diff --git a/test/units/TEST-50-DISSECT.sh b/test/units/TEST-50-DISSECT.sh
index 14ff8ad250..99e4991402 100755
--- a/test/units/TEST-50-DISSECT.sh
+++ b/test/units/TEST-50-DISSECT.sh
@@ -37,13 +37,7 @@ trap at_exit EXIT
 # For unprivileged tests
 loginctl enable-linger testuser
 
-# Requires kernel built with certain kconfigs, as listed in README:
-# https://oracle.github.io/kconfigs/?config=UTS_RELEASE&config=DM_VERITY_VERIFY_ROOTHASH_SIG&config=DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING&config=DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING&config=IMA_ARCH_POLICY&config=INTEGRITY_MACHINE_KEYRING
-if grep -q "$(openssl x509 -noout -subject -in /usr/share/mkosi.crt | sed 's/^.*CN=//')" /proc/keys && \
-        ( . /etc/os-release; [ "$ID" != "centos" ] || systemd-analyze compare-versions "$VERSION_ID" ge 10 ) && \
-        ( . /etc/os-release; [ "$ID" != "debian" ] || [ -z "${VERSION_ID:-}" ] || systemd-analyze compare-versions "$VERSION_ID" ge 13 ) && \
-        ( . /etc/os-release; [ "$ID" != "ubuntu" ] || systemd-analyze compare-versions "$VERSION_ID" ge 24.04 ) && \
-        systemd-analyze compare-versions "$(cryptsetup --version | sed 's/^cryptsetup \([0-9]*\.[0-9]*\.[0-9]*\) .*/\1/')" ge 2.3.0; then
+if machine_supports_verity_keyring; then
     export VERITY_SIG_SUPPORTED=1
 else
     export VERITY_SIG_SUPPORTED=0
diff --git a/test/units/TEST-70-TPM2.nvpcr.sh b/test/units/TEST-70-TPM2.nvpcr.sh
index ba5d6c9b7f..c5a6d1c213 100755
--- a/test/units/TEST-70-TPM2.nvpcr.sh
+++ b/test/units/TEST-70-TPM2.nvpcr.sh
@@ -54,11 +54,20 @@ DIGEST_MEASURED2="$(echo -n "schnurz" | openssl dgst -sha256 -hex -r | cut -d' '
 DIGEST_EXPECTED2="$(echo "$DIGEST_EXPECTED$DIGEST_MEASURED2" | tr '[:lower:]' '[:upper:]' | basenc --base16 -d | openssl dgst -sha256 -hex -r | cut -d' ' -f1)"
 test "$DIGEST_ACTUAL2" = "$DIGEST_EXPECTED2"
 
-mkdir /tmp/nvpcr
+mkdir -p /tmp/nvpcr/tree
+touch /tmp/nvpcr/tree/file
 
-OPENSSL_CONFIG="/tmp/nvpcr/opensslconfig"
-# Unfortunately OpenSSL insists on reading some config file, hence provide one with mostly placeholder contents
-cat >"${OPENSSL_CONFIG:?}" <<EOF
+if machine_supports_verity_keyring; then
+    SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs \
+        systemd-repart -P \
+                    -s /tmp/nvpcr/tree \
+                    --certificate=/usr/share/mkosi.crt \
+                    --private-key=/usr/share/mkosi.key \
+                    /var/tmp/nvpcr.raw
+else
+    OPENSSL_CONFIG="/tmp/nvpcr/opensslconfig"
+    # Unfortunately OpenSSL insists on reading some config file, hence provide one with mostly placeholder contents
+    cat >"${OPENSSL_CONFIG:?}" <<EOF
 [ req ]
 prompt = no
 distinguished_name = req_distinguished_name
@@ -73,22 +82,20 @@ CN = Common Name
 emailAddress = test@email.com
 EOF
 
-openssl req -config "$OPENSSL_CONFIG" -subj="/CN=waldo" \
-            -x509 -sha256 -nodes -days 365 -newkey rsa:4096 \
-            -keyout /tmp/nvpcr/test-70-nvpcr.key -out /tmp/nvpcr/test-70-nvpcr.crt
+    openssl req -config "$OPENSSL_CONFIG" -subj="/CN=waldo" \
+                -x509 -sha256 -nodes -days 365 -newkey rsa:4096 \
+                -keyout /tmp/nvpcr/test-70-nvpcr.key -out /tmp/nvpcr/test-70-nvpcr.crt
 
-mkdir /tmp/nvpcr/tree
-touch /tmp/nvpcr/tree/file
+    SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs \
+        systemd-repart -P \
+                    -s /tmp/nvpcr/tree \
+                    --certificate=/tmp/nvpcr/test-70-nvpcr.crt \
+                    --private-key=/tmp/nvpcr/test-70-nvpcr.key \
+                    /var/tmp/nvpcr.raw
 
-SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs \
-    systemd-repart -P \
-                   -s /tmp/nvpcr/tree \
-                   --certificate=/tmp/nvpcr/test-70-nvpcr.crt \
-                   --private-key=/tmp/nvpcr/test-70-nvpcr.key \
-                   /var/tmp/nvpcr.raw
-
-mkdir -p /run/verity.d
-cp /tmp/nvpcr/test-70-nvpcr.crt /run/verity.d/
+    mkdir -p /run/verity.d
+    cp /tmp/nvpcr/test-70-nvpcr.crt /run/verity.d/
+fi
 
 cp /run/log/systemd/tpm2-measure.log /tmp/nvpcr/log-before
 
diff --git a/test/units/TEST-86-MULTI-PROFILE-UKI.sh b/test/units/TEST-86-MULTI-PROFILE-UKI.sh
index 1af0788d5e..5518cb6561 100755
--- a/test/units/TEST-86-MULTI-PROFILE-UKI.sh
+++ b/test/units/TEST-86-MULTI-PROFILE-UKI.sh
@@ -5,6 +5,11 @@ set -o pipefail
 
 export SYSTEMD_LOG_LEVEL=debug
 
+if ! systemd-analyze has-tpm2; then
+    echo "Full TPM2 support not available, skipping the test"
+    exit 0
+fi
+
 bootctl
 
 CURRENT_UKI=$(bootctl --print-stub-path)
diff --git a/test/units/util.sh b/test/units/util.sh
index 372ce1c58d..6f03f5e339 100755
--- a/test/units/util.sh
+++ b/test/units/util.sh
@@ -285,6 +285,20 @@ kernel_supports_lsm() {
     return 1
 }
 
+machine_supports_verity_keyring() {
+    # Requires kernel built with certain kconfigs, as listed in README:
+    # https://oracle.github.io/kconfigs/?config=UTS_RELEASE&config=DM_VERITY_VERIFY_ROOTHASH_SIG&config=DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING&config=DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING&config=IMA_ARCH_POLICY&config=INTEGRITY_MACHINE_KEYRING
+    if grep -q "$(openssl x509 -noout -subject -in /usr/share/mkosi.crt | sed 's/^.*CN=//')" /proc/keys && \
+            ( . /etc/os-release; [ "$ID" != "centos" ] || systemd-analyze compare-versions "$VERSION_ID" ge 10 ) && \
+            ( . /etc/os-release; [ "$ID" != "debian" ] || [ -z "${VERSION_ID:-}" ] || systemd-analyze compare-versions "$VERSION_ID" ge 13 ) && \
+            ( . /etc/os-release; [ "$ID" != "ubuntu" ] || systemd-analyze compare-versions "$VERSION_ID" ge 24.04 ) && \
+            systemd-analyze compare-versions "$(cryptsetup --version | sed 's/^cryptsetup \([0-9]*\.[0-9]*\.[0-9]*\) .*/\1/')" ge 2.3.0; then
+        return 0
+    fi
+
+    return 1
+}
+
 install_extension_images() {
         local os_release
         os_release="$(test -e /etc/os-release && echo /etc/os-release || echo /usr/lib/os-release)"