diff --git a/lib/utils.pm b/lib/utils.pm
index e74f290c..2d9f5a88 100644
--- a/lib/utils.pm
+++ b/lib/utils.pm
@@ -452,7 +452,7 @@ sub repos_mirrorlist {
 
 sub cleanup_workaround_repo {
     # clean up the workaround repo (see next).
-    script_run "rm -rf /opt/workarounds_repo";
+    script_run "rm -rf /mnt/workarounds_repo";
     script_run "rm -f /etc/yum.repos.d/workarounds.repo";
 }
 
@@ -472,10 +472,10 @@ sub setup_workaround_repo {
     # (in this case we need the repo to exist but do not want to use
     # it on the actual support_server system)
     unless (get_var("TEST") eq "support_server" && $version ne get_var("CURRREL")) {
-        assert_script_run 'printf "[workarounds]\nname=Workarounds repo\nbaseurl=file:///opt/workarounds_repo\nenabled=1\nmetadata_expire=1\ngpgcheck=0" > /etc/yum.repos.d/workarounds.repo';
+        assert_script_run 'printf "[workarounds]\nname=Workarounds repo\nbaseurl=file:///mnt/workarounds_repo\nenabled=1\nmetadata_expire=1\ngpgcheck=0" > /etc/yum.repos.d/workarounds.repo';
     }
-    assert_script_run "mkdir -p /opt/workarounds_repo";
-    assert_script_run "pushd /opt/workarounds_repo";
+    assert_script_run "mkdir -p /mnt/workarounds_repo";
+    assert_script_run "pushd /mnt/workarounds_repo";
     my %workarounds = (
         "35" => [],
         "36" => [],
@@ -553,20 +553,13 @@ sub _repo_setup_compose {
 sub _repo_setup_updates {
     # Appropriate repo setup steps for testing a Bodhi update
     # Check if we already ran, bail if so
-    return unless script_run "test -f /etc/yum.repos.d/advisory.repo";
+    return if (get_var("_ADVISORY_REPO_DONE"));
     my $version = get_var("VERSION");
     my $currrel = get_var("CURRREL", "0");
-    repos_mirrorlist();
     # this can be used for debugging repo config if something is wrong
     # unless (script_run 'pushd /etc/yum.repos.d && tar czvf yumreposd.tar.gz * && popd') {
     #     upload_logs "/etc/yum.repos.d/yumreposd.tar.gz";
     # }
-    if ($version > $currrel) {
-        # Disable updates-testing so other bad updates don't break us
-        disable_updates_repos(both => 0);
-    }
-    # set up the workaround repo
-    setup_workaround_repo;
 
     # Set up an additional repo containing the update or task packages. We do
     # this rather than simply running a one-time update because it may be the
@@ -574,7 +567,7 @@ sub _repo_setup_updates {
     # installed by one of the tests; by setting up a repo containing the
     # update and enabling it here, we ensure all later 'dnf install' calls
     # will get the packages from the update.
-    assert_script_run "mkdir -p /opt/update_repo";
+    assert_script_run "mkdir -p /mnt/update_repo";
     # if NUMDISKS is above 1, assume we want to put the update repo on
     # the other disk (to avoid huge updates exhausting space on the main
     # disk)
@@ -583,10 +576,28 @@ sub _repo_setup_updates {
         # partition.
         assert_script_run "echo 'type=83' | sfdisk /dev/vdb";
         assert_script_run "mkfs.ext4 /dev/vdb1";
-        assert_script_run "echo '/dev/vdb1 /opt/update_repo ext4 defaults 1 2' >> /etc/fstab";
-        assert_script_run "mount /opt/update_repo";
+        assert_script_run "echo '/dev/vdb1 /mnt/update_repo ext4 defaults 1 2' >> /etc/fstab";
+        assert_script_run "mount /mnt/update_repo";
+    }
+    assert_script_run "cd /mnt/update_repo";
+    # on CANNED, we need to enter the toolbox at this point
+    if (get_var("CANNED")) {
+        type_string "toolbox -y enter\n";
+        # look for the little purple dot
+        assert_screen "console_in_toolbox", 180;
+    }
+    # use mirrorlist not metalink in repo configs
+    repos_mirrorlist();
+    # Disable updates-testing so other bad updates don't break us
+    disable_updates_repos(both => 0) if ($version > $currrel);
+    # set up the workaround repo
+    setup_workaround_repo;
+    if (get_var("CANNED")) {
+        # install and use en_US.UTF-8 locale for consistent sort
+        # ordering
+        assert_script_run "dnf -y install glibc-langpack-en", 300;
+        assert_script_run "export LC_ALL=en_US.UTF-8";
     }
-    assert_script_run "cd /opt/update_repo";
     script_run "dnf -y install bodhi-client createrepo koji", 300;
 
     # download the packages
@@ -614,14 +625,17 @@ sub _repo_setup_updates {
     }
 
     # log the exact packages in the update at test time, with their
-    # source packages and epochs
-    assert_script_run 'rpm -qp *.rpm --qf "%{SOURCERPM} %{EPOCH} %{NAME}-%{VERSION}-%{RELEASE}\n" | sort -u > /var/log/updatepkgs.txt';
-    upload_logs "/var/log/updatepkgs.txt";
+    # source packages and epochs. we use /mnt as the path for this
+    # and similar files because, on ostree-based installs where we
+    # have to use a toolbox container for part of this, it's common
+    # to the host system and container
+    assert_script_run 'rpm -qp *.rpm --qf "%{SOURCERPM} %{EPOCH} %{NAME}-%{VERSION}-%{RELEASE}\n" | sort -u > /mnt/updatepkgs.txt';
+    upload_logs "/mnt/updatepkgs.txt";
     # also log just the binary package names: this is so we can check
     # later whether any package from the update *should* have been
     # installed, but was not
-    assert_script_run 'rpm -qp *.rpm --qf "%{NAME} " > /var/log/updatepkgnames.txt';
-    upload_logs "/var/log/updatepkgnames.txt";
+    assert_script_run 'rpm -qp *.rpm --qf "%{NAME} " > /mnt/updatepkgnames.txt';
+    upload_logs "/mnt/updatepkgnames.txt";
 
     # create the repo metadata
     assert_script_run "createrepo .", timeout => 180;
@@ -630,9 +644,14 @@ sub _repo_setup_updates {
     # (in this case we need the repo to exist but do not want to use
     # it on the actual support_server system)
     unless (get_var("TEST") eq "support_server" && $version ne get_var("CURRREL")) {
-        assert_script_run 'printf "[advisory]\nname=Advisory repo\nbaseurl=file:///opt/update_repo\nenabled=1\nmetadata_expire=3600\ngpgcheck=0" > /etc/yum.repos.d/advisory.repo';
-        # run an update now (except for upgrade tests)
-        script_run "dnf -y update", 900 unless (get_var("UPGRADE"));
+        assert_script_run 'printf "[advisory]\nname=Advisory repo\nbaseurl=file:///mnt/update_repo\nenabled=1\nmetadata_expire=3600\ngpgcheck=0" > /etc/yum.repos.d/advisory.repo';
+        # run an update now (except for upgrade or CANNED tests)
+        script_run "dnf -y update", 900 unless (get_var("UPGRADE") || get_var("CANNED"));
+    }
+    # exit the toolbox on CANNED
+    if (get_var("CANNED")) {
+        type_string "exit\n";
+        wait_still_screen 5;
     }
     # mark via a variable that we've set up the update/task repo and done
     # all the logging stuff above
@@ -1072,16 +1091,16 @@ sub advisory_get_installed_packages {
     assert_script_run 'rpm -qa --qf "%{SOURCERPM} %{EPOCH} %{NAME}-%{VERSION}-%{RELEASE}\n" | sort -u > /tmp/allpkgs.txt', timeout => 90;
     # this finds lines which appear in both files
     # http://www.unix.com/unix-for-dummies-questions-and-answers/34549-find-matching-lines-between-2-files.html
-    if (script_run 'comm -12 /tmp/allpkgs.txt /var/log/updatepkgs.txt > /var/log/testedpkgs.txt') {
+    if (script_run 'comm -12 /tmp/allpkgs.txt /mnt/updatepkgs.txt > /mnt/testedpkgs.txt') {
         # occasionally, for some reason, it's unhappy about sorting;
         # we shouldn't fail the test in this case, just upload the
         # files so we can see why...
         upload_logs "/tmp/allpkgs.txt", failok => 1;
-        upload_logs "/var/log/updatepkgs.txt", failok => 1;
+        upload_logs "/mnt/updatepkgs.txt", failok => 1;
     }
     # we'll try and upload the output even if comm 'failed', as it
     # does in fact still write it in some cases
-    upload_logs "/var/log/testedpkgs.txt", failok => 1;
+    upload_logs "/mnt/testedpkgs.txt", failok => 1;
 }
 
 sub advisory_check_nonmatching_packages {
@@ -1101,7 +1120,7 @@ sub advisory_check_nonmatching_packages {
     script_run 'touch /tmp/installedupdatepkgs.txt';
     # this creates /tmp/installedupdatepkgs.txt as a sorted list of installed
     # packages with the same name as packages from the update, in the same form
-    # as /var/log/updatepkgs.txt. The '--last | head -1' tries to handle the
+    # as /mnt/updatepkgs.txt. The '--last | head -1' tries to handle the
     # problem of installonly packages like the kernel, where we wind up with
     # *multiple* versions installed after the update; the first line of output
     # for any given package with --last is the most recent version, i.e. the
@@ -1112,14 +1131,14 @@ sub advisory_check_nonmatching_packages {
     # (we need four to reach bash, and half of them get eaten by perl or
     # something along the way). Yes, it only works with *single* quotes. Yes,
     # I hate escaping
-    script_run 'for pkg in $(cat /var/log/updatepkgnames.txt); do rpm -q $pkg && rpm -q $pkg --last | head -1 | cut -d" " -f1 | sed -e \'s,\^,\\\\\\\\^,g\' | xargs rpm -q --qf "%{SOURCERPM} %{EPOCH} %{NAME}-%{VERSION}-%{RELEASE}\n" >> /tmp/installedupdatepkgs.txt; done', timeout => 180;
+    script_run 'for pkg in $(cat /mnt/updatepkgnames.txt); do rpm -q $pkg && rpm -q $pkg --last | head -1 | cut -d" " -f1 | sed -e \'s,\^,\\\\\\\\^,g\' | xargs rpm -q --qf "%{SOURCERPM} %{EPOCH} %{NAME}-%{VERSION}-%{RELEASE}\n" >> /tmp/installedupdatepkgs.txt; done', timeout => 180;
     script_run 'sort -u -o /tmp/installedupdatepkgs.txt /tmp/installedupdatepkgs.txt';
     # for debugging, may as well always upload these, can't hurt anything
     upload_logs "/tmp/installedupdatepkgs.txt", failok => 1;
-    upload_logs "/var/log/updatepkgs.txt", failok => 1;
+    upload_logs "/mnt/updatepkgs.txt", failok => 1;
     # if any line appears in installedupdatepkgs.txt but not updatepkgs.txt,
     # we have a problem.
-    if (script_run 'comm -23 /tmp/installedupdatepkgs.txt /var/log/updatepkgs.txt > /var/log/installednotupdatedpkgs.txt') {
+    if (script_run 'comm -23 /tmp/installedupdatepkgs.txt /mnt/updatepkgs.txt > /mnt/installednotupdatedpkgs.txt') {
         # occasionally, for some reason, it's unhappy about sorting;
         # we shouldn't fail the test in this case, just make a note
         # of it so we can look why...
@@ -1127,8 +1146,8 @@ sub advisory_check_nonmatching_packages {
     }
     # this exits 1 if the file is zero-length, 0 if it's longer
     # if it's 0, that's *BAD*: we want to upload the file and fail
-    unless (script_run 'test -s /var/log/installednotupdatedpkgs.txt') {
-        upload_logs "/var/log/installednotupdatedpkgs.txt", failok => 1;
+    unless (script_run 'test -s /mnt/installednotupdatedpkgs.txt') {
+        upload_logs "/mnt/installednotupdatedpkgs.txt", failok => 1;
         my $message = "Package(s) from update not installed when it should have been! See installednotupdatedpkgs.txt";
         if ($args{fatal}) {
             set_var("_ACNMP_DONE", "1");
diff --git a/main.pm b/main.pm
index f575cec6..f7756835 100644
--- a/main.pm
+++ b/main.pm
@@ -353,9 +353,10 @@ sub load_postinstall_tests() {
 
     # load the ADVISORY / KOJITASK post-install test - this records which
     # update or task packages were actually installed during the test. Don't
-    # do this for INSTALL test(s); these are checking that an installer image
-    # built from the update works and do not install the update themselves.
-    if (get_var("ADVISORY_OR_TASK") && !get_var("INSTALL")) {
+    # do this for netinst tests; as these just use the default install repo,
+    # they will not get the packages from the update. But installs from live
+    # image and ostree installer image should get them.
+    if (get_var("ADVISORY_OR_TASK") && get_var("TEST") ne "install_default_update_netinst") {
         # don't do this for support server unless the update is for the same
         # release as the support server disk image, as we don't install the
         # updates on support server when they differ
diff --git a/ostree-parse-pungi.py b/ostree-parse-pungi.py
new file mode 100644
index 00000000..5ff45633
--- /dev/null
+++ b/ostree-parse-pungi.py
@@ -0,0 +1,48 @@
+#!/usr/bin/python
+
+import re
+import sys
+
+# the "current" base platform version, i.e. the one that the GNOME
+# app builds currently tagged "stable" need
+BASEVER = "37"
+# a regex to find where we replace that
+BASEPATT = re.compile(r"(runtime/org.fedoraproject.Platform/.*?/f)(\d+)")
+
+flavor = sys.argv[1]
+arch = sys.argv[2]
+
+started = 0
+finished = 0
+ostree = ""
+with open("fedora.conf", "r") as conffh:
+    for line in conffh.readlines():
+        if line == "ostree_installer = [\n":
+            started = 1
+        if started and not finished:
+            ostree += line
+        if started and line == "]\n":
+            finished = 1
+# don't do this at home, kids!
+exec(ostree)
+
+for (gotflav, dic) in ostree_installer:
+    if flavor in gotflav.lower():
+        args = dic[arch]
+        break
+
+cmd = "--rootfs-size=" + args["rootfs_size"]
+for addtemp in args["add_template"]:
+    cmd += f" --add-template=/fedora-lorax-templates/{addtemp}"
+for addtempvar in args["add_template_var"]:
+    # this changes e.g. "runtime/org.fedoraproject.Platform/x86_64/f35"
+    # to "runtime/org.fedoraproject.Platform/x86_64/f37" , if BASEVER
+    # is "37"
+    addtempvar = BASEPATT.sub(r"\g<1>" + BASEVER, addtempvar)
+    cmd += f" --add-template-var=\"{addtempvar}\""
+
+# this is where the previous step of the openQA test created the
+# ostree repo
+cmd = cmd.replace("https://kojipkgs.fedoraproject.org/compose/ostree/repo/", "file:///ostree/repo")
+
+print(cmd)
diff --git a/templates-updates.fif.json b/templates-updates.fif.json
index 31a9cce7..213d33c2 100644
--- a/templates-updates.fif.json
+++ b/templates-updates.fif.json
@@ -116,6 +116,21 @@
             },
             "version": "*"
         },
+        "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*": {
+            "arch": "x86_64",
+            "distri": "fedora",
+            "flavor": "updates-silverblue-dvd_ostree-iso",
+            "settings": {
+                "CANNED": "1",
+                "DESKTOP": "gnome",
+                "HDDSIZEGB": "15",
+                "NUMDISKS": "2",
+                "PACKAGE_SET": "default",
+                "RETRY": "1",
+                "SUBVARIANT": "Silverblue"
+            },
+            "version": "*"
+        },
         "fedora-updates-workstation-live-iso-x86_64-*": {
             "arch": "x86_64",
             "distri": "fedora",
@@ -223,6 +238,14 @@
             "machine": "uefi",
             "product": "fedora-updates-kde-live-iso-x86_64-*"
         },
+        "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*-64bit": {
+            "machine": "64bit",
+            "product": "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*"
+        },
+        "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*-uefi": {
+            "machine": "uefi",
+            "product": "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*"
+        },
         "fedora-updates-workstation-live-iso-x86_64-*-64bit": {
             "machine": "64bit",
             "product": "fedora-updates-workstation-live-iso-x86_64-*"
@@ -359,7 +382,7 @@
             },
             "settings": {
                 "+START_AFTER_TEST": "installer_build@%ARCH_BASE_MACHINE%",
-                "ADD_REPOSITORY_VARIATION": "nfs://172.16.2.110:/opt/update_repo",
+                "ADD_REPOSITORY_VARIATION": "nfs://172.16.2.110:/mnt/update_repo",
                 "INSTALL": "1",
                 "INSTALL_UNLOCK": "support_ready",
                 "ISO": "%ADVISORY_OR_TASK%-netinst-%ARCH%.iso",
@@ -369,6 +392,17 @@
                 "WORKER_CLASS": "tap"
             }
         },
+        "install_default_update_ostree": {
+            "profiles": {
+                "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*-64bit": 5
+            },
+            "settings": {
+                "INSTALL": "1",
+                "ISO": "%ADVISORY_OR_TASK%-%SUBVARIANT%-ostree-%ARCH%.iso",
+                "PACKAGE_SET": "default",
+                "+START_AFTER_TEST": "ostree_build@%ARCH_BASE_MACHINE%"
+            }
+        },
         "installer_build": {
             "profiles": {
                 "fedora-updates-everything-boot-iso-x86_64-*-64bit": 5
@@ -401,6 +435,23 @@
                 "USER_LOGIN": "false"
             }
         },
+        "ostree_build": {
+            "profiles": {
+                "fedora-updates-silverblue-dvd_ostree-iso-x86_64-*-64bit": 5
+            },
+            "settings": {
+                "+DESKTOP": "",
+                "+CANNED": "",
+                "BOOTFROM": "c",
+                "HDD_1": "disk_f%VERSION%_minimal_3_%ARCH%.qcow2",
+                "HDDSIZEGB_3": "25",
+                "MAX_JOB_TIME": "10800",
+                "+NUMDISKS": "3",
+                "POSTINSTALL": "_ostree_build",
+                "ROOT_PASSWORD": "weakpassword",
+                "USER_LOGIN": "false"
+            }
+        },
         "podman": {
             "profiles": {
                 "fedora-updates-container-aarch64-*-aarch64": 5,
diff --git a/tests/_advisory_post.pm b/tests/_advisory_post.pm
index 76023ed0..76642caf 100644
--- a/tests/_advisory_post.pm
+++ b/tests/_advisory_post.pm
@@ -6,6 +6,9 @@ use utils;
 sub run {
     my $self = shift;
     $self->root_console(tty => 3);
+    # do repo_setup if it's not been done already - this is for the
+    # install_default_update tests
+    repo_setup;
     # figure out which packages from the update actually got installed
     # (if any) as part of this test
     advisory_get_installed_packages;
diff --git a/tests/_live_build.pm b/tests/_live_build.pm
index 2d273ab9..e49fcada 100644
--- a/tests/_live_build.pm
+++ b/tests/_live_build.pm
@@ -40,11 +40,11 @@ sub run {
     assert_script_run "echo \"include('/etc/mock/fedora-${version}-${arch}.cfg')\" > /etc/mock/openqa.cfg";
     # make the side and workarounds repos and the serial device available inside the mock root
     assert_script_run 'echo "config_opts[\'plugin_conf\'][\'bind_mount_enable\'] = True" >> /etc/mock/openqa.cfg';
-    assert_script_run 'echo "config_opts[\'plugin_conf\'][\'bind_mount_opts\'][\'dirs\'].append((\'/opt/update_repo\', \'/opt/update_repo\'))" >> /etc/mock/openqa.cfg';
-    assert_script_run 'echo "config_opts[\'plugin_conf\'][\'bind_mount_opts\'][\'dirs\'].append((\'/opt/workarounds_repo\', \'/opt/workarounds_repo\'))" >> /etc/mock/openqa.cfg';
+    assert_script_run 'echo "config_opts[\'plugin_conf\'][\'bind_mount_opts\'][\'dirs\'].append((\'/mnt/update_repo\', \'/mnt/update_repo\'))" >> /etc/mock/openqa.cfg';
+    assert_script_run 'echo "config_opts[\'plugin_conf\'][\'bind_mount_opts\'][\'dirs\'].append((\'/mnt/workarounds_repo\', \'/mnt/workarounds_repo\'))" >> /etc/mock/openqa.cfg';
     assert_script_run 'echo "config_opts[\'plugin_conf\'][\'bind_mount_opts\'][\'dirs\'].append((\'/dev/' . $serialdev . '\', \'/dev/' . $serialdev . '\'))" >> /etc/mock/openqa.cfg';
     # add the side repo and workarounds to the config
-    assert_script_run 'printf "config_opts[\'dnf.conf\'] += \"\"\"\n[advisory]\nname=Advisory repo\nbaseurl=file:///opt/update_repo\nenabled=1\nmetadata_expire=3600\ngpgcheck=0\n\n[workarounds]\nname=Workarounds repo\nbaseurl=file:///opt/workarounds_repo\nenabled=1\nmetadata_expire=3600\ngpgcheck=0\n\"\"\"" >> /etc/mock/openqa.cfg';
+    assert_script_run 'printf "config_opts[\'dnf.conf\'] += \"\"\"\n[advisory]\nname=Advisory repo\nbaseurl=file:///mnt/update_repo\nenabled=1\nmetadata_expire=3600\ngpgcheck=0\n\n[workarounds]\nname=Workarounds repo\nbaseurl=file:///mnt/workarounds_repo\nenabled=1\nmetadata_expire=3600\ngpgcheck=0\n\"\"\"" >> /etc/mock/openqa.cfg';
     # replace metalink with mirrorlist so we don't get slow mirrors
     repos_mirrorlist("/etc/mock/openqa.cfg");
     # upload the config so we can check it's OK
@@ -54,9 +54,9 @@ sub run {
     assert_script_run 'cd fedora-kickstarts';
     assert_script_run "git checkout ${branch}";
     # now add the side repo to the appropriate repo ks
-    assert_script_run 'echo "repo --name=advisory --baseurl=file:///opt/update_repo" >> ' . $repoks;
+    assert_script_run 'echo "repo --name=advisory --baseurl=file:///mnt/update_repo" >> ' . $repoks;
     # and the workarounds repo
-    assert_script_run 'echo "repo --name=workarounds --baseurl=file:///opt/workarounds_repo" >> ' . $repoks;
+    assert_script_run 'echo "repo --name=workarounds --baseurl=file:///mnt/workarounds_repo" >> ' . $repoks;
     # FIXME: this is a workaround for #2119518, disabling oomd so it
     # doesn't go crazy killing things
     my $relnum = get_release_number;
diff --git a/tests/_ostree_build.pm b/tests/_ostree_build.pm
new file mode 100644
index 00000000..202ae6e6
--- /dev/null
+++ b/tests/_ostree_build.pm
@@ -0,0 +1,97 @@
+use base "installedtest";
+use strict;
+use testapi;
+use utils;
+
+sub run {
+    my $self = shift;
+    my $version = get_var("VERSION");
+    my $currrel = get_var("CURRREL");
+    my $rawrel = get_var("RAWREL");
+    my $repo = $version eq $rawrel ? "fedora-rawhide.repo" : "fedora.repo";
+    my $branch;
+    my $releasever;
+    if ($version eq $rawrel) {
+        $branch = "main";
+        $releasever = "Rawhide";
+    }
+    else {
+        $branch = "f${version}";
+        $releasever = $version;
+    }
+    my $advortask = get_var("ADVISORY_OR_TASK");
+    my $arch = get_var("ARCH");
+    my $subv = get_var("SUBVARIANT");
+    my $lcsubv = lc($subv);
+    assert_script_run "cd /";
+    # usually a good idea for this kinda thing
+    assert_script_run "setenforce Permissive";
+    # install the tools we need
+    assert_script_run "dnf -y install git lorax flatpak ostree rpm-ostree wget dbus-daemon", 300;
+    # now check out workstation-ostree-config
+    assert_script_run 'git clone https://pagure.io/workstation-ostree-config.git';
+    assert_script_run 'pushd workstation-ostree-config';
+    assert_script_run "git checkout ${branch}";
+    # now copy the advisory and workaround repo config files in
+    assert_script_run 'cp /etc/yum.repos.d/advisory.repo .';
+    assert_script_run 'cp /etc/yum.repos.d/workarounds.repo .';
+    # and add them to the config file
+    assert_script_run 'sed -i -e "s,repos:,repos:\n  - advisory\n  - workarounds,g" fedora-' . $lcsubv . '.yaml';
+    # upload the config so we can check it
+    upload_logs "fedora-$lcsubv.yaml";
+    assert_script_run 'popd';
+    # now make the ostree repo
+    assert_script_run "mkdir -p /ostree";
+    assert_script_run "ostree --repo=/ostree/repo init --mode=archive";
+    # PULL SOME LEVERS! PULL SOME LEVERS!
+    # This shadows pungi/ostree/tree.py
+    # FIXME: when https://fedoraproject.org/wiki/Changes/FedoraSilverblueUnifiedCore
+    # is implemented we should match it by adding --unified-core to the args
+    # Difference from releng: we don't pass --write-commitid-to as it
+    # disables updating the ref with the new commit, and we *do* want
+    # to do that. pungi updates the ref itself, I don't want to copy
+    # all that work in here
+    assert_script_run "rpm-ostree compose tree --repo=/ostree/repo/ --add-metadata-string=version=${advortask} --force-nocache /workstation-ostree-config/fedora-$lcsubv.yaml > /tmp/ostree.log 2>&1", 4500;
+    upload_logs "/tmp/ostree.log";
+    # check out the ostree installer lorax templates
+    assert_script_run 'cd /';
+    assert_script_run 'git clone https://pagure.io/fedora-lorax-templates.git';
+    # also check out pungi-fedora and use our script to build part of
+    # the lorax command
+    assert_script_run 'git clone https://pagure.io/pungi-fedora.git';
+    assert_script_run 'cd pungi-fedora/';
+    assert_script_run "git checkout ${branch}";
+    # FIXME FIXME change 'ostree' to 'main' on/after merge
+    assert_script_run 'wget https://pagure.io/fedora-qa/os-autoinst-distri-fedora/raw/ostree/f/ostree-parse-pungi.py', timeout => 120;
+    my $loraxargs = script_output "python3 ostree-parse-pungi.py $lcsubv $arch";
+
+    # this 'temporary file cleanup' thing can actually wipe bits of
+    # the lorax install root while lorax is still running...
+    assert_script_run "systemctl stop systemd-tmpfiles-clean.timer";
+    # create the installer ISO
+    assert_script_run "rm -rf /var/tmp/*";
+    assert_script_run "echo 'type=83' | sfdisk /dev/vdc";
+    assert_script_run "mkfs.ext4 /dev/vdc1";
+    assert_script_run "echo '/dev/vdc1 /var/tmp ext4 defaults 1 2' >> /etc/fstab";
+    assert_script_run "mount /var/tmp";
+    assert_script_run "mkdir -p /var/tmp/imgbuild";
+    assert_script_run "cd /var/tmp/imgbuild";
+
+    my $cmd = "lorax -p Fedora -v ${version} -r ${version} --repo=/etc/yum.repos.d/${repo} --variant=${subv} --nomacboot --buildarch=${arch} --volid=F-${subv}-ostree-${arch}-oqa --logfile=./lorax.log ${loraxargs}";
+    unless ($version > $currrel) {
+        $cmd .= " --isfinal --repo=/etc/yum.repos.d/fedora-updates.repo";
+    }
+    $cmd .= " --repo=/etc/yum.repos.d/advisory.repo --repo=/etc/yum.repos.d/workarounds.repo ./results";
+    assert_script_run $cmd, 4800;
+    # good to have the log around for checks
+    upload_logs "lorax.log", failok => 1;
+    assert_script_run "mv results/images/boot.iso ./${advortask}-${subv}-ostree-${arch}.iso";
+    upload_asset "./${advortask}-${subv}-ostree-${arch}.iso";
+}
+
+sub test_flags {
+    return {fatal => 1};
+}
+
+1;
+
diff --git a/tests/_support_server.pm b/tests/_support_server.pm
index 670d2a08..c133b8d6 100644
--- a/tests/_support_server.pm
+++ b/tests/_support_server.pm
@@ -130,7 +130,7 @@ sub run {
     assert_script_run "curl -o /export/root-user-crypted-net.ks https://fedorapeople.org/groups/qa/kickstarts/root-user-crypted-net.ks";
     # for update tests, set up the update repository and export it
     if (get_var("ADVISORY_OR_TASK")) {
-        assert_script_run "echo '/opt/update_repo 172.16.2.0/24(ro)' >> /etc/exports";
+        assert_script_run "echo '/mnt/update_repo 172.16.2.0/24(ro)' >> /etc/exports";
     }
     # for compose tests, we do all this stuff
     else {