diff --git a/tests/role_deploy_domain_controller.pm b/tests/role_deploy_domain_controller.pm
index bcd97f02..ab744b41 100644
--- a/tests/role_deploy_domain_controller.pm
+++ b/tests/role_deploy_domain_controller.pm
@@ -77,6 +77,11 @@ sub run {
         # this is the other side of the version branch - we're on 29+,
         # so no rolekit. First  install the necessary packages
         assert_script_run "dnf -y groupinstall freeipa-server", 600;
+        # FIXME workaround RHBZ#1606541 until it's fixed
+        unless (script_run "ls -l /usr/sbin/setup-ds.pl") {
+            record_soft_failure "389-ds-base-legacy-tools missing - #1606541";
+            assert_script_run "dnf -y install 389-ds-base-legacy-tools", 180;
+        }
         # configure the firewall
         for my $service (qw(freeipa-ldap freeipa-ldaps dns)) {
             assert_script_run "firewall-cmd --permanent --add-service $service";