diff --git a/.github/workflows/verify-k8s.yml b/.github/workflows/verify-k8s.yml
index 1ebcb06eb..a7a60833f 100644
--- a/.github/workflows/verify-k8s.yml
+++ b/.github/workflows/verify-k8s.yml
@@ -32,6 +32,20 @@ jobs:
 
   verify-k8s-deployment:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false # Keep running if one leg fails.
+      matrix:
+        issuer:
+        - "OIDC Issuer"
+        - "Meta Issuer"
+
+        include:
+        - issuer: "OIDC Issuer"
+          issuer-config: |
+            "OIDCIssuers": {"https://kubernetes.default.svc": {"IssuerURL": "https://kubernetes.default.svc","ClientID": "sigstore","Type": "kubernetes"}}
+        - issuer: "Meta Issuer"
+          issuer-config: |
+            "MetaIssuers": {"https://kubernetes.*.svc": {"ClientID": "sigstore","Type": "kubernetes"}}
 
     env:
       # https://github.com/google/go-containerregistry/pull/125 allows insecure registry for
@@ -149,13 +163,7 @@ jobs:
           data:
             config.json: |-
                 {
-                  "OIDCIssuers": {
-                    "https://kubernetes.default.svc": {
-                      "IssuerURL": "https://kubernetes.default.svc",
-                      "ClientID": "sigstore",
-                      "Type": "kubernetes"
-                    }
-                  }
+                  ${{ matrix.issuer-config }}
                 }
           EOF
 
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 3e558188b..a0752225d 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -196,7 +196,7 @@ func Load(configPath string) error {
 		return err
 	}
 
-	if _, ok := cfg.OIDCIssuers["https://kubernetes.default.svc"]; ok {
+	if _, ok := cfg.GetIssuer("https://kubernetes.default.svc"); ok {
 		// Add the Kubernetes cluster's CA to the system CA pool, and to
 		// the default transport.
 		rootCAs, _ := x509.SystemCertPool()
@@ -233,6 +233,12 @@ func Load(configPath string) error {
 		cfg.verifiers[iss.IssuerURL] = verifier
 	}
 
+	cache, err := lru.New2Q(100 /* size */)
+	if err != nil {
+		return err
+	}
+	cfg.lru = cache
+
 	config = cfg
 	log.Logger.Infof("Loaded config %v from %s", cfg, configPath)
 	return nil