diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/plans/all.fmf b/plans/all.fmf
new file mode 100644
index 0000000..2bce34a
--- /dev/null
+++ b/plans/all.fmf
@@ -0,0 +1,6 @@
+summary:
+    Run all tests
+discover:
+    how: fmf
+execute:
+    how: tmt
diff --git a/test/browser/browser.sh b/test/browser/browser.sh
new file mode 100755
index 0000000..7457dc9
--- /dev/null
+++ b/test/browser/browser.sh
@@ -0,0 +1,56 @@
+#!/bin/sh
+set -eux
+
+TESTS="$(realpath $(dirname "$0"))"
+if [ -d source ]; then
+    # path for standard-test-source
+    SOURCE="$(pwd)/source"
+else
+    SOURCE="$(realpath $TESTS/../..)"
+fi
+LOGS="$(pwd)/logs"
+mkdir -p "$LOGS"
+chmod a+w "$LOGS"
+
+# install browser; on RHEL, use chromium from epel
+# HACK: chromium-headless ought to be enough, but version 88 has a crash: https://bugs.chromium.org/p/chromium/issues/detail?id=1170634
+if ! rpm -q chromium; then
+    if grep -q 'ID=.*rhel' /etc/os-release; then
+        dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
+        dnf config-manager --enable epel
+    fi
+    dnf install -y chromium
+fi
+
+# create user account for logging in
+if ! id admin 2>/dev/null; then
+    useradd -c Administrator -G wheel admin
+    echo admin:foobar | chpasswd
+fi
+
+# set root's password
+echo root:foobar | chpasswd
+
+# avoid sudo lecture during tests
+su -c 'echo foobar | sudo --stdin whoami' - admin
+
+# create user account for running the test
+if ! id runtest 2>/dev/null; then
+    useradd -c 'Test runner' runtest
+    # allow test to set up things on the machine
+    mkdir -p /root/.ssh
+    curl https://raw.githubusercontent.com/cockpit-project/bots/master/machine/identity.pub  >> /root/.ssh/authorized_keys
+    chmod 600 /root/.ssh/authorized_keys
+fi
+chown -R runtest "$SOURCE"
+
+# disable core dumps, we rather investigate them upstream where test VMs are accessible
+echo core > /proc/sys/kernel/core_pattern
+
+systemctl enable --now cockpit.socket
+
+# Run tests as unprivileged user
+su - -c "env SOURCE=$SOURCE LOGS=$LOGS $TESTS/run-test.sh" runtest
+
+RC=$(cat $LOGS/exitcode)
+exit ${RC:-1}
diff --git a/test/browser/main.fmf b/test/browser/main.fmf
new file mode 100644
index 0000000..ea9acb6
--- /dev/null
+++ b/test/browser/main.fmf
@@ -0,0 +1,13 @@
+summary:
+    Run browser integration tests on the host
+require:
+  - cockpit-starter-kit
+  - cockpit-ws
+  - cockpit-system
+  - git
+  - libvirt-python3
+  - make
+  - npm
+  - python3
+test: ./browser.sh
+duration: 60m
diff --git a/test/browser/run-test.sh b/test/browser/run-test.sh
new file mode 100755
index 0000000..a3c7585
--- /dev/null
+++ b/test/browser/run-test.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+set -eux
+
+# tests need cockpit's bots/ libraries and test infrastructure
+cd $SOURCE
+git init
+make bots test/common
+
+# only install a subset to save time/space
+rm -f package-lock.json  # otherwise the command below installs *everything*, argh
+npm install chrome-remote-interface sizzle
+
+. /etc/os-release
+export TEST_OS="${ID}-${VERSION_ID/./-}"
+export TEST_AUDIT_NO_SELINUX=1
+
+EXCLUDES=""
+
+RC=0
+test/common/run-tests --nondestructive --machine 127.0.0.1:22 --browser 127.0.0.1:9090 $EXCLUDES || RC=$?
+
+echo $RC > "$LOGS/exitcode"
+cp --verbose Test* "$LOGS" || true
+# deliver test result via exitcode file
+exit 0