diff --git a/plans/all.fmf b/plans/all.fmf
index 2c1c71adc93e..0e297d4c67de 100644
--- a/plans/all.fmf
+++ b/plans/all.fmf
@@ -7,6 +7,10 @@ discover:
 execute:
     how: tmt
 
+# Let's handle them upstream only, don't break Fedora/RHEL reverse dependency gating
+environment:
+    TEST_AUDIT_NO_SELINUX: 1
+
 /basic:
     summary: Run tests for basic packages
     discover+:
diff --git a/test/browser/browser.sh b/test/browser/browser.sh
index 8c53540ec323..63c4d8ead4b3 100755
--- a/test/browser/browser.sh
+++ b/test/browser/browser.sh
@@ -5,10 +5,13 @@ set -eux
 # like "basic", passed on to run-test.sh
 PLAN="$1"
 
+export TEST_BROWSER=${TEST_BROWSER:-firefox}
+
 MYDIR="$(realpath $(dirname "$0"))"
 SOURCE="$(realpath $MYDIR/../..)"
 # https://tmt.readthedocs.io/en/stable/overview.html#variables
 LOGS="${TMT_TEST_DATA:-$(pwd)/logs}"
+export SOURCE LOGS
 mkdir -p "$LOGS"
 chmod a+w "$LOGS"
 
@@ -84,7 +87,9 @@ firewall-cmd --add-service=cockpit --permanent
 firewall-cmd --add-service=cockpit
 
 # Run tests as unprivileged user
-su - -c "env TEST_BROWSER=firefox SOURCE=$SOURCE LOGS=$LOGS $MYDIR/run-test.sh $PLAN" runtest
+# once we drop support for RHEL 8, use this:
+# runuser -u runtest --whitelist-environment=TEST_BROWSER,TEST_ALLOW_JOURNAL_MESSAGES,TEST_AUDIT_NO_SELINUX,SOURCE,LOGS "$MYDIR/run-test.sh" "$PLAN"
+runuser -u runtest --preserve-environment env USER=runtest HOME="$(getent passwd runtest | cut -f6 -d:)" "$MYDIR/run-test.sh" "$PLAN"
 
 RC=$(cat $LOGS/exitcode)
 exit ${RC:-1}
diff --git a/test/browser/run-test.sh b/test/browser/run-test.sh
index 58f405b48331..50872251d430 100755
--- a/test/browser/run-test.sh
+++ b/test/browser/run-test.sh
@@ -62,6 +62,11 @@ export TEST_ALLOW_JOURNAL_MESSAGES
 TESTS=""
 EXCLUDES=""
 RC=0
+
+# make it easy to check in logs
+echo "TEST_ALLOW_JOURNAL_MESSAGES: ${TEST_ALLOW_JOURNAL_MESSAGES:-}"
+echo "TEST_AUDIT_NO_SELINUX: ${TEST_AUDIT_NO_SELINUX:-}"
+
 if [ "$PLAN" = "optional" ]; then
     TESTS="$TESTS
            TestAutoUpdates