trigger_unified-api_redeployment:
   needs: ['production_deploy']
   trigger:
diff --git a/Dockerfile b/Dockerfile
index 6351d9e292734360b0361dfb746c25df09c048be..673fd66425ddc9c658526bb1feb90f8f61818997 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM europe-north1-docker.pkg.dev/holi-shared/docker-hub-remote/denoland/deno:alpine-1.45.2
+FROM europe-north1-docker.pkg.dev/holi-shared/docker-hub-remote/denoland/deno:2.0.0
 
 # The port that your application listens to.
 EXPOSE 8005