diff --git a/Makefile b/Makefile
index 010c6b4dc..eddef026e 100644
--- a/Makefile
+++ b/Makefile
@@ -146,10 +146,19 @@ $(RPMFILE): $(TARFILE) $(RPM_NAME).spec
 	# sanity check
 	test -e "$(RPMFILE)"
 
-# build a VM with locally built rpm installed
-$(VM_IMAGE): $(RPMFILE) bots
+# determine what to depend on and do for Fedora/RHEL/Debian VM preparation
+ifneq ($(filter debian-%,$(TEST_OS)),)
+VM_DEP=$(TARFILE) packaging/debian/rules packaging/debian/control
+VM_PACKAGE=--upload `pwd`/$(TARFILE):/var/tmp/ --upload `pwd`/packaging/debian:/var/tmp/
+else
+VM_DEP=$(RPMFILE)
+VM_PACKAGE=--install cockpit-ws --install `pwd`/$(RPMFILE)
+endif
+
+# build a VM with locally built rpm/dsc installed
+$(VM_IMAGE): $(VM_DEP) bots
 	rm -f $(VM_IMAGE) $(VM_IMAGE).qcow2
-	bots/image-customize -v -i cockpit-ws -i `pwd`/$(RPMFILE) -s $(CURDIR)/test/vm.install $(TEST_OS)
+	bots/image-customize -v $(VM_PACKAGE) -s $(CURDIR)/test/vm.install $(TEST_OS)
 
 # convenience target for the above
 vm: $(VM_IMAGE)
diff --git a/test/vm.install b/test/vm.install
index fa954a5bc..2c54d5434 100644
--- a/test/vm.install
+++ b/test/vm.install
@@ -1,8 +1,42 @@
 #!/bin/sh
 # image-customize script to enable cockpit in test VMs
-# The application RPM will be installed separately
 set -eu
 
+# for Debian based images, build and install debs; for RPM based ones, the locally built rpm gets installed separately
+if [ -d /var/tmp/debian ]; then
+    apt-get update
+    eatmydata apt-get install -y cockpit-ws cockpit-system
+
+    # HACK: starting podman.service complains about missing crun: https://bugs.debian.org/961016
+    eatmydata apt-get install -y crun
+
+    # HACK: enable Debian unstable until podman 2.0 is in testing
+    echo 'deb http://deb.debian.org/debian unstable main' > /etc/apt/sources.list.d/unstable.list
+    apt-get update
+    eatmydata apt-get install -y podman
+
+    # build source package
+    cd /var/tmp
+    TAR=$(ls cockpit-podman-*.tar.gz)
+    VERSION="${TAR#cockpit-podman-}"
+    VERSION="${VERSION%.tar.gz}"
+    ln -s $TAR cockpit-podman_${VERSION}.orig.tar.gz
+    tar xf "$TAR"
+    cd cockpit-podman
+    cp -r ../debian .
+    sed -i "s/(0-1)/(${VERSION}-1)/" debian/changelog
+    dpkg-buildpackage -S -us -uc -nc
+    cd ..
+
+    # build and install binary package
+    pbuilder build --buildresult . *.dsc
+    dpkg -i *.deb
+
+    # Debian does not enable user namespaces by default
+    echo kernel.unprivileged_userns_clone = 1 > /etc/sysctl.d/00-local-userns.conf
+    systemctl restart systemd-sysctl
+fi
+
 systemctl enable cockpit.socket podman.socket
 
 # don't force https:// (self-signed cert)