diff --git a/codebuild/spec/buildspec_ktls.yml b/codebuild/spec/buildspec_ktls.yml
new file mode 100644
index 00000000000..1da6b429c95
--- /dev/null
+++ b/codebuild/spec/buildspec_ktls.yml
@@ -0,0 +1,24 @@
+---
+version: 0.2
+batch:
+  build-list:
+    - identifier: UnitAl2Qemu
+      debug-session: true
+      env:
+        compute-type: BUILD_GENERAL1_LARGE
+        image: aws/codebuild/standard:7.0
+        privileged-mode: true
+phases:
+  install:
+    commands:
+      - apt update
+      - apt upgrade -y
+      - apt install -y qemu qemu-system-x86 wget cloud-image-utils
+      - aws s3 --quiet sync s3://s2n-ktls-testing ./qemu
+
+  build:
+    commands:
+      - cd qemu; bash ./run.sh; cd ..
+      - rsync -avz --exclude=qemu --exclude=tests/fuzz -e 'ssh -p 2222' . codebuild@localhost:/home/codebuild/s2n-tls
+      - codebuild-breakpoint
+      - ssh -p 2222 codebuild@localhost "cd s2n-tls; sudo modprobe tls; nix develop .#openssl111 --command bash -c 'source ./nix/shell.sh && clean && configure 1 && build && unit inet_socket_test'"
diff --git a/nix/shell.sh b/nix/shell.sh
index 14acd88a4aa..d0cc4961fb5 100644
--- a/nix/shell.sh
+++ b/nix/shell.sh
@@ -16,12 +16,14 @@ function clean {
 }
 
 function configure {
+    local pq=${1:-0}
     banner "Configuring with cmake"
     cmake -S . -B./build \
           -DBUILD_TESTING=ON \
           -DS2N_INTEG_TESTS=ON \
           -DS2N_INSTALL_S2NC_S2ND=ON \
           -DS2N_INTEG_NIX=ON \
+          -DS2N_NO_PQ=$pq \
           -DBUILD_SHARED_LIBS=ON \
           -DCMAKE_BUILD_TYPE=RelWithDebInfo
 }