diff --git a/.github/workflows/test-hw.yml b/.github/workflows/test-hw.yml
index 5f56d0b9..fe71c0a0 100644
--- a/.github/workflows/test-hw.yml
+++ b/.github/workflows/test-hw.yml
@@ -10,7 +10,7 @@ name: HW
 
 on:
   # needs PR target for secrets access; guard by requiring label
-  pull_request_target:
+  pull_request_target: # !! dummy
     types: [opened, reopened, synchronize, labeled]
 
 # downgrade permissions to read-only as you would have in a standard PR action
@@ -47,7 +47,7 @@ jobs:
       xml: ${{ steps.repo.outputs.xml }}
     steps:
     - id: repo
-      uses: seL4/ci-actions/repo-checkout@master
+      uses: axel-h/ci-actions/repo-checkout@patch-axel-7
       with:
         manifest_repo: camkes-vm-examples-manifest
         manifest: master.xml
@@ -62,7 +62,7 @@ jobs:
       matrix:
         march: [nehalem, armv7a, armv8a]
     steps:
-    - uses: seL4/ci-actions/camkes-vm@master
+    - uses: axel-h/ci-actions/camkes-vm@patch-axel-7
       with:
         xml: ${{ needs.code.outputs.xml }}
         march: ${{ matrix.march }}
@@ -99,7 +99,7 @@ jobs:
         with:
           name: images-${{ matrix.march }}
       - name: Run
-        uses: seL4/ci-actions/camkes-vm-hw@master
+        uses: axel-h/ci-actions/camkes-vm-hw@patch-axel-7
         with:
           march: ${{ matrix.march }}
           index: $${{ strategy.job-index }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f8fb52a0..28933451 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,6 +18,6 @@ jobs:
       matrix:
         march: [nehalem, armv7a, armv8a]
     steps:
-    - uses: seL4/ci-actions/camkes-vm@master
+    - uses: axel-h/ci-actions/camkes-vm@patch-axel-7
       with:
         march: ${{ matrix.march }}
diff --git a/apps/Arm/vm_minimal/CMakeLists.txt b/apps/Arm/vm_minimal/CMakeLists.txt
index aa4480c7..406e9c11 100644
--- a/apps/Arm/vm_minimal/CMakeLists.txt
+++ b/apps/Arm/vm_minimal/CMakeLists.txt
@@ -86,6 +86,14 @@ elseif("${KernelARMPlatform}" STREQUAL "tx2")
     AddToFileServer("linux-dtb" "${output_dtb_location}" DEPENDS dtb_gen_target)
 
 elseif("${KernelARMPlatform}" STREQUAL "qemu-arm-virt")
+
+    # QEMU supports ARMv7/aarch32 and ARMv8/aarch32, but currently there are
+    # Linux images for aarch64 only. However, it is unclear if that is the only
+    # blocker to get this example run in QEMU on aarch32.
+    if(NOT KernelSel4ArchAarch64)
+        message(FATAL_ERROR "Only AARCH64 is supported")
+    endif()
+
     find_package(camkes-vm-linux REQUIRED)
     include(${CAMKES_VM_LINUX_HELPERS_PATH})
     set(cpp_flags "-DKERNELARMPLATFORM_QEMU-ARM-VIRT")
diff --git a/apps/Arm/vm_minimal/zcu102/2022_1/devices.camkes b/apps/Arm/vm_minimal/zcu102/2022_1/devices.camkes
index 5450e817..d0d2e49f 100644
--- a/apps/Arm/vm_minimal/zcu102/2022_1/devices.camkes
+++ b/apps/Arm/vm_minimal/zcu102/2022_1/devices.camkes
@@ -27,7 +27,8 @@ assembly {
             "initrd_addr" : VAR_STRINGIZE(VM_INITRD_ADDR),
             "kernel_entry_addr" : VAR_STRINGIZE(VM_ENTRY_ADDR),
         };
-        vm0.num_vcpus = 4;
+        vm0.num_vcpus = 2;
+        vm0.pcpus = [2, 3];
 
         /* Extra untyped pool to allow for 256MB of RAM */
         vm0.simple_untyped28_pool = 1;