diff --git a/README.md b/README.md
index a5d11a4d..71d76f36 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,7 @@ and `test_flags()` method, inheriting from one of the classes mentioned above.
 4. Link your newly created Test suite to medium type in [WebUI -> Job groups](https://localhost:8080/admin/groups).
 5. Run test (see [openqa_fedora_tools repository](https://bitbucket.org/rajcze/openqa_fedora_tools)).
 6. Create needles (images) by using interactive mode and needles editor in WebUI.
-7. Add new Job template and Test suite into `templates` file.
+7. Add new Job template and Test suite into `templates` file (and `templates-updates`, if the test is applicable to the update testing workflow)
 8. Add new Test suite and Test case into [`conf_test_suites.py`](https://pagure.io/fedora-qa/fedora_openqa/blob/master/f/fedora_openqa/conf_test_suites.py) file in fedora_openqa repository.
 9. Open differential request via phabricator, set os-autoinst-disti-fedora as a project and repository.
 10. Open differential request for fedora_openqa change if necessary.
diff --git a/VARIABLES.md b/VARIABLES.md
index f1051f08..32f88c06 100644
--- a/VARIABLES.md
+++ b/VARIABLES.md
@@ -74,6 +74,8 @@ it also means that `B` conflicts `A` even if not shown in the table).
 | `POSTINSTALL` | string | not set | nothing | If set, `tests/(value)_postinstall.pm` will be loaded after install, boot, login, and other postinstall tests
 | `UEFI` | boolean | `false`/not set | nothing | whether to use UEFI, this variable isn't usually set in test suites but in machine definition |
 | `ANACONDA_TEXT` | boolean | `false`/not set | all | when specified, anaconda will run in text mode |
+| `ANACONDA_STATIC` | string (IPv4 address) | not set | `ANACONDA_TEXT` | If set, will set up static networking using the chosen IP address during install |
+| `POST_STATIC` | string (space-separated IPv4 address and hostname) | not set | nothing | If set, will set up static networking using the chosen IP address and hostname during early post-install |
 
 Run variables
 -------------
@@ -81,8 +83,9 @@ These variables should be set when tests are scheduled (when running `isos post`
 
 | Variable | Explanation |
 | -------- | ----------- |
-| `ISO` | contains filename of ISO that is used for booting. If ISOURL is not set, file must exist in /var/lib/openqa/share/factory/iso. If ISOURL is set, it will be downloaded to this name instead of its original name |
+| `ISO` | contains filename of ISO that is used for booting. If `ISO_URL` is not set, file must exist in /var/lib/openqa/share/factory/iso. If `ISO_URL` is set, it will be downloaded to this name instead of its original name |
 | `ISO_URL` | contains URL for ISO to boot, openQA will download it |
+| `ADVISORY` | A Bodhi update ID. If set, the 'update testing' flow will be used: post-install tests will be run with the packages from the update, starting from the stable release base disk images |
 | `DISTRI` | contains distribution name (should be same as in WebUI, probably `fedora`) |
 | `VERSION` | contains version of distribution |
 | `FLAVOR` | indicates what type of distribution is used. Three Pungi properties, joined with `-`: `variant`, `type`, and `format`. e.g.: `Server-dvd-iso`. Special value `universal` is used to schedule the group of tests that should be run once each per arch per compose, against the 'best' available ISO |
diff --git a/lib/tapnet.pm b/lib/tapnet.pm
index 279322fe..4e36cd84 100644
--- a/lib/tapnet.pm
+++ b/lib/tapnet.pm
@@ -40,9 +40,20 @@ sub setup_tap_static {
         # add entry to /etc/hosts
         assert_script_run "echo '$ip $hostname $short' >> /etc/hosts";
     }
+    # use host's name servers (this is usually going to be correct,
+    # tests which don't want this can overwrite resolv.conf)
+    my @dns = get_host_dns();
+    my $dnstext = '';
+    for (my $i=0; $i < @dns; $i++) {
+        my $num = $i + 1;
+        $dnstext .= "\nDNS" . ${num} . "=" . $dns[$i];
+    }
     # bring up network. DEFROUTE is *vital* here
-    assert_script_run "printf 'DEVICE=eth0\nBOOTPROTO=none\nIPADDR=$ip\nGATEWAY=10.0.2.2\nPREFIX=24\nDEFROUTE=yes' > /etc/sysconfig/network-scripts/ifcfg-eth0";
-    script_run "systemctl restart NetworkManager.service";
+    my $conftext = "DEVICE=eth0\nBOOTPROTO=none\nIPADDR=$ip\nGATEWAY=10.0.2.2\nPREFIX=24\nDEFROUTE=yes\nONBOOT=yes" . $dnstext;
+    assert_script_run "printf '${conftext}\n' > /etc/sysconfig/network-scripts/ifcfg-eth0";
+    assert_script_run "systemctl restart NetworkManager.service";
+    # the above doesn't seem to reliably set up resolv.conf, so...
+    clone_host_file "/etc/resolv.conf";
 }
 
 sub get_host_dns {
diff --git a/lib/utils.pm b/lib/utils.pm
index 3da25b33..355a23f0 100644
--- a/lib/utils.pm
+++ b/lib/utils.pm
@@ -284,11 +284,13 @@ sub start_cockpit {
     }
 }
 
-sub repo_setup {
+sub _repo_setup_compose {
+    # Appropriate repo setup steps for testing a compose
     # disable updates-testing and updates and use the compose location
     # as the target for fedora and rawhide rather than mirrorlist, so
     # tools see only packages from the compose under test
     my $location = get_var("LOCATION");
+    return unless $location;
     assert_script_run 'dnf config-manager --set-disabled updates-testing updates';
     # we use script_run here as the rawhide repo file won't always exist
     # and we don't want to bother testing or predicting its existence;
@@ -298,3 +300,45 @@ sub repo_setup {
     script_run "cat /etc/yum.repos.d/{fedora,fedora-rawhide}.repo", 0;
 }
 
+sub _repo_setup_updates {
+    # Appropriate repo setup steps for testing a Bodhi update
+    # Check if we already ran, bail if so
+    return unless script_run "test -f /etc/yum.repos.d/advisory.repo";
+    # Use baseurl not metalink so we don't wind up timing out getting
+    # metadata from a slow source...baseurl will always give us dl
+    # in infra
+    assert_script_run "sed -i -e 's,^metalink,#metalink,g' -e 's,^#baseurl,baseurl,g' /etc/yum.repos.d/fedora*.repo";
+    # Set up an additional repo containing the update packages. We do
+    # this rather than simply running a one-time update because it may
+    # be the case that a package from the update isn't installed *now*
+    # but will be installed by one of the tests; by setting up a repo
+    # containing the update and enabling it here, we ensure all later
+    # 'dnf install' calls will get the packages from the update.
+    assert_script_run "mkdir -p /opt/update_repo";
+    assert_script_run "cd /opt/update_repo";
+    assert_script_run "dnf -y install bodhi-client git createrepo", 300;
+    # download the packages
+    my $version = lc(get_var("VERSION"));
+    if ($version eq 'rawhide' || $version > 25) {
+        # bodhi client 2.x
+        assert_script_run "bodhi updates download --updateid " . get_var("ADVISORY"), 300;
+    }
+    else {
+        # bodhi client 0.9
+        # latest git python-fedora fixes bug which makes bodhi -D UPDATE_ID fail
+        assert_script_run "git clone https://github.com/fedora-infra/python-fedora.git";
+        assert_script_run "PYTHONPATH=python-fedora/ bodhi -D " . get_var("ADVISORY"), 300;
+    }
+    # create the repo metadata
+    assert_script_run "createrepo .";
+    # write a repo config file
+    assert_script_run 'printf "[advisory]\nname=Advisory repo\nbaseurl=file:///opt/update_repo\nenabled=1\nmetadata_expire=3600\ngpgcheck=0" > /etc/yum.repos.d/advisory.repo';
+    # run an update now
+    script_run "dnf -y update", 300;
+}
+
+sub repo_setup {
+    # Run the appropriate sub-function for the job
+    get_var("ADVISORY") ? _repo_setup_updates : _repo_setup_compose;
+}
+
diff --git a/main.pm b/main.pm
index 2ddcbe89..e4a5824f 100644
--- a/main.pm
+++ b/main.pm
@@ -127,7 +127,7 @@ sub load_install_tests() {
 
     ## Networking
     if (get_var('ANACONDA_STATIC')) {
-        autotest::loadtest "tests/_network_static.pm";
+        autotest::loadtest "tests/_anaconda_network_static.pm";
     }
 
     ## Installation source
@@ -172,13 +172,9 @@ sub load_install_tests() {
     autotest::loadtest "tests/_do_install_and_reboot.pm";
 }
 
-sub load_postinstall_tests() {
-    # special case for the memory check test, as it doesn't need to boot
-    # the installed system: just load its test and return
-    if (get_var("MEMCHECK")) {
-        autotest::loadtest "tests/_memcheck.pm";
-        return;
-    }
+sub _load_early_postinstall_tests() {
+    # Early post-install test loading. Split out as a separate sub
+    # because we do this all twice on update tests.
 
     # Unlock encrypted storage volumes, if necessary. The test name here
     # follows the 'storage post-install' convention, but must be run earlier.
@@ -197,7 +193,34 @@ sub load_postinstall_tests() {
     unless (get_var("DESKTOP")) {
         autotest::loadtest "tests/_console_wait_login.pm";
     }
+}
 
+sub load_postinstall_tests() {
+    # special case for the memory check test, as it doesn't need to boot
+    # the installed system: just load its test and return
+    if (get_var("MEMCHECK")) {
+        autotest::loadtest "tests/_memcheck.pm";
+        return;
+    }
+
+    # load the early tests
+    _load_early_postinstall_tests();
+
+    # do standard post-install static network config if the var is set
+    # this is here not in early_postinstall_tests as there's no need
+    # to do it twice
+    if (get_var("POST_STATIC")) {
+        autotest::loadtest "tests/_post_network_static.pm";
+    }
+
+    # if scheduler passed an advisory, update packages from that advisory
+    # (intended for the updates testing workflow, so we install the updates
+    # to be tested)
+    if (get_var("ADVISORY")) {
+        autotest::loadtest "tests/_advisory_update.pm";
+        # now load the early boot tests again, as _advisory_update reboots
+        _load_early_postinstall_tests();
+    }
     # from now on, we have fully installed and booted system with root/specified user logged in
 
     # If there is a post-install test to verify storage configuration worked
diff --git a/templates b/templates
index c8de910e..d59577fb 100755
--- a/templates
+++ b/templates
@@ -1639,6 +1639,7 @@
                         { key => "NICTYPE", value => "tap" },
                         { key => "WORKER_CLASS", value => "tap" },
                         { key => "GRUB_POSTINSTALL", value => "net.ifnames=0 biosdevname=0" },
+                        { key => "POST_STATIC", value => "10.0.2.110 support.domain.local" },
                         { key => "TEST_TARGET", value => "NONE" },
                       ],
                     },
@@ -2198,6 +2199,7 @@
                         { key => "BOOTFROM", value => "c" },
                         { key => "HDD_1", value => "disk_%FLAVOR%_%MACHINE%.qcow2" },
                         { key => "GRUB", value => "net.ifnames=0 biosdevname=0" },
+                        { key => "POST_STATIC", value => "10.0.2.100 ipa001.domain.local" },
                         { key => "NICTYPE", value => "tap" },
                         { key => "WORKER_CLASS", value => "tap" },
                       ],
@@ -2238,7 +2240,7 @@
                         { key => "ROOT_PASSWORD", value => "weakpassword" },
                         { key => "START_AFTER_TEST", value => "server_cockpit_default" },
                         { key => "BOOTFROM", value => "c" },
-                        { key => "HDD_1", value => "disk_%MACHINE%_cockpit.qcow2" },
+                        { key => "+HDD_1", value => "disk_%MACHINE%_cockpit.qcow2" },
                       ],
                     },
                     {
@@ -2250,8 +2252,9 @@
                         { key => "START_AFTER_TEST", value => "server_cockpit_default" },
                         { key => "PARALLEL_WITH", value => "server_role_deploy_domain_controller" },
                         { key => "BOOTFROM", value => "c" },
-                        { key => "HDD_1", value => "disk_%MACHINE%_cockpit.qcow2" },
+                        { key => "+HDD_1", value => "disk_%MACHINE%_cockpit.qcow2" },
                         { key => "GRUB_POSTINSTALL", value => "net.ifnames=0 biosdevname=0" },
+                        { key => "POST_STATIC", value => "10.0.2.102 client002.domain.local" },
                         { key => "NICTYPE", value => "tap" },
                         { key => "WORKER_CLASS", value => "tap" },
                       ],
@@ -2267,6 +2270,7 @@
                         { key => "BOOTFROM", value => "c" },
                         { key => "HDD_1", value => "disk_%FLAVOR%_%MACHINE%.qcow2" },
                         { key => "GRUB_POSTINSTALL", value => "net.ifnames=0 biosdevname=0" },
+                        { key => "POST_STATIC", value => "10.0.2.103 client003.domain.local" },
                         { key => "NICTYPE", value => "tap" },
                         { key => "WORKER_CLASS", value => "tap" },
                       ],
@@ -2281,6 +2285,7 @@
                         { key => "BOOTFROM", value => "c" },
                         { key => "HDD_1", value => "disk_%FLAVOR%_%MACHINE%.qcow2" },
                         { key => "GRUB_POSTINSTALL", value => "net.ifnames=0 biosdevname=0" },
+                        { key => "POST_STATIC", value => "10.0.2.104 db.domain.local" },
                         { key => "NICTYPE", value => "tap" },
                         { key => "WORKER_CLASS", value => "tap" },
                       ],
@@ -2296,6 +2301,7 @@
                         { key => "BOOTFROM", value => "c" },
                         { key => "HDD_1", value => "disk_%FLAVOR%_%MACHINE%.qcow2" },
                         { key => "GRUB_POSTINSTALL", value => "net.ifnames=0 biosdevname=0" },
+                        { key => "POST_STATIC", value => "10.0.2.105 dbclient.domain.local" },
                         { key => "NICTYPE", value => "tap" },
                         { key => "WORKER_CLASS", value => "tap" },
                       ],
diff --git a/templates-updates b/templates-updates
new file mode 100755
index 00000000..2889c1ff
--- /dev/null
+++ b/templates-updates
@@ -0,0 +1,349 @@
+#!/usr/share/openqa/script/load_templates
+#
+# Fedora Machines, Products, TestSuites and JobTemplates
+#
+# use load_templates to load the file into the database
+#
+{
+  JobTemplates => [
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-workstation",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_selinux" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_selinux" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 42,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-kde",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_selinux" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-workstation",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_services_start" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_services_start" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 42,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-kde",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_services_start" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-workstation",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_service_manipulation" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_service_manipulation" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 42,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-kde",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_service_manipulation" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-workstation",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_update_cli" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_update_cli" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 42,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-kde",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "base_update_cli" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 30,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-workstation",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "desktop_update_graphical" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 32,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-kde",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "desktop_update_graphical" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 30,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-workstation",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "desktop_terminal" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 32,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-kde",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "desktop_terminal" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 30,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-workstation",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "desktop_browser" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 32,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-kde",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "desktop_browser" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 30,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-workstation",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "desktop_notifications_postinstall" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 32,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-kde",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "desktop_notifications_postinstall" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "server_role_deploy_domain_controller" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "server_cockpit_default" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "server_cockpit_basic" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "realmd_join_cockpit" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 30,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "realmd_join_sssd" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "server_role_deploy_database_server" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "server_database_client" },
+                    },
+                    {
+                      machine    => { name => "64bit" },
+                      prio       => 40,
+                      product    => {
+                                      arch    => "x86_64",
+                                      distri  => "fedora",
+                                      flavor  => "updates-server",
+                                      version => "*",
+                                    },
+                      test_suite => { name => "server_firewall_default" },
+                    },
+                  ],
+  Products     => [
+                    {
+                      arch      => "x86_64",
+                      distri    => "fedora",
+                      flavor    => "updates-workstation",
+                      name      => "",
+                      settings  => [
+                        { key => "DESKTOP", value => "gnome" },
+                                   ],
+                      version   => "*",
+                    },
+                    {
+                      arch      => "x86_64",
+                      distri    => "fedora",
+                      flavor    => "updates-kde",
+                      name      => "",
+                      settings  => [
+                        { key => "DESKTOP", value => "kde" }
+                                   ],
+                      version   => "*",
+                    },
+                    {
+                      arch      => "x86_64",
+                      distri    => "fedora",
+                      flavor    => "updates-server",
+                      name      => "",
+                      settings  => [
+                                   ],
+                      version   => "*",
+                    },
+                  ],
+}
diff --git a/tests/_advisory_update.pm b/tests/_advisory_update.pm
new file mode 100644
index 00000000..7f3f3dce
--- /dev/null
+++ b/tests/_advisory_update.pm
@@ -0,0 +1,26 @@
+use base "installedtest";
+use strict;
+use testapi;
+use utils;
+
+sub run {
+    my $self = shift;
+    # do the 'repo setup' steps, which set up a repo containing the
+    # update packages and run 'dnf update'
+    $self->root_console(tty=>3);
+    repo_setup;
+    # reboot, in case any of the updates need a reboot to apply
+    script_run "reboot", 0;
+}
+
+sub test_flags {
+    # without anything - rollback to 'lastgood' snapshot if failed
+    # 'fatal' - whole test suite is in danger if this fails
+    # 'milestone' - after this test succeeds, update 'lastgood'
+    # 'important' - if this fails, set the overall state to 'fail'
+    return { fatal => 1 };
+}
+
+1;
+
+# vim: set sw=4 et:
diff --git a/tests/_network_static.pm b/tests/_anaconda_network_static.pm
similarity index 100%
rename from tests/_network_static.pm
rename to tests/_anaconda_network_static.pm
diff --git a/tests/_graphical_wait_login.pm b/tests/_graphical_wait_login.pm
index 1d330c0e..1184f2c1 100644
--- a/tests/_graphical_wait_login.pm
+++ b/tests/_graphical_wait_login.pm
@@ -38,34 +38,42 @@ sub run {
         send_key "ret";
 
         # Handle initial-setup, for GNOME, unless START_AFTER_TEST
-        # is set in which case it will have been done already
-        if (get_var("DESKTOP") eq 'gnome' && !get_var("START_AFTER_TEST")) {
-            assert_screen "next_button", 120;
-            # wait a bit in case of animation
-            wait_still_screen 3;
-            for my $n (1..3) {
-                # click 'Next' three times, moving the mouse to avoid
-                # highlight problems, sleeping to give it time to get
-                # to the next screen between clicks
-                mouse_set(100, 100);
-                wait_screen_change { assert_and_click "next_button"; };
-                # for Japanese, we need to workaround a bug on the keyboard
-                # selection screen
-                if ($n == 1 && get_var("LANGUAGE") eq 'japanese') {
-                    if (!check_screen 'initial_setup_kana_kanji_selected', 5) {
-                        record_soft_failure 'kana kanji not selected: bgo#776189';
-                        assert_and_click 'initial_setup_kana_kanji';
+        # is set in which case it will have been done already. Always
+        # do it if ADVISORY is set, as for the update testing flow,
+        # START_AFTER_TEST is set but a no-op and this hasn't happened
+        if (get_var("DESKTOP") eq 'gnome' && (get_var("ADVISORY") || !get_var("START_AFTER_TEST"))) {
+            # as this test gets loaded twice on the ADVISORY flow,
+            # keep track of whether this happened already
+            unless (get_var("_gis_done")) {
+                assert_screen "next_button", 120;
+                # wait a bit in case of animation
+                wait_still_screen 3;
+                for my $n (1..3) {
+                    # click 'Next' three times, moving the mouse to avoid
+                    # highlight problems, sleeping to give it time to get
+                    # to the next screen between clicks
+                    mouse_set(100, 100);
+                    wait_screen_change { assert_and_click "next_button"; };
+                    # for Japanese, we need to workaround a bug on the keyboard
+                    # selection screen
+                    if ($n == 1 && get_var("LANGUAGE") eq 'japanese') {
+                        if (!check_screen 'initial_setup_kana_kanji_selected', 5) {
+                            record_soft_failure 'kana kanji not selected: bgo#776189';
+                            assert_and_click 'initial_setup_kana_kanji';
+                        }
                     }
                 }
+                # click 'Skip' one time
+                mouse_set(100,100);
+                wait_screen_change { assert_and_click "skip_button"; };
+                send_key "ret";
+                # wait for the stupid 'help' screen to show and kill it
+                assert_screen "getting_started";
+                send_key "alt-f4";
+                wait_still_screen 5;
+                # don't do it again on second load
+                set_var("_gis_done", 1);
             }
-            # click 'Skip' one time
-            mouse_set(100,100);
-            wait_screen_change { assert_and_click "skip_button"; };
-            send_key "ret";
-            # wait for the stupid 'help' screen to show and kill it
-            assert_screen "getting_started";
-            send_key "alt-f4";
-            wait_still_screen 5;
         }
 
         # Move the mouse somewhere it won't highlight the match areas
diff --git a/tests/_post_network_static.pm b/tests/_post_network_static.pm
new file mode 100644
index 00000000..8e09b9ed
--- /dev/null
+++ b/tests/_post_network_static.pm
@@ -0,0 +1,25 @@
+use base "installedtest";
+use strict;
+use testapi;
+use tapnet;
+use utils;
+
+sub run {
+    my $self = shift;
+    my ($ip, $hostname) = split(/ /, get_var("POST_STATIC"));
+    $hostname //= 'localhost.localdomain';
+    # set up networking
+    setup_tap_static($ip, $hostname);
+}
+
+sub test_flags {
+    # without anything - rollback to 'lastgood' snapshot if failed
+    # 'fatal' - whole test suite is in danger if this fails
+    # 'milestone' - after this test succeeds, update 'lastgood'
+    # 'important' - if this fails, set the overall state to 'fail'
+    return { fatal => 1 };
+}
+
+1;
+
+# vim: set sw=4 et:
diff --git a/tests/_support_server.pm b/tests/_support_server.pm
index f1e563b9..18212da4 100644
--- a/tests/_support_server.pm
+++ b/tests/_support_server.pm
@@ -7,14 +7,6 @@ use tapnet;
 
 sub run {
     my $self=shift;
-    # clone host's /etc/hosts (for phx2 internal routing to work)
-    # must come *before* setup_tap_static or else it would overwrite
-    # its changes
-    clone_host_file("/etc/hosts");
-    # set up networking
-    setup_tap_static("10.0.2.110", "support.domain.local");
-    clone_host_file("/etc/resolv.conf");
-
     ## DNS / DHCP (dnsmasq)
     # create config
     assert_script_run "printf 'domain=domain.local\ndhcp-range=10.0.2.112,10.0.2.199\ndhcp-option=option:router,10.0.2.2' > /etc/dnsmasq.conf";
diff --git a/tests/database_client.pm b/tests/database_client.pm
index ca004633..bd9313dc 100644
--- a/tests/database_client.pm
+++ b/tests/database_client.pm
@@ -7,14 +7,6 @@ use utils;
 
 sub run {
     my $self=shift;
-    # clone host's /etc/hosts (for phx2 internal routing to work)
-    # must come *before* setup_tap_static or else it would overwrite
-    # its changes
-    clone_host_file("/etc/hosts");
-    # set up networking
-    setup_tap_static("10.0.2.105", "dbclient.domain.local");
-    # clone host's resolv.conf to get name resolution
-    clone_host_file("/etc/resolv.conf");
     # use compose repo, disable u-t, etc.
     repo_setup();
     # install postgresql
diff --git a/tests/realmd_join_cockpit.pm b/tests/realmd_join_cockpit.pm
index 26373e66..820efc81 100644
--- a/tests/realmd_join_cockpit.pm
+++ b/tests/realmd_join_cockpit.pm
@@ -7,18 +7,14 @@ use tapnet;
 
 sub run {
     my $self = shift;
-    # clone host's /etc/hosts (for phx2 internal routing to work)
-    # must come *before* setup_tap_static or else it would overwrite
-    # its changes
-    clone_host_file("/etc/hosts");
-    # set up networking
-    setup_tap_static("10.0.2.102", "client002.domain.local");
     # use FreeIPA server as DNS server
     assert_script_run "printf 'search domain.local\nnameserver 10.0.2.100' > /etc/resolv.conf";
     # wait for the server to be ready (do it now just to make sure name
     # resolution is working before we proceed)
     mutex_lock "freeipa_ready";
     mutex_unlock "freeipa_ready";
+    # do repo setup
+    repo_setup();
     # run firefox and login to cockpit
     # note: we can't use wait_screen_change, wait_still_screen or
     # check_type_string in cockpit because of that fucking constantly
diff --git a/tests/realmd_join_sssd.pm b/tests/realmd_join_sssd.pm
index d6186fd8..4229f554 100644
--- a/tests/realmd_join_sssd.pm
+++ b/tests/realmd_join_sssd.pm
@@ -7,12 +7,6 @@ use utils;
 
 sub run {
     my $self=shift;
-    # clone host's /etc/hosts (for phx2 internal routing to work)
-    # must come *before* setup_tap_static or else it would overwrite
-    # its changes
-    clone_host_file("/etc/hosts");
-    # set up networking
-    setup_tap_static("10.0.2.103", "client003.domain.local");
     # use FreeIPA server as DNS server
     assert_script_run "printf 'search domain.local\nnameserver 10.0.2.100' > /etc/resolv.conf";
     # wait for the server to be ready (do it now just to make sure name
diff --git a/tests/role_deploy_database_server.pm b/tests/role_deploy_database_server.pm
index 4a1256b0..57c68344 100644
--- a/tests/role_deploy_database_server.pm
+++ b/tests/role_deploy_database_server.pm
@@ -8,11 +8,6 @@ use utils;
 
 sub run {
     my $self=shift;
-    clone_host_file("/etc/hosts");
-    # set up networking
-    setup_tap_static("10.0.2.104", "db.domain.local");
-    # clone host's resolv.conf to get name resolution
-    clone_host_file("/etc/resolv.conf");
     # use compose repo, disable u-t, etc.
     repo_setup();
     # deploy the database server role
diff --git a/tests/role_deploy_domain_controller.pm b/tests/role_deploy_domain_controller.pm
index 6d6dc8c4..953e5ab4 100644
--- a/tests/role_deploy_domain_controller.pm
+++ b/tests/role_deploy_domain_controller.pm
@@ -10,14 +10,6 @@ sub run {
     my $self = shift;
     # login
     $self->root_console();
-    # clone host's /etc/hosts (for phx2 internal routing to work)
-    # must come *before* setup_tap_static or else it would overwrite
-    # its changes
-    clone_host_file("/etc/hosts");
-    # set up networking
-    setup_tap_static("10.0.2.100", "ipa001.domain.local");
-    # clone host's resolv.conf to get name resolution
-    clone_host_file("/etc/resolv.conf");
     # use compose repo, disable u-t, etc.
     repo_setup();
     # we need a lot of entropy for this, and we don't care how good