diff --git a/.ci/provision/centos_7.sh b/.ci/provision/centos_7.sh
index f43b26db6..483fd1215 100755
--- a/.ci/provision/centos_7.sh
+++ b/.ci/provision/centos_7.sh
@@ -53,4 +53,8 @@ sudo chown -R ${USER} /opt/firezone
 bin/omnibus build firezone
 
 sudo rpm -i pkg/firezone*.rpm
-sudo firezone-ctl reconfigure
+
+# Usually fails the first time
+sudo firezone-ctl reconfigure || true
+
+sudo firezone-ctl restart
diff --git a/.ci/provision/centos_8.sh b/.ci/provision/centos_8.sh
index 30dcf25da..384574fa6 100755
--- a/.ci/provision/centos_8.sh
+++ b/.ci/provision/centos_8.sh
@@ -47,4 +47,8 @@ sudo chown -R ${USER} /opt/firezone
 bin/omnibus build firezone
 
 sudo rpm -i pkg/firezone*.rpm
-sudo firezone-ctl reconfigure
+
+# Usually fails the first time
+sudo firezone-ctl reconfigure || true
+
+sudo firezone-ctl restart
diff --git a/.ci/provision/debian_10.sh b/.ci/provision/debian_10.sh
index 9137c7de3..eca236ae5 100755
--- a/.ci/provision/debian_10.sh
+++ b/.ci/provision/debian_10.sh
@@ -53,4 +53,8 @@ sudo chown -R ${USER} /opt/firezone
 CC=/usr/bin/gcc-10 bin/omnibus build firezone
 
 sudo dpkg -i pkg/firezone*.deb
-sudo firezone-ctl reconfigure
+
+# Usually fails the first time
+sudo firezone-ctl reconfigure || true
+
+sudo firezone-ctl restart
diff --git a/.ci/provision/debian_11.sh b/.ci/provision/debian_11.sh
new file mode 100755
index 000000000..eca236ae5
--- /dev/null
+++ b/.ci/provision/debian_11.sh
@@ -0,0 +1,60 @@
+#!/bin/bash
+set -xe
+
+export DEBIAN_FRONTEND=noninteractive
+
+# Install prerequisites
+sudo apt-get update -q
+sudo apt-get install -y -q \
+  dpkg-dev \
+  zlib1g-dev \
+  libssl-dev \
+  openssl \
+  bzip2 \
+  procps \
+  rsync \
+  ca-certificates \
+  build-essential \
+  git \
+  gnupg \
+  curl \
+  unzip \
+  locales \
+  net-tools \
+  systemd \
+  wireguard-dkms
+
+# Set locale
+sudo sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen
+sudo locale-gen
+export LANG=en_US.UTF-8
+export LANGUAGE=en_US:en
+export LC_ALL=en_US.UTF-8
+
+# Install asdf
+if [ ! -d $HOME/.asdf ]; then
+  git clone --depth 1 https://github.com/asdf-vm/asdf.git $HOME/.asdf
+fi
+grep -qxF '. $HOME/.asdf/asdf.sh' $HOME/.bashrc || echo '. $HOME/.asdf/asdf.sh' >> $HOME/.bashrc
+grep -qxF '. $HOME/.asdf/completions/asdf.bash' $HOME/.bashrc || echo '. $HOME/.asdf/completions/asdf.bash' >> $HOME/.bashrc
+. $HOME/.asdf/asdf.sh
+asdf list ruby || asdf plugin-add ruby
+cd /vagrant
+asdf install
+
+# Install omnibus
+cd omnibus
+gem install bundler
+bundle install --binstubs
+
+# Build omnibus package
+sudo mkdir -p /opt/firezone
+sudo chown -R ${USER} /opt/firezone
+CC=/usr/bin/gcc-10 bin/omnibus build firezone
+
+sudo dpkg -i pkg/firezone*.deb
+
+# Usually fails the first time
+sudo firezone-ctl reconfigure || true
+
+sudo firezone-ctl restart
diff --git a/.ci/provision/fedora_33.sh b/.ci/provision/fedora_33.sh
index 38313e7d1..a19aa092a 100755
--- a/.ci/provision/fedora_33.sh
+++ b/.ci/provision/fedora_33.sh
@@ -43,4 +43,8 @@ sudo chown -R ${USER} /opt/firezone
 bin/omnibus build firezone
 
 sudo rpm -i pkg/firezone*.rpm
-sudo firezone-ctl reconfigure
+
+# Usually fails the first time
+sudo firezone-ctl reconfigure || true
+
+sudo firezone-ctl restart
diff --git a/.ci/provision/fedora_34.sh b/.ci/provision/fedora_34.sh
index 38313e7d1..a19aa092a 100755
--- a/.ci/provision/fedora_34.sh
+++ b/.ci/provision/fedora_34.sh
@@ -43,4 +43,8 @@ sudo chown -R ${USER} /opt/firezone
 bin/omnibus build firezone
 
 sudo rpm -i pkg/firezone*.rpm
-sudo firezone-ctl reconfigure
+
+# Usually fails the first time
+sudo firezone-ctl reconfigure || true
+
+sudo firezone-ctl restart
diff --git a/.ci/provision/ubuntu_18.04.sh b/.ci/provision/ubuntu_18.04.sh
index 0ad84fb32..3f7d181db 100755
--- a/.ci/provision/ubuntu_18.04.sh
+++ b/.ci/provision/ubuntu_18.04.sh
@@ -52,4 +52,8 @@ sudo chown -R ${USER} /opt/firezone
 bin/omnibus build firezone
 
 sudo dpkg -i pkg/firezone*.deb
-sudo firezone-ctl reconfigure
+
+# Usually fails the first time
+sudo firezone-ctl reconfigure || true
+
+sudo firezone-ctl restart
diff --git a/.ci/provision/ubuntu_20.04.sh b/.ci/provision/ubuntu_20.04.sh
index 0ad84fb32..3f7d181db 100755
--- a/.ci/provision/ubuntu_20.04.sh
+++ b/.ci/provision/ubuntu_20.04.sh
@@ -52,4 +52,8 @@ sudo chown -R ${USER} /opt/firezone
 bin/omnibus build firezone
 
 sudo dpkg -i pkg/firezone*.deb
-sudo firezone-ctl reconfigure
+
+# Usually fails the first time
+sudo firezone-ctl reconfigure || true
+
+sudo firezone-ctl restart
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9ce186868..76a00e195 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -77,6 +77,8 @@ jobs:
             os: ubuntu_18.04
           - port: 8806
             os: ubuntu_20.04
+          - port: 8807
+            os: debian_11
     # if: github.ref == 'refs/heads/master'
     steps:
       - uses: actions/checkout@v2
@@ -90,6 +92,7 @@ jobs:
       matrix:
         os:
           - debian_10
+          - debian_11
           - ubuntu_18.04
           - ubuntu_20.04
           - centos_7
diff --git a/Vagrantfile b/Vagrantfile
index 8723e083c..26f636019 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -86,4 +86,11 @@ Vagrant.configure("2") do |config|
     ubuntu2004.vm.network "forwarded_port", guest: 8800, host: ENV.fetch("PORT", 8806)
     ubuntu2004.vm.provision "shell", path: ".ci/provision/ubuntu_20.04.sh", privileged: false
   end
+
+  config.vm.define "debian_11" do |debian11|
+    debian11.vm.box = "generic/debian11"
+    debian11.vm.box_url = "https://home.cloudfirenetwork.com/vb/debian11.box"
+    debian11.vm.network "forwarded_port", guest: 8800, host: ENV.fetch("PORT", 8807)
+    debian11.vm.provision "shell", path: ".ci/provision/debian_11.sh", privileged: false
+  end
 end