diff --git a/scripts/runtests-postinstall.sh b/scripts/runtests-postinstall.sh
index bdc7010d..ce4a3c3f 100755
--- a/scripts/runtests-postinstall.sh
+++ b/scripts/runtests-postinstall.sh
@@ -8,15 +8,14 @@ set -e
 # FIXME may depend on images
 REFSHA="ff2a3238eae5abdb0effb092fadbcec2487119e4"
 
-. $(dirname $0)/lib.sh
-
 for conf in "${TESTCONFS[@]}"; do
-    IFS=- read fw version media sr < <(echo "$conf")
-    host1="install.test::Nested::boot_inst[$fw-$version-83nightly-host1-$media-$sr]-vm1-$REFSHA"
-    host2="install.test::Nested::boot_inst[$fw-$version-83nightly-host2-$media-$sr]-vm1-$REFSHA"
+    IFS=- read fw sr < <(echo "$conf")
+    host1="install.test::Nested::boot_inst[$fw-83nightly-host1-iso-$sr]-vm1-$REFSHA"
+    host2="install.test::Nested::boot_inst[$fw-83nightly-host2-iso-$sr]-vm1-$REFSHA"
 
+    # FIXME?  --host-version=8.3.0
     run_pytest \
-        --runner "./jobs.py run postinstall 'cache://${host1},cache://${host2}'" \
+        --runner "./jobs.py run postinstall cache://${host1},cache://${host2}" \
         --log-file=test-postinstall-$conf.log \
         "$@"
 done
diff --git a/scripts/runtests-postupgrade.sh b/scripts/runtests-postupgrade.sh
index b21b5201..c35e11c7 100755
--- a/scripts/runtests-postupgrade.sh
+++ b/scripts/runtests-postupgrade.sh
@@ -12,14 +12,31 @@ REFSHA="ff2a3238eae5abdb0effb092fadbcec2487119e4"
 
 for conf in "${REFCONFS[@]}"; do
     IFS=- read fw version media sr < <(echo "$conf")
+    [ upgrade_should_work "$version" ] || continue
     host1="install.test::Nested::boot_upg[$fw-$version-83nightly-host1-$media-$sr]-vm1-$REFSHA"
     host2="install.test::Nested::boot_upg[$fw-$version-83nightly-host2-$media-$sr]-vm1-$REFSHA"
 
     run_pytest \
         --runner "./jobs.py run postinstall 'cache://${host1},cache://${host2}'" \
-        --log-file=test-postinstall-$conf.log \
-        "$@" \
-        ;
+        --log-file=test-postupgrade-$conf.log \
+        "$@"
+
+    # FIXME postinstall-intrapool-migrate needs a 2-host pool
+
+    case "$version" in
+        83*) continue;; # TLS already tested
+        *)              # go on and test with TLS
+
+            run_pytest \
+                --runner "./jobs.py run postinstall-with-tls 'cache://${host1},cache://${host2}'" \
+                --log-file=test-postupgrade-tls-$conf.log \
+                "$@"
+
+            # FIXME: needs to cache TLS-enabled machines
+
+            # FIXME postinstall-intrapool-migrate (with TLS) needs a 2-host pool
+            ;;
+    esac
 done
 
 report_failures