diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 000000000..d00491fd7
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/packit.yaml b/packit.yaml
index 225335c9d..87800c4ba 100644
--- a/packit.yaml
+++ b/packit.yaml
@@ -9,3 +9,10 @@ actions:
   # https://github.com/packit/sandcastle/pull/92
   # https://medium.com/the-node-js-collection/node-js-memory-management-in-container-environments-7eb8409a74e8
   create-archive: make NODE_OPTIONS=--max-old-space-size=500 dist-gzip
+jobs:
+  - job: tests
+    trigger: pull_request
+    metadata:
+      targets:
+      # XXX: use fedora-all once this works
+      - fedora-33
diff --git a/plans/browser.fmf b/plans/browser.fmf
new file mode 100644
index 000000000..e9245083f
--- /dev/null
+++ b/plans/browser.fmf
@@ -0,0 +1,14 @@
+summary: Run browser integration tests on the host
+prepare:
+    how: install
+    package:
+    - cockpit-podman
+    - cockpit-ws
+    - cockpit-system
+    - git
+    - libvirt-python3
+    - make
+    - npm
+    - python3
+execute:
+    script: plans/browser.sh
diff --git a/plans/browser.sh b/plans/browser.sh
new file mode 100755
index 000000000..e936ff084
--- /dev/null
+++ b/plans/browser.sh
@@ -0,0 +1,80 @@
+#!/bin/sh
+set -eux
+
+TESTS="$(realpath $(dirname "$0"))"
+if [ -d source ]; then
+    # path for standard-test-source
+    SOURCE="$(pwd)/source"
+else
+    SOURCE="$(realpath $TESTS/..)"
+fi
+LOGS="$(pwd)/logs"
+mkdir -p "$LOGS"
+chmod a+w "$LOGS"
+
+# Install browser
+# HACK: chromium 88 crashes with some keyDown commands: https://bugs.chromium.org/p/chromium/issues/detail?id=1170634
+if rpm -q chromium-headless; then
+    dnf remove -y chromium-headless
+fi
+
+if grep -q 'ID=.*rhel' /etc/os-release; then
+    dnf install -y \
+    https://kojipkgs.fedoraproject.org//packages/chromium/87.0.4280.141/1.el8/x86_64/chromium-common-87.0.4280.141-1.el8.x86_64.rpm \
+    https://kojipkgs.fedoraproject.org//packages/chromium/87.0.4280.141/1.el8/x86_64/chromium-headless-87.0.4280.141-1.el8.x86_64.rpm
+else
+    dnf install -y \
+    https://kojipkgs.fedoraproject.org//packages/chromium/87.0.4280.141/1.fc32/x86_64/chromium-common-87.0.4280.141-1.fc32.x86_64.rpm \
+    https://kojipkgs.fedoraproject.org//packages/chromium/87.0.4280.141/1.fc32/x86_64/chromium-headless-87.0.4280.141-1.fc32.x86_64.rpm
+fi
+
+# HACK: systemd kills the services after 90s
+# See https://github.com/containers/podman/issues/8751
+sed -i 's/Type=notify/Type=exec/' /usr/lib/systemd/system/podman.service
+sed -i 's/Type=notify/Type=exec/' /usr/lib/systemd/user/podman.service
+
+# create user account for logging in
+if ! id admin 2>/dev/null; then
+    useradd -c Administrator -G wheel admin
+    echo admin:foobar | chpasswd
+fi
+
+# set root's password
+echo root:foobar | chpasswd
+
+# avoid sudo lecture during tests
+su -c 'echo foobar | sudo --stdin whoami' - admin
+
+# create user account for running the test
+if ! id runtest 2>/dev/null; then
+    useradd -c 'Test runner' runtest
+    # allow test to set up things on the machine
+    mkdir -p /root/.ssh
+    curl https://raw.githubusercontent.com/cockpit-project/bots/master/machine/identity.pub  >> /root/.ssh/authorized_keys
+    chmod 600 /root/.ssh/authorized_keys
+fi
+chown -R runtest "$SOURCE"
+
+# disable core dumps, we rather investigate them upstream where test VMs are accessible
+echo core > /proc/sys/kernel/core_pattern
+
+# grab a few images to play with; tests run offline, so they cannot download images
+podman rmi --all
+podman pull quay.io/libpod/busybox
+podman pull quay.io/libpod/alpine
+podman pull quay.io/cockpit/registry:2
+
+# copy images for user podman tests; podman insists on user session
+loginctl enable-linger $(id -u admin)
+for img in quay.io/libpod/busybox quay.io/libpod/alpine quay.io/cockpit/registry:2; do
+    podman save  $img | sudo -i -u admin podman load
+done
+loginctl disable-linger $(id -u admin)
+
+systemctl enable --now cockpit.socket podman.socket
+
+# Run tests as unprivileged user
+su - -c "env SOURCE=$SOURCE LOGS=$LOGS $TESTS/run-test.sh" runtest
+
+RC=$(cat $LOGS/exitcode)
+exit ${RC:-1}
diff --git a/plans/run-test.sh b/plans/run-test.sh
new file mode 100755
index 000000000..ea553a3d9
--- /dev/null
+++ b/plans/run-test.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+set -eux
+
+# tests need cockpit's bots/ libraries and test infrastructure
+cd $SOURCE
+git init
+make bots test/common
+
+# only install a subset to save time/space
+rm -f package-lock.json  # otherwise the command below installs *everything*, argh
+npm install chrome-remote-interface sizzle
+
+. /etc/os-release
+export TEST_OS="${ID}-${VERSION_ID/./-}"
+# HACK: upstream does not yet know about rawhide
+if [ "$TEST_OS" = "fedora-34" ]; then
+    export TEST_OS=fedora-33
+fi
+
+export TEST_AUDIT_NO_SELINUX=1
+
+# FIXME: Internal Server Error: statfs /tmp/bin: no such file or directory
+EXCLUDES="--exclude TestApplication.testRunImageUser"
+
+RC=0
+test/common/run-tests --nondestructive --machine 127.0.0.1:22 --browser 127.0.0.1:9090 $EXCLUDES || RC=$?
+
+echo $RC > "$LOGS/exitcode"
+cp --verbose Test* "$LOGS" || true
+# deliver test result via exitcode file
+exit 0