diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9acfe2396..f39a18c8e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -443,7 +443,8 @@ jobs:
             --auth-bundle $(pwd)/.var/lib/foremanctl/proxy.example.com.tar.gz \
             --foreman-fqdn quadlet.example.com \
             --templates-listen-on http \
-            --templates-url http://proxy.example.com:8000
+            --templates-url http://proxy.example.com:8000 \
+            --add-feature bmc
       - name: Run tests
         run: |
           ./forge test --pytest-args="--server-hostname=proxy"
diff --git a/tests/conftest.py b/tests/conftest.py
index a87f61dcf..a59ec135b 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -130,25 +130,45 @@ def default_certificates(certificate_source):
         pytest.skip("Only applies to non-custom certificate deployments")
 
 
+@pytest.fixture(scope="module")
+def quadlet_client_certificate():
+    # this intentionally uses get_paramiko_host directly, as we want the cert of the quadlet box
+    # not the one "server" points at, as that can be the proxy
+    quadlet = get_paramiko_host('quadlet')
+    hostname = quadlet.run("hostname -f").stdout.strip()
+    cert = quadlet.file(f"/var/lib/foremanctl/certs/certs/{hostname}-client.crt").content_string
+    key = quadlet.file(f"/var/lib/foremanctl/certs/private/{hostname}-client.key").content_string
+    return (cert, key)
+
+
+@pytest.fixture(scope="module")
+def client_certificate():
+    return quadlet_client_certificate
+
+
 @pytest.fixture(scope="module")
 def database_mode(obsah_params):
     return obsah_params.get('database_mode', 'internal')
 
 
+def get_paramiko_host(hostname):
+    return testinfra.get_host(f'paramiko://{hostname}', sudo=True, ssh_config=SSH_CONFIG)
+
+
 @pytest.fixture(scope="module")
 def server(server_hostname):
-    yield testinfra.get_host(f'paramiko://{server_hostname}', sudo=True, ssh_config=SSH_CONFIG)
+    yield get_paramiko_host(server_hostname)
 
 
 @pytest.fixture(scope="module")
 def client(client_hostname):
-    yield testinfra.get_host(f'paramiko://{client_hostname}', sudo=True, ssh_config=SSH_CONFIG)
+    yield get_paramiko_host(client_hostname)
 
 
 @pytest.fixture(scope="module")
 def database(database_mode, server):
     if database_mode == 'external':
-        yield testinfra.get_host('paramiko://database', sudo=True, ssh_config=SSH_CONFIG)
+        yield get_paramiko_host('database')
     else:
         yield server
 
@@ -340,13 +360,17 @@ def proxy_base_url(server_fqdn):
 
 
 @pytest.fixture(scope="module")
-def curl_request(server, certificates, server_fqdn):
+def curl_request(server, server_fqdn, certificates, client_certificate):
+    cert, key = client_certificate
+    server.run(f"echo '{cert}' > /tmp/quadlet.crt")
+    server.run(f"echo '{key}' > /tmp/quadlet.key")
+
     def _request(path, base_url=None, method=None, data=None, headers=None, return_body=False):
         url = f"{base_url or f'https://{server_fqdn}'}/{path}"
         curl_opts = (
             f"--cacert {certificates['server_ca_certificate']} "
-            f"--cert {certificates['client_certificate']} "
-            f"--key {certificates['client_key']} "
+            f"--cert /tmp/quadlet.crt "
+            f"--key /tmp/quadlet.key "
             f"--silent "
         )
         if not return_body: