diff --git a/.github/.cspell/project-dictionary.txt b/.github/.cspell/project-dictionary.txt
index 835e9838..5988f76e 100644
--- a/.github/.cspell/project-dictionary.txt
+++ b/.github/.cspell/project-dictionary.txt
@@ -1,5 +1,6 @@
 binstall
 bytecodealliance
+Dpkg
 jfrimmel
 koalaman
 libc
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0c7512e4..dc55910f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ on:
       - main
       - dev
   schedule:
-    - cron: '0 0 * * *'
+    - cron: '0 1 * * *'
   workflow_dispatch:
 
 defaults:
@@ -53,8 +53,14 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          - container: ubuntu:20.04
+            # valgrind: installing snap to container is difficult...
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch
+          - container: debian:latest
+            # valgrind: installing snap to container is difficult...
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch
           - container: alpine:latest
-            # cargo-udeps,protoc,valgrind,wasmtime,mdbook,mdbook-linkcheck don't support musl host.
+            # cargo-udeps,protoc,valgrind,wasmtime,mdbook,mdbook-linkcheck,cargo-watch don't provide prebuilt binaries for musl host.
             tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,parse-changelog,cargo-valgrind,cargo-deny,cross,nextest,shellcheck,shfmt,wasm-pack
     runs-on: ubuntu-latest
     container: ${{ matrix.container }}
@@ -62,8 +68,14 @@ jobs:
       - uses: actions/checkout@v3
         with:
           persist-credentials: false
-      - name: Install requirements
-        run: apk add cargo curl bash tar xz
+      - name: Install requirements (ubuntu/debian)
+        run: |
+          set -ex
+          apt-get -o Acquire::Retries=10 -qq update
+          apt-get -o Acquire::Retries=10 -qq -o Dpkg::Use-Pty=0 install -y --no-install-recommends ca-certificates cargo curl unzip xz-utils
+        if: startsWith(matrix.container, 'ubuntu') || startsWith(matrix.container, 'debian')
+      - name: Install requirements (alpine)
+        run: apk add bash cargo curl tar xz
         shell: sh
         if: startsWith(matrix.container, 'alpine')
       - uses: ./
diff --git a/main.sh b/main.sh
index a2f1c5a6..3e2fd81f 100755
--- a/main.sh
+++ b/main.sh
@@ -137,6 +137,34 @@ cargo_binstall() {
         *) cargo binstall --force --no-confirm --version "${version}" "${tool}" ;;
     esac
 }
+apt_update() {
+    if type -P sudo &>/dev/null; then
+        retry sudo apt-get -o Acquire::Retries=10 -qq update
+    else
+        retry apt-get -o Acquire::Retries=10 -qq update
+    fi
+}
+apt_install() {
+    if type -P sudo &>/dev/null; then
+        retry sudo apt-get -o Acquire::Retries=10 -qq -o Dpkg::Use-Pty=0 install -y --no-install-recommends "$@"
+    else
+        retry apt-get -o Acquire::Retries=10 -qq -o Dpkg::Use-Pty=0 install -y --no-install-recommends "$@"
+    fi
+}
+apt_remove() {
+    if type -P sudo &>/dev/null; then
+        sudo apt-get -qq -o Dpkg::Use-Pty=0 remove -y "$@"
+    else
+        apt-get -qq -o Dpkg::Use-Pty=0 remove -y "$@"
+    fi
+}
+snap_install() {
+    if type -P sudo &>/dev/null; then
+        retry sudo snap install "$@"
+    else
+        retry snap install "$@"
+    fi
+}
 
 if [[ $# -gt 0 ]]; then
     bail "invalid argument '$1'"
@@ -313,7 +341,7 @@ for tool in "${tools[@]}"; do
             esac
             miner_patch_version="${version#*.}"
             base_url="https://github.com/${repo}/releases/download/v${miner_patch_version}/protoc-${miner_patch_version}"
-            # Copying files to /usr/local/include requires sudo.
+            # Copying files to /usr/local/include requires sudo, so do not use it.
             bin_dir="${HOME}/.install-action/bin"
             include_dir="${HOME}/.install-action/include"
             if [[ ! -d "${bin_dir}" ]]; then
@@ -359,7 +387,7 @@ for tool in "${tools[@]}"; do
             case "${OSTYPE}" in
                 linux*)
                     if type -P shellcheck &>/dev/null; then
-                        sudo apt-get -qq -o Dpkg::Use-Pty=0 remove -y shellcheck
+                        apt_remove shellcheck
                     fi
                     url="${base_url}.linux.x86_64.tar.xz"
                     ;;
@@ -411,12 +439,12 @@ for tool in "${tools[@]}"; do
                 darwin* | cygwin* | msys*) bail "${tool} for non-linux is not supported yet by this action" ;;
                 *) bail "unsupported OSTYPE '${OSTYPE}' for ${tool}" ;;
             esac
-            retry sudo apt-get -o Acquire::Retries=10 -qq update
+            apt_update
             # libc6-dbg is needed to run Valgrind
-            retry sudo apt-get -o Acquire::Retries=10 -qq -o Dpkg::Use-Pty=0 install -y libc6-dbg
+            apt_install libc6-dbg
             # Use snap to install the latest Valgrind
             # https://snapcraft.io/install/valgrind/ubuntu
-            retry sudo snap install valgrind --classic
+            snap_install valgrind --classic
             ;;
         wasm-pack)
             # https://github.com/rustwasm/wasm-pack/releases