diff --git a/templates b/templates
index fd6cccc4..0e220982 100755
--- a/templates
+++ b/templates
@@ -2245,14 +2245,14 @@
                       ],
                     },
                     {
-                      name => "upgrade_realmd_join_sssd",
+                      name => "upgrade_realmd_client",
                       settings => [
                         { key => "ROOT_PASSWORD", value => "weakpassword" },
                         { key => "HDD_1", value => "disk_f%CURRREL%_server_3_x86_64.img" },
                         { key => "UPGRADE", value => "1" },
                         { key => "TEST_TARGET", value => "COMPOSE" },
                         { key => "PREUPGRADE", value => "realmd_join_sssd" },
-                        { key => "POSTINSTALL", value => "freeipa_client" },
+                        { key => "POSTINSTALL", value => "freeipa_webui freeipa_password_change freeipa_client" },
                         { key => "PARALLEL_WITH", value => "upgrade_server_domain_controller" },
                         { key => "USER_LOGIN", value => "false" },
                         { key => "GRUB_POSTINSTALL", value => "net.ifnames=0 biosdevname=0" },
diff --git a/tests/freeipa_webui.pm b/tests/freeipa_webui.pm
index afe60bc0..1847b9f8 100644
--- a/tests/freeipa_webui.pm
+++ b/tests/freeipa_webui.pm
@@ -6,6 +6,11 @@ use freeipa;
 
 sub run {
     my $self = shift;
+    # On the upgrade path, we don't have firefox / X installed yet
+    if (get_var("UPGRADE")) {
+        assert_script_run 'dnf -y groupinstall "base-x"', 300;
+        assert_script_run 'dnf -y install firefox', 120;
+    }
     # we're restarting firefox (instead of using the same one from
     # realmd_join_cockpit) so Firefox's trusted CA store refreshes and
     # it trusts the web server cert