diff --git a/tests/container-run.sh b/tests/run-test.sh
similarity index 57%
rename from tests/container-run.sh
rename to tests/run-test.sh
index 8a2370c..ca652c6 100755
--- a/tests/container-run.sh
+++ b/tests/run-test.sh
@@ -1,38 +1,31 @@
 #!/bin/sh
 set -eux
 
-# CSP does not like the the invalid host name _gateway, so translate it
-HOST=$(getent hosts _gateway | cut -f1 -d' ')
-
-trap "cp --verbose Test* /logs/ || true" EXIT
-
 # tests need cockpit's bots/ libraries
-cd /tmp
-git clone --depth=1 https://github.com/cockpit-project/cockpit
-cd cockpit
+cd "$SOURCE"
 git clone --depth=1 https://github.com/cockpit-project/bots
 # pre-download cirros image for Machines tests
 bots/image-download cirros
-# copy tests from our source, so that they match the released version
-rm -rf test
-cp -a /source/test .
-
 # only install a subset to save time/space
 npm install axe-core chrome-remote-interface sizzle
 
-export TEST_OS=fedora-32
-export TEST_AUDIT_NO_SELINUX=1
+. /etc/os-release
+export TEST_OS="${ID}-${VERSION_ID/./-}"
+# HACK: upstream does not yet know about fedora rawhide
+if [ "$TEST_OS" = "fedora-33" ]; then
+    export TEST_OS=fedora-32
+fi
 
 RC=0
 
 # some tests are still too unstable: testCreate,testAddDisk,testDetachDisk,testNICAdd
-test/verify/check-machines-dbus -tv --machine $HOST:22 --browser $HOST:9090 \
+test/verify/check-machines-dbus -tv --machine localhost:22 --browser localhost:9090 \
     TestMachinesDBus.test{Basic,Libvirt,VCPU,MultipleSettings,BootOrder} \
     TestMachinesDBus.test{InlineConsole,ExternalConsole,SerialConsole} \
     TestMachinesDBus.test{StoragePools,StoragePoolsCreate,VmNICs,NetworkSettings} || RC=$?
 
 # not all classes are nondestructive, and we can't run rebooting tests
-test/verify/check-packagekit -tv --machine $HOST:22 --browser $HOST:9090 TestUpdates.test{Basic,SecurityOnly} TestAutoUpdates || RC=$?
+test/verify/check-packagekit -tv --machine localhost:22 --browser localhost:9090 TestUpdates.test{Basic,SecurityOnly} TestAutoUpdates || RC=$?
 
 # check-menu is not @nondestructive yet, keep it last
 for t in accounts \
@@ -44,8 +37,10 @@ for t in accounts \
          storage-partitions \
          storage-used storage-lvm2 \
          menu; do
-    test/verify/check-$t -tv --machine $HOST:22 --browser $HOST:9090 || RC=$?
+    test/verify/check-$t -tv --machine localhost:22 --browser localhost:9090 || RC=$?
 done
 
-echo $RC > /logs/exitcode
-exit $RC
+echo $RC > "$LOGS/exitcode"
+cp --verbose Test* "$LOGS" || true
+# deliver test result via exitcode file
+exit 0
diff --git a/tests/tests.yml b/tests/tests.yml
index 0788f80..aa3c42f 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -19,8 +19,12 @@
     - createrepo_c
     - dnf-automatic
     - firewalld
+    - git
     - libvirt-daemon-config-network
-    - podman
+    - libvirt-python3
+    - make
+    - npm
+    - python3
     - targetcli
     - tlog
     tests:
diff --git a/tests/verify.sh b/tests/verify.sh
index 8d7e624..d4e1fa1 100755
--- a/tests/verify.sh
+++ b/tests/verify.sh
@@ -8,12 +8,27 @@ TESTS="$(pwd)/tests"
 mkdir -p "$LOGS"
 chmod a+w "$LOGS"
 
+# install browser; on RHEL, use chromium from epel
+if ! rpm -q chromium-headless; then
+    if grep -q 'ID=rhel' /etc/os-release; then
+        dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
+        dnf config-manager --enable epel
+    fi
+    dnf install -y chromium-headless
+fi
+
 # create user account for logging in
 if ! id admin 2>/dev/null; then
     useradd -c Administrator -G wheel admin
     echo admin:foobar | chpasswd
 fi
 
+# create user account for running the test
+if ! id runtest 2>/dev/null; then
+    useradd -c 'Test runner' runtest
+fi
+chown -R runtest "$SOURCE"
+
 # disable core dumps, we rather investigate them upstream where test VMs are accessible
 echo core > /proc/sys/kernel/core_pattern
 
@@ -22,18 +37,8 @@ systemctl start firewalld
 firewall-cmd --add-service=cockpit --permanent
 firewall-cmd --add-service=cockpit
 
-# The cockpit/tests container has chromium-browser and other test
-# dependencies, which we don't have on RHEL itself. Also, we don't actually
-# want to install these on the tested image, so run the test in a container,
-# which tests the host. Use a fixed tag to avoid running into failures with
-# "latest", as we don't gate container updates on the dist-git tests for now.
-podman run --rm -i -v "$SOURCE:/source:ro,Z" -v "$TESTS:/tests:ro,Z" -v "$LOGS:/logs:Z" docker.io/cockpit/tasks:2020-01-30 /tests/container-run.sh || true
-
-# reset system changes from verify tests, for running this multiple times in a row
-# HACK: Isolate tests from each other: https://pagure.io/fedora-ci/general/issue/11
-rm -f /etc/systemd/system/cockpit.service.d/notls.conf
-systemctl daemon-reload
-systemctl stop cockpit.service
+# Run tests as unprivileged user
+su - -c "env SOURCE=$SOURCE LOGS=$LOGS $TESTS/run-test.sh" runtest
 
 RC=$(cat $LOGS/exitcode)
 exit ${RC:-1}