diff --git a/lib/utils.pm b/lib/utils.pm
index 547c5d60..ea12c705 100644
--- a/lib/utils.pm
+++ b/lib/utils.pm
@@ -455,6 +455,9 @@ sub setup_workaround_repo {
 }
 
 sub _repo_setup_compose {
+    # doesn't work for IoT, anything that hits this in an IoT path
+    # must work with default mirror config...
+    return if (get_var("SUBVARIANT") eq "IoT");
     # Appropriate repo setup steps for testing a compose
     # disable updates-testing and updates and use the compose location
     # as the target for fedora and rawhide rather than mirrorlist, so
diff --git a/needles/iot/zezere_claim_button-20200721.json b/needles/iot/zezere_claim_button-20200721.json
new file mode 100644
index 00000000..d563aa3c
--- /dev/null
+++ b/needles/iot/zezere_claim_button-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 204,
+      "ypos": 213,
+      "width": 35,
+      "height": 16,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_claim_button"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_claim_button-20200721.png b/needles/iot/zezere_claim_button-20200721.png
new file mode 100644
index 00000000..c0d1e1b1
Binary files /dev/null and b/needles/iot/zezere_claim_button-20200721.png differ
diff --git a/needles/iot/zezere_claim_button-alt-20200721.json b/needles/iot/zezere_claim_button-alt-20200721.json
new file mode 100644
index 00000000..34911310
--- /dev/null
+++ b/needles/iot/zezere_claim_button-alt-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "height": 16,
+      "type": "match",
+      "ypos": 213,
+      "width": 35,
+      "xpos": 205
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_claim_button"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_claim_button-alt-20200721.png b/needles/iot/zezere_claim_button-alt-20200721.png
new file mode 100644
index 00000000..67976d68
Binary files /dev/null and b/needles/iot/zezere_claim_button-alt-20200721.png differ
diff --git a/needles/iot/zezere_claim_unowned-20200721.json b/needles/iot/zezere_claim_unowned-20200721.json
new file mode 100644
index 00000000..f21cf3ef
--- /dev/null
+++ b/needles/iot/zezere_claim_unowned-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 102,
+      "ypos": 158,
+      "width": 155,
+      "height": 12,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_claim_unowned"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_claim_unowned-20200721.png b/needles/iot/zezere_claim_unowned-20200721.png
new file mode 100644
index 00000000..2cfa0db2
Binary files /dev/null and b/needles/iot/zezere_claim_unowned-20200721.png differ
diff --git a/needles/iot/zezere_device_management-20200721.json b/needles/iot/zezere_device_management-20200721.json
new file mode 100644
index 00000000..50170d46
--- /dev/null
+++ b/needles/iot/zezere_device_management-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 481,
+      "ypos": 159,
+      "width": 133,
+      "height": 12,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_device_management"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_device_management-20200721.png b/needles/iot/zezere_device_management-20200721.png
new file mode 100644
index 00000000..e84d936e
Binary files /dev/null and b/needles/iot/zezere_device_management-20200721.png differ
diff --git a/needles/iot/zezere_login-20200721.json b/needles/iot/zezere_login-20200721.json
new file mode 100644
index 00000000..aef5aaa9
--- /dev/null
+++ b/needles/iot/zezere_login-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 21,
+      "ypos": 119,
+      "width": 44,
+      "height": 12,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_login"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_login-20200721.png b/needles/iot/zezere_login-20200721.png
new file mode 100644
index 00000000..87247af7
Binary files /dev/null and b/needles/iot/zezere_login-20200721.png differ
diff --git a/needles/iot/zezere_provision_installed-20200721.json b/needles/iot/zezere_provision_installed-20200721.json
new file mode 100644
index 00000000..e46df90d
--- /dev/null
+++ b/needles/iot/zezere_provision_installed-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 14,
+      "ypos": 214,
+      "width": 89,
+      "height": 13,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_provision_installed"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_provision_installed-20200721.png b/needles/iot/zezere_provision_installed-20200721.png
new file mode 100644
index 00000000..3899bf3d
Binary files /dev/null and b/needles/iot/zezere_provision_installed-20200721.png differ
diff --git a/needles/iot/zezere_provision_menu-20200721.json b/needles/iot/zezere_provision_menu-20200721.json
new file mode 100644
index 00000000..dec57b30
--- /dev/null
+++ b/needles/iot/zezere_provision_menu-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 27,
+      "ypos": 214,
+      "width": 12,
+      "height": 13,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_provision_menu"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_provision_menu-20200721.png b/needles/iot/zezere_provision_menu-20200721.png
new file mode 100644
index 00000000..daa2f4ab
Binary files /dev/null and b/needles/iot/zezere_provision_menu-20200721.png differ
diff --git a/needles/iot/zezere_provision_schedule-20200721.json b/needles/iot/zezere_provision_schedule-20200721.json
new file mode 100644
index 00000000..ab65034d
--- /dev/null
+++ b/needles/iot/zezere_provision_schedule-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 176,
+      "ypos": 214,
+      "width": 52,
+      "height": 13,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_provision_schedule"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_provision_schedule-20200721.png b/needles/iot/zezere_provision_schedule-20200721.png
new file mode 100644
index 00000000..3899bf3d
Binary files /dev/null and b/needles/iot/zezere_provision_schedule-20200721.png differ
diff --git a/needles/iot/zezere_ssh_key-20200721.json b/needles/iot/zezere_ssh_key-20200721.json
new file mode 100644
index 00000000..76383303
--- /dev/null
+++ b/needles/iot/zezere_ssh_key-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 299,
+      "ypos": 157,
+      "width": 142,
+      "height": 15,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_ssh_key"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_ssh_key-20200721.png b/needles/iot/zezere_ssh_key-20200721.png
new file mode 100644
index 00000000..b59d7dec
Binary files /dev/null and b/needles/iot/zezere_ssh_key-20200721.png differ
diff --git a/needles/iot/zezere_ssh_key_contents-20200721.json b/needles/iot/zezere_ssh_key_contents-20200721.json
new file mode 100644
index 00000000..15507351
--- /dev/null
+++ b/needles/iot/zezere_ssh_key_contents-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 26,
+      "ypos": 292,
+      "width": 185,
+      "height": 10,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_ssh_key_contents"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_ssh_key_contents-20200721.png b/needles/iot/zezere_ssh_key_contents-20200721.png
new file mode 100644
index 00000000..48b97b71
Binary files /dev/null and b/needles/iot/zezere_ssh_key_contents-20200721.png differ
diff --git a/needles/iot/zezere_submit_provision-20200721.json b/needles/iot/zezere_submit_provision-20200721.json
new file mode 100644
index 00000000..35385ac1
--- /dev/null
+++ b/needles/iot/zezere_submit_provision-20200721.json
@@ -0,0 +1,15 @@
+{
+  "area": [
+    {
+      "xpos": 377,
+      "ypos": 238,
+      "width": 67,
+      "height": 13,
+      "type": "match"
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "zezere_submit_provision"
+  ]
+}
\ No newline at end of file
diff --git a/needles/iot/zezere_submit_provision-20200721.png b/needles/iot/zezere_submit_provision-20200721.png
new file mode 100644
index 00000000..6a414af0
Binary files /dev/null and b/needles/iot/zezere_submit_provision-20200721.png differ
diff --git a/templates.fif.json b/templates.fif.json
index e2591866..0eeb46cb 100644
--- a/templates.fif.json
+++ b/templates.fif.json
@@ -1570,7 +1570,7 @@
                 "START_AFTER_TEST": "install_default_upload"
             }
         },
-	"iot_rpmostree_rebase": {
+        "iot_rpmostree_rebase": {
                 "profiles": {
                 "fedora-IoT-dvd_ostree-iso-aarch64-*-aarch64": 20,
                 "fedora-IoT-dvd_ostree-iso-x86_64-*-64bit": 40
@@ -1584,6 +1584,46 @@
                 "USER_LOGIN": "false"
             }
         },
+        "iot_zezere_ignition": {
+                "profiles": {
+                "fedora-IoT-dvd_ostree-iso-aarch64-*-aarch64": 20,
+                "fedora-IoT-dvd_ostree-iso-x86_64-*-64bit": 40
+            },
+            "settings": {
+                "BOOTFROM": "c",
+                "GRUB_POSTINSTALL": "net.ifnames=0 biosdevname=0 zezere.url=http://172.16.2.118",
+                "HDD_1": "disk_%FLAVOR%_%MACHINE%.qcow2",
+                "NICTYPE": "tap",
+                "PARALLEL_WITH": "iot_zezere_server",
+                "POSTINSTALL": "iot_zezere_ignition",
+                "POST_STATIC": "172.16.2.119 zezere001.domain.local",
+                "ROOT_PASSWORD": "weakpassword",
+                "START_AFTER_TEST": "install_default_upload",
+                "USER_LOGIN": "false",
+                "WORKER_CLASS": "tap"
+            }
+        },
+        "iot_zezere_server": {
+            "profiles": {
+                "fedora-IoT-dvd_ostree-iso-aarch64-*-aarch64": 20,
+                "fedora-IoT-dvd_ostree-iso-x86_64-*-64bit": 40
+            },
+            "settings": {
+                "BOOTFROM": "c",
+                "GRUB_POSTINSTALL": "net.ifnames=0 biosdevname=0",
+                "HDD_1": "disk_f%CURRREL%_support_5_%ARCH%.img",
+                "NICTYPE": "tap",
+                "PARALLEL_CANCEL_WHOLE_CLUSTER": "0",
+                "POSTINSTALL": "_iot_zezere_server _setup_browser _iot_zezere_remote",
+                "POST_STATIC": "172.16.2.118 zezere002.domain.local",
+                "ROOT_PASSWORD": "weakpassword",
+                "START_AFTER_TEST": "install_default_upload",
+                "TEST_TARGET": "NONE",
+                "USER_LOGIN": "false",
+                "WORKER_CLASS": "tap"
+            }
+        },
+
         "mediakit_fileconflicts": {
             "profiles": {
                 "fedora-Server-dvd-iso-aarch64-*-aarch64": 10,
diff --git a/tests/_iot_zezere_remote.pm b/tests/_iot_zezere_remote.pm
new file mode 100644
index 00000000..9f9ab235
--- /dev/null
+++ b/tests/_iot_zezere_remote.pm
@@ -0,0 +1,58 @@
+use base "installedtest";
+use strict;
+use lockapi;
+use testapi;
+use utils;
+
+sub run {
+    my $self = shift;
+    # set up an ssh key
+    type_string "ssh-keygen\n";
+    sleep 2;
+    # confirm directory
+    send_key "ret";
+    sleep 2;
+    # empty passphrase
+    send_key "ret";
+    sleep 2;
+    # confirm empty passphrase
+    send_key "ret";
+    my $sshpub = script_output "cat /root/.ssh/id_rsa.pub";
+    # launch Firefox
+    type_string "startx /usr/bin/firefox -width 1024 -height 768 http://172.16.2.118\n";
+    # log in as admin
+    assert_screen "zezere_login";
+    type_string "admin";
+    send_key "tab";
+    type_string "weakpassword\n";
+    # add our ssh key
+    assert_and_click "zezere_ssh_key";
+    assert_and_click "zezere_ssh_key_contents";
+    type_string "$sshpub";
+    send_key "tab";
+    send_key "ret";
+    # claim the device
+    assert_and_click "zezere_claim_unowned";
+    assert_and_click "zezere_claim_button";
+    # provision it
+    assert_and_click "zezere_device_management";
+    assert_and_click "zezere_submit_provision";
+    assert_and_click "zezere_provision_menu";
+    send_key_until_needlematch("zezere_provision_installed", "down", 3, 3);
+    assert_and_click "zezere_provision_schedule";
+    # exit
+    quit_firefox;
+    # wait for the provision request to go through
+    sleep 30;
+    # ssh into iot host and create key file
+    assert_script_run 'ssh -o StrictHostKeyChecking=no root@172.16.2.119 touch /tmp/zezerekeyfile';
+}
+
+
+sub test_flags {
+    return { fatal => 1 };
+}
+
+1;
+
+# vim: set sw=4 et:
diff --git a/tests/_iot_zezere_server.pm b/tests/_iot_zezere_server.pm
new file mode 100644
index 00000000..f8e2344f
--- /dev/null
+++ b/tests/_iot_zezere_server.pm
@@ -0,0 +1,47 @@
+use base "installedtest";
+use strict;
+use testapi;
+use utils;
+
+sub run {
+    my $self = shift;
+    # deploy a zezere (Fedora IoT provisioning server) instance
+    assert_script_run "dnf --enablerepo=updates-testing -y install zezere", 180;
+    # write config file
+    assert_script_run "printf '[global]\nsecret_key = SECRET_KEY\ndebug = yes\nallowed_hosts = localhost, localhost.localdomain, 172.16.2.118\nauth_method = local\n\n[oidc.rp]\nsign_algo = RS256\n\n[database]\nengine = django.db.backends.sqlite3\nname = /var/local/zezere.sqlite3' > /etc/zezere.conf";
+    # write systemd unit file
+    assert_script_run "printf '[Unit]\nDescription=Zezere provisioning server\n\n[Service]\nExecStart=/usr/bin/zezere-manage runserver 172.16.2.118:80\n\n[Install]\nWantedBy=multi-user.target' > /etc/systemd/system/zezere.service";
+    assert_script_run "systemctl daemon-reload";
+    # open firewall port
+    assert_script_run "firewall-cmd --add-service=http";
+    # update DB schema
+    assert_script_run "zezere-manage makemigrations";
+    assert_script_run "zezere-manage migrate";
+    # load DB fixtures
+    assert_script_run "zezere-manage loaddata fedora_iot_runreqs";
+    assert_script_run "zezere-manage loaddata fedora_installed";
+    # create admin user
+    assert_script_run 'zezere-manage createsuperuser --username admin --email zezere@domain.local --no-input';
+    # set admin password (can't find a non-interactive way sadly)
+    type_string "zezere-manage changepassword admin\n";
+    sleep 2;
+    type_string "weakpassword\n";
+    sleep 2;
+    type_string "weakpassword\n";
+    sleep 2;
+    # check DB exists
+    assert_script_run "ls -l /var/local/zezere.sqlite3";
+    # start server
+    assert_script_run "systemctl start zezere.service";
+    # check it seems to be running
+    assert_script_run "curl http://172.16.2.118";
+}
+
+
+sub test_flags {
+    return { fatal => 1 };
+}
+
+1;
+
+# vim: set sw=4 et:
diff --git a/tests/iot_zezere_ignition.pm b/tests/iot_zezere_ignition.pm
new file mode 100644
index 00000000..399d3d5c
--- /dev/null
+++ b/tests/iot_zezere_ignition.pm
@@ -0,0 +1,19 @@
+use base "installedtest";
+use strict;
+use testapi;
+
+sub run {
+    my $self = shift;
+    # wait for the remote test to ssh in and create a file, that
+    # tells us we're done
+    assert_script_run "until test -f /tmp/zezerekeyfile; do sleep 1; done", 900;
+}
+
+
+sub test_flags {
+    return { fatal => 1 };
+}
+
+1;
+
+# vim: set sw=4 et: