diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f71b3e28..fa330f72d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -136,7 +136,7 @@ jobs:
 
       - name: Setup env
         run: |
-          BASE=$(just pullspec-for-os ${{ matrix.test_os }})
+          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
           echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
 
       - name: Build container
@@ -175,13 +175,19 @@ jobs:
 
   # This variant does composefs testing
   test-integration-cfs:
+    continue-on-error: ${{ matrix.experimental }}
     strategy:
       fail-fast: false
       matrix:
-        # TODO expand this matrix, we need to make it better to override the target
         # OS via Justfile variables too
-        test_os: [centos-10]
+        test_os: [fedora-42, fedora-43, fedora-44, centos-10]
         variant: [composefs-sealeduki-sdboot]
+        experimental: [false]
+        # For issue https://github.com/bootc-dev/bootc/issues/1812
+        include:
+          - test_os: centos-9
+            variant: composefs-sealeduki-sdboot
+            experimental: true
 
     runs-on: ubuntu-24.04
 
@@ -196,13 +202,18 @@ jobs:
 
       - name: Setup env
         run: |
-          BASE=$(just pullspec-for-os ${{ matrix.test_os }})
+          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
+          BUILDROOTBASE=$(just pullspec-for-os buildroot-base ${{ matrix.test_os }})
           echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
+          echo "BOOTC_buildroot_base=${BUILDROOTBASE}" >> $GITHUB_ENV
           echo "BOOTC_variant="${{ matrix.variant }} >> $GITHUB_ENV
 
       - name: Build container
         run: |
           just build-integration-test-image
+          # Extra cross-check (duplicating the integration test) that we're using the right base
+          used_vid=$(podman run --rm localhost/bootc-integration bash -c '. /usr/lib/os-release && echo ${ID}-${VERSION_ID}')
+          test ${{ matrix.test_os }} = "${used_vid}"
 
       - name: Unit and container integration tests
         run: just test-container
diff --git a/Justfile b/Justfile
index 5b86c7aea..7c604a94b 100644
--- a/Justfile
+++ b/Justfile
@@ -82,11 +82,15 @@ build-integration-test-image: build
 test-composefs:
     # These first two are currently a distinct test suite from tmt that directly
     # runs an integration test binary in the base image via bcvk
-    just variant=composefs-sealeduki-sdboot build
-    cargo run --release -p tests-integration -- composefs-bcvk {{base_img}}
+    just _composefs-build-image
+    cargo run --release -p tests-integration -- composefs-bcvk {{integration_img}}
     # We're trying to move more testing to tmt
     just variant=composefs-sealeduki-sdboot test-tmt readonly local-upgrade-reboot
 
+# Internal helper to build integration test image with composefs variant
+_composefs-build-image:
+    just variant=composefs-sealeduki-sdboot build-integration-test-image
+
 # Only used by ci.yml right now
 build-install-test-image: build-integration-test-image
     cd hack && podman build {{base_buildargs}} -t {{integration_img}}-install -f Containerfile.drop-lbis
@@ -136,9 +140,10 @@ clean-local-images:
     podman images --filter "label={{testimage_label}}"
     podman images --filter "label={{testimage_label}}" --format "{{{{.ID}}" | xargs -r podman rmi -f
 
-# Print the container image reference for a given short $ID-VERSION_ID
-pullspec-for-os NAME:
-    @jq -r --arg v "{{NAME}}" '.[$v]' < hack/os-image-map.json
+# Print the container image reference for a given short $ID-VERSION_ID for NAME
+# and 'base' or 'buildroot-base' for TYPE (base image type)
+pullspec-for-os TYPE NAME:
+    @jq -r --arg v "{{NAME}}" '."{{TYPE}}"[$v]' < hack/os-image-map.json
 
 build-mdbook:
     cd docs && podman build {{base_buildargs}} -t localhost/bootc-mdbook -f Dockerfile.mdbook
diff --git a/hack/os-image-map.json b/hack/os-image-map.json
index c4ffef30c..661558b1b 100644
--- a/hack/os-image-map.json
+++ b/hack/os-image-map.json
@@ -1,9 +1,16 @@
 {
-  "rhel-9.8": "images.paas.redhat.com/bootc/rhel-bootc:latest-9.8",
-  "rhel-10.2": "images.paas.redhat.com/bootc/rhel-bootc:latest-10.2",
-  "centos-9": "quay.io/centos-bootc/centos-bootc:stream9",
-  "centos-10": "quay.io/centos-bootc/centos-bootc:stream10",
-  "fedora-42": "quay.io/fedora/fedora-bootc:42",
-  "fedora-43": "quay.io/fedora/fedora-bootc:43",
-  "fedora-44": "quay.io/fedora/fedora-bootc:rawhide"
+  "base": {
+    "centos-9": "quay.io/centos-bootc/centos-bootc:stream9",
+    "centos-10": "quay.io/centos-bootc/centos-bootc:stream10",
+    "fedora-42": "quay.io/fedora/fedora-bootc:42",
+    "fedora-43": "quay.io/fedora/fedora-bootc:43",
+    "fedora-44": "quay.io/fedora/fedora-bootc:rawhide"
+  },
+  "buildroot-base": {
+    "centos-9": "quay.io/centos/centos:stream9",
+    "centos-10": "quay.io/centos/centos:stream10",
+    "fedora-42": "quay.io/fedora/fedora:42",
+    "fedora-43": "quay.io/fedora/fedora:43",
+    "fedora-44": "quay.io/fedora/fedora:rawhide"
+  }
 }
diff --git a/hack/provision-packit.sh b/hack/provision-packit.sh
index 9cf2eacc7..3a3abafaa 100755
--- a/hack/provision-packit.sh
+++ b/hack/provision-packit.sh
@@ -32,7 +32,7 @@ fi
 
 # Get base image URL
 TEST_OS="${ID}-${VERSION_ID}"
-BASE=$(jq -r --arg v "$TEST_OS" '.[$v]' < os-image-map.json)
+BASE=$(jq -r --arg v "$TEST_OS" '.base[$v]' < os-image-map.json)
 
 if [[ "$ID" == "rhel" ]]; then
     # OSCI gating only
diff --git a/tests/build-sealed b/tests/build-sealed
index 64cbb7270..e99acb100 100755
--- a/tests/build-sealed
+++ b/tests/build-sealed
@@ -58,6 +58,9 @@ if test -z "${secureboot}"; then
   cd -
 fi
 
-runv podman build -t $output_image --build-arg=COMPOSEFS_FSVERITY=${cfs_digest} --build-arg=base=${input_image} \
+runv podman build -t $output_image \
+  --build-arg=COMPOSEFS_FSVERITY=${cfs_digest} \
+  --build-arg=base=${input_image} \
+  --build-arg=buildroot=${BOOTC_buildroot_base} \
   --secret=id=key,src=${secureboot}/db.key \
   --secret=id=cert,src=${secureboot}/db.crt -f Dockerfile.cfsuki .