diff --git a/.github/workflows/ci-pr.yaml b/.github/workflows/ci-pr.yaml
index 0369749..7018cb9 100644
--- a/.github/workflows/ci-pr.yaml
+++ b/.github/workflows/ci-pr.yaml
@@ -45,6 +45,27 @@ jobs:
         with:
           command: check bans
 
+  cargo-nextest:
+    name: Cargo Nextest
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ inputs.toolchain }}
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@nextest
+
+      - name: Run tests
+        run: cargo nextest run --workspace
+
   cargo-hack-check:
     name: Cargo Hack Check
     runs-on: ubuntu-24.04
diff --git a/zingo-netutils/src/lib.rs b/zingo-netutils/src/lib.rs
index 34249eb..0f86dda 100644
--- a/zingo-netutils/src/lib.rs
+++ b/zingo-netutils/src/lib.rs
@@ -33,13 +33,13 @@ fn client_tls_config() -> Result<ClientTlsConfig, GetClientError> {
     #[cfg(test)]
     {
         if let Some(pem) = load_test_cert_pem() {
-            return Ok(
-                ClientTlsConfig::new().ca_certificate(tonic::transport::Certificate::from_pem(pem))
-            );
+            return Ok(ClientTlsConfig::new()
+                .ca_certificate(tonic::transport::Certificate::from_pem(pem))
+                .with_webpki_roots());
         }
     }
 
-    Ok(ClientTlsConfig::new())
+    Ok(ClientTlsConfig::new().with_webpki_roots())
 }
 /// The connector, containing the URI to connect to.
 /// This type is mostly an interface to the `get_client` method.
@@ -406,4 +406,49 @@ mod tests {
 
         server_task.abort();
     }
+
+    #[tokio::test]
+    async fn connects_to_public_mainnet_indexer_and_gets_info() {
+        use std::time::Duration;
+        use tokio::time::timeout;
+        use tonic::Request;
+        use zcash_client_backend::proto::service::Empty;
+
+        let _ = rustls::crypto::ring::default_provider().install_default();
+
+        let endpoint = "https://zec.rocks:443".to_string();
+
+        let uri: http::Uri = endpoint.parse().expect("bad mainnet indexer URI");
+
+        let mut client = timeout(Duration::from_secs(10), get_client(uri))
+            .await
+            .expect("timed out connecting to public indexer")
+            .expect("failed to connect to public indexer");
+
+        let response = timeout(
+            Duration::from_secs(10),
+            client.get_lightd_info(Request::new(Empty {})),
+        )
+        .await
+        .expect("timed out calling GetLightdInfo")
+        .expect("GetLightdInfo RPC failed")
+        .into_inner();
+
+        assert!(
+            !response.chain_name.is_empty(),
+            "chain_name should not be empty"
+        );
+        assert!(
+            response.block_height > 0,
+            "block_height should be > 0, got {}",
+            response.block_height
+        );
+
+        let chain = response.chain_name.to_ascii_lowercase();
+        assert!(
+            chain.contains("main"),
+            "expected a mainnet server, got chain_name={:?}",
+            response.chain_name
+        );
+    }
 }