diff --git a/mantle/cmd/kola/options.go b/mantle/cmd/kola/options.go
index 2d9aaf0742..7895c035da 100644
--- a/mantle/cmd/kola/options.go
+++ b/mantle/cmd/kola/options.go
@@ -157,6 +157,7 @@ func init() {
 	bv(&kola.QEMUOptions.Native4k, "qemu-native-4k", false, "Force 4k sectors for main disk")
 	bv(&kola.QEMUOptions.Nvme, "qemu-nvme", false, "Use NVMe for main disk")
 	bv(&kola.QEMUOptions.Swtpm, "qemu-swtpm", true, "Create temporary software TPM")
+	ssv(&kola.QEMUOptions.BindRO, "qemu-bind-ro", nil, "Inject a host directory; this does not automatically mount in the guest")
 
 	sv(&kola.QEMUIsoOptions.IsoPath, "qemu-iso", "", "path to CoreOS ISO image")
 	bv(&kola.QEMUIsoOptions.AsDisk, "qemu-iso-as-disk", false, "attach ISO image as regular disk")
diff --git a/mantle/platform/machine/qemu/cluster.go b/mantle/platform/machine/qemu/cluster.go
index 874b5387e0..8f23ba54b3 100644
--- a/mantle/platform/machine/qemu/cluster.go
+++ b/mantle/platform/machine/qemu/cluster.go
@@ -19,6 +19,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 
 	"sync"
 	"time"
@@ -120,6 +121,13 @@ func (qc *Cluster) NewMachineWithQemuOptions(userdata *conf.UserData, options pl
 	builder.Hostname = fmt.Sprintf("qemu%d", qc.BaseCluster.AllocateMachineSerial())
 	builder.ConsoleFile = qm.consolePath
 
+	// This one doesn't support configuring the path because we can't
+	// reliably change the Ignition config here...
+	for _, path := range qc.flight.opts.BindRO {
+		destpathrel := strings.TrimLeft(path, "/")
+		builder.Mount9p(path, "/kola/host/"+destpathrel, true)
+	}
+
 	if qc.flight.opts.Memory != "" {
 		memory, err := strconv.ParseInt(qc.flight.opts.Memory, 10, 32)
 		if err != nil {
diff --git a/mantle/platform/machine/qemu/flight.go b/mantle/platform/machine/qemu/flight.go
index 188fd599e9..8abc4db8e6 100644
--- a/mantle/platform/machine/qemu/flight.go
+++ b/mantle/platform/machine/qemu/flight.go
@@ -46,6 +46,9 @@ type Options struct {
 	//Option to create a temporary software TPM - true by default
 	Swtpm bool
 
+	// Array of $hostpath
+	BindRO []string
+
 	//IBM Secure Execution
 	SecureExecution               bool
 	SecureExecutionIgnitionPubKey string