diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/plans/all.fmf b/plans/all.fmf
new file mode 100644
index 0000000..40356c6
--- /dev/null
+++ b/plans/all.fmf
@@ -0,0 +1,19 @@
+discover:
+    how: fmf
+execute:
+    how: tmt
+
+/system:
+    summary: Run tests on system podman
+    discover+:
+        test: /test/browser/system
+
+/user:
+    summary: Run tests on user podman
+    discover+:
+        test: /test/browser/user
+
+/misc:
+    summary: Run other tests
+    discover+:
+        test: /test/browser/other
diff --git a/test/browser/browser.sh b/test/browser/browser.sh
new file mode 100644
index 0000000..052a5ae
--- /dev/null
+++ b/test/browser/browser.sh
@@ -0,0 +1,75 @@
+#!/bin/sh
+set -eux
+
+TESTS="$(realpath $(dirname "$0"))"
+SOURCE="$(realpath $TESTS/../..)"
+LOGS="$(pwd)/logs"
+mkdir -p "$LOGS"
+chmod a+w "$LOGS"
+
+# HACK: https://bugzilla.redhat.com/show_bug.cgi?id=2033020
+dnf update -y pam || true
+
+# install firefox (available everywhere in Fedora and RHEL)
+# we don't need the H.264 codec, and it is sometimes not available (rhbz#2005760)
+dnf install --disablerepo=fedora-cisco-openh264 -y --setopt=install_weak_deps=False firefox
+
+# nodejs 10 is too old for current Cockpit test API
+if grep -q platform:el8 /etc/os-release; then
+    dnf module switch-to -y nodejs:16
+fi
+
+# create user account for logging in
+if ! id admin 2>/dev/null; then
+    useradd -c Administrator -G wheel admin
+    echo admin:foobar | chpasswd
+fi
+
+# set root's password
+echo root:foobar | chpasswd
+
+# avoid sudo lecture during tests
+su -c 'echo foobar | sudo --stdin whoami' - admin
+
+# create user account for running the test
+if ! id runtest 2>/dev/null; then
+    useradd -c 'Test runner' runtest
+    # allow test to set up things on the machine
+    mkdir -p /root/.ssh
+    curl https://raw.githubusercontent.com/cockpit-project/bots/main/machine/identity.pub  >> /root/.ssh/authorized_keys
+    chmod 600 /root/.ssh/authorized_keys
+fi
+chown -R runtest "$SOURCE"
+
+# disable core dumps, we rather investigate them upstream where test VMs are accessible
+echo core > /proc/sys/kernel/core_pattern
+
+## CSR specific setup ##
+# install cockpit-packagekit and glibc-langpack-en for testAppMenu
+dnf install -y cockpit-packagekit glibc-langpack-en
+
+mkdir -p /var/log/journal/
+cp 1.journal /var/log/journal/1.journal
+cp binary-rec.journal /var/log/journal/binary-rec.journal
+
+# Add proxy provider domain for sssd for testSessionRecordingConf test
+cat > /etc/sssd/sssd.conf <<EOF
+[sssd]
+services=nss, pam
+domains=nssfiles
+
+[domain/nssfiles]
+id_provider=proxy
+proxy_lib_name=files
+proxy_pam_target=sssd-shadowutils
+EOF
+chmod 600 /etc/sssd/sssd.conf
+systemctl start sssd
+
+systemctl enable --now cockpit.socket
+
+# Run tests as unprivileged user
+su - -c "env TEST_BROWSER=firefox SOURCE=$SOURCE LOGS=$LOGS $TESTS/run-test.sh" runtest
+
+RC=$(cat $LOGS/exitcode)
+exit ${RC:-1}
diff --git a/test/browser/main.fmf b/test/browser/main.fmf
new file mode 100644
index 0000000..17aeecc
--- /dev/null
+++ b/test/browser/main.fmf
@@ -0,0 +1,25 @@
+require:
+  - cockpit-session-recording
+  - tlog
+  - cockpit-ws
+  - cockpit-system
+  - cockpit-packagekit
+  - bzip2
+  - git-core
+  - libvirt-python3
+  - make
+  - nodejs
+  - python3
+duration: 30m
+
+/system:
+    test: ./browser.sh system
+    summary: Run *System tests
+
+/user:
+    test: ./browser.sh user
+    summary: Run *User tests
+
+/other:
+    test: ./browser.sh other
+    summary: Run all other tests
diff --git a/test/browser/run-test.sh b/test/browser/run-test.sh
new file mode 100644
index 0000000..7fec784
--- /dev/null
+++ b/test/browser/run-test.sh
@@ -0,0 +1,45 @@
+#!/bin/sh
+set -eux
+
+PLAN="$1"
+
+# tests need cockpit's bots/ libraries and test infrastructure
+cd $SOURCE
+rm -f bots  # common local case: existing bots symlink
+make bots test/common
+
+if [ -e .git ]; then
+    tools/node-modules checkout
+    # disable detection of affected tests; testing takes too long as there is no parallelization
+    mv .git dot-git
+else
+    # upstream tarballs ship test dependencies; print version for debugging
+    grep '"version"' node_modules/chrome-remote-interface/package.json
+fi
+
+. /etc/os-release
+export TEST_OS="${ID}-${VERSION_ID/./-}"
+export TEST_AUDIT_NO_SELINUX=1
+
+if [ "${TEST_OS#centos-}" != "$TEST_OS" ]; then
+    TEST_OS="${TEST_OS}-stream"
+fi
+
+# select subset of tests according to plan
+TESTS="$(test/common/run-tests -l)"
+case "$PLAN" in
+    system) TESTS="$(echo "$TESTS" | grep 'System$')" ;;
+    user) TESTS="$(echo "$TESTS" | grep 'User$')" ;;
+    other) TESTS="$(echo "$TESTS" | grep -vE '(System|User)$')" ;;
+    *) echo "Unknown test plan: $PLAN" >&2; exit 1 ;;
+esac
+
+EXCLUDES=""
+
+RC=0
+test/common/run-tests --nondestructive --machine 127.0.0.1:22 --browser 127.0.0.1:9090 $TESTS $EXCLUDES || RC=$?
+
+echo $RC > "$LOGS/exitcode"
+cp --verbose Test* "$LOGS" || true
+# deliver test result via exitcode file
+exit 0