diff --git a/pkg/testsuites/standard_suites.go b/pkg/testsuites/standard_suites.go
index 6c3c2258cb55..d1f403b54189 100644
--- a/pkg/testsuites/standard_suites.go
+++ b/pkg/testsuites/standard_suites.go
@@ -317,9 +317,9 @@ var staticSuites = []ginkgo.TestSuite{
 		The conformance testing suite for certified third-party CNI plugins.
 		`),
 		Qualifiers: []string{
-			`name.contains("[Suite:k8s]") && name.contains("[sig-network]") && 
-				(name.contains("[Conformance]") || 
-					(name.contains("NetworkPolicy") && !name.contains("named port")) || 
+			`source == "openshift:payload:hyperkube" && name.contains("[sig-network]") &&
+				(name.contains("[Conformance]") ||
+					(name.contains("NetworkPolicy") && !name.contains("named port")) ||
 					name.contains("[Feature:IPv6DualStack]"))`,
 		},
 	},
diff --git a/pkg/testsuites/suites_test.go b/pkg/testsuites/suites_test.go
index f6a3dd7a9f7f..defdcd9bcf40 100644
--- a/pkg/testsuites/suites_test.go
+++ b/pkg/testsuites/suites_test.go
@@ -5,13 +5,15 @@ import (
 	"testing"
 
 	"github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	"github.com/openshift/origin/pkg/test/ginkgo"
 )
 
 // TestSuiteQualifiersValidCEL validates that all CEL expressions in suite qualifiers
 // are syntactically valid
 func TestSuiteQualifiersValidCEL(t *testing.T) {
 	dummyTest := &extensiontests.ExtensionTestSpec{
-		Name: "[sig-test] Test a thing [Suite:openshift/conformance/parallel] [Early]",
+		Name:   "[sig-test] Test a thing [Suite:openshift/conformance/parallel] [Early]",
+		Source: "openshift:payload:origin",
 	}
 	dummySpecs := extensiontests.ExtensionTestSpecs{dummyTest}
 
@@ -49,3 +51,66 @@ func TestSuiteQualifiersValidCEL(t *testing.T) {
 		}
 	})
 }
+
+func TestThirdPartySuiteMatchesHyperkubeTests(t *testing.T) {
+	var thirdPartySuite *ginkgo.TestSuite
+	for i := range staticSuites {
+		if staticSuites[i].Name == "openshift/network/third-party" {
+			thirdPartySuite = &staticSuites[i]
+			break
+		}
+	}
+	if thirdPartySuite == nil {
+		t.Fatal("openshift/network/third-party suite not found")
+	}
+
+	candidateTests := extensiontests.ExtensionTestSpecs{
+		{
+			Name:   "[sig-network] NetworkPolicy API should support creating NetworkPolicy API operations [Conformance]",
+			Source: "openshift:payload:hyperkube",
+		},
+		{
+			Name:   "[sig-network] Networking should provide Internet connection for containers [Feature:Networking-IPv4] [Conformance]",
+			Source: "openshift:payload:hyperkube",
+		},
+		{
+			Name:   "[sig-network] NetworkPolicy should enforce policy based on Ports [Feature:IPv6DualStack]",
+			Source: "openshift:payload:hyperkube",
+		},
+		{
+			Name:   "[sig-network] NetworkPolicy named port should not match",
+			Source: "openshift:payload:hyperkube",
+		},
+		{
+			Name:   "[sig-storage] some storage test [Conformance]",
+			Source: "openshift:payload:hyperkube",
+		},
+		{
+			Name:   "[sig-network] some origin network test [Conformance]",
+			Source: "openshift:payload:origin",
+		},
+	}
+
+	filtered, err := candidateTests.Filter(thirdPartySuite.Qualifiers)
+	if err != nil {
+		t.Fatalf("failed to filter: %v", err)
+	}
+
+	expectedNames := map[string]bool{
+		"[sig-network] NetworkPolicy API should support creating NetworkPolicy API operations [Conformance]":                 true,
+		"[sig-network] Networking should provide Internet connection for containers [Feature:Networking-IPv4] [Conformance]": true,
+		"[sig-network] NetworkPolicy should enforce policy based on Ports [Feature:IPv6DualStack]":                           true,
+	}
+
+	if len(filtered) != len(expectedNames) {
+		t.Errorf("expected %d tests, got %d", len(expectedNames), len(filtered))
+		for _, s := range filtered {
+			t.Logf("  matched: %s", s.Name)
+		}
+	}
+	for _, s := range filtered {
+		if !expectedNames[s.Name] {
+			t.Errorf("unexpected test matched: %s", s.Name)
+		}
+	}
+}