diff --git a/tests/freeipa_password_change_postinstall.pm b/tests/freeipa_password_change_postinstall.pm
index fbdbf816..362e7d2d 100644
--- a/tests/freeipa_password_change_postinstall.pm
+++ b/tests/freeipa_password_change_postinstall.pm
@@ -41,7 +41,7 @@ sub run {
     assert_script_run 'printf "loremipsum" | kinit test1';
     # change password via CLI (back to batterystaple, as that's what
     # freeipa_client test expects)
-    assert_script_run 'dnf -y install freeipa-admintools';
+    assert_script_run 'dnf -y --nogpgcheck install freeipa-admintools';
     assert_script_run 'printf "batterystaple\nbatterystaple" | ipa user-mod test1 --password';
     # check we can kinit again
     assert_script_run 'printf "batterystaple" | kinit test1';
diff --git a/tests/role_deploy_domain_controller.pm b/tests/role_deploy_domain_controller.pm
index a0f2c70a..cb964511 100644
--- a/tests/role_deploy_domain_controller.pm
+++ b/tests/role_deploy_domain_controller.pm
@@ -24,7 +24,7 @@ sub run {
     assert_script_run 'dnf config-manager --set-disabled updates-testing';
     # we need a lot of entropy for this, and we don't care how good
     # it is, so let's use haveged
-    assert_script_run 'dnf -y install haveged', 300;
+    assert_script_run 'dnf -y --nogpgcheck install haveged', 300;
     assert_script_run 'systemctl start haveged.service';
     # read DNS server IPs from host's /etc/resolv.conf for passing to
     # rolectl
diff --git a/tests/server_cockpit_default_postinstall.pm b/tests/server_cockpit_default_postinstall.pm
index a96fde46..428bebb0 100644
--- a/tests/server_cockpit_default_postinstall.pm
+++ b/tests/server_cockpit_default_postinstall.pm
@@ -11,8 +11,8 @@ sub run {
     # we don't want updates-testing for validation purposes
     assert_script_run 'dnf config-manager --set-disabled updates-testing';
     # install a desktop and firefox so we can actually try it
-    assert_script_run 'dnf -y groupinstall "base-x"', 300;
-    assert_script_run 'dnf -y install firefox', 120;
+    assert_script_run 'dnf -y --nogpgcheck groupinstall "base-x"', 300;
+    assert_script_run 'dnf -y --nogpgcheck install firefox', 120;
     $self->start_cockpit(0);
     # quit firefox (return to console)
     send_key "ctrl-q";
diff --git a/tests/upgrade_run.pm b/tests/upgrade_run.pm
index 62a2bc9d..6b57778f 100644
--- a/tests/upgrade_run.pm
+++ b/tests/upgrade_run.pm
@@ -4,19 +4,10 @@ use testapi;
 
 sub run {
     my $self = shift;
-    my $release = lc(get_var("VERSION"));
-    # NOTE: this doesn't actually work yet, it's a FIXME in fedorabase
-    my $milestone = $self->get_milestone;
-    my $args = "--releasever=${release}";
-    # This is excessive - after the Bodhi activation point we don't
-    # need --nogpgcheck for Branched. But that's hard to detect magically
-    if ($release eq 'rawhide' or $milestone eq 'branched') {
-        $args .= " --nogpgcheck";
-    }
     # disable screen blanking (download can take a long time)
     script_run "setterm -blank 0";
 
-    assert_script_run "dnf -y system-upgrade download ${args}", 6000;
+    assert_script_run "dnf -y --nogpgcheck system-upgrade download", 6000;
 
     upload_logs "/var/log/dnf.log";
     upload_logs "/var/log/dnf.rpm.log";