diff --git a/ci/prow-entrypoint.sh b/ci/prow-entrypoint.sh
index a075ef619..6726272a8 100755
--- a/ci/prow-entrypoint.sh
+++ b/ci/prow-entrypoint.sh
@@ -59,6 +59,7 @@ setup_variant() {
     ln -snf "manifest-${variant}.yaml" "src/config/manifest.yaml"
     ln -snf "extensions-${variant}.yaml" "src/config/extensions.yaml"
     ln -snf "image-${variant}.yaml" "src/config/image.yaml"
+    ln -snf "kola-denylist-${variant}.yaml" "src/config/kola-denylist.yaml"
 }
 
 # Do a cosa build & cosa build-extensions only.
@@ -148,10 +149,6 @@ kola_test_metal() {
 }
 
 # Temporary to get EL9 in CI
-kola_test_qemu_light() {
-    cosa buildextend-qemu
-    cosa kola --basic-qemu-scenarios
-}
 kola_test_metal_light() {
     cosa buildextend-metal
     cosa buildextend-metal4k
@@ -276,9 +273,7 @@ main () {
             # Temporary. Will be removed once variant support is in COSA
             setup_variant "c9s"
             cosa_build
-            # Temporary light tests only until all tests pass
-            kola_test_qemu_light
-            # kola_test_qemu
+            kola_test_qemu
             ;;
         "scos-9-build-test-metal" )
             setup_user
@@ -286,15 +281,15 @@ main () {
             # Temporary. Will be removed once variant support is in COSA
             setup_variant "c9s"
             cosa_build
-            # Temporary light tests only until all tests pass
+            # Temporary to get SCOS in CI
             kola_test_metal_light
-            # kola_test_metal
-            ;;
-        "explicitely-disabled-test")
-            echo "Disabled tests"
-            exit 0
             ;;
         *)
+            # This case ensures that we exhaustively list the tests that should
+            # pass for a PR. To add a new test in openshift/os:
+            # 1. Add a new test case here that does nothing and get it merged
+            # 2. Add a new test job in openshift/release that calls this test
+            # 3. Update your test here and debug it with the CI in the PR
             echo "Unknown test name"
             exit 1
             ;;
diff --git a/common-el9.yaml b/common-el9.yaml
index 90b0c3b1d..b78aea665 100644
--- a/common-el9.yaml
+++ b/common-el9.yaml
@@ -6,9 +6,6 @@ postprocess:
      #!/usr/bin/env bash
      set -xeo pipefail
 
-     # FIXME: Force enable dbus-broker to get the dbus.service → dbus-broker.service
-     systemctl enable dbus-broker
-
      # FIXME: Why is this only broken here?  NM isn't removing the link?
      sed -i '/etc.resolv/d' /usr/lib/tmpfiles.d/etc.conf
 
@@ -27,6 +24,13 @@ postprocess:
      runtime_path="/usr/bin/crun"
      EOF
 
+     # Enable tmp-on-tmpfs by default because we don't want to have things leak
+     # across reboots, it increases alignment with FCOS, and also fixes the
+     # Live ISO. First, verify that RHEL is still disabling.
+     grep -q '# RHEL-only: Disable /tmp on tmpfs' /usr/lib/systemd/system/basic.target
+     echo '# RHCOS-only: we follow the Fedora/upstream default' >> /usr/lib/systemd/system/basic.target
+     echo 'Wants=tmp.mount' >> /usr/lib/systemd/system/basic.target
+
 # Packages that are only for SCOS & RHCOS 9
 packages:
  - openvswitch2.17
diff --git a/kola-denylist-c9s.yaml b/kola-denylist-c9s.yaml
new file mode 100644
index 000000000..09bb7bdd4
--- /dev/null
+++ b/kola-denylist-c9s.yaml
@@ -0,0 +1,52 @@
+# This file documents currently known-to-fail kola tests. It is consumed by
+# coreos-assembler to automatically skip some tests. For more information,
+# see: https://github.com/coreos/coreos-assembler/pull/866.
+- pattern: fips.enable*
+  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1782026
+  arches:
+   - s390x
+- pattern: coreos.ignition.journald-log
+  tracker: https://github.com/coreos/coreos-assembler/issues/1173
+- pattern: coreos.ignition.mount.*
+  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1899990
+  arches:
+  - s390x
+- pattern: ext.config.shared.ignition.stable-boot
+  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=2075085
+  arches:
+  - s390x
+- pattern: ext.config.shared.kdump.crash
+  tracker: https://github.com/coreos/coreos-assembler/issues/2725
+  arches:
+  - ppc64le
+- pattern: coreos.boot-mirror.luks
+  tracker: https://github.com/coreos/coreos-assembler/issues/2725
+  arches:
+  - ppc64le
+- pattern: coreos.boot-mirror
+  tracker: https://github.com/coreos/coreos-assembler/issues/2725
+  arches:
+  - ppc64le
+- pattern: ext.config.shared.files.file-directory-permissions
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1243
+  arches:
+  - s390x
+- pattern: ext.config.shared.kdump.crash
+  tracker: https://github.com/coreos/fedora-coreos-config/issues/1500
+  arches:
+    - s390x
+
+# Broken tests under investigation
+- pattern: coreos.boot-mirror
+- pattern: ext.config.shared.chrony.dhcp-propagation
+- pattern: ext.config.shared.files.dracut-executable
+  tracker: https://github.com/openshift/os/issues/942
+- pattern: ext.config.shared.networking.default-network-behavior-change
+- pattern: ext.config.shared.networking.force-persist-ip
+- pattern: ext.config.shared.networking.mtu-on-bond-kargs
+- pattern: ext.config.shared.networking.prefer-ignition-networking
+- pattern: ext.config.shared.podman.dns
+- pattern: ext.config.version.rhel-major-version
+- pattern: ext.config.version.rhel-matches-rhcos-build
+- pattern: rhcos.network.bond-with-dhcp
+- pattern: rhcos.network.bond-with-restart
diff --git a/kola-denylist-rhel-8.6.yaml b/kola-denylist-rhel-8.6.yaml
new file mode 100644
index 000000000..e91c6ab25
--- /dev/null
+++ b/kola-denylist-rhel-8.6.yaml
@@ -0,0 +1,37 @@
+# This file documents currently known-to-fail kola tests. It is consumed by
+# coreos-assembler to automatically skip some tests. For more information,
+# see: https://github.com/coreos/coreos-assembler/pull/866.
+- pattern: fips.enable*
+  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1782026
+  arches:
+   - s390x
+- pattern: coreos.ignition.journald-log
+  tracker: https://github.com/coreos/coreos-assembler/issues/1173
+- pattern: coreos.ignition.mount.*
+  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1899990
+  arches:
+  - s390x
+- pattern: ext.config.shared.ignition.stable-boot
+  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=2075085
+  arches:
+  - s390x
+- pattern: ext.config.shared.kdump.crash
+  tracker: https://github.com/coreos/coreos-assembler/issues/2725
+  arches:
+  - ppc64le
+- pattern: coreos.boot-mirror.luks
+  tracker: https://github.com/coreos/coreos-assembler/issues/2725
+  arches:
+  - ppc64le
+- pattern: coreos.boot-mirror
+  tracker: https://github.com/coreos/coreos-assembler/issues/2725
+  arches:
+  - ppc64le
+- pattern: ext.config.shared.files.file-directory-permissions
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1243
+  arches:
+  - s390x
+- pattern: ext.config.shared.kdump.crash
+  tracker: https://github.com/coreos/fedora-coreos-config/issues/1500
+  arches:
+    - s390x
diff --git a/kola-denylist-rhel-9.0.yaml b/kola-denylist-rhel-9.0.yaml
new file mode 100644
index 000000000..e91c6ab25
--- /dev/null
+++ b/kola-denylist-rhel-9.0.yaml
@@ -0,0 +1,37 @@
+# This file documents currently known-to-fail kola tests. It is consumed by
+# coreos-assembler to automatically skip some tests. For more information,
+# see: https://github.com/coreos/coreos-assembler/pull/866.
+- pattern: fips.enable*
+  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1782026
+  arches:
+   - s390x
+- pattern: coreos.ignition.journald-log
+  tracker: https://github.com/coreos/coreos-assembler/issues/1173
+- pattern: coreos.ignition.mount.*
+  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1899990
+  arches:
+  - s390x
+- pattern: ext.config.shared.ignition.stable-boot
+  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=2075085
+  arches:
+  - s390x
+- pattern: ext.config.shared.kdump.crash
+  tracker: https://github.com/coreos/coreos-assembler/issues/2725
+  arches:
+  - ppc64le
+- pattern: coreos.boot-mirror.luks
+  tracker: https://github.com/coreos/coreos-assembler/issues/2725
+  arches:
+  - ppc64le
+- pattern: coreos.boot-mirror
+  tracker: https://github.com/coreos/coreos-assembler/issues/2725
+  arches:
+  - ppc64le
+- pattern: ext.config.shared.files.file-directory-permissions
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1243
+  arches:
+  - s390x
+- pattern: ext.config.shared.kdump.crash
+  tracker: https://github.com/coreos/fedora-coreos-config/issues/1500
+  arches:
+    - s390x
diff --git a/kola-denylist.yaml b/kola-denylist.yaml
deleted file mode 100644
index e91c6ab25..000000000
--- a/kola-denylist.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# This file documents currently known-to-fail kola tests. It is consumed by
-# coreos-assembler to automatically skip some tests. For more information,
-# see: https://github.com/coreos/coreos-assembler/pull/866.
-- pattern: fips.enable*
-  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1782026
-  arches:
-   - s390x
-- pattern: coreos.ignition.journald-log
-  tracker: https://github.com/coreos/coreos-assembler/issues/1173
-- pattern: coreos.ignition.mount.*
-  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1899990
-  arches:
-  - s390x
-- pattern: ext.config.shared.ignition.stable-boot
-  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=2075085
-  arches:
-  - s390x
-- pattern: ext.config.shared.kdump.crash
-  tracker: https://github.com/coreos/coreos-assembler/issues/2725
-  arches:
-  - ppc64le
-- pattern: coreos.boot-mirror.luks
-  tracker: https://github.com/coreos/coreos-assembler/issues/2725
-  arches:
-  - ppc64le
-- pattern: coreos.boot-mirror
-  tracker: https://github.com/coreos/coreos-assembler/issues/2725
-  arches:
-  - ppc64le
-- pattern: ext.config.shared.files.file-directory-permissions
-  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1243
-  arches:
-  - s390x
-- pattern: ext.config.shared.kdump.crash
-  tracker: https://github.com/coreos/fedora-coreos-config/issues/1500
-  arches:
-    - s390x
diff --git a/kola-denylist.yaml b/kola-denylist.yaml
new file mode 120000
index 000000000..65df9810c
--- /dev/null
+++ b/kola-denylist.yaml
@@ -0,0 +1 @@
+kola-denylist-rhel-8.6.yaml
\ No newline at end of file
diff --git a/manifest-c9s.yaml b/manifest-c9s.yaml
index 778ce5cad..082080b39 100644
--- a/manifest-c9s.yaml
+++ b/manifest-c9s.yaml
@@ -17,6 +17,10 @@ include:
 
 # Starting from here, everything should be specific to SCOS
 
+# SCOS specific overlays
+ostree-layers:
+  - overlay/07c9s
+
 # CentOS Stream 9 repos + internal repos for now
 repos:
   - baseos
diff --git a/overlay.d/07c9s/usr/lib/systemd/system-preset/36-scos-disabled.preset b/overlay.d/07c9s/usr/lib/systemd/system-preset/36-scos-disabled.preset
new file mode 100644
index 000000000..ccdaa8db3
--- /dev/null
+++ b/overlay.d/07c9s/usr/lib/systemd/system-preset/36-scos-disabled.preset
@@ -0,0 +1 @@
+disable iscsid.socket
diff --git a/tests/kola/toolbox b/tests/kola/toolbox
new file mode 120000
index 000000000..cdf36e17d
--- /dev/null
+++ b/tests/kola/toolbox
@@ -0,0 +1 @@
+../../fedora-coreos-config/tests/kola/toolbox
\ No newline at end of file
diff --git a/tests/kola/version/toolbox b/tests/kola/version/toolbox
deleted file mode 100755
index 2f068dce4..000000000
--- a/tests/kola/version/toolbox
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-
-# This is RHCOS only, we ship a different version of toolbox in FCOS
-
-# kola: { "exclusive": false }
-set -xeuo pipefail
-
-fatal() {
-    echo "$@" >&2
-    exit 1
-}
-
-# make it a var so we can change when/if we switch to containers/toolbox
-url="https://github.com/coreos/toolbox"
-
-if [ "$(rpm -q --qf '%{URL}' toolbox)" != "${url}" ]; then
-    fatal "Error: toolbox is not a shell script as expected"
-fi