diff --git a/playbooks/roles/bifrost-create-vm-nodes/defaults/main.yml b/playbooks/roles/bifrost-create-vm-nodes/defaults/main.yml
index b8c14e0bc..e294fd75f 100644
--- a/playbooks/roles/bifrost-create-vm-nodes/defaults/main.yml
+++ b/playbooks/roles/bifrost-create-vm-nodes/defaults/main.yml
@@ -34,7 +34,7 @@ test_vm_storage_pool_path: "/var/lib/libvirt/images"
 test_vm_logdir: "/var/log/libvirt/baremetal_logs"
 # NOTE(pas-ha) next two are generic values for most OSes, overridden by distro-specifc vars
 test_vm_emulator: "/usr/bin/qemu-system-x86_64"
-test_vm_machine: "pc"
+test_vm_machine: "q35"
 # NOTE(pas-ha) not really tested with non-local qemu connections
 test_vm_libvirt_uri: "{{ lookup('env', 'LIBVIRT_CONNECT_URI') | default('qemu:///system', true) }}"
 # Settings related to installing bifrost in a virtual environment
diff --git a/playbooks/roles/bifrost-create-vm-nodes/tasks/prepare_libvirt.yml b/playbooks/roles/bifrost-create-vm-nodes/tasks/prepare_libvirt.yml
index 272fe3a73..355834777 100644
--- a/playbooks/roles/bifrost-create-vm-nodes/tasks/prepare_libvirt.yml
+++ b/playbooks/roles/bifrost-create-vm-nodes/tasks/prepare_libvirt.yml
@@ -212,12 +212,17 @@
   become: true
   register: redfish_emulator_service_file
 
+# NOTE(dtantsur): secure boot capable firmware goes second because some systems
+# (e.g. Ubuntu) provide it but refuse to boot. However, CentOS provides only
+# secure boot capable firmware, and it works for both secure und normal boot.
 - name: find OVMF firmware
   set_fact:
     efi_loader_path: "{{ item }}"
   with_first_found:
     - /usr/share/edk2/ovmf/OVMF_CODE.fd
+    - /usr/share/edk2/ovmf/OVMF_CODE.secboot.fd
     - /usr/share/OVMF/OVMF_CODE.fd
+    - /usr/share/OVMF/OVMF_CODE.secboot.fd
     - /usr/share/qemu/ovmf-x86_64-code.bin
   ignore_errors: true
   when: efi_loader_path is undefined
diff --git a/releasenotes/notes/uefi-emu-5fd047d01c09ed32.yaml b/releasenotes/notes/uefi-emu-5fd047d01c09ed32.yaml
index 8f064a0d0..dbc405f07 100644
--- a/releasenotes/notes/uefi-emu-5fd047d01c09ed32.yaml
+++ b/releasenotes/notes/uefi-emu-5fd047d01c09ed32.yaml
@@ -5,7 +5,5 @@ features:
     environment. Pass ``default_boot_mode=uefi`` to enable.
 issues:
   - |
-    UEFI testing does not work on CentOS/RHEL 8 because of the limitations of
-    the provided OVMF firmware.
-  - |
-    UEFI testing does not work on Ubuntu Focal because of TFTP issues.
+    UEFI testing with network boot does not work on Ubuntu Focal because of
+    TFTP issues.
diff --git a/zuul.d/bifrost-jobs.yaml b/zuul.d/bifrost-jobs.yaml
index 455458eb2..c7fbf56c9 100644
--- a/zuul.d/bifrost-jobs.yaml
+++ b/zuul.d/bifrost-jobs.yaml
@@ -141,6 +141,14 @@
       test_driver: redfish
       enable_prometheus_exporter: true
 
+- job:
+    name: bifrost-integration-redfish-vmedia-uefi-centos-8
+    parent: bifrost-integration-tinyipa-centos-8
+    vars:
+      boot_mode: uefi
+      test_driver: redfish
+      use_vmedia: true
+
 - job:
     name: bifrost-integration-tinyipa-debian-buster
     parent: bifrost-integration-tinyipa
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index f3af3a4f6..26c730cc6 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -13,6 +13,7 @@
         - bifrost-integration-tinyipa-keystone-ubuntu-focal
         - bifrost-integration-tinyipa-keystone-centos-8
         - bifrost-integration-redfish-vmedia-uefi-ubuntu-focal
+        - bifrost-integration-redfish-vmedia-uefi-centos-8
         # Non-voting jobs
         - bifrost-integration-tinyipa-ubuntu-bionic:
             voting: false